From patchwork Thu Dec 1 18:03:52 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stephen Smalley X-Patchwork-Id: 9456635 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 2D1FD60585 for ; Thu, 1 Dec 2016 18:02:29 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 2228328512 for ; Thu, 1 Dec 2016 18:02:29 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 163B92852D; Thu, 1 Dec 2016 18:02:29 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from emsm-gh1-uea11.nsa.gov (smtp.nsa.gov [8.44.101.9]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 71B6928512 for ; Thu, 1 Dec 2016 18:02:23 +0000 (UTC) X-IronPort-AV: E=Sophos;i="5.33,726,1477958400"; d="cil'?scan'208,223";a="1214993" IronPort-PHdr: =?us-ascii?q?9a23=3AzGbEMhCvteZx0V45ZYqkUyQJP3N1i/DPJgcQr6Af?= =?us-ascii?q?oPdwSPr/p8iwAkXT6L1XgUPTWs2DsrQf2rGQ7/mrBDdIyK3CmUhKSIZLWR4BhJ?= =?us-ascii?q?detC0bK+nBN3fGKuX3ZTcxBsVIWQwt1Xi6NU9IBJS2PAWK8TW94jEIBxrwKxd+?= =?us-ascii?q?KPjrFY7OlcS30P2594HObwlSijewZb1/IA+5oAnMucUbgYVvIbstxxXUpXdFZ/?= =?us-ascii?q?5Yzn5yK1KJmBb86Maw/Jp9/ClVpvks6c1OX7jkcqohVbBXAygoPG4z5M3wqBnM?= =?us-ascii?q?VhCP6WcGUmUXiRVHHQ7I5wznU5jrsyv6su192DSGPcDzULs5Vyiu47ttRRT1ky?= =?us-ascii?q?oMKSI3/3/LhcxxlKJboQyupxpjw47PfYqZMONycr7Bcd8GQGZMWMheVzZFAoih?= =?us-ascii?q?cYUBCeQPNvtco4XkuVcCsR6yCA+xD+3t1zBInGf707Ak3eQvEQ/G2w8uEdwAv3?= =?us-ascii?q?vbrtr6KL8SXOKowKTG0zrDdOhb2TLh5IXSaB0tvf+BULB2fMHMyUcvDQTFjlCI?= =?us-ascii?q?pIL4IzOayPwNs2iF4OpmSOmhlmsnpBt1ojir2MgtipTCi4UOyl/Z7iV025o1JN?= =?us-ascii?q?2kR057Zt6oCp1QtzqAOIdsTcMiRH9otT88x7YbupC7ZDAHxIkoyhPQcfCKc5WE?= =?us-ascii?q?7gj9WOuePzt0nm9pdbSijBio60eg0PfzVsys3VZPqSpKj8fDu2gW1xzW9siHUv?= =?us-ascii?q?x9/lq92TqX1wDc9OVEIUcsmKrHMZEh2L8wlocIsUjZAi/3mFn5jK+Rdkk+/Oin?= =?us-ascii?q?9//nban8qp+ZNo90jhnyMqUomsOhHeQ1KhUCUmeU9Oim1LDv4Ff1TKtFg/EoiK?= =?us-ascii?q?XVrYjWJcEBqa64Bw9V3Jwj6xG6Dzq+y9QXg30HLFNDeBKagInlIkrBIPflDfe5?= =?us-ascii?q?n1ujjixryuvaPrzhHprNLn/DnK3nfbZm8UFQ0gUzzddB555MELEOPOrzWlPttN?= =?us-ascii?q?zfFhI5PRa0zPzhCNph14MeQnmCAqqBMKPTqFOI/ewuI/KWaI8Sojb9JOAv5+Ty?= =?us-ascii?q?gn8hhV8dYa6p0IMUaH+iHfRmJFiZbGHvgtgbEmcKuRc+QPbtiF2YXj5Zf2yyUL?= =?us-ascii?q?4k5jEnFIKmCp/OSZqwj7yb3Se0AIdWa3tcBV+QFHfkbYKEW+0DaCiKOM9ujiQE?= =?us-ascii?q?VaS9S48mzRyutBH1y75jLurT4SAYsY/j1MRy5+3Wjx4+7zt0D96S02uVVWF7gn?= =?us-ascii?q?sIRyMq3KB4uUF90VmD0bJ/g/xDCdxe/OhJUgE9NZ/Syux1EdbyVhjHftiXVFas?= =?us-ascii?q?Ws+mDi0pTtIt398OZF5wGtu4gRDHwyqlHaUVl6eQCZwq7K3cxWP+J9t4y3rc06?= =?us-ascii?q?khlVYmSNNVNWK6nq5/6xTTB4nRnkWFiqmlaKUc0zTJ9GqY0WWOu0RYXxJqXqXe?= =?us-ascii?q?QXATfE3Wosrl5knaVb+hFawnMhddyc6FMqZKbNzpjVFCRPj9I9TTeHi+lHmqBR?= =?us-ascii?q?aP3L+Ma5Dqe2oF1iXHFEcEixwT/WqBNQUmGyiuuX7eAyZwGlLhbELh6vVxqHOh?= =?us-ascii?q?QU8u0wGFcVdh26Cz+hELmfyWU+kT0a4cuCc9tzV0G06w38zXC9Wcuwphe79cbc?= =?us-ascii?q?kh71dH0mLZsQN9M4ekL6BjgF4RaR53v0T02xVwEIVAntAgrGk2wwpqNaKYzFRB?= =?us-ascii?q?eiuc3ZDxIb3XNnD+/AuxZK7S21He1suW+6gU5fQjs1XjvQepFks+/HV8ydVV1W?= =?us-ascii?q?WT5onSBgoITZ3xSlo39wR9p7zCeCk94IfU1XlyPqmurjDC3NwoCfA+yha9Y9hf?= =?us-ascii?q?K7mIFAjoE80VH8KuMvAlm0C1bhIYO+Bf7LY0MNm7d/uCwqKkJvxskymhjWRD/I?= =?us-ascii?q?B91USM+jF5SuLU2ZYFxO2X0hGBVzjikFerqtr3lpxcZTEOAmq/zjDpBItVZqFr?= =?us-ascii?q?Y4kLD3yjI9OpydV6g57iRWRY+ESlB1wYxM+jYQCSYEDl3Q1MyUQXpmSqmSimwD?= =?us-ascii?q?xyiDEktamf0zLIw+T5choIJHJLSHNljVf2Loi+l8oaU1Swbwg1iBul4l73x7Zd?= =?us-ascii?q?pKtiNGTTX0FIcDX2L214VKu/qKaCadZV6Jw0qSVXTPi8YVeCR77luRQazifjEn?= =?us-ascii?q?BCyzA6azGruoz1nxJgh2KbNnpzq2DZec5ozxfF+NPcXeJR3iYBRCRgkTnYHEW8?= =?us-ascii?q?P9238tWMjZjDtPy+WHy7VpBIbCnr1p2PtDGg5WFwGh2/mO2zmsf7Hgck3y/70M?= =?us-ascii?q?NqVSrWoxrmZInkybi6O/p9fkZ0HF/899Z6GoZmn4s+np4Q32QahpKQ/Xccn2f8?= =?us-ascii?q?L8hU2aXkbHUXXT4L2dnV4Ar710J/MnKF3YX5Vm+SwsF5fdm1fnsW2j4h78BNEK?= =?us-ascii?q?qU47xEkjdvolu4tQLRff99kywbyfQw9H4amP0GtxA1ziqDGLwSG1dXPTD0nRSS?= =?us-ascii?q?89++tLlXZHqocbWo0Upxh9ShDLWcrQFARHb2YI0tEDR27sphLFLMy2H85Zv8eN?= =?us-ascii?q?bOd94TsAObkwvYhehPNJ0xjuYKhTZgOW/lp30p0eA6gQZr3Z6guIiHLGVs8bmj?= =?us-ascii?q?DRFEMz35fcQT+ivijaxGhMaZw5ivHol9GjUMRJboS+ioHygKtfT/LAuOHjw8qm?= =?us-ascii?q?2AGbrDEw+f6UFmoGjJE5+3NnGYPn0Zwc9lRBmHK0xVmBoUUykinp4lCgCqw9Ts?= =?us-ascii?q?cF9n6T8K+FH4rBpMyv5vNxTkU2fQuhmnZSkuRJiYNhpW4RlI513JPsyG8uJzAy?= =?us-ascii?q?ZY84W8owyWNGOUfQtIDXsTVUyaHF3jJaOh5drd8+iCHOWyNf/OYaiIqeNETfeE?= =?us-ascii?q?3I6v0oxl/zeMMcWDJH9iAOMn2kBbR3B2B9zZmykTSywQjy/NdNSUpAmm9S14sM?= =?us-ascii?q?+/6+/mWBn16ouREbRSPstg+wusjaeFKeGQmD5zKSxE2ZMU2X/I1L8f0UYJhCFv?= =?us-ascii?q?eDmtFrIAuDXQQ63OgaBXDgQUayVpOMtP9aI80RFHOdTHhdPtyr54kvk1Bk9fWl?= =?us-ascii?q?zugM6pe9IFLnq6NFPfGkmLMrGGKifKw8Hzeqy8TrJRgP9Ttx2qtjaRC1XjMSib?= =?us-ascii?q?lzn1SxCvNvlBjD2cPBxboo29aBFtCGn9Q9LgcRK7Kth3giM1wbAvmnzKMmscPi?= =?us-ascii?q?RmfENWsr2c9yVYjetjG2ZZ9HpqMfGEmzqF7+nfMpsWsvtqAiBqmO9B5XQ6zLVV?= =?us-ascii?q?7C9aS/xphCvSrtluo1S4neWVzDpoTgZOoC5RhI2XpUViJbnZ9p5YVHbF+hIN8X?= =?us-ascii?q?ufCxAUqNtgFNLvp7pQy9jUmaL0MDdN7dTU/c4GCMjVLMKIK30hMBXzFD7TFgsF?= =?us-ascii?q?QiahNXvDiExFjPGS6nqVo4A8qpfygpUOTqRWVF8yFvMBFkRqBtoCIIx0XjMli7?= =?us-ascii?q?KbitAH5WamphnLWMpapozHVu6VAfj3MjaWk6JEaAUSzrPiMYsTNpb21Fdjallg?= =?us-ascii?q?gYvKHETQXchXoiJ/bg44ukNN/2ZiTmcrwULqdhut4GMPFf6zhhM5lwx+YeIr9D?= =?us-ascii?q?jx/Vg3IlvKqTAqn0Yvg9XlhiqdcDnrLKe/RYtWETb7t1AtMpPnRAZ4dRC9klZ6?= =?us-ascii?q?NDfFWr1RlKBtenpxiA/GvptOF+VcQrNYbx8N3/GXZuko0FRGpiWh20BH+fPPCY?= =?us-ascii?q?F+mwsybZ6ss3VA1hptbN4vO6PfObFJwUJWhqKSuS+ozfs8zxUCKEYI6m+SfzQI?= =?us-ascii?q?uEMQPLk8OyWo5vBs6RCFmzZbfGgMUOAqrexs9kI8POSN1C3g07heKkyrMOyfNa?= =?us-ascii?q?yZsXDalcGUWlMwyl8Il05d8Lhtz8gjd0uUV0YyzLqeDBkGKc3CKQRJYMVI73jT?= =?us-ascii?q?YTyCsePTzpJpJ4+9DPznTfeStKYIhUKpBAUpH54M78sbGJmszEHYINzoLL4C0R?= =?us-ascii?q?Ui+B7nJFObA/RVYBiLiisIo9mjzJ9r2olQPi0dAWR4MSWw+rbXpg8rjeGeU9c3?= =?us-ascii?q?YnYVRJALOmgwWMKkhy5Tp25AAyWv0uIF1AiC6CfxpiTXDDbiYdpseu2UaAhtCN?= =?us-ascii?q?6o5zow7bK6iVnN8pXRP2v6L8htusfT6eMGoJaKE+lbTb18s0jAhYZXX3mqUm7J?= =?us-ascii?q?Ed6yIZj/cZIhYsf1CnmgVFyzkjw1T9rrMNarMKeInRniRZxIv4mDwDAjKci9Gy?= =?us-ascii?q?kFFBhuoeEO/7hzahAdY5Ulex7orB4xN7a/IQuC1dWuWWmtIyNMT/ZD1eW6e6BX?= =?us-ascii?q?zy00Y++11XsgT5U6z+2p/k4IX5wFkw/Ryu2iZ4ZEVyj/AHtdex/ApSAhjWhuKv?= =?us-ascii?q?4ywvsjwBPPqVQcKTaLdO11Z2xEuNE8AUiSL21vBGQlXVGRkY3N7xWw0LAV+itS?= =?us-ascii?q?g8xb0fZZsHTkuJ/Qfi6sUrSxqZrJqyogccQmo6ppPIz5P8SJqYjTnjPaTJjfqA?= =?us-ascii?q?GFVjC1F+ZCkNhKPC1YWOVImX0iOcEepYVB61A+WdslKrNTD6ksorSqaTt6Ai4I?= =?us-ascii?q?0S8WSZ+P3DwYjue7wbvamQ+acI4+PxwcrJVCntwdXjZsYiwEvq+jUJ7ZmnSYSm?= =?us-ascii?q?gROggT8xpD5AYBlo92ceDl5IvITJBMyz5KrfJ7SDHLFpxy+1v9VG6WnUDySO+9?= =?us-ascii?q?nOyxwQJS0PXs38EbWRFlEkhS3eNWlkouKLxsKqkQopTFsiSUekzgpm7tzvWpJE?= =?us-ascii?q?VJw83Oa1L4FJbFtXb7UiAE93wYX5NAyHHeFZQXkgp2cqUrqU5NII+4ZEnx+SYo?= =?us-ascii?q?x4NzH7m3Tcqr3UoqrW4aRye2FNpME/tpsEjKWD1jeZyrq47oO5RTQm9R5J2SsE?= =?us-ascii?q?1VkENzPC6l0ZBcMd1C4iYQXDhTpjWQpNSySNdZ1s9wE58BOdZ/u3DzGaNCJJiR?= =?us-ascii?q?o2M5ur3pyn/F5T88qk22xDOtFK+kV+hZ5XERGh01J2SCrUkiF/cs8mDX8l3Wrl?= =?us-ascii?q?B44+JbCaOVgUV3vjl9AohEBixV2nC9M1RzUH5Gvv1aKKvPacxTWf0yagK0NhMj?= =?us-ascii?q?C/Emx1SJ8l9wnXjneSx+rAxa+zrSXwMsTykanq/tmSECqsGgITIaSZVIYis6Yi?= =?us-ascii?q?jYNQ2bgj5YvAxDa050Rp8VGNBF9K8H3YFM5MrNVV6sKT0ZXBxlLg83yvRfmlJf?= =?us-ascii?q?vEiaZCzQAxGleurIsh1yYciettWpLOjj8AdBlIznrPgy978fSH2+hQ2tXdfeop?= =?us-ascii?q?fmttKUq0SOdL33M/GnbH/FSzjMkw6/iak4AJnN4ifcLhBXK59kxno4eZLhE3LE?= =?us-ascii?q?PQxaJ6IHIEpWTbh6ac5aou9AesBkZL0E+bRqBhKaXBPgBJKgrP9aLlbJXzveKz?= =?us-ascii?q?+N8uuloYLc9bbdU/TvZtSQx3bbRKJ6Jot66SPlFLj0zIBT4Vf22vNx9kNgU1fG?= =?us-ascii?q?LSGBrNPlJgwV+MmubEzivocmHTnOGpd/jGLtxl1cd8oQWyCl7ZIYx4lC5XntT+?= =?us-ascii?q?J3yFL/sOpI97lr8YM3+axmyd+oJafOLvRXqU1nDQKSBgVk7JUtB3VwSH5Kb+8N?= =?us-ascii?q?MvjRe78Zjcf0p+DxCaMX9AWf+/ZFZtvfO0HBhs6/BymeSRNehgcBriUaLg+G2P?= =?us-ascii?q?6bgKJ0TNulpezl2kIs/1e+LwQJzLZ25Yue/aqIvuDXZQPLzbcYQqjqWt/zrrM0?= =?us-ascii?q?tkOU4f0pj78OempwYwG9EegdUMAdxn36wqAx0SIsCd7DEK78+P5eTXI2gCjsm5?= =?us-ascii?q?dnH1UZAvkUB6aE/ZxCnmcknOzULtsWcqFelWaIER6rCKQCxWSq6yuQJ2llmQrO?= =?us-ascii?q?3gr1QW684176tyh4QTHDz937iEpaSqG3BVtOXyquIUJ3rCmAPA72u9rspaQ07E?= =?us-ascii?q?Y2P3f/tN2RlWuuJrVXH9H+JNOGOyU0okwYjIEpTNy1xY8bAca9IMsW8Hxmavve?= =?us-ascii?q?8Garni9arqdJmYXR/8aV+u/NEnm4la2arLeNyy5ExXgkp10/7cqgNv7W7d2QX/?= =?us-ascii?q?uoz3oRTzt4uwbZWh61rqLUr1UTOUOV1EfGg4MKMc9e3XkjzkHp/vQjQNMp+wVa?= =?us-ascii?q?F4bAYe8Cqi73ODvwwFafbMw4Vi+C3DRJBF71F0d3GLQk0mLqoM3JjWvQ+0EvRo?= =?us-ascii?q?RodUznhBl3Ap49KU0z6FkY3DADEQkLaRCUFr2oA1rqLZccX0gZdRuHxKS6ersw?= =?us-ascii?q?3UBrw7Ou5fXcYvZgCKcWLfZSkBKOk0ZHFZ4Mtq0eWr18cUdH9KHLvgjiF5TnX/?= =?us-ascii?q?/+mHUrNP21Wc5b/tobt3sj/ga/XwCv6YpH77sAlJ+IcbNLbobWs8Bh9Udn4iQP?= =?us-ascii?q?eTZXjBh4lRO5XvgWpPr/7djDrJqo9uGuWb41R+oN6xg7G2R+jpX3gFA5otHbzv?= =?us-ascii?q?xcRZPRiYT+9gBNPnGLtZ3C0xZmNeoBN4Krfbhn93UdJCgSPXEOMsSMa/k6/SBt?= =?us-ascii?q?NC/f51tYAsMDfdkYJtbCmRhIik31X7Fe7tbbGkWGBId3bc8o6XT4xSso/ps9Xe?= =?us-ascii?q?bg6SO2KorE715XJfNDkT9glNTcq+gJ2fDSEjQY4WGFaxhpxSOP05aNBOzq/eqS?= =?us-ascii?q?1NHUV0gLHio3U4dBOjWC+RaoRveulJnzVAOb9NPziookdE2MXnyxgLgFsqFUHO?= =?us-ascii?q?5PlCr72CReFofyh/6SqNqj9m9XtlxBEIZu4hzIA6FfMYthORX4jManXE58CTXj?= =?us-ascii?q?eMvMbBohpPKWxvsQ4+V5L0b+YIgbIhQYy7L193VYVQ5uSL/ssVafQ+0ReNVnSP?= =?us-ascii?q?TernBW8oJsMakPM0aBpJbytDdHtEg2ABM1aL83tjFaeVXBnBZOW6rtpbAOhQ0S?= =?us-ascii?q?Ud9/uU9RFmO9I20+5z/dWqRTkqadEvsV8i+cTqYWSUVnLjt+Qw+p2JVpY7apn/?= =?us-ascii?q?dHsmNAni9nvPcq0zhmRAahtiztpqIN3ykg+LK5tDgap3xFT/uenD3MCVpezfQG?= =?us-ascii?q?l6EcBGj+6VakenkMcJPy4KV7JcTn7YQh4mo/bg8lfyAdWeSgFjz/j6KPAoyUqt?= =?us-ascii?q?5cgwSNuMrWZ7+pMScSLqg9yQ7kR3Vl0AjRghho8GUPQji74t4rPoO9Ntg5xiay?= =?us-ascii?q?H2jUakoM6LtTsMTtrV4LUPc2aVR5zWVs1siHQSMMS9LLG2YxlQUkcmJEcJRC6R?= =?us-ascii?q?AGDaUohCiHvrVe9AEOfDjUCpil+pXXncrQ23k9TddrxnrRpq2Bh5MqzGNqlshx?= =?us-ascii?q?7i6PpHQSbfLXX9VrAnjp2YdV0fb+aOm1suAbVItmz6ysUOMDMsmm4ma2xJRqVV?= =?us-ascii?q?OmxrsAG1q1KukDyanHUy29U22XRfyLc3SQnzY+KkPy4BioLl40aMdNtEI9MPHN?= =?us-ascii?q?hp1blw3nT7x0QD+cpVnFw2w/KekabR45uJ+7ewwWS+4cf/OTKvYowP0iE1YMdH?= =?us-ascii?q?vJHSxqC++qr16igpV0N29n4UXgbuTn6hrmP8eKGhkYDY7aqYZ8+eS9RmKFI3Bg?= =?us-ascii?q?1hNzPE5w9+fRDFkxs+hcc5GKndfOm9t7y+kFd+x2MS08vN4TlZhv6Y6O0MeFaR?= =?us-ascii?q?vR1Ir9JcnJoviEBP3S10oqdX9eUroYeQP6+Z43P984W73WGLtWow4cBawkT5A7?= =?us-ascii?q?MGfx7q50JhtpcgHNfLS0ntXqpuWTa5tUu3/W7lUwLCLGtB0Y0fG0SA17b4ywh3?= =?us-ascii?q?rsOpwwQShBr9J1ABt8AIRPA98ArxagA5OMlqC7k8Wx+0JmtOAUqqfwD/HK1Mij?= =?us-ascii?q?34pvRZRa4laLPDnJDqlxnktllviyguvH0pTpDsPifc0LWfNjQm7BcLDGBZm/Kj?= =?us-ascii?q?OSNcLgYU5J7aCT3Kh/UhqPeCDzR7CGuzG8NPV4/UU7zZR1fO7SzDwr8rHa18L+?= =?us-ascii?q?Z2Vapie4sX6JL4BS7F3QCuzYWBJYU/2F8HxqHacPd4v76P8OMcA+wNib+wRz9y?= =?us-ascii?q?pN0M+EI6ins0/N1UV3e53HLEvpxSk5Q5cFIAylPkY3gm/WtG7dAXJCIcigMsZt?= =?us-ascii?q?ndmVAgbq50lrlmEnfnRBFXbwRdeNJWgb3NqzZAmL9AJQE9YOhO+2eVc+tqKoU+?= =?us-ascii?q?VoPItKmfmyvrUdjdlpMz3PRNRdPyzIKb95JCZeDuXOpFguZR4JqKY1WoYzZZeQ?= =?us-ascii?q?JEMHMUGAyT79zAfY1k30bdOs3r6TICkK6nVH067F0T9Uqgm7o/mZgcrjX6vCYZ?= =?us-ascii?q?HrWv7SLColVjaHRTQ9EUap5U2ou/was/qEOW0fuEwbYjqOCA4PoaBitcPfAXTU?= =?us-ascii?q?le1nfZ0Kn+yaWzvqRC1jiqU9GjxHtVuSTPoHFAnWaWLhgWVHtQO+Jv5M52/lb6?= =?us-ascii?q?aCyqtbQeMWHpBMcvqfQ9fCfvBePTgonC0DOOmgZ93cs6o50lXQQGsWCabH70ee?= =?us-ascii?q?TE+ITfyY3D/rQ4EVsJIvuiop59LchCl3HLrUP7yHvT6h7pa4jDqEue3ZTmQtYU?= =?us-ascii?q?k1gOUYAGmbwRlAM3oJC9cPt0HoXKGAZlxA1HUzieJhwxUMYhh8UmVy0n1Km/aw?= =?us-ascii?q?AtNWSVwTjGOuRv0Gd1d3DDUr8E+F+A3yfMIAtt7JR2NE8LsDV5YdJuEy6IbLIK?= =?us-ascii?q?sQ3Oop3DV+rSwhvSWdCk9SgwOG/qfLAqJz2KdC5Wg5/vFxWEGDWTXffXbbyoC+?= =?us-ascii?q?EcJA2T9uoWz418rTpu1tNrxap4d9AFoRBCJ5OM3S/T5GUWHuxAS9oQy3HDKALz?= =?us-ascii?q?IFs343Inkqa+d5yKdHqhvOat/F4EWbtqtp/ES2CAqMIqau1ZpXA8Xg0w65YG9N?= =?us-ascii?q?fCn9U9htp/JMkssCSb82boi5RVbaJ07xCRzLlToL8U3RvrmzDcdMil4bm6EoJc?= =?us-ascii?q?ChC5IGFvHFzTp4xDBO35NJwmqPVICMLqbl4tB1UCldfqK2TmPmNdeQZW3/?= X-IPAS-Result: =?us-ascii?q?A2HjAgAPZEBY/wHyM5BcGQEBAQEBAQEBAQEBBwEBAQEBFAE?= =?us-ascii?q?BAQEBAQEBAQEBBwEBAQEBgw0BAQEBAR+BXqMsAQaBHZZ0AiWGBIIKUwEBAQEBA?= =?us-ascii?q?QEBAgECXyiCMxoBghoBAQEBAwECICsgDgMJAQEKDQQDAQIBJgQCAgIBAS0VCQg?= =?us-ascii?q?GAQcFBgIBAQEYBIhMrBCCKSoCiwwBCgEBARUOhXSCR4JehBsRATyCZIJdBY54f?= =?us-ascii?q?Yppg1+Beos3gXKIMIYUh12GHYQMVWEXAhEOI4NtgWNUhxWCLgEBAQ?= Received: from unknown (HELO tarius.tycho.ncsc.mil) ([144.51.242.1]) by emsm-gh1-uea11.nsa.gov with ESMTP; 01 Dec 2016 18:01:36 +0000 Received: from prometheus.infosec.tycho.ncsc.mil (prometheus [192.168.25.40]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id uB1I0uFD024946; Thu, 1 Dec 2016 13:01:04 -0500 Received: from tarius.tycho.ncsc.mil (tarius.infosec.tycho.ncsc.mil [144.51.242.1]) by prometheus.infosec.tycho.ncsc.mil (8.15.2/8.15.2) with ESMTP id uB1I0pbV159891 for ; Thu, 1 Dec 2016 13:00:51 -0500 Received: from moss-pluto.infosec.tycho.ncsc.mil (moss-pluto [192.168.25.131]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id uB1I0nue024943; Thu, 1 Dec 2016 13:00:50 -0500 Subject: Re: [RFC][PATCH] selinux: support distinctions among all network address families To: Guido Trentalancia , selinux@tycho.nsa.gov References: <1480604861-13982-1-git-send-email-sds@tycho.nsa.gov> <1480613322.4558.29.camel@trentalancia.net> From: Stephen Smalley Organization: National Security Agency Message-ID: <9b023671-606f-d3b2-9d70-3bbcbf5e5dba@tycho.nsa.gov> Date: Thu, 1 Dec 2016 13:03:52 -0500 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.4.0 MIME-Version: 1.0 In-Reply-To: <1480613322.4558.29.camel@trentalancia.net> X-BeenThere: selinux@tycho.nsa.gov X-Mailman-Version: 2.1.20 Precedence: list List-Id: "Security-Enhanced Linux \(SELinux\) mailing list" List-Post: List-Help: Errors-To: selinux-bounces@tycho.nsa.gov Sender: "Selinux" X-Virus-Scanned: ClamAV using ClamSMTP On 12/01/2016 12:28 PM, Guido Trentalancia wrote: > Hello again Stephen and Paul. > > On Thu, 01/12/2016 at 10.57 -0500, Stephen Smalley wrote: >> On 12/01/2016 10:07 AM, Stephen Smalley wrote: > > [...] > >> A couple of notes on this change: >> >> - To fully test (beyond just confirming that it doesn't break >> anything >> when the policy capability is not defined), we'll need a patched >> libsepol and policy (and unfortunately it requires patching the base >> policy; can't be done via a policy module). Can certainly provide >> those >> too but figured I'd wait to see the response to the kernel patch >> first. > > The libsepol patch is straightforward. > > You can have a look at the one I have posted on the 23rd of August 2016 > under the subject "[PATCH] Update libsepol to support the policy > capability for AF_ALG sockets" and adapt it to the new policy > capability name and to the fact that you are now removing the Redhat > policy capability. > > As for the Reference Policy patch, if you want, I can forward to you > the one that I had created at that time for the ALG_SOCKET family, so > that you can adapt it to the multiple socket types. > > Same thing for the SELinux Testsuite patch: if you want, I can forward > to you the one that I had created at that time for the ALG_SOCKET > family and that would be enough for testing the new capability because > it's representative of all the new socket types. > > With kind regards, Actually, I realized belatedly that CIL makes it possible to enable testing of this change just through a policy module. Attached is a CIL policy module that one can insert via semodule -i testextsockclass.cil (caveat: may break your system if using any of these socket classes). Also attached is the libsepol patch. So now I just need a test case - will have a look at your AF_ALG patch. From daaea4522b34a54c2cff319c458d7d1a0267ecbe Mon Sep 17 00:00:00 2001 From: Stephen Smalley Date: Thu, 1 Dec 2016 11:08:06 -0500 Subject: [PATCH] libsepol: Define extended_socket_class policy capability Define the extended_socket_class policy capability used to enable the use of separate socket security classes for all network address families rather than the generic socket class. The legacy redhat1 policy capability that was only ever used in testing within Fedora for ptrace_child is reclaimed for this purpose; as far as I can tell, this policy capability is not enabled in any supported distro policy. Signed-off-by: Stephen Smalley --- libsepol/include/sepol/policydb/polcaps.h | 2 +- libsepol/src/polcaps.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/libsepol/include/sepol/policydb/polcaps.h b/libsepol/include/sepol/policydb/polcaps.h index 53d7994..c9e40f6 100644 --- a/libsepol/include/sepol/policydb/polcaps.h +++ b/libsepol/include/sepol/policydb/polcaps.h @@ -9,7 +9,7 @@ extern "C" { enum { POLICYDB_CAPABILITY_NETPEER, POLICYDB_CAPABILITY_OPENPERM, - POLICYDB_CAPABILITY_REDHAT1, /* reserved for RH testing of ptrace_child */ + POLICYDB_CAPABILITY_EXTSOCKCLASS, POLICYDB_CAPABILITY_ALWAYSNETWORK, __POLICYDB_CAPABILITY_MAX }; diff --git a/libsepol/src/polcaps.c b/libsepol/src/polcaps.c index 43a71a7..3924cb8 100644 --- a/libsepol/src/polcaps.c +++ b/libsepol/src/polcaps.c @@ -8,7 +8,7 @@ static const char *polcap_names[] = { "network_peer_controls", /* POLICYDB_CAPABILITY_NETPEER */ "open_perms", /* POLICYDB_CAPABILITY_OPENPERM */ - "redhat1", /* POLICYDB_CAPABILITY_REDHAT1, aka ptrace_child */ + "extended_socket_class", /* POLICYDB_CAPABILITY_EXTSOCKCLASS */ "always_check_network", /* POLICYDB_CAPABILITY_ALWAYSNETWORK */ NULL }; -- 2.7.4