From patchwork Thu Dec 8 16:24:28 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stephen Smalley X-Patchwork-Id: 9466621 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id D753D60459 for ; Thu, 8 Dec 2016 16:22:24 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id C5010285C8 for ; Thu, 8 Dec 2016 16:22:24 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id B8355285CA; Thu, 8 Dec 2016 16:22:24 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-1.9 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_NONE autolearn=ham version=3.3.1 Received: from emsm-gh1-uea10.nsa.gov (smtp.nsa.gov [8.44.101.8]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 9C9BB285C8 for ; Thu, 8 Dec 2016 16:22:22 +0000 (UTC) X-IronPort-AV: E=Sophos;i="5.33,320,1477958400"; d="scan'208";a="1742123" IronPort-PHdr: =?us-ascii?q?9a23=3AYK/lPxOPAQOJ+r661Tgl6mtUPXoX/o7sNwtQ0KIM?= =?us-ascii?q?zox0LPj7ocbcNUDSrc9gkEXOFd2CrakV0KyL7+u7CCQp2tWoiDg6aptCVhsI24?= =?us-ascii?q?09vjcLJ4q7M3D9N+PgdCcgHc5PBxdP9nC/NlVJSo6lPwWB6nK94iQPFRrhKAF7?= =?us-ascii?q?Ovr6GpLIj8Swyuu+54Dfbx9GiTe5b75+NhW7oAreusQYhYZpN7o8xAbOrnZUYe?= =?us-ascii?q?pd2HlmJUiUnxby58ew+IBs/iFNsP8/9MBOTLv3cb0gQbNXEDopPWY15Nb2tRbY?= =?us-ascii?q?VguA+mEcUmQNnRVWBQXO8Qz3UY3wsiv+sep9xTWaMMjrRr06RTiu86FmQwLzhS?= =?us-ascii?q?wZKzA27n3Yis1ojKJavh2hoQB/w5XJa42RLfZyY7/Rcc8fSWdHUMlRTShBCZ6i?= =?us-ascii?q?YYUJAeQKIOJUo5Djq1cSqBezAxSnCuHyxT9SnnL4wLM00+ohHwHB3wIuEdwBv3?= =?us-ascii?q?vWo9rpLKcfU/25wafWwjXYdP5W3Cvx5ZLSfxw9r/yBX7R9etfRx0k1EAPFi02d?= =?us-ascii?q?p5H5PzyLzuQNs3aU7+x9Xuyyjm4osQVxojyxycYsl4LEgZkVxU3f9Shi3IY0Jc?= =?us-ascii?q?G3SE58YdK+FptQrDuVO5F5QsMlXWFloSA3waAFt56jZCUG1ZsqyhHFZ/GHboSE?= =?us-ascii?q?+AzvWemPLTtimX5ofq+0iQyo/ki60OL8U9G50FNNriVYjNbBrmsN1xnP6sifTf?= =?us-ascii?q?t941uh1S6P1w/N7uFEJlg5lbbBJJ47w74wi4ETvV7fHi72hEr2jKiWel8i+ue0?= =?us-ascii?q?8OTofq/qppqdN49wkg3+M6IuldKjAekgLwQDUGeW9f682bH+50H1XrpHguMsnq?= =?us-ascii?q?XEqJzaIN4Upq+9Aw9byIYj7BO/Ai+90NsGmXkHLVRFeA+IjoTwIF7OJ+34DfGj?= =?us-ascii?q?jFuyizdm3OzGP739DZXNKXjPirHhfa1n5EJGxwozys5f64pOCr4dOPLzRlPxtN?= =?us-ascii?q?vAAx84NQy03/joCNFj2YMbR22PHrWZMaPJvF+P/uIgPe+MZIoPtzb8L/gq/Pnu?= =?us-ascii?q?jHAjlV8aZ6mp0oMdaGqkEfR+P0WZfX3sj88BEGYLuQo+SvfniFiGUTJKZnayWb?= =?us-ascii?q?gw5jchB4K8DofDR56tj6Kb0Ce9AJJWenhMCkqQHnfwa4WER/AMZTqMLc95iDME?= =?us-ascii?q?T7mhS5Q62BG2rgD60btnLvHM+i0cr53syMZ66/fUlREo+jx+F96d3H2VT2Fogm?= =?us-ascii?q?MIQCc73a5+oUx5z1eMz7J4judWFdNN+vxJVR06OoTEz+xgDNDyWBzOccuVSFq8?= =?us-ascii?q?RdWmGz4xRMorw9ASe0Z9B8mijhfb0iqkGb8ajbqLC4A18qLHxHXxIt59y3ff2K?= =?us-ascii?q?k6gVgmWdFDNWq8hq5w7wLTHZLGk12Fl6a2cqQRxC3N+32AzWqJoUFVSw1wXr/G?= =?us-ascii?q?XXAYe0vat9P55lnNT7W2E7QoLhNBydKeKqtNctDml0hJRO3iONvAeWK8gH2/Cg?= =?us-ascii?q?qNxr+Wa4rqYWod1j3HCEcYiwAT4WqGNQ8mCyi9uW3eCCJhFUnzY0Ls9ulzs2i7?= =?us-ascii?q?QVM1zw6UaU1hy7u19QQPifyaVfwTwqoOuD09pDVsAFa9w9XWBsKApwV/eKVcZd?= =?us-ascii?q?Q97UxD1WLEqwx9OZmgILp4il4ZaQR3sFvk1w9rBYVYjcgqsHQqwRJpKaKWylNB?= =?us-ascii?q?cCiY3YzrN73MLGny+x6ua6vM1VHYytqW/LkA6OggoVX5oA6pDlYi82lg09RN3X?= =?us-ascii?q?qT/JHKDBYMXpLrSUY67AZ6qK/AYiYm+oPU0GdgMa6usj/Nw9gpHvcqyg68f9dD?= =?us-ascii?q?N6OJDBPyHNAHCMivMuMqn0OkYQ4DPOBX6KE7Jdimd+ec1K6tIulggCqsjX5b74?= =?us-ascii?q?BlzkKM6y18R/bO35YEx/GY2hWIVyzngVi7rM/3g4dEaSsVHmqlxijuHJRRabFq?= =?us-ascii?q?fYYXFWeuJNW6ychkiJ7xQXFX6lCjBlwd1cC1eRqddUb93RFO2kQNu3CnnzW3zy?= =?us-ascii?q?BsmTEzsqWfxDDOw/jldBcfJG5LRXVtjUvrIYiuldwVQEiobw8vlBuq/kv6w6lb?= =?us-ascii?q?pKJlIGnJRkdEZS/2L3ttUqGorLqNf9ZP6I80sSVQSOm8ZVGaSqXhoxcDyCPsAW?= =?us-ascii?q?9exDE9dzG3tZT0hAd6iHqcLHZ1rXrWZdpwyQ3Z5NPCWf5bxiAGSzVgiTnLGli8?= =?us-ascii?q?OMGk/c+Tl5fHtuCxSXihWYFUcSjl1o6Arza76nFxARGlmPCzgNLnGxAg0SDnz9?= =?us-ascii?q?lqSTnIrBHkb4nzzau6LOZnclNyC1Pm8MV6HYV+kpc3hJEWwnUag4mZ/XwAkWjv?= =?us-ascii?q?K9lb37zxbGYVTz4R39HV+BTl2FFkLn+RwoL5UmyRzdVnZ9ShfGMZxCY978RUB6?= =?us-ascii?q?eO9rBEmzV6okagpwLLffd9hisdyecp6HMCgOEGpgwtzj6GD7ARA0ZYOzfslxKW?= =?us-ascii?q?4NCitqlXY3yvcbeo3kpkgd+hFK2Coh1bWHvhYpctBzJw7sFhP1LUynLz7J3kd8?= =?us-ascii?q?fKbd8Iqx2UiAnPj/JOKJ4rjfoKgjdnOXjhsnI7xe47igZu3Z6ks4SdLWVi4r65?= =?us-ascii?q?CAZCNjLpf8MT5i3tjaFGk8aI2YCgA45sGisNXJT1TfKkCjQSuur7NwyWCj0ztm?= =?us-ascii?q?+bGabDHQ+Y8Epmt2jAE42vN3yMOHYZzMliRRmEKExRmg8UWi82npkjFgCl3Mbh?= =?us-ascii?q?alt25igN5l7krRtB0uFoNhn7UmjBvwqobzA0SJaRLBVI8gFC+0fVMcub7u1tBS?= =?us-ascii?q?1Y+IOurBCVIGyBewtIFX0JWlCDB137MLmh/9/A8/SfBuq7NPbOb6uBpvFZV/eS?= =?us-ascii?q?352vypFm/zGONsqRInZiE+c32k1ZXXB2A87ZgSkASzQLlyLRaM6WvBi8+i1roc?= =?us-ascii?q?Cl8PXrQB7v5YyUBrtUL9pv5wu2jruZOO6Imil1MzBY2Y0QxXXQ0rgQwEYSiz1y?= =?us-ascii?q?dzmqCbkPqCjNQ7jLl6BKCR4UcTl/NMxS76IzxgNNI9LUisvp1r5kif44E01FWk?= =?us-ascii?q?H8lcyyaswKJm68OEnBBEmVKLSMPSfLzN3vYaOgVb1Qi/1ZtweqtTeVCUPjOy6M?= =?us-ascii?q?lz3uVxGvKuxDlj2UPBlEtIG6aBZtBnDpTMj6ZR2jLN93kTo2zKUyhnPQL2EcKS?= =?us-ascii?q?B8flhDrr2R9yNYmel/G2JA7npjN+aEnTqW7+jCJZYSq/drBT50l+1C6nQg17RV?= =?us-ascii?q?9D1EROBymCbKtdFhuFaqku2Oyjp8TBpOsSxHhJmVskp+I6nZ7YdPWXLF/BIL8G?= =?us-ascii?q?WRBA8HqMdlC931pqBQ0cLDlazpJzde6NLU+s0cC9LTKMKdP3orKQDpFyLMDAsZ?= =?us-ascii?q?UT6rMnnSiFdckPGd8X2VqIM3pYXyl5UVS79UTlo1GukdCkR/E9wIOI13US88kb?= =?us-ascii?q?6HkM4I4mKzowPeRMpAoJDISOmfAfL3KDmHi7lEYgEHwbL8LYsIMY361FZual5g?= =?us-ascii?q?nITFA0DQR8xCojV9bg8op0VA6GR+Tmo2207/cAOt534SGuCynhEtkAt+Zvoi9D?= =?us-ascii?q?T37lgrIVrKoTc/n1MqmdX5mzyRdiD+LLuoV4FMFyX0r1QxMo/8QwttbQ2ygUxk?= =?us-ascii?q?NDDBR71LlLttbmVriA7AuZtVB/FQV6pEYAUfxfuPffUnzUxcqjm7xU9A/ebFD4?= =?us-ascii?q?VtmxEucZO3rHJA3BljbMIvKqzWP6pJzVlQiriIviC2yuA72BUeKFoV8GOOZC4I?= =?us-ascii?q?v1QFNqM4KCqz4ONj8xaClCdDeGUXTPUqo+hq+V46O+SO1yLgyaBMK0CrO+yZMa?= =?us-ascii?q?yZp3DKldSUTVMoykMIi05F8KBr3sg5bUqUVl0gzKCKGhsTL8rCMwZVbsRJ9HfN?= =?us-ascii?q?YSmOrP/NwZNpP4S9DOzoS/GBtLoMiEK+AAkpB5gM7tgGHpS0zU7YNtnoI6QKyR?= =?us-ascii?q?U3/gvrOk6IDO9TdxKIjTcHuduwwIVz3YlAIDESG399PTyr5rbQpQ8rgP2DUM0w?= =?us-ascii?q?YngEQosOLmg2V9Gimy5Fo3RACyG60uwDyAec8jD8vT7fDD/gb9pkf/eZfgljB8?= =?us-ascii?q?2z+Tkl9Ki2k1HX+I3EJ27mLdRipsPP6eQCqpaDDPNUV6dys0HdmolfXHGqXGjP?= =?us-ascii?q?EcOvK5j3cYksYsT+CmymXVynlzI1U8DxMc62LqeWhQHoRIBUsJSU3T04KcC9ET?= =?us-ascii?q?QeFAtqqOEY+KJwfwsDbIQnYRTwrQQxK7S/IBuE0tWpW2uiNCdZT/xYzeW8e7xb?= =?us-ascii?q?0jEhbvGkx3s6T5E7zu638UgXSJEMkB7e2e6pZ5NCXijrBnxdZwLPqDI6l2h7Nu?= =?us-ascii?q?c92OE/wA/IsVQHPDCLc/RpZ3Bes9E6G1ySPW18CnAkSF+EkYrD/gms0qgO/ytc?= =?us-ascii?q?mtZU1vFFsHj+v5LEfT2sWayqpo/OvCY6a9gpvbFxO5T5IsSarJPegiDfTJ7Ivw?= =?us-ascii?q?2KSi61DfxamsRLLSJZR/lJl2clOdAGuYVf6EoxUNs+KKJVCKU2oLCldyZkBzYI?= =?us-ascii?q?zSAFT4OAwCACguCk1rTAkheQcYgtPwIcv5VHgtodVSl2YiUEq6K4TIrWlnWLSm?= =?us-ascii?q?4SLAcd8ARA/gQAmZFsfur9+orHUIdMyyJKo/JzSibEDYdn913gR26MnFf4Vuuu?= =?us-ascii?q?k/ay3Q1I1vLt0sMXWBllCUhS3+xWjFcnKKlrK6kMuY7HqiWIdUX7vG3xyOumI1?= =?us-ascii?q?1RydbMeVPhEYTLr3bxXCoH9HIIQo9PzW3QGo4JkwplcqoroktDIJy+cEbk+zMk?= =?us-ascii?q?35hpH6W/Vc2z21klr2wJSDuxHtVdDOFmtFbXWDx7bJCxtJXqJYldQm9K9J2asV?= =?us-ascii?q?dZn11nMzSlxppEN8FN/jkMUSBVoTqHptuyT9ZM1NRqD58WONh/pWnyGKdFOJiX?= =?us-ascii?q?rH02vr3vynDZ+zAgvle13i+zG6qiQ+Jf4WIeBh0jJ36CpUk3E+ss7mDS/0jNs1?= =?us-ascii?q?9u5OdUHL2PjUR3oDtmH5BOGixG1Wu5IFtpVnVGtftVKLjNecxGX/YyfQOvOwA5?= =?us-ascii?q?FfM+0U2F5117nXf4Yyx3twtV4SPdUhI1VSYLnLjihycSqsa9OT8VU5hIdykubz?= =?us-ascii?q?/ZKwKHniBapA5fa0ZuW58DGNZE9bYb3Y9a/sfZTEasLiYFXAd8OQ0ky/pfklVD?= =?us-ascii?q?sF6ZeSDbAgqkb/HPsgd4fc2Jts6mMOz5/BtbioPgqO037b8DR2CgmQG3QtDTtI?= =?us-ascii?q?78ttyLtkuSb6j0Keu8bmHdTDLUlxC/ma8kD4XW/yjUKAdbN556yX8/bJj9FWLL?= =?us-ascii?q?OA9JK7gdJ0VFSaBwcc9GrfxCZ894ZKYJ/rdgBhKdSRP1AoOvqORJI03OSjvANy?= =?us-ascii?q?WB6vKwoYbN4rzHU+TgYdaMx3nfSaJtIph68SX7G6vt0YJG+Er23eli+1hnRlfY?= =?us-ascii?q?KCCOss7hJh8V68a/bEfiuIMmHS/OCpdqjHXt3l1Ad9YQQyCy65sYxo9W5GryRO?= =?us-ascii?q?5l3EX+q/Fd975h6YYr+b9p0tu0Kb3UKftErU9tGgKUCRly9pUxHGh/QHhcYvUP?= =?us-ascii?q?J/jMfaQWl9zupvvzF6wQ9h2a5fJVZsfAJ07chMazEDecRgJYnA0Zsz4VMhOc1+?= =?us-ascii?q?KZm69zUculvfP52l437FejMh4L16tt5YCZ+qqSuODYcR3RzaQeWqfwQsP/tLMs?= =?us-ascii?q?u1md5fc8jr4BZnR1YxG7EOgaTsMd2n3gwr40wi0xCM7DArbg+OJZV30jgDLgmp?= =?us-ascii?q?d9H1EIFfMIB7aL+p5enmggkezDKtIWarxCmnqIFRO8F78N03qr6y+JL2l5nhHB?= =?us-ascii?q?yQv/THi17FDosS94WjfDwM37kkVLTLW3A1ldXzaxM09irDyPJBbotMbwuakt7k?= =?us-ascii?q?E5KHbktNWWlGulIrxXAdbyJNmBISkwuFIXjYE+Rt211oAdAtqxOtAR8GtxbvHG?= =?us-ascii?q?8WOkjzdBo7tbh4rZ+syV+O/YHX+uj62ArLWC2S5Xx2MkvV4l7NCgLfbO68eMQ/?= =?us-ascii?q?u2y2YbVz1/tBfZXx6ptrzbqEgZOUOW0EfKnIwKOs9W3Xwj2077+ucsW9Mz+x9Y?= =?us-ascii?q?ForaYPMCvz/zMiPuwVmDe9I3SjWe0zxPE1LzFVl1A6k82GT1vM7TlHfQ/VMoRp?= =?us-ascii?q?NqeEz8mRx3FZg4Jl4x6FgK2CoMDxIBaReBDLGnHU7lN5cLVVAfaRSb27i3YqI3?= =?us-ascii?q?3Up1wrOz6+/cc/dxB68MNvlHiA6BgkRbG5wRsa0EQ7J8YEVR9KjJqQj+E4LnRe?= =?us-ascii?q?TplWIsNf2pRcBX6cQZt2An4gu/XBeg54lM4KsciJCSbKFEeYLMvMd+70h5+TEP?= =?us-ascii?q?ajZBgB9ljxO2Seocvvzs4sDHsJq07eajTKMtR+EJ+BgxAGRxkZ/wjUssod7J0O?= =?us-ascii?q?dcUZXVhp7j8ABMOXGKvIfa0x9gKeUQL4KreLdg93oZKCgYO30BI8Caa/8i7C9x?= =?us-ascii?q?KD/T/UBNAtsQZdMEO8rAgRtUhVf3WL5J+crUBESYBpxod88y8Wr40j81/oUnUu?= =?us-ascii?q?r67j+5O4zf5UlXP/xflCVsiM7CpO8NzPrQCSgX5GKUax1rzSKC1ZaNEffw/eOD?= =?us-ascii?q?yN3OUVMJADI2WZ9HJDWe4QynWva1lJLxXwOV6878mogxe16LS3yqgqsFrrhDHv?= =?us-ascii?q?JahiX8xDheGZj/h+iJvNq09GtXqlpHHZ5o4h3EA6VeMI90ORb5lsm3XkhzHDb/?= =?us-ascii?q?eMXPexUyv+qZ2/kD7P9jN0vkYo8bOAgLx6j96XpPQQtkUKT2sUqBXeINeNtmT+?= =?us-ascii?q?vJrmhP5oJ8N6APPFacpJvwrjdLsVw2GxEmaLsxrjxca0nPkxZYW77ut74clgQc?= =?us-ascii?q?UdB4uUhWGWKzIm4+5CTIVb5TjKaPDPwZ6DKTTrYBU09wKCNxXwu12Ilye7uuhf?= =?us-ascii?q?1HrnlGkT15oPcw1TxpWgCxtjDtp6IC2DIg5Ku3tC4btnxfU+WSiSHIBktfzP4S?= =?us-ascii?q?l6cTF27i6UCgYHkEdIby76NoJd7++ok943QyehEjfywaXeu+CyH/lb6IApeVvN?= =?us-ascii?q?JamhGNpN3EbaWvIigKKrQ91RXjSmBy0gfAmhZo7GwLQjKn4N8/Ooq9Pcclxiy1?= =?us-ascii?q?GWnUb1sM5r1GsNHxtFERVuc2b01uwHl72MidWiINXNDPG3oyjgU8b2VEcY5M6R?= =?us-ascii?q?geF6YymTaEpKhG/gYTYDfPCYSo4YzQkMjH2HUnStdq3G3WrLWfhpw2yH1lh890?= =?us-ascii?q?7imWtXQda+PYSNRsDmHu2IlQz+L+ZvOtsv0ISYZ9x7ShVeUNMs+99mes35VqQE?= =?us-ascii?q?ClzKwEH1WlKO8D2qvbUyC9RG2aXuSLc26MkywlPU7y4RmoM0A4acZLr087KevC?= =?us-ascii?q?hZ9cmhb/UbN1WCWfv1vbw3EiMe8AcQI5ppuncRQQTOENf+icOfQuwPomBVsNcX?= =?us-ascii?q?/GBy12BvSysV6wgYd7OnJg4V7gbeTq6ADmP8OYGgMYHo7Csp5x5fu6S3qDOXB+?= =?us-ascii?q?wh1yMk10+vzRFlsrsO9TbYqRkcLWh9tlze4Pb+1tPjElut4PhoJj7pGZ0MiOcR?= =?us-ascii?q?HWwJf9O9XVovyDDv3EyEQqfGBaXaYDbQPz+Yo6IsYzW6fPErtBoRQcGa86TYQj?= =?us-ascii?q?N2fx9KB0NARzcgrQZLSonMbnveeLZppIp3/M8F08NiDcuwcMyvasVwx0c4iqh2?= =?us-ascii?q?nuIJA3Xj9Bs9xtCh59EYtTGsMPswmnDICQmK2hjd++5V96sfcQsaXsEvDKyMi5?= =?us-ascii?q?34JpUphf5EyLPzXRBK5wj0RnlOuygfDA0p/vBsPkY98EUvZ0QnLdYL/cAoq/Mi?= =?us-ascii?q?6OOt77e0Ne6LGTzrR5UgmKaSDiW6qGszGkNOl64Uol14N0Zu3TzCYi77vDwtv9?= =?us-ascii?q?e3lbpju/rX6OLJZf4kLFBejfXxJMV/WI62dkHawSbYvx6ugOK9giz8aG7wl09j?= =?us-ascii?q?RC39OPI7K9oU/UxkJ7aZXbIVPn2iYhQ4kKIQiwPlU3jG/cq3TdHW5cIda+Jclq?= =?us-ascii?q?mtaVAQTn51NtlmE1em5BBm3oSM+WOWgfxc2zfxWK9AZRANYYg+63eFI3trGoSe?= =?us-ascii?q?Z2JJpJg+Oqu6sbkdxxMSHAWNBaPz3MLL9xJjdRCuTPpF41Yh8LqrQ1XoY1ZYOS?= =?us-ascii?q?IEMcK0qAyDn9zQ3F0UHucNyszqmJKj4M8npb17LFzSRMpw6htPaCnMLjVLHZbJ?= =?us-ascii?q?frXP/dNyYrWS2aRTQsHkaz51iko+ALseGbIWgBuFAUZDydCAoIqaByotjcFGjT?= =?us-ascii?q?mfdsfJcSnvCVRzjwSDFklKo1HitLsUGMQ+EfFQTNbn7hmWxctxa4Kv9K433lc6?= =?us-ascii?q?WSxrBJVOwOHotMbvqZTsPdef9EOzgoljQZOOC7f9DHsbY501TIQnUdE6nJ8l2e?= =?us-ascii?q?UUGXTuabxzLxUoUfp5I0tTYw+tLMgi93FLzFP7SFqD6t9Y63lz2VufDYVmkxY0?= =?us-ascii?q?w1h/8CAGaBwBlcMm0EDc8auF31SK6ae0lMzG4pif5p2xIUdwR8SGZh0mdXnPmj?= =?us-ascii?q?Hs1UUkAUjGe0T/0dbVB3ESk8/UmU7Q3uedYAo9zcR3dC9rsQTooQNPso6IzQOK?= =?us-ascii?q?sK2vYp3SlmrTc8syqHClNSkAOF/7DXHKJmyb1I/XM48O1uXkGTXzPfdXDKypGo?= =?us-ascii?q?C8JK2ShjoHPp2tHKvu9zLrtapoB4AFAMAS5sINDS4yxBW3nu2ASupxa7ACieID?= =?us-ascii?q?UB7TYJIiwFcOJ1wvR+sBnWa9nB50SQt7g9p0S1EwqLDKS72IAYQv3ugD2xdC0D?= =?us-ascii?q?VDKsDZ0+/u5EidI6eao6Yc27BFfbI071CQfO6A4W8x2/maimFcpHxC0ll6woLN?= =?us-ascii?q?z4F90RAcLxwCBzw3EOwoEGi2KWHIWMNdXC98VkCCRWZdGGQn7xbceMZm+quQ?= =?us-ascii?q?=3D=3D?= X-IPAS-Result: =?us-ascii?q?A2GzAwBRh0lY/wHyM5BeGgEBAQECAQEBAQgBAQEBFQEBAQE?= =?us-ascii?q?CAQEBAQgBAQEBgwELAQEBAQEfgWCjOQEGgR2XAgMih3tTAQEBAQEBAQECAQJfK?= =?us-ascii?q?IIzGgGCGwEFAQIgKyALAwMJAQEKDQsmBAICAwEtFREGCAUGAgEBARgEiEqoM4I?= =?us-ascii?q?pKgKLBAEBCAEBAQEBAQEBEQ+FdIJHCIJWhBoRAYMggl0Fj36KbINhjT6Bc4g4h?= =?us-ascii?q?haHZYYjhA5WYRcCEQ4jhVFUhgSCLgEBAQ?= Received: from unknown (HELO tarius.tycho.ncsc.mil) ([144.51.242.1]) by emsm-gh1-uea10.nsa.gov with ESMTP; 08 Dec 2016 16:22:20 +0000 Received: from prometheus.infosec.tycho.ncsc.mil (prometheus [192.168.25.40]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id uB8GLRX1020752; Thu, 8 Dec 2016 11:21:40 -0500 Received: from tarius.tycho.ncsc.mil (tarius.infosec.tycho.ncsc.mil [144.51.242.1]) by prometheus.infosec.tycho.ncsc.mil (8.15.2/8.15.2) with ESMTP id uB8GLPQ5021570 for ; Thu, 8 Dec 2016 11:21:25 -0500 Received: from moss-pluto.infosec.tycho.ncsc.mil (moss-pluto [192.168.25.131]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id uB8GLNHk020750; Thu, 8 Dec 2016 11:21:23 -0500 Subject: Re: [PATCH v2] selinux: support distinctions among all network address families To: Paul Moore References: <1481036419-30057-1-git-send-email-sds@tycho.nsa.gov> <4d02c906-b208-ffe8-8a56-46734d764c34@tycho.nsa.gov> From: Stephen Smalley Organization: National Security Agency Message-ID: Date: Thu, 8 Dec 2016 11:24:28 -0500 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.5.1 MIME-Version: 1.0 In-Reply-To: X-BeenThere: selinux@tycho.nsa.gov X-Mailman-Version: 2.1.20 Precedence: list List-Id: "Security-Enhanced Linux \(SELinux\) mailing list" List-Post: List-Help: Cc: selinux@tycho.nsa.gov Errors-To: selinux-bounces@tycho.nsa.gov Sender: "Selinux" X-Virus-Scanned: ClamAV using ClamSMTP On 12/07/2016 06:32 PM, Paul Moore wrote: > On Wed, Dec 7, 2016 at 10:24 AM, Stephen Smalley wrote: >> On 12/07/2016 10:14 AM, Paul Moore wrote: >>> On Wed, Dec 7, 2016 at 8:25 AM, Stephen Smalley wrote: >>>> On 12/06/2016 07:13 PM, Paul Moore wrote: >>>>> On Tue, Dec 6, 2016 at 10:00 AM, Stephen Smalley wrote: >>>>>> Extend SELinux to support distinctions among all network address families >>>>>> implemented by the kernel by defining new socket security classes >>>>>> and mapping to them. Otherwise, many sockets are mapped to the generic >>>>>> socket class and are indistinguishable in policy. This has come up >>>>>> previously with regard to selectively allowing access to bluetooth sockets, >>>>>> and more recently with regard to selectively allowing access to AF_ALG >>>>>> sockets. Guido Trentalancia submitted a patch that took a similar approach >>>>>> to add only support for distinguishing AF_ALG sockets, but this generalizes >>>>>> his approach to handle all address families implemented by the kernel. >>>>>> Socket security classes are also added for ICMP and SCTP sockets. >>>>>> Socket security classes were not defined for AF_* values that are reserved >>>>>> but unimplemented in the kernel, e.g. AF_NETBEUI, AF_SECURITY, AF_ASH, >>>>>> AF_ECONET, AF_SNA, AF_WANPIPE. >>>>>> >>>>>> Backward compatibility is provided by only enabling the finer-grained >>>>>> socket classes if a new policy capability is set in the policy; older >>>>>> policies will behave as before. The legacy redhat1 policy capability >>>>>> that was only ever used in testing within Fedora for ptrace_child >>>>>> is reclaimed for this purpose; as far as I can tell, this policy >>>>>> capability is not enabled in any supported distro policy. >>>>>> >>>>>> Add a pair of conditional compilation guards to detect when new AF_* values >>>>>> are added so that we can update SELinux accordingly rather than having to >>>>>> belatedly update it long after new address families are introduced. >>>>>> >>>>>> Signed-off-by: Stephen Smalley >>>>>> --- >>>>>> v2 reworks the style based on comments from Guido Trentalancia and adds >>>>>> security classes for SCTP and ICMP sockets. The security class support >>>>>> for SCTP sockets was based on Richard Haines' SCTP patch set. For now, >>>>>> we only duplicate the class definition for rawip_socket for SCTP and ICMP >>>>>> sockets since that is how they were previously mapped. The SCTP definition >>>>>> can be further fleshed out by the SCTP patch set itself. >>>>>> >>>>>> security/selinux/hooks.c | 73 +++++++++++++++++++++++++++++++++++++ >>>>>> security/selinux/include/classmap.h | 68 ++++++++++++++++++++++++++++++++++ >>>>>> security/selinux/include/security.h | 3 +- >>>>>> security/selinux/selinuxfs.c | 2 +- >>>>>> security/selinux/ss/services.c | 3 ++ >>>>>> 5 files changed, 147 insertions(+), 2 deletions(-) >>>>> >>>>> You mentioned IGMP previously, if we have a class for ICMP, it seems >>>>> reasonable to have one for IGMP, don't you think? Although this does >>>>> spiral a bit if we consider all the IPPROTO* protocols. >>>> >>>> I thought about it, but the kernel does not provide IGMP sockets per se, >>>> unlike ICMP or SCTP sockets (i.e. ipv4/af_inet.c:inetsw_array[] defines >>>> an entry for SOCK_DGRAM, IPPROTO_ICMP and sctp/protocol.c defines and >>>> registers inet_protosw entries for SOCK_STREAM, IPPROTO_SCTP and >>>> SOCK_SEQPACKET, IPPROTO_SCTP; there is no equivalent for IGMP unless I >>>> missed it). So IGMP sockets are just raw IP sockets with a particular >>>> protocol value; they have no stream, seqpacket, or dgram semantics, and >>>> it is unclear it is worthwhile to distinguish them in policy. >>> >>> Yes, sorry about that, it looks like you're right. I thought there >>> might be some sort of IGMP routing daemon or something that would need >>> to create an IGMP socket, but it looks like you just configure the >>> kernel's multicast routing table and the kernel takes care of the IGMP >>> packets. >> >> Well, I think you can create an IGMP socket ala socket(PF_INET, >> SOCK_RAW, IPPROTO_IGMP). And we could map that to a IGMP socket class >> if we really wanted to do so. But that would be the first time we ever >> mapped a (PF_INET, SOCK_RAW, proto) to something other than >> SECCLASS_RAWIP_SOCKET. And at that point we'd probably want to map >> every individual protocol value. Not sure we need/want to go there. > > Yes, creating classes for each IPPROTO value is not something I think > we want to do, although I have no problem doing it for key protocols > as necessary. > > I just merged this into selinux#next, the pull request for v4.10 was > already sent up to James so this will go in during the v4.11 merge > window (I think this can wait, it might give us time to get some of > the policy ready). Yes, sounds good. I just pushed the patch for libsepol that allows one to specify the new policy capability in policy, and attached is a patch for Fedora's policy that you can add to its .spec file and rebuild if you want to try it out (but you first have to build and install the updated selinux userspace that defines it). May submit a modified form for upstream refpolicy that just comments out the policy capability so that we don't break building refpolicy on the currently released libsepol. diff -ru serefpolicy-3.13.1.orig/policy/flask/access_vectors serefpolicy-3.13.1/policy/flask/access_vectors --- serefpolicy-3.13.1.orig/policy/flask/access_vectors 2016-12-08 09:25:14.979787006 -0500 +++ serefpolicy-3.13.1/policy/flask/access_vectors 2016-12-08 10:46:30.621989680 -0500 @@ -950,3 +950,118 @@ class cap2_userns inherits cap2 + +# +# Define the access vector interpretation for the new socket classes +# enabled by the extended_socket_class policy capability. +# + +# +# The next two classes were previously mapped to rawip_socket and therefore +# have the same definition as rawip_socket (until further permissions +# are defined). +# +class sctp_socket +inherits socket +{ + node_bind +} + +class icmp_socket +inherits socket +{ + node_bind +} + +# +# The remaining network socket classes were previously +# mapped to the socket class and therefore have the +# same definition as socket. +# + +class ax25_socket +inherits socket + +class ipx_socket +inherits socket + +class netrom_socket +inherits socket + +class bridge_socket +inherits socket + +class atmpvc_socket +inherits socket + +class x25_socket +inherits socket + +class rose_socket +inherits socket + +class decnet_socket +inherits socket + +class atmsvc_socket +inherits socket + +class rds_socket +inherits socket + +class irda_socket +inherits socket + +class pppox_socket +inherits socket + +class llc_socket +inherits socket + +class ib_socket +inherits socket + +class mpls_socket +inherits socket + +class can_socket +inherits socket + +class tipc_socket +inherits socket + +class bluetooth_socket +inherits socket + +class iucv_socket +inherits socket + +class rxrpc_socket +inherits socket + +class isdn_socket +inherits socket + +class phonet_socket +inherits socket + +class ieee802154_socket +inherits socket + +class caif_socket +inherits socket + +class alg_socket +inherits socket + +class nfc_socket +inherits socket + +class vsock_socket +inherits socket + +class kcm_socket +inherits socket + +class qipcrtr_socket +inherits socket diff -ru serefpolicy-3.13.1.orig/policy/flask/security_classes serefpolicy-3.13.1/policy/flask/security_classes --- serefpolicy-3.13.1.orig/policy/flask/security_classes 2016-12-08 09:25:14.979787006 -0500 +++ serefpolicy-3.13.1/policy/flask/security_classes 2016-12-08 10:40:29.799582596 -0500 @@ -154,4 +154,39 @@ class cap_userns class cap2_userns +# New socket classes introduced by extended_socket_class policy capability. +# These two were previously mapped to rawip_socket. +class sctp_socket +class icmp_socket +# These were previously mapped to socket. +class ax25_socket +class ipx_socket +class netrom_socket +class bridge_socket +class atmpvc_socket +class x25_socket +class rose_socket +class decnet_socket +class atmsvc_socket +class rds_socket +class irda_socket +class pppox_socket +class llc_socket +class ib_socket +class mpls_socket +class can_socket +class tipc_socket +class bluetooth_socket +class iucv_socket +class rxrpc_socket +class isdn_socket +class phonet_socket +class ieee802154_socket +class caif_socket +class alg_socket +class nfc_socket +class vsock_socket +class kcm_socket +class qipcrtr_socket + # FLASK diff -ru serefpolicy-3.13.1.orig/policy/policy_capabilities serefpolicy-3.13.1/policy/policy_capabilities --- serefpolicy-3.13.1.orig/policy/policy_capabilities 2013-11-13 03:56:14.000000000 -0500 +++ serefpolicy-3.13.1/policy/policy_capabilities 2016-12-08 10:37:48.657007126 -0500 @@ -31,3 +31,44 @@ # blk_file: open # policycap open_perms; + +# Enable separate security classes for +# all network address families previously +# mapped to the socket class and for +# ICMP and SCTP sockets previously mapped +# to the rawip_socket class. +# +# Classes enabled: +# sctp_socket +# icmp_socket +# ax25_socket +# ipx_socket +# netrom_socket +# bridge_socket +# atmpvc_socket +# x25_socket +# rose_socket +# decnet_socket +# atmsvc_socket +# rds_socket +# irda_socket +# pppox_socket +# llc_socket +# ib_socket +# mpls_socket +# can_socket +# tipc_socket +# bluetooth_socket +# iucv_socket +# rxrpc_socket +# isdn_socket +# phonet_socket +# ieee802154_socket +# caif_socket +# alg_socket +# nfc_socket +# vsock_socket +# kcm_socket +# qipcrtr_socket +# +policycap extended_socket_class; diff -ru serefpolicy-3.13.1.orig/policy/support/obj_perm_sets.spt serefpolicy-3.13.1/policy/support/obj_perm_sets.spt --- serefpolicy-3.13.1.orig/policy/support/obj_perm_sets.spt 2016-12-08 09:25:15.032787970 -0500 +++ serefpolicy-3.13.1/policy/support/obj_perm_sets.spt 2016-12-08 10:50:08.497462292 -0500 @@ -28,7 +28,7 @@ # # All socket classes. # -define(`socket_class_set', `{ tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket appletalk_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socket netlink_audit_socket netlink_ip6fw_socket netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket netlink_netfilter_socket netlink_generic_socket netlink_scsitransport_socket netlink_rdma_socket netlink_crypto_socket }') +define(`socket_class_set', `{ tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket appletalk_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socket netlink_audit_socket netlink_ip6fw_socket netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket netlink_netfilter_socket netlink_generic_socket netlink_scsitransport_socket netlink_rdma_socket netlink_crypto_socket sctp_socket icmp_socket ax25_socket ipx_socket netrom_socket bridge_socket atmpvc_socket x25_socket rose_socket decnet_socket atmsvc_socket rds_socket irda_socket pppox_socket llc_socket ib_socket mpls_socket can_socket tipc_socket bluetooth_socket iucv_socket rxrpc_socket isdn_socket phonet_socket ieee802154_socket caif_socket alg_socket nfc_socket vsock_socket kcm_socket qipcrtr_socket}') # # Datagram socket classes.