From patchwork Sat Sep 22 00:17:16 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Casey Schaufler X-Patchwork-Id: 10612351 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 8BFBF6CB for ; Mon, 24 Sep 2018 12:29:30 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 7860B29E71 for ; Mon, 24 Sep 2018 12:29:30 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 6BE2329EA4; Mon, 24 Sep 2018 12:29:30 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.3 required=2.0 tests=BAYES_00,DKIM_SIGNED, MAILING_LIST_MULTI,NO_RDNS_DOTCOM_HELO,RCVD_IN_DNSWL_MED,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from ucol19pa09.eemsg.mail.mil (ucol19pa09.eemsg.mail.mil [214.24.24.82]) (using TLSv1.2 with cipher DHE-RSA-AES256-SHA256 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 6A45429E71 for ; Mon, 24 Sep 2018 12:29:29 +0000 (UTC) X-EEMSG-check-008: 772125034|UCOL19PA09_EEMSG_MP7.csd.disa.mil X-IronPort-AV: E=Sophos;i="5.54,297,1534809600"; d="scan'208";a="772125034" Received: from emsm-gh1-uea11.ncsc.mil ([214.29.60.3]) by ucol19pa09.eemsg.mail.mil with ESMTP; 24 Sep 2018 12:29:25 +0000 X-IronPort-AV: E=Sophos;i="5.54,297,1534809600"; d="scan'208";a="18575165" IronPort-PHdr: 9a23:qkAZhxwGNj5clVTXCy+O+j09IxM/srCxBDY+r6Qd1u0VKPad9pjvdHbS+e9qxAeQG9mDtLQc06L/iOPJYSQ4+5GPsXQPItRndiQuroEopTEmG9OPEkbhLfTnPGQQFcVGU0J5rTngaRAGUMnxaEfPrXKs8DUcBgvwNRZvJuTyB4Xek9m72/q99pHPYQhEniaxba9vJxiqsAvdsdUbj5F/Iagr0BvJpXVIe+VSxWx2IF+Yggjx6MSt8pN96ipco/0u+dJOXqX8ZKQ4UKdXDC86PGAv5c3krgfMQA2S7XYBSGoWkx5IAw/Y7BHmW5r6ryX3uvZh1CScIMb7Vq4/Vyi84Kh3SR/okCYHOCA/8GHLkcx7kaZXrAu8qxBj34LYZYeYO/RkfqPZYNgUW2xPUMhMXCBFG4+wcpcDA+8HMOlfrYbyvVsOrRy5BQW1He/i1jFFi37r0aEjz+gtDBzN0Ag+E94StXjZqsj+OqUPXuCv1KTG0zvDYfNV1znz5ofHfRIur+yUXb9ybMbcx1UgGQzbgVWLsoHlIzGY2/4Rv2SH4edsS+SigHMnpQFrpTivw98hh5fTiYIO1F/F9ThyzpspKt24UkF7fNCkEJ9OuCGAKoB7Rd8tTHtzuCkkyrwLooW7czQKyJs92h7fZfiHfJaS4h76SOmeOy10i25ieLK6nhu/91WrxO7kVsSszVpHoSVInsPMu3wQzRDf9MeKRuVn8ku8wTqC1gLe5vtZLU01kafXMZ8sz74qmpYNr0jOESn7k1jsgqCMbEUr4O2o5vziYrXhu5CTKZd5ihr7MqQygsy/Bvk4MhQWU2ib5+u80Lrj8FXlQLpQlP02k7TZsIvAKcQHpq+2Hw9V0oE55xa5Ezimy8gXkWMCLFJEfBKLl4npO1fQL/DkFfqznluhnThxy/3GI7HtGIvBI3fdnLv7YLpx80tcxxAyzdBb6ZJUELYBIPfrV0/qqtPYCh45Mwqpw+foEdlyzYQeWX+JAqCFLqzSqkSF5v4vIuaQZI8VvyzxK/4+5/H0l3M5llgdfbex0ZsNdH+4BuhmI1meYXf0gNcBFmEKsRAiTOzqklKCVyVeZ3S1X6I64zE0EpmmDZvdSYC3m7yNxiC7HodZZmpeEFCDDW/od5mYW/cLcC+SIM1hnSYYWriiUI8h0heutA7ky7d8IOrU/jAYtJ3429ho4e3TiQwy+SZzD8SH3GGHV3t0kX8QRz8qwKB/plRwyk+d3qdjnfNYE91T5+9OUgohNJ7T0fJ1BM7oVgLGZNeJR06sQs+6DjEpUtIx39gObl5gFNWliBDD2TelDKERl7yKH5E76LzT32L2J8pnzHbGzqYhhUE8QsRTLW2mmrJ/9w/LCo/HkkWZk6OqeroG3CPW+meM03eBvEZCUAFqSaXFR3cfZknIotvl+kPOVbiuCa4oMgFZ086NNrNKasH1jVVBXPrjNs7ebHi3m2isBBaI3aiBbI/ye2UcxSndE0YFkxsJ8XaBLwg+CT+ro3jCAzx2CVLvf0Ts/PF9qHyhTU80yByKYlZi17Wv+R4VguGcR+kU3rIetycrsy90E0ql39LKF9qAoBJsc79BbtMn4VdIy3jZuhdnMZO8KqBunFkecx54v0n2zRV4Fp1AkdQ2rHMt1Ad9NbiX0FdfeDODwZDxOrrXJ3Lp/B+zaq7ZxFfe0MqX+qgV8vg4rUvsvB2xHEo473pny8VV02eb5pjSFgodTI/+X1049xh/qLDWeC896J3I1Xd0K6m7rifC2841BOsi0hugZNlfMLmDFA/pD80XHNOuKOotm1mnaxILJuZS+LQyP8y4a/uMwLSrM/p4nDK6kWRH55hw00yW+Cp4Vu7HwYwFw+qD0wuZSTj8lkyust3ymYxeYjESBGW/wzD+BIFNfq1yYZoLCWC2Ls2xx9V+g5rtVGBD9FO4HVwJxtWpeR2IY1z6xw1Q2lwdoWa7liug0zx0jzYpo7KC0yzS2evibgEKNXJMRGlnkVjjO5O0j8wAUEiucQcpiAOv5VzmyKhDuKR/M27TTF9Wfyj3M25iTqywtqCYb8FT6JMotiNXUOunbFCeS779pQEV0znkH2dEwzA7bT6qsI3jnxNmkGKdMGpzrH3BdMF0xBff/8DcSedK3jUYQCl4iD/XBkWzPtSy5tWUj5bDsua/V229TZ1fay/rwp2ctCGj/21lHQW/n+yvmt3gCQU6yyj7191uVSrWthbzfo7r1qqhPOJ8Y0lnGET859B9GoFknYs6nIsQ1mQChpWJ4XoHln/+MdZF1qL4d3oAXj0LzMDT4Aj+3k1sMG6Jy5j+VnWHzctrf8O6bX8O2iIh88BKD7+Z7KRekitoplq3sxrRbuJ7njcB1/Qu8mUXg/wSuAUz1CWdGaoeHVJfPSzxjRSH886xrKtQZGa1fri/ylBynda/A7GeugtcQmr2eo8+HS9s6cVyKEzM0Hvu5Yz/ZtnQa88cth2OnxfGkedVNIo7luAWiip/JWL9oXolxvYjjRN0wJG6uJOKJHls/KKlAh9ULzP1aNkV+j33iqZehMmW1Zi1Hpp9AjULQIfoTfWwHTIRtfXnMxiBHSY5qnecF7rfExGQ6Ft6r3LPFJCrMm+YKGMfzdp8WBmXPFZfjxwMXDUmgp45ERinxML7f0d/+jAR4Vv4pwBCyu12Khb/VX3fqx2wajcuT5ifLgRZ4R1e50vPNsye9O1zFTlC/pK9tAyNNnCbZwNQAGEHQEyLGU3sPqK06tnG7+iYAfG+IuDUbrqSrOxSTfCIxYig0oF+5TaDKt2PPmV+D/08wkdMRmt2F8PdmzUOUCwXiznNY9SApBii5iJ7tNu//+rvWALu44uPFrRTPM5z9BG2m6eDKvWQiDx3KDlCypMM3njIyL4F0F4VkSFueCGnEa4cui7VUKLQhqhXAgYAZCNyO8tI6KQ80xJQNsHFkdz116R3jvgvB1dCT1zhldmjZdYWLGGlKFPHGEGLOayEJT3Lw8D3eaS8SblRjOVIqRK9ojObE07/PjSZiTblTRevMftDjCuDJhxRpJm9cgpxCWjkVN/pdAW7P8VtjT032r05nWvKOnQGMTh9aENNtrmQ4jlEjfphAWBB6WBlLeackSaD8+bYMooWsedsAilskeJV/m41y79O4SFHQ/x1gzfSocRoo1G9kemPyyBrUBxQpTZXnIiLp1ltOb3F9plcXnbJ5AgN4nuLCxsUvdRlEMHgu6BLx9fUlaLzMipN89Xa/csEHcjbNsKGPGAnMRX3BD7eFBEFQiKzNWHDm0xdl+mf+WCPoZgkq5jjhYEOR6RBW1wvDPMaDUpkHMccL5hrQzMki7+bjNII5HakqhneWtlatIjdVv2OGfXvNCqZjb5cahsMxrP4N5ocNov62kxlcVR6k4LKG1fKUdBKuC1hYRc+oF9R/3hmUm0zx0XlZxu24HANEf60nxg2ihZxYOk26Djs5FI3KUbQqysrjEk9g9Plji6NcDTpNqe/QZlWCzbot0g2Kp70Xhp6bQi1nUxiKDfIWqlcj6V+emBxiQ/duJxPGfhGQa1CfhAQ2emdZ+803lREtiWn2UhH6PPZCZtjkQsqdoKsr3JA2g94cdE1JKzRK7BSwVRKgKKBoDOo3PgrwAACP0YN7H+SeCkQtUMSMrkmJjan8fJ05gyHmzpDfm8MV/wwrf9x7Uw9Ov6PzyT5375NN0C9LeqfIL2Fu2LYj86HXksw1l8Ul0lC5bV5ytksc0yPWk810bSRCQoGNdDZKQ5PdcpT9GLffSGUseXC2Zh1JZmyFvj0Te+Ss6YZmlikHAAoH4sQ7sQBGZ2s0FrAI8n+MbAL0wkg6gPwKVqZC/RJfQ6Eny0co8Gj1pN325dSJi0FC2VnLSq3/qrXphMtgPebQNg2YG0VUZcfO30qX826nypZv3VeAzmtzuIW1hSN7z/mqiTXFjn8YMJpZO2IahN0FNG25TI//rCsiVHN6JXeIHr1OM9+ut/V8+wauYiIC/dVTbl7vEfcn4hYR3OqU27TH966PYLwa4w2YdzyFHm6TkS1iygpQMfpINatMq+IjBnmRIpOrIab3DEjNcq8Fj4EGBd9vOAD67xiagIdeZY7ZgTotwsmPaylPAiYysmuQ3qqKTZOSvlQ1/+6Z79JwCowb++6znQgQ4o0zuat904CWJUKjhbDxfm+fIlSSy7zFWJBew/Xvyo2i3BhNvouwuc42B7IqV4cMzSRe+xzZm1EuNU8BV2JLHVzDWo4QEScgpTf7Q622LAS5DBdn9dS0e1KqnT+uYXfYD20UqyxtZrVqzYgbcQho6BpK4PjONaGtJXEkjzcV5TQswyFUC+mF/VBgNRQJjxXQOVQk2E/JcMGoZZB6VY2VsomO7xPD6wsq6u2aTZ4CC4d1jUVV4We0zwemu28wafVlg+McJQ+NxwJqJdCgtwDXCNtfywRurSjWJvMl2+YVGcEPR0f7QJS6wIcjoVwZPzq4JLUTJ9QzD5bu+50XTbWGZlp7VT7TnqbjkT/SPWkj+OmxxlSzO723tkdRhF/FVBXx/xKmUswNLF3N64Qs5bSsj+TaUP1pn/iyPe9KVlKzs3Uakf4A5bbumr6Ti0c42cbRYtVxHHYD5QSnBJzaLw3q1VUPICmZkH+6iQ/yIRnA7a0ScKmy0sroHsdWyiqFN9BBP18v1LMRD1peZarp4v5O59KWG9f5IWdq0tFkEVqKyO504RTJNxN4jEWQDhCujGdvNysSMJdx8N5E5gMLcphtHvnHqNLJoSRqWUsurPz0n/Z5yw8sFCiyTWvAa+3UfxW8HAFFwU0I2SetlMvAPEy8mfT9VDNtk57//tBCriIl0Vxry53HopSCTZRyXClM1NzQWFDs+pALKTVd9JTQ+UuZRC1IRMzDvgm0FKV/UFvgXj2eTRyuRVA9yDbQQY0STEfgq3xlj0GtsGnJTgaRopKbTo7dSfFLBmbmSRNsxZBcExqXo0ZAtJZ+7EawYRU/9DNSUC3KS0fWxxiLA042+JFlUFfqEWYZTzdDQ2wePbNqBJ3e8mRrNSuLPvk4ghKkZ/nv/o+96UYQH2qgwutTs7Cr4XkrN2FqlOOdLvkM+27eXLBQyXMjRG0hbcgEZbK+jPePxdFJJZhyHore57hBXTMPRRcKKIRP1BbWrxiadVavuBaYNdpeKQI+a9oHR+HQw3gGYyxo/lcL1bTQzveIz+H8uOhvYLZ9abdRvT4ZsyQ23bHRLp6PpF+6TTgGrfq14pe9lD32vdr+EN6U0LJMzudrNT7OwME+NWidlb4vpI3Bz/WB41wkHX1zEFaa8UXWzGq8IgfyJ5B7XbwTuR40lT8sOJM7LRk7Ig37KpvyciqOafTJ/NasVVkAhiPHAlq8IsiAHRnTWBLfuARMOvRfbgejc32r+D3DKkX5R2O9uxXd9TIOkbBmtOlBTGEUxxEmwUBpiAGIQuAzfKFnLV0Scm9r+jjxk0t+0S+LgIBzL115IeF+7CHq/XLYBbK1rgLRLTqSd3vobg2vEOS//IknqYUemNpew2nDPQdVskFy2j7zKAq1iwtHNnBH7Lh5P5DT2g2ni/km51mA1oWHe4bEqSR8oRDhGc4nPbZOccMfqBFgGaPGgauEqUexn6z9yuXPG5ljwnW0x7qXWO88F/2rCF/QSvWzNfvi1FVWaezBUdTWSqpJEB5vSiXPAXyqNr4paQ17U8xMmz+t9KBjmihN61NH835OtOcJTM4pFUNjJ0+Xtavw5wUGcKhINcN93FzdvTe5H2tky9dpKdHgI3S4tqL9fXTHHmgibCaqrqWyTBc1Hc4p1E+5cq6OvHI+dKKX+yi13wNQCdnpwvBQxm1p6Tdr1AVJUOL10PLl5YRPt1D3Hk40Ubm5PM4QN8o8QVTGYnBa+kFpTDpNzv+2UyfbM4vVimCzztXGUr4EVZkF6gnw2L8pd/Hm3jW9V0pQIlwakPmiAd4D4U9M00t7kYYzjAEEQgXZhCRFKuoClj9LYsYSUgDbgyK3Lq9eqc3201/2K+g5O/XbexhGqUMN/ddjgiVnFhYG5IbqrMeQLNie1BH8K7YuwniB5LhX/f4iXo6Lee1TdxC8cAFq3si5R6yRxu+6ZhZ6bYWk5SIdrNZbpjNu8B89F1r5TkVdixCmBJ/lQ+2UfgApOD/5djWqJio5figVKYjQ+Ua7BY1CH54j5TunFAvu9fX2PlASofNk4Tw7BhNI2KWuIbdyxR8Ju4OK4Wlfbl+83UHIzMTJ2kJPdqQavkz/zVhMDPN6FxeGskMf88XPNLRmQBIjU3kQLRT9svYGl+bDId+bMIo4HD0yDAy95szTODg5CWwJZ/B81FHJ+lDgzl0lNLeuOgVxuLfBzMJ7nmfdxh42TiCy52KC/bs4eWM1s/bWE4cEi4xSYddKyKI+Ra7SeqtiJXpTgSU59f9gJ0gcEKQR2Sxk7oev6dNEO5AjyD70SZEFoDxmf2Zqd2s6HFYtldfCoZ88QXFGLlDPpV8IRn5mNGrRlJ9BiTjZs7ZbR8uuOuKxucW/epyLUz+ZZUUIhgc0bL19WJVThdySL7xpluZWuYRa8V9RfPcqnBa85lgK7MOPFeBuJzqtClHp04sDA8vdrAwsiRQdlPSkw1NR6b0pLkAhxMYUd54v09MBG2xNHs65zrGTqRVkLKRBecU8jqJSKwOVF9kMiRkQxO6wJ9uYaemnehbsmNamSNwuP0q3CZ6Sxu8uC3soaUN1Ck++LG5sjUOp3hFTuSYkyfVBlRP1vMKjb0TC3z681yzfGEDbJfu4LlgPcng95Mu43c4YRo4ZCAGQOKgCz3wj6OPH4yPv9JchAKXtMXIc7CzMTAYNq4hxhL7W3h9zg/ekQ5z8GsFRzWv8N4pKYamNMY72CWoA2nbdVcL4qNPqsfxs0AETPdlIW9mlUFY94DTQiwLWdyKAGs+kxIldXQBdZVP9BsXP7cnjyzOvaRc+AwQJjDOHdLhsqvZmMrTkVw6V81r3SqCpKiCnIkry1VjktZ572iJontEM6TjfodIA37uxs8L0uH6ZvOwosgbWYBmz/KnS/ZEPc69ry/+/LZOfwfxwrUYAkr8M+IZwLrfezmqRHfeWumRdWWI2TEjPRi2rTuvLlt/SsBKpkkmP+2K0pxblwunU7R0TyOLqFnzx2UlNuUbfAsy/oygflpOBM0cavPUDu8pw7VqC1YBdHTOGiheAO+stlusgY09PG9vtwGyXenx6R3hePubHBUNWdrCo5h+5P28A2GMI3ltyDVzeU1z6eqZDF0yq/VVNZCc29rI0ZAz6ecYc79INiont5ZHgot+7aGM2dqONBTWyYz/Y9rSp67cS8bDwlwqd2cSab8QZQf49s1uJdIic6HCFrte+xIHDO41R4J3cy+78KByMRM2fBXdaaq5huH0qe+RIJhZvXnb6hQ3NiiW80kHy/qpXUl1dJynmXj2CI4/SygHrNB3DBZiWoxVFJVE5yOjDo6ZiemXjNWr+lJzvadeuKb3AOrLxd2/94p0Vpleo0eMOWCVTIxqiUdsDeCFuf7E2w33QZfneNgsWOl0Q23CZvnAE5npbnq1M8biclJB6bPU9b9iVQ+YbymxC7HAsSC/M+9t6kxilKR3eePSyHom6LSNi/XoYGQOjS64oG/BD5Bf5UHEAeHEF0ZfQOGI4U5+Fq0ecIXw+f1LOtVky9+ZtVogpA9e2deIdvDy5nTH3Vh2INeKdBGziS8kRYkHJgi+OkIwgGjf727QGmlYMtP+dZI/nc6fAkW8/0ApxCcga2taFSztTNaVf20a35HbBkWR7AweKdEFkqasfFIg8LWoQLxjM45IiM2xv7UOjNhtJjuKT8EcNCbVf9oUdiFJALDpo14lKgUBr6BzX440YZaUJ0ZSO06bxDLa1gDC2FD6c9G2ka2AZi0R9yYirfreyTYZgQ6/tL6Ch9H7FrDUaJajRPnJLC8sTS2XXxwpFkCo8gz85r9d5LyTJmEEp0pSZyuTDEgZqPopvNHQCWiVkupmL/hozPyZWiWlUCRjj+JyHSdEs0mQXuAOXRfbdX7vgWdQ+USiK/ZA8Gijbuiw16NVXOtQCYxJfw== X-IPAS-Result: A2ClAACF16hb/wHyM5BaHAEBAQQBAQcEAQGBUYILA4EIXCiMCV+LSYFogn6TdhSBYicTAYUEgxYhNBgBAwEBAQEBAQIBbBwMgjUkgmADAwECJBMGAQEMIAwCAwkBAUAICAMBLRQBEQYBBwUGAgEBARgEgwCBagMVA5cRihyBajOCdQEBBYEEAQF1gjADglMIF4phF4IAgRInDIIxhHkBEgGFd4hKhTVBMY4QCYIMjhcdWYg7hhiOe4MChE44ZHFNIxU7gmyCGQwXg0aKHAFVT3sBAYl9gj0BAQ Received: from tarius.tycho.ncsc.mil ([144.51.242.1]) by emsm-gh1-uea11.NCSC.MIL with ESMTP; 24 Sep 2018 12:29:26 +0000 Received: from prometheus.infosec.tycho.ncsc.mil (prometheus.infosec.tycho.ncsc.mil [192.168.25.40]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id w8OCTPUV028677; Mon, 24 Sep 2018 08:29:26 -0400 Received: from tarius.tycho.ncsc.mil (tarius.infosec.tycho.ncsc.mil [144.51.242.1]) by prometheus.infosec.tycho.ncsc.mil (8.15.2/8.15.2) with ESMTP id w8M0HSSP018225 for ; Fri, 21 Sep 2018 20:17:28 -0400 Received: from goalie.tycho.ncsc.mil (goalie.infosec.tycho.ncsc.mil [144.51.242.250]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id w8M0HQnE009805 for ; Fri, 21 Sep 2018 20:17:28 -0400 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: A1AkAADYiKVblywbGNZbHAEBAQQBAQcEAQGBU4IJgWcog3OIdItLgWiCfpN2gXqEdwJCgwQhNhYBAwEBAQEBAQIUAQEBAQEGGAZMhUUDAyMEGQEBOA8lAiYCAkUSBgEMBgIBAYMdgWoDFQOYJoocb3szgnUBAQWBBAEBdYI+A4JRCBd0iWUXggCBEicMgjGILYJXiEqFM0Exjg0JggyOFx1ZiDuGFI53gn6EVQaCAE0jFYMnghkMDgmDRoocAVVPjlQBAQ X-IPAS-Result: A1AkAADYiKVblywbGNZbHAEBAQQBAQcEAQGBU4IJgWcog3OIdItLgWiCfpN2gXqEdwJCgwQhNhYBAwEBAQEBAQIUAQEBAQEGGAZMhUUDAyMEGQEBOA8lAiYCAkUSBgEMBgIBAYMdgWoDFQOYJoocb3szgnUBAQWBBAEBdYI+A4JRCBd0iWUXggCBEicMgjGILYJXiEqFM0Exjg0JggyOFx1ZiDuGFI53gn6EVQaCAE0jFYMnghkMDgmDRoocAVVPjlQBAQ X-IronPort-AV: E=Sophos;i="5.54,287,1534824000"; d="scan'208";a="375808" Received: from emsm-gh1-uea11.ncsc.mil ([214.29.60.35]) by goalie.tycho.ncsc.mil with ESMTP; 21 Sep 2018 20:17:27 -0400 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: A0AiAACWiaVblywbGNZbHAEBAQQBAQcEAQGBU4IJgWcog3OIdItLgWiCfpN2gXqEdwJCgwQhNhYBAwEBAQEBAQIBEwEBAQEBBhgGTAyCNSSCYAMDIwQZAQE4DyUCJgICRRIGAQwGAgEBgx2BagMVA5ggihxvezOCdQEBBYEEAQF1gj4DglEIF3SJZReCAIESJwyCMYgtgleISoUzQTGODQmCDI4XHVmIO4YUjneCfoRVBoIATSMVgyeCGQwOCYNGihwBVU+OVAEB X-IPAS-Result: A0AiAACWiaVblywbGNZbHAEBAQQBAQcEAQGBU4IJgWcog3OIdItLgWiCfpN2gXqEdwJCgwQhNhYBAwEBAQEBAQIBEwEBAQEBBhgGTAyCNSSCYAMDIwQZAQE4DyUCJgICRRIGAQwGAgEBgx2BagMVA5ggihxvezOCdQEBBYEEAQF1gj4DglEIF3SJZReCAIESJwyCMYgtgleISoUzQTGODQmCDI4XHVmIO4YUjneCfoRVBoIATSMVgyeCGQwOCYNGihwBVU+OVAEB X-IronPort-AV: E=Sophos;i="5.54,287,1534809600"; d="scan'208";a="18546018" X-IronPort-Outbreak-Status: No, level 0, Unknown - Unknown Received: from updc3cpa05.eemsg.mail.mil ([214.24.27.44]) by emsm-gh1-uea11.NCSC.MIL with ESMTP; 22 Sep 2018 00:17:26 +0000 X-EEMSG-check-005: 0 X-EEMSG-check-006: 000-001;227031ce-d7a4-4e4d-aaf4-16ac2f4edfd5 Authentication-Results: upbd19pa05.eemsg.mail.mil; spf=None smtp.pra=casey@schaufler-ca.com; spf=None smtp.mailfrom=casey@schaufler-ca.com; spf=None smtp.helo=postmaster@sonic305-10.consmr.mail.bf2.yahoo.com; dkim=pass (signature verified) header.i=@yahoo.com X-EEMSG-check-008: 326151124|UPBD19PA05_EEMSG_MP5.csd.disa.mil X-EEMSG-SBRS: 3.5 X-EEMSG-ORIG-IP: 74.6.133.49 X-EEMSG-check-002: true X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: A0DBAADYiKVbhzGFBkpbHQEBBQEHBQGBU4NwKINziHSNM4J+k3aBeoR3AkKDBBkGBjIWAQMBAQEBAQEBAQETAQEBCgsJCBsOIwyCNSSCYAMDIwQZAQE4DyUCJgICRRIGAQwGAgEBgx2BagMVmCmKHG97M4J1AQEFgQQBAXWCPgOCUQgXdIl8ggCBEicMgjGILYJXiEqFM0Exjg0JggyOFx1ZiDuGFI53gn6EVQaCAE0jFYMnghkMDgmDRoocAVUfMI5UAQE X-IPAS-Result: A0DBAADYiKVbhzGFBkpbHQEBBQEHBQGBU4NwKINziHSNM4J+k3aBeoR3AkKDBBkGBjIWAQMBAQEBAQEBAQETAQEBCgsJCBsOIwyCNSSCYAMDIwQZAQE4DyUCJgICRRIGAQwGAgEBgx2BagMVmCmKHG97M4J1AQEFgQQBAXWCPgOCUQgXdIl8ggCBEicMgjGILYJXiEqFM0Exjg0JggyOFx1ZiDuGFI53gn6EVQaCAE0jFYMnghkMDgmDRoocAVUfMI5UAQE Received: from sonic305-10.consmr.mail.bf2.yahoo.com ([74.6.133.49]) by upbd19pa05.eemsg.mail.mil with ESMTP; 22 Sep 2018 00:17:24 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1537575442; bh=NJlgySVhKkti88Ke2/CP6DIkkD+ndlpqrxjeWUpvOF4=; h=Subject:To:References:From:Date:In-Reply-To:From:Subject; b=IOes+eKq/koFarDALuVwzCWjtPk2isx8TCQhoFOO+6sYgxdUdX0c+VvUFAOysRD687bez0ljFLy7uGlsNs41LGwXTlE5M9GM+5vrS1m9Zmc6DNgaT369pJ0bQfmhZvTzBH3D4dNVod5XoYOnLt0RNZBhn7Or5pmcEaQmJ2wiHnJgX3pVPK5QHBWTVfn3cdrAWQ+atJhfR1W8Hqt0stnQ/ssBCO50xiEQYexPLdmcOe2hrODw6bCn2salHYSuLDhtFbUZzycGBF/Lpgo/n7mXR2SxEjGfDOst5c+aLHeJFSSQL76TqCEIzAkmYorKX6MpgKFBIS+MyXJxTDCHsTcWpA== X-YMail-OSG: 4lH2B7gVM1k8Fo0JbexzVq.0MOe8ygO724hZU7zrVbVdWmr2QRMnUFukGAZRPo3 wtFLGEUsZMakUvQGLATk_cxGilj_GSMkO5he7Yun5naxXvoRZRxTtOyLLh7LaJh0Tqr8rfZ27dy8 7uMGxsBQEgW00jIYQ7IuTHLje2bYTArToQjNvVBIgK0uyti.3KMWu3GApwxFoVLB5T2gQrPNYSs4 azs1FF3OOamIMfucnQBi8b59TOHKOzINrlQfQm0iz2czY9_1vPslK3CBw0s5CWrJA0aZvw32t8uf ho5rWZxn18NOMuzS284bzoyfGiayDC10w7n7bGP0C_2vLvzWBC0vfv8UDl8OQOXIHnsDhpzjsm0u 8Pp23xeM7u_.mAgjivbAPCfR8rATaEMNRUWGBUp9casea6BCnMXqtP.zuVi48w86D1yH_VA7fP_h galqOmPr.kVYmu6pxH58g4c2JaCLJGajKM1oQk0WBa8iMfhhse2fthjk1JnO03EjNPjzeZ6dHQC_ gIZU9LVwm1eljv4m7sBi16yGC6zth2L.jsBpRUmHtrCsi6QoW4UmVqE9jCBCluhIwRfTBd4ZRVhI So0edGKxpmpNsdAgEr1wFK0wbr87cSySJewjO1o2KFsEJK4eK9XwGYQovk3utZJIWbiH1YxPvCuj eLIQ4PVyDQ7GQdw.0Koa8Xc19TgBeCaUNFEBlj3iCLBwUXQYVYCh1Ex5BolA0p_VCKjVyBhMG5AJ UgGXFFwW02xgNFKk1MsfFmndalliNoWmrTRjcsm97hEntdFPgAzcJb7tIjlVLMjOQbUD1TgOzT6J VMG9Fe5nURDU8RAhOgOIXyt2g6z5LHNppB7POpUHZwv45Q9gjR4Uzmq629l_7a3ouXrgFyRncBZq VToJgX9T6I2cU6_N6Pt7flKXsKKG.b9ANqjD2hgeCmMljcMcSxGrkkOB6Bh_H.AN.XMReGpvISTr f7OImyhxxVnSIOaF03Gzu1lV0Z4sYt1VlCPNDrTU8q0z2glHw9qIWk.dZydb.oOMfxFFmy2tGh2f C7ykEgqMAiNbiD5o46NupdIQvY4X8eQ-- Received: from sonic.gate.mail.ne1.yahoo.com by sonic305.consmr.mail.bf2.yahoo.com with HTTP; Sat, 22 Sep 2018 00:17:22 +0000 Received: from c-67-169-65-224.hsd1.ca.comcast.net (EHLO [192.168.0.102]) ([67.169.65.224]) by smtp421.mail.bf1.yahoo.com (Oath Hermes SMTP Server) with ESMTPA ID e2a7d46096dc622f046581817a1535e3; Sat, 22 Sep 2018 00:17:21 +0000 (UTC) To: LSM , James Morris , SE Linux , LKLM , John Johansen , Kees Cook , Tetsuo Handa , Paul Moore , Stephen Smalley , "linux-fsdevel@vger.kernel.org" , Alexey Dobriyan , =?utf-8?q?Micka=C3=ABl_Sala=C3=BCn?= , Salvatore Mesoraca References: X-EEMSG-check-009: 444-444 From: Casey Schaufler Message-ID: <8b652ffb-5636-7aed-0715-f896a6a7cdf6@schaufler-ca.com> Date: Fri, 21 Sep 2018 17:17:16 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: Content-Language: en-US X-Mailman-Approved-At: Mon, 24 Sep 2018 08:26:06 -0400 Subject: [PATCH v4 03/19] SELinux: Abstract use of cred security blob X-BeenThere: selinux@tycho.nsa.gov X-Mailman-Version: 2.1.21 Precedence: list List-Id: "Security-Enhanced Linux \(SELinux\) mailing list" List-Post: List-Help: Errors-To: selinux-bounces@tycho.nsa.gov Sender: "Selinux" X-Virus-Scanned: ClamAV using ClamSMTP Don't use the cred->security pointer directly. Provide a helper function that provides the security blob pointer. Signed-off-by: Casey Schaufler Reviewed-by: Kees Cook --- security/selinux/hooks.c | 54 +++++++++++++++---------------- security/selinux/include/objsec.h | 5 +++ security/selinux/xfrm.c | 4 +-- 3 files changed, 34 insertions(+), 29 deletions(-) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index ad9a9b8e9979..9d6cdd21acb6 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -228,7 +228,7 @@ static inline u32 cred_sid(const struct cred *cred) { const struct task_security_struct *tsec; - tsec = cred->security; + tsec = selinux_cred(cred); return tsec->sid; } @@ -464,7 +464,7 @@ static int may_context_mount_sb_relabel(u32 sid, struct superblock_security_struct *sbsec, const struct cred *cred) { - const struct task_security_struct *tsec = cred->security; + const struct task_security_struct *tsec = selinux_cred(cred); int rc; rc = avc_has_perm(&selinux_state, @@ -483,7 +483,7 @@ static int may_context_mount_inode_relabel(u32 sid, struct superblock_security_struct *sbsec, const struct cred *cred) { - const struct task_security_struct *tsec = cred->security; + const struct task_security_struct *tsec = selinux_cred(cred); int rc; rc = avc_has_perm(&selinux_state, tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM, @@ -1949,7 +1949,7 @@ static int may_create(struct inode *dir, struct dentry *dentry, u16 tclass) { - const struct task_security_struct *tsec = current_security(); + const struct task_security_struct *tsec = selinux_cred(current_cred()); struct inode_security_struct *dsec; struct superblock_security_struct *sbsec; u32 sid, newsid; @@ -1971,7 +1971,7 @@ static int may_create(struct inode *dir, if (rc) return rc; - rc = selinux_determine_inode_label(current_security(), dir, + rc = selinux_determine_inode_label(selinux_cred(current_cred()), dir, &dentry->d_name, tclass, &newsid); if (rc) return rc; @@ -2478,8 +2478,8 @@ static int selinux_bprm_set_creds(struct linux_binprm *bprm) if (bprm->called_set_creds) return 0; - old_tsec = current_security(); - new_tsec = bprm->cred->security; + old_tsec = selinux_cred(current_cred()); + new_tsec = selinux_cred(bprm->cred); isec = inode_security(inode); /* Default to the current task SID. */ @@ -2643,7 +2643,7 @@ static void selinux_bprm_committing_creds(struct linux_binprm *bprm) struct rlimit *rlim, *initrlim; int rc, i; - new_tsec = bprm->cred->security; + new_tsec = selinux_cred(bprm->cred); if (new_tsec->sid == new_tsec->osid) return; @@ -2686,7 +2686,7 @@ static void selinux_bprm_committing_creds(struct linux_binprm *bprm) */ static void selinux_bprm_committed_creds(struct linux_binprm *bprm) { - const struct task_security_struct *tsec = current_security(); + const struct task_security_struct *tsec = selinux_cred(current_cred()); struct itimerval itimer; u32 osid, sid; int rc, i; @@ -2989,7 +2989,7 @@ static int selinux_dentry_init_security(struct dentry *dentry, int mode, u32 newsid; int rc; - rc = selinux_determine_inode_label(current_security(), + rc = selinux_determine_inode_label(selinux_cred(current_cred()), d_inode(dentry->d_parent), name, inode_mode_to_security_class(mode), &newsid); @@ -3009,14 +3009,14 @@ static int selinux_dentry_create_files_as(struct dentry *dentry, int mode, int rc; struct task_security_struct *tsec; - rc = selinux_determine_inode_label(old->security, + rc = selinux_determine_inode_label(selinux_cred(old), d_inode(dentry->d_parent), name, inode_mode_to_security_class(mode), &newsid); if (rc) return rc; - tsec = new->security; + tsec = selinux_cred(new); tsec->create_sid = newsid; return 0; } @@ -3026,7 +3026,7 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir, const char **name, void **value, size_t *len) { - const struct task_security_struct *tsec = current_security(); + const struct task_security_struct *tsec = selinux_cred(current_cred()); struct superblock_security_struct *sbsec; u32 newsid, clen; int rc; @@ -3036,7 +3036,7 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir, newsid = tsec->create_sid; - rc = selinux_determine_inode_label(current_security(), + rc = selinux_determine_inode_label(selinux_cred(current_cred()), dir, qstr, inode_mode_to_security_class(inode->i_mode), &newsid); @@ -3498,7 +3498,7 @@ static int selinux_inode_copy_up(struct dentry *src, struct cred **new) return -ENOMEM; } - tsec = new_creds->security; + tsec = selinux_cred(new_creds); /* Get label from overlay inode and set it in create_sid */ selinux_inode_getsecid(d_inode(src), &sid); tsec->create_sid = sid; @@ -3918,7 +3918,7 @@ static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp) */ static void selinux_cred_free(struct cred *cred) { - struct task_security_struct *tsec = cred->security; + struct task_security_struct *tsec = selinux_cred(cred); /* * cred->security == NULL if security_cred_alloc_blank() or @@ -3938,7 +3938,7 @@ static int selinux_cred_prepare(struct cred *new, const struct cred *old, const struct task_security_struct *old_tsec; struct task_security_struct *tsec; - old_tsec = old->security; + old_tsec = selinux_cred(old); tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp); if (!tsec) @@ -3953,8 +3953,8 @@ static int selinux_cred_prepare(struct cred *new, const struct cred *old, */ static void selinux_cred_transfer(struct cred *new, const struct cred *old) { - const struct task_security_struct *old_tsec = old->security; - struct task_security_struct *tsec = new->security; + const struct task_security_struct *old_tsec = selinux_cred(old); + struct task_security_struct *tsec = selinux_cred(new); *tsec = *old_tsec; } @@ -3970,7 +3970,7 @@ static void selinux_cred_getsecid(const struct cred *c, u32 *secid) */ static int selinux_kernel_act_as(struct cred *new, u32 secid) { - struct task_security_struct *tsec = new->security; + struct task_security_struct *tsec = selinux_cred(new); u32 sid = current_sid(); int ret; @@ -3995,7 +3995,7 @@ static int selinux_kernel_act_as(struct cred *new, u32 secid) static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode) { struct inode_security_struct *isec = inode_security(inode); - struct task_security_struct *tsec = new->security; + struct task_security_struct *tsec = selinux_cred(new); u32 sid = current_sid(); int ret; @@ -4544,7 +4544,7 @@ static int sock_has_perm(struct sock *sk, u32 perms) static int selinux_socket_create(int family, int type, int protocol, int kern) { - const struct task_security_struct *tsec = current_security(); + const struct task_security_struct *tsec = selinux_cred(current_cred()); u32 newsid; u16 secclass; int rc; @@ -4564,7 +4564,7 @@ static int selinux_socket_create(int family, int type, static int selinux_socket_post_create(struct socket *sock, int family, int type, int protocol, int kern) { - const struct task_security_struct *tsec = current_security(); + const struct task_security_struct *tsec = selinux_cred(current_cred()); struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock)); struct sk_security_struct *sksec; u16 sclass = socket_type_to_security_class(family, type, protocol); @@ -5442,7 +5442,7 @@ static int selinux_secmark_relabel_packet(u32 sid) const struct task_security_struct *__tsec; u32 tsid; - __tsec = current_security(); + __tsec = selinux_cred(current_cred()); tsid = __tsec->sid; return avc_has_perm(&selinux_state, @@ -6379,7 +6379,7 @@ static int selinux_getprocattr(struct task_struct *p, unsigned len; rcu_read_lock(); - __tsec = __task_cred(p)->security; + __tsec = selinux_cred(__task_cred(p)); if (current != p) { error = avc_has_perm(&selinux_state, @@ -6502,7 +6502,7 @@ static int selinux_setprocattr(const char *name, void *value, size_t size) operation. See selinux_bprm_set_creds for the execve checks and may_create for the file creation checks. The operation will then fail if the context is not permitted. */ - tsec = new->security; + tsec = selinux_cred(new); if (!strcmp(name, "exec")) { tsec->exec_sid = sid; } else if (!strcmp(name, "fscreate")) { @@ -6631,7 +6631,7 @@ static int selinux_key_alloc(struct key *k, const struct cred *cred, if (!ksec) return -ENOMEM; - tsec = cred->security; + tsec = selinux_cred(cred); if (tsec->keycreate_sid) ksec->sid = tsec->keycreate_sid; else diff --git a/security/selinux/include/objsec.h b/security/selinux/include/objsec.h index cc5e26b0161b..734b6833bdff 100644 --- a/security/selinux/include/objsec.h +++ b/security/selinux/include/objsec.h @@ -158,4 +158,9 @@ struct bpf_security_struct { u32 sid; /*SID of bpf obj creater*/ }; +static inline struct task_security_struct *selinux_cred(const struct cred *cred) +{ + return cred->security; +} + #endif /* _SELINUX_OBJSEC_H_ */ diff --git a/security/selinux/xfrm.c b/security/selinux/xfrm.c index 91dc3783ed94..8ffe7e1053c4 100644 --- a/security/selinux/xfrm.c +++ b/security/selinux/xfrm.c @@ -79,7 +79,7 @@ static int selinux_xfrm_alloc_user(struct xfrm_sec_ctx **ctxp, gfp_t gfp) { int rc; - const struct task_security_struct *tsec = current_security(); + const struct task_security_struct *tsec = selinux_cred(current_cred()); struct xfrm_sec_ctx *ctx = NULL; u32 str_len; @@ -138,7 +138,7 @@ static void selinux_xfrm_free(struct xfrm_sec_ctx *ctx) */ static int selinux_xfrm_delete(struct xfrm_sec_ctx *ctx) { - const struct task_security_struct *tsec = current_security(); + const struct task_security_struct *tsec = selinux_cred(current_cred()); if (!ctx) return 0;