From patchwork Sat Sep 22 00:19:20 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Casey Schaufler X-Patchwork-Id: 10612377 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 1AEB81803 for ; Mon, 24 Sep 2018 12:30:30 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 08CC029EAB for ; Mon, 24 Sep 2018 12:30:30 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id F0E5D29EB2; Mon, 24 Sep 2018 12:30:29 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, MAILING_LIST_MULTI,NO_RDNS_DOTCOM_HELO,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from upbd19pa12.eemsg.mail.mil (upbd19pa12.eemsg.mail.mil [214.24.27.87]) (using TLSv1.2 with cipher DHE-RSA-AES256-SHA256 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 1B45D29EB1 for ; Mon, 24 Sep 2018 12:30:26 +0000 (UTC) X-EEMSG-check-008: 159496132|UPBD19PA12_EEMSG_MP12.csd.disa.mil Received: from emsm-gh1-uea11.ncsc.mil ([214.29.60.3]) by upbd19pa12.eemsg.mail.mil with ESMTP; 24 Sep 2018 12:30:22 +0000 X-IronPort-AV: E=Sophos;i="5.54,297,1534809600"; d="scan'208";a="18575265" IronPort-PHdr: 9a23:f47i4ha2+05yMTf2K2w/FvH/LSx+4OfEezUN459isYplN5qZosu5Zh7h7PlgxGXEQZ/co6odzbaO7Oa4ASQp2tWoiDg6aptCVhsI2409vjcLJ4q7M3D9N+PgdCcgHc5PBxdP9nC/NlVJSo6lPwWB6nK94iQPFRrhKAF7Ovr6GpLIj8Swyuu+54Dfbx9HiTahY75+Ngm6oRnMvcQKnIVuLbo8xAHUqXVSYeRWwm1oJVOXnxni48q74YBu/SdNtf8/7sBMSar1cbg2QrxeFzQmLns65Nb3uhnZTAuA/WUTX2MLmRdVGQfF7RX6XpDssivms+d2xSeXMdHqQb0yRD+v9LlgRgP2hygbNj456GDXhdJ2jKJHuxKquhhzz5fJbI2JKPZye6XQct0ARWpFQ81fSSpPDI2hZIcLFuYNIPpUo4z7qlQJrxSxHwmsBOToyjNRn3P7waM33uU8HQ3fwAAsAs8FvHDKoNnpMasfV/2+wqvVwjXZd/5Yxzn95ojLfB4vr/6DUrB/f9fJyUQtCg/IgEmfp4P7MDOOzekNr2qW4vB8We6zhWMrtQd8qSWvyMc2jYnJg5oYx07e+iVi3ok0JcCzRlNnbt6kCpRQqi+aN49oTcM4Xmplvzo1xacduZGlfCkH048nyALfa/OdboiI7BbjW/iLITthmH1qYqiziAq18Uil0+DxUNS/3lVSriddj9XBuX8A2wbT58SaUPdx4Eis1SiV2wzO8u1JIEI5mbDGJ5MgxrM8jJsevETZEiPohkn7g6mbfVg+9Oey8eToeLDmq4eZN49zlw7xLLwjmte6AeQkKggOWHWb+fik2L3j40L5RLJKg+UqkqbDqpDaJNkbprWjDw9J0ocs9xa/DzC83NQegXYHN05KdAiCj4joP1HCOPH4DfGhjFSwiDpn2v/LM7L7DpjNM3TPiqntcLlj50JG1QY/1dVf6IhVCrEFLvLzQEjxtNnAAx8iLQO0x+fnCNNg1oIRQG6AGaiZML7UsVCU+O0vOPKBZJMVuTnhK/gl4OTijXkimVAHZ6Wp0pwXaG6gEvR8P0qZeWbsgssGEWoSvAo+S+rqh0eeUT5TfXmyWbkx5jM8CIKgCIfMXJutgKCf0yehBZ1afGdGCkqDEX3wbYWLR+8MaD6OIs9mijEEV7qhRJU92hGtrw/6zLxnLuvK+iADu5Lj0MV15uLImhEv8zx0E9md33uKT2FukWMCXyU207xnoUxh1leD1rB1g+RGGtNI+fxJVAY6NYLbz+FhCtD9RBzOccmTRFahWNWmDik7TsgtzN8Wf0Z9B9Kigwje0CqtBb8VkaGEC4Iw8qLdxHX+Pdhyy2zB1KU7iFkmWMRPP3W8hqFj7wjTG5LJk0KBmqm0baQTxjTN9GaYzWeVpEFXShRwUaTeXXAHYkvZt8j26V3YQ7+pE7QnPRNLydSeJatSdt3pkVJGSe/tOdTfZ2Kxnnm/BQyTy7OCcoXlZmId3D/HB0gciQAT+nSGOhYiCSe9uW7eCyZuFV33aUP27eZ+sG+7TlMzzwySbE1uzbm1+hkIhfGHSPMcxLEEuCA8qzluG1a9xd3WAcKapwV9ZKVcfc894FBf2G3DqgN9JJ2gIL54hlMFaQt4o0bu2w9wCoVansggtGkqwxZqKaKEzFNBcCuV0ozqNb3TNGby5wyvaq7R2lzFy9aZ5qYP5+o+q1X/vQGmDFAu83N53NlJy3Gc/InFDBIOUZLtVUY67wJ6qKzHbSQm6IPU0HJtPbOysjDcx9IjHPElxQq4f9dDLKOEExf/E9YUB8i0L+wqgESpYwkfPOBU8641McameOGA2KKxOuZvgi6mh3xd4I9hykKM6zZ8SunQ0pcL2f6Y2heHWCnmjFe6qc33h55LZSsJEWqizCjoHolRZrd9fYwTE2ehP9W3xslih57qQ3NY8l+jB1cC2MC3YhqfdEby0hNK1UQQu3CnnjG4zzNsmTEzsqWfxDDOw/jldBcfJ2FLWHNtjU33LIeoiNAaWVSnYBIylBu5/0r6wbZUpLhnJWnJXUhIZzT2L31lUqaoqLqCYtJA6I8vsSVNSuizfVCaSrn7oxsVyC7jG2pexDYheDGwvZX1hRt6iHiSLHxrtnrWZdlwxQvD5NzbXfNR2jsGRDJkiTXOHVizId2p/dSSl5feveGzTHmhVoVScSntzIOPqDC76XdsARKhg/C5gsfnHhQi0S/ny9lqUj3FrAz7Yonv06S1L/hncVVvBF7y8Md6AZx+nZcrhJ0K3nganJqV92IdkWjvKdVbxb7+bH0VSD4I3dHV5hPl1VZgLn2XwYL5TXOdzdV9Z9WgZWMWwC095dhQCKiI9LxEgTd1ol2goALJe/d9gzMdxuU26HEAheEJpBQizj+GD7APBklXIzbslw+S49Clq6VXeXyvfqSu20pwmtChFr6CrR9GVHb/ZJgiATd67t9jP1LUzH3z9obkdcHObdIVqxKZiAnAj+5IJ5IxjPYKgzRoOX7lt30/1+E7lQBu3Y29vIWfM2Vi5r+5AhpDOzLpZsMT5jHsgb9QnsmM2YCjBJJhGi8EXJHwV/KnDCoStej7NwaJCDA8qXeaGb7BEgKE7UdmqHzPE561OHGLOHkZzdJiRByDK0BFhgAbQik6lIYjFg+23MzhbFt55jcJ6172sBRMzP5oNx76UmrEqgendCo7SJ+FLBVM9gFC/UDVMc6A4e1vAyFU5JqhrBaCKmaDfQRHEXkJWlCYB1DkJrSu68PA/PaFCeqlNfTOZ6mOqetFV/qT352gzo5m8yyLNsWVMXloF+c71VZbXXBlB8TZnC0CRDcMmC7Ka86bpQy8+jFsrsyl6/TkRh7g6ZGUC7RMNdVv+ha2gbqMNuOLmCl4KSxY1o4XxXPSxrkQxkISizppdzmrC7gAsjTNTK3IkK9NExEbcz9zNNdP768kxQZNOMHbitTz1rNjk/E6FUxKVV37lcGvf8AKJHu9NFzfDkaRKLuGPSHLw93wYa6kS71QjOVVtwW3uTafEk/jIiqMmiLsVxCuLeFMlj+UMAZZuIGnfRZnEXLjQ87+ah2nLN93iiU7wbsqiXzQMW4RKjt8c0RWrr2M9yxYhO5/G29A7nZ/K+mLhTqZ5fHCKpkKqftrHjh0l+VC7XQg1bRV9z9LS+ZvmCTOrt5juEqpkuiVyjV6VxpOpC5LhJiVskRiI6nZ8IdPWWrc9hIX8WqQEwgKp8diCtD3pq9f0MbPlKPuJzdZ6N/b59EcB9LTKMOJK3ouLwbmGCPODAsEUT6qNXvTh0pDn/GO7neVtIQ1qoDwmJoSTb9WTFg1FvQACkt7GtwDIZB3Uygrkb6dkc4E/32+rAPeRM9CpJDISuqSAenzKDaelbREfAUHwbf5LYQVK4361FdvZUV9nITPB0XfR8tNojF7Yg8yvkpN7GB0Tncv1EL9dgOt/HgTGOapkREqjwt+ZuIt9Cvx71osOFrFujEwkEgwmNXihzCdajjxI7msXYtOESr7q1AxMo/nQwZydQCygU1kNDLDR7JNj7thdXtmhxLduZpPA/FTVrdIYBkOyvGLf/8oy0hTqj27xU9b4uvIEYFtlA8rcZGwsX1Pwwdjbd4zJazXIqpG1ENdibmPviCy0OA92QEeJ1sX/GOUZiEIpFQCNqM6KCqw4uxs9QuCliNYd2cSUfonuehl+V4jO+ue1SLgyKRMKlqxNuCFKKOZoWfAn9aSQlwszkMIi1VF/b9u3Mc5dUqUVlwgzLuWFxQNLsrMMRhbYddI+nXPeiiDqvnCwZVwP4qhDO/oVvOOuLwSgk26AAYjB54M4dgZHpmwzEHYKt/qI6IHyRo3+AvmP0mKDPNNeBKPkTcIvdu/zINp0oZBJjERG2J9MT+45rzPvA8lnOKDXMsqYncdRoYELGg5WNe9myFCpHlAECO33fgHyAec6z/8pyLQDDb4b9pia/eUZQ9sCN+s9jUl9qi6k1jX/YvCJ2viL9RtpsfP6f8Gp5aAE/5VQ6NxvFvcm4lZQnyqUnTAEd2uKpjxdYYjc8L7Bmy9UlylhDI/V93xM8q1LqiUnQHoQp5ZsIyB0zA5Ns+yCC0eGxZ2p+EM/699axcMY5wnbh7ssAQ+KrGwIByC3tWoXWmtNSNcT+NDwuWie7xX0y0sY/eiyHsnSpE11fO38EAKRJEOgBHT3vOjZ45ZUSjoBHNSZx/PpS0il2h6N+YyxOg/zAnPsVkGPDCBbPZpZ3Bcv9EgGVOSJm17BXAiR1+Bi4rP+A2s0qsT/ytcntZUzfZKvGL4vpDBfDKmQLarponNsyo8cdgmpLV8MZDkIsuDr57egiDTTJzLvQGfVi61CeZakMBKIC1EWPlIhX0lOcsetIpD7ko+SNwzKKFRB6k3uL+qcyZkAjAPwiMDUYOPwiACiP+m27TGjheQbIgiMBscvZVMmNsSSSh2bT8fpK+4TIjWkneESmkSLAcI4wVM/xgMlohqfuDq+IDIVoNDyyZKo/JoVSvGDoVo+EbmRWGXm1f4TO6snPCu3QJX0P3jyMIbWAJlBUhb2elWilMiKKtrJKkIoo7KrjiIeFvivGL21OupPkReydHPel3jC4rFqHD8XTEC9n0SWY9P0mvQFZAInwp+cqYrq01GIJq6dUbm+zwk24NpEqGjWsCl21kpsXQLSzqkHtdaF+5mt1fXVyF/bJCwtJXpIZNSTXFM+JeFsVdWjF1tMzKlyZpbM8xN+CADUyVPoTqHoNu/U8lD2choD5ASPNtwp3D9F75aN5SLpX05pKDvwGfD+z8gqFe62CmzG6igQuJF5W0RBBsmKHmFp0kyC+ss7n3S/UrTslB1+OdbAqaAjVlrrDZ6BJBOCS5D1Wq5IFRrUHlGr+JaJbzQc8NGR/kyYQGgOwAiFfE8xUOE5kd0kmnlYyxpqgRV4TjdUBcuWSkTnLjthSUUqtu7Nj8CV5JIcTIhYj/HKw2BgyBXuw1fa0VwVJAHGdtF/qwb3Y9I/srDVUmsKDsKXBp5Ng4i1vpfj0FDul2CeS/BFQqoaerPshpvcMeTtsGpKvr5/B1Aioz6ru817LkDSGegmQ22RtDStYn8ucOWtkGWbqf3L/W8YWPdTDjLlR2wiqokD5jO/yjXLgVbLoJ3xmc6bpf6CG7EJxJGK7gcJ0pBWqBwcc9GrfxCZ894ZKYJ/rdgBhCGRhPqA4GvqedJL1bNSjTELiWB9OO/rZjV7bPDVejqftaMyGrfQ6JrIpd67iH2G7Hu0YJF+0r23PJt+ll7SVjAPSCBts7uJhgX5Mm4a0vtooEpHS7MAJhuinbtwVtAd8UPSS2w7JsY0I9Z6Gr3Se9g10jzt+tS96Vr6YYp+L1pzMa0Kr3UKftErU9mDB+UBh9p9pU2GmR/QX5eYvMJIvfLYasZldzuq/zwF6EP7B2V4OlZZNvcKkHPhMawFzacSQZekwcZsz4aKQmc2OCZlK9oU8qlovL52k016VikMhEG1Kxt5ZuD+qeQpe/WbgHewqIYVaXxXcP8sKgstF2O6vE+k74OYGN1aRW9EOcBTs4d2nvgzacywC03EsPDBLzh9+RBV3I4gjLgg4pyH0gSGv4PAbWL+plRkXkilOzELN0WdbpClXyVGR6jCL8Cxmah6zGLL2l9nhHOzxbwTHur7FDssS93XSvMztnkkkpPVbm7HFxSUDStOU95tjOPIQXpucHvuasv8EE5LmzktdyKlGu7O7NbBc7/K8KGISkyul0XiIc9Rtu12YAUAdC9Osse8GlibvvC7GOmiyBBrLlBh4rC5cGV/fLbHWK+gK2eqrWNwi1Yy3cjsFE79N+gLPHP6MeQT/SuyWkRUz91uxHdUB6ttrzbs1cUNFSN0EfKhIMKOdVZ0mMj1k385egjR9Uz9B5FFovbYvMPqj/yNCHzwVaFbNI9TjOe3CdPHlLpDVl4H7Ax2G3ss8LSjnfc4kAmSIZ2eUzmgxx3Eoo5JFki6FgS2CUDFxYCZQqcDLGyCkTvNZEEWlQbaRSbwLi6fb863U90wrOv4u/fd/BzB6oJNvZAkwGPnVlbGpQNsa0dQbJxYEFd9K/Jpgf4D4joQvnmmWA2NfKrXsBQ6doZuGc64gajWxqg7o9O77cFiJ+ScK5JepzMvN1h4Edm4j4PbTZBgB9ljxO2Seocvvzs4sDHsJq07eajTKQtSPsZ9xg6A2RzlJXxj0olod7Jy+dQUIvVhprj8ApVOX6FpJ7a0wVgKeoJM4+rc7Jg93IJJicAI3IOOcGba+I74y9rMTXc+0ZOAsUSatMEJMDNgxxbilX1WLFP8crWAlqYC4Zwd8Ar6Gr60zI1/oE/Uubn7j+5O5bf40tLP/xdkCVmjMjCq/QNwfrOFCgX5mGUZANrzSOE15mAEO3w/eGLyNHIS1MGADA5XJpHKDqF4wynSfK/lI/1XQOM9s/znJU+eVqeRnOvmKQFs75MHvBbhyT63zheE4X1iOyPs9qo9mRbrFpHEJx87RfdAqVQIo17OQjklsmsXkV9CDP/eNvVdhUypuWb3eIM4+RiN0vke4AXOBUEy6j16XBNVAthVKb2vkqFXeIWfNZmT/fEoW5O5IJ4L68AJkOdpIDrrjhUtFA2GhEmZ6EqojxcaEbOgBVfW7zot74YlgscTdl5tFdIGWKxPmI++jXGWb1RjKmQE/wV7i6TQ7cPU0pyNCN+RAm52JJ0e7umhfpHqH9JnjthoPg21DxrXB68tjfwqKIN2DIg/ra4uS4fuXxESOWRjSPICVRFzPQXgqYQEXHi6UazYHMbdov9/KFnJdj89Ykm+3k/Yw8sfy4BXeu7ECzwkqWIApCPsNJbmR6Nt8XObaOpISgUKLs91QrpR2Jh3QjGgBZo7GwLTy277N8qIYWyJccoyymzFGjFalkM+KJJscr2tV4NVuc2b01uwHkwmvSAEwk2YYSbH2czkxhhcmhPbYhC9Q5fEq4knzKFlrdJ8xtSYzrOFImhvI7KkpGMkVs0SNpxjkfRvLeEndt+0nhigcl19QaIsXEfdqrfScA6RjDI+897yOrjd735qe0DSY172Jy9QfQCNY+l4mLw15J0DAvt4pc6OhLtNO4F26eeUCq/T2CccfqEfnLKnDsjNEP2ox6yIQtzIOVNr0l1EOzCj5hHmgupBbFzRiPWp1jbxWo4POUyfAswv4GmcAUOCuUWYr7YbcsjzeZ2I1wLbDedHiZ7EOSxtl2Fl4hhPHBh/EC8Zv7ipESuDNaOAQQDWa7TqJJ4saiiS2SOJH5miR5/Jk9588/eUlA2qOIaaJ+SgMLZwdJ2l+wdIbMlCSQgvpY2nYV55MHAyM6XdTnJx4v2YNTSpeKVRfbYyhJuMlpGX6IZbAW93IAzOto0SvWHBrdClQgNDqg9Bpo6PiH+878iaEs5dg/XeaTxjNLmq/yGYrNKqHLMqFE9NiHRv1sE0PP+BVh/bpa3lzD8O5w9WD9Fh8NiBwEgH4ZVHc4E6Q29DMjQ0Ii/hs+86gtWvOUQsLv5DLie3di+1Z9wTpFczUOONTfVQqJshxIhxsGzifTJUZ3GMsrmcEcCHLx+Q2XtZr7JH4a4JnSIN96qPwZ9+rqC2a5+SBjZQS3iWLCPvyTsYO4i5EggzZZxd+OKkhQi6rja3J35YGQN9Qm5qnvcH5JE4U2CPufeVg9aTfefuDJuFLYafKPv/+cHLNImzcLZ6AA15zNHhpjWa5O9p1PBjxooPanQK1HkjmNoAdNQch2iLUshh3PYoX3BAHNaa9KpMtRpnM3PUke/2nFdsjoGXkcZSizlSNKKNi4e0sO6IgiL8FEubZ4Yh+DiX0k+u+WpTPVwfI1fkLChva4KgP5yICHGWcZeMjuVJ7YwNT1UXYCt7EMwbEsitL44EpwweYDIJUoGNEmazianxgLZ3FzcbNes3buHJCsMt35OibnC1GspxUGiofjMpMrlXfjCaY3uGv7fNC1wTjaBWTE7Clqk43+/vPwFt6HAfyJG+hYfZSSJDRRVo6luqZ7aADWViORje5pMj/efCEWSACF7la9nHi9QrgjMWPsMEwDKcmXsyHRRog2sJ/JAvDrlYrSUy7ATWrk+E4JMdfrfSNzddA== X-IPAS-Result: A2AXBQB72Khb/wHyM5BaHAEBAQQBAQcEAQGDXAOBCFwojGiLSYRmlAqBXyoTAYUEgxYhOBQBAwEBAQEBAQIBbBwMgjUkgmADAwECJBMGAQEMIAwCAwkBAUAICAMBLRQBEQYBBwUGAgEBARgEgwCBagMVA5cNihyBajOCdQEBBYEEAQF1gjADglMIF4phF4IAgRIngj2EeQESAYV3iEqFNUExjhAJggyOFx1ZiDuGGI57h2chZHFNIxU7gmyCGQwXg0aKHAFVT3sBAYl9gj0BAQ Received: from tarius.tycho.ncsc.mil ([144.51.242.1]) by emsm-gh1-uea11.NCSC.MIL with ESMTP; 24 Sep 2018 12:30:10 +0000 Received: from prometheus.infosec.tycho.ncsc.mil (prometheus.infosec.tycho.ncsc.mil [192.168.25.40]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id w8OCU9Wv028813; Mon, 24 Sep 2018 08:30:10 -0400 Received: from tarius.tycho.ncsc.mil (tarius.infosec.tycho.ncsc.mil [144.51.242.1]) by prometheus.infosec.tycho.ncsc.mil (8.15.2/8.15.2) with ESMTP id w8M0JYrE018287 for ; Fri, 21 Sep 2018 20:19:34 -0400 Received: from goalie.tycho.ncsc.mil (goalie.infosec.tycho.ncsc.mil [144.51.242.250]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id w8M0JVI6009902 for ; Fri, 21 Sep 2018 20:19:33 -0400 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: A1A3AAD5iaVbly0bGNZbHAEBAQQBAQcEAQGBVIIIgWcog3OIdItLhGaVcIR3AkKDBCE3FQEDAQEBAQEBAhQBAQEBAQYYBkyFRQMDIwQZAQE4DyUCJgICRRIGAQwGAgEBgx2BagMVA5gdihxvezOCdQEBBYEEAQF1gj4DglEIF3SJZReCAIESJ4I9iC2CV4hKhTNBMY4NCYIMjhcdWYg7hhSOd4digXdNIxWDJ4IZDA4Jg0aKHAFVT45UAQE X-IPAS-Result: A1A3AAD5iaVbly0bGNZbHAEBAQQBAQcEAQGBVIIIgWcog3OIdItLhGaVcIR3AkKDBCE3FQEDAQEBAQEBAhQBAQEBAQYYBkyFRQMDIwQZAQE4DyUCJgICRRIGAQwGAgEBgx2BagMVA5gdihxvezOCdQEBBYEEAQF1gj4DglEIF3SJZReCAIESJ4I9iC2CV4hKhTNBMY4NCYIMjhcdWYg7hhSOd4digXdNIxWDJ4IZDA4Jg0aKHAFVT45UAQE X-IronPort-AV: E=Sophos;i="5.54,287,1534824000"; d="scan'208";a="375837" Received: from emsm-gh1-uea10.ncsc.mil ([214.29.60.34]) by goalie.tycho.ncsc.mil with ESMTP; 21 Sep 2018 20:19:33 -0400 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: A0AzAACWiaVbly0bGNZbHAEBAQQBAQcEAQGBVIIIgWcog3OIdItLhGaVcIR3AkKDBCE3FQEDAQEBAQEBAgETAQEBAQEGGAZMDII1JIJgAwMjBBkBATgPJQImAgJFEgYBDAYCAQGDHYFqAxUDmCCKHG97M4J1AQEFgQQBAXWCPgOCUQgXdIllF4IAgRIngj2ILYJXiEqFM0Exjg0JggyOFx1ZiDuGFI53h2KBd00jFYMnghkMDgmDRoocAVVPjlQBAQ X-IPAS-Result: A0AzAACWiaVbly0bGNZbHAEBAQQBAQcEAQGBVIIIgWcog3OIdItLhGaVcIR3AkKDBCE3FQEDAQEBAQEBAgETAQEBAQEGGAZMDII1JIJgAwMjBBkBATgPJQImAgJFEgYBDAYCAQGDHYFqAxUDmCCKHG97M4J1AQEFgQQBAXWCPgOCUQgXdIllF4IAgRIngj2ILYJXiEqFM0Exjg0JggyOFx1ZiDuGFI53h2KBd00jFYMnghkMDgmDRoocAVVPjlQBAQ X-IronPort-AV: E=Sophos;i="5.54,287,1534809600"; d="scan'208";a="16120233" X-IronPort-Outbreak-Status: No, level 0, Unknown - Unknown Received: from updc3cpa06.eemsg.mail.mil ([214.24.27.45]) by EMSM-GH1-UEA10.NCSC.MIL with ESMTP; 22 Sep 2018 00:19:32 +0000 X-EEMSG-check-005: 0 X-EEMSG-check-006: 000-001;fa60826e-4ca6-40c0-832d-60aef6f29144 Authentication-Results: UPDC3CPA08.eemsg.mail.mil; spf=None smtp.pra=casey@schaufler-ca.com; spf=None smtp.mailfrom=casey@schaufler-ca.com; spf=None smtp.helo=postmaster@sonic306-10.consmr.mail.bf2.yahoo.com; dkim=pass (signature verified) header.i=@yahoo.com X-EEMSG-check-008: 45270333|UPDC3CPA08_EEMSG_MP24.csd.disa.mil X-EEMSG-SBRS: 3.5 X-EEMSG-ORIG-IP: 74.6.132.49 X-EEMSG-check-002: true X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: A0AhAQDCiaVbhzGEBkpbHQEBBQEHBQGBVINvKINziHSQMZVwhHcCQoMEGQYGMxUBAwEBAQEBAQEBARMBAQEIDQkIGw4jDII1JIJgAwMjBBkBATgPJQImAgJFEgYBDAYCAQGDHYFqAxWYH4ocb3szgnUBAQWBBAEBdYI+A4JRCBd0iXyCAIESJ4I9iC2CV4hKhTNBMY4NCYIMjhcdWYg7hhSOd4digXdNIxWDJ4IZDA4Jg0aKHAFVHzCOVAEB X-IPAS-Result: A0AhAQDCiaVbhzGEBkpbHQEBBQEHBQGBVINvKINziHSQMZVwhHcCQoMEGQYGMxUBAwEBAQEBAQEBARMBAQEIDQkIGw4jDII1JIJgAwMjBBkBATgPJQImAgJFEgYBDAYCAQGDHYFqAxWYH4ocb3szgnUBAQWBBAEBdYI+A4JRCBd0iXyCAIESJ4I9iC2CV4hKhTNBMY4NCYIMjhcdWYg7hhSOd4digXdNIxWDJ4IZDA4Jg0aKHAFVHzCOVAEB Received: from sonic306-10.consmr.mail.bf2.yahoo.com ([74.6.132.49]) by UPDC3CPA08.eemsg.mail.mil with ESMTP; 22 Sep 2018 00:19:30 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1537575569; bh=FizomyUFTpM0gGb8QbATHpRvkCai+P+cVJQjQdzFIw4=; h=Subject:To:References:From:Date:In-Reply-To:From:Subject; b=lZdHl4FHaa6gd4n2sETPAyyJ+fERk0dhQKFjVXKRcqjQgXUxSMDFw/9U52jE0Hx20P8Jrn910BzFLkcTjIRkWibRc+An0rneN42EHxs+jWaeiQr+p9cd7Stii5I7uR45lqeeS2c7dQoeQYcPZKp3ovANX3newF83et+a+bzPigmYaRwTJl8thpcelfuNsCfqIiLGsZZkgCLqAP8Uh3JJGFVM2sri24nHz3TWDLLNrkogLVOwPmhtTjahsdo4K3bU/JuWK9Sz6zgUYL5MPZuizBY/reZNbii69CFCXRSVEiOu07llRpDVc8eLOvGN9Iyx/Mi2HBDivVQb85iWtMZ7Jw== X-YMail-OSG: 28_kXhYVM1mw1i7lOzLyZKSdCpc2xhWnQwjk8Um_wiLnlKn.wXNQNnb9.zDAyKT SEvOKjDpzKunT_A4j9OmfJuj8m3T_P7N08rxinyYWHehglyQCyWumE78VhtW7tgNeKeZbdUENbrz BYiPfx09_Sp_6gJtSUtbJvYIF0tiLtWpESD4uV.LbWnpAES5H3Jnxgc9x.cVhzljeaTt0LYYPCXd wxfWq0SUuTNkoU4bF9C0VYV2dGxDk3_aEopkaEv5f0sy1KRyCLmGFp2MerQ61efCdE.BZQA5eL0C MX8SDYSQUD6OrUqkIg6B4LxqDtd3.__egXT713xXz.vt4bmzvHiA7xzzayRkLYaYAbdoO4GL_H72 EHBgxGa8d6aNFncnWANNC_R72FZnhMXR8Icvp04fkSB6d8Q7egMj9jeSIV6eMizwyevxJ43G.igM QGOpjmEspxU4rLVRAbQSFzwakFa84yld3aa1afLE_xEPNuGYT.BoeK83ZQi60FluJdcLxs7_9Pd3 M26mz3_KPBOephU9u1WNaHK3WhDxVmHSWnVpQQKMeZDMwK0lySTcoPU7.1GJoCspPL3.CEWStZGg GXU5AAe8gthvNFvesyd9mEOE104jRxCbZH5_Q7RusvdEfNuZyeObH_z6z9.7ewOpDVbHv_8afK5o yHR.eQeMxH_C0.NXFPwoo9MGxT0BxtJktPaRcNs5vSOTzgBdtM06yqNaeiFiKWkrIjuB5y95w1OT BX5IwS5xAPxpbIF3JwaKRsdjqftrMB.aMDaUQk4LNS0rN2ZadF.TD2DxYrEJQgDBaj_MFYKJ_x5L Lcd1r1cFugadB_qb7GJ1ShoXqfCURYic3EYeRzZTf5eCeXWvdf9DPUpwFhPQFbRnr_5kpSXabfz2 pLEsuaUDdx9SyUk3B2aDfJfg7UUMAWfRi66oybX0P4OdNYdcosgFYIE7z2zAlDiqHHfthYADUrdw YxoWSef3haaP_QLZpXsWMUHUtc3jsFN9K3WMDJBjQVei9EhhDUeEaGVP4Ztin3S_77E_RloG2lo_ osJNlgvU3D8N6lYdQg7R_6pgQrVFMzqvhZmlhplzf Received: from sonic.gate.mail.ne1.yahoo.com by sonic306.consmr.mail.bf2.yahoo.com with HTTP; Sat, 22 Sep 2018 00:19:29 +0000 Received: from c-67-169-65-224.hsd1.ca.comcast.net (EHLO [192.168.0.102]) ([67.169.65.224]) by smtp421.mail.bf1.yahoo.com (Oath Hermes SMTP Server) with ESMTPA ID a37820a85d64bfebdeb517ad78a6c000; Sat, 22 Sep 2018 00:19:25 +0000 (UTC) To: LSM , James Morris , SE Linux , LKLM , John Johansen , Kees Cook , Tetsuo Handa , Paul Moore , Stephen Smalley , "linux-fsdevel@vger.kernel.org" , Alexey Dobriyan , =?utf-8?q?Micka=C3=ABl_Sala=C3=BCn?= , Salvatore Mesoraca References: X-EEMSG-check-009: 444-444 From: Casey Schaufler Message-ID: Date: Fri, 21 Sep 2018 17:19:20 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: Content-Language: en-US X-Mailman-Approved-At: Mon, 24 Sep 2018 08:26:06 -0400 Subject: [PATCH v4 13/19] Smack: Abstract use of inode security blob X-BeenThere: selinux@tycho.nsa.gov X-Mailman-Version: 2.1.21 Precedence: list List-Id: "Security-Enhanced Linux \(SELinux\) mailing list" List-Post: List-Help: Errors-To: selinux-bounces@tycho.nsa.gov Sender: "Selinux" X-Virus-Scanned: ClamAV using ClamSMTP Don't use the inode->i_security pointer directly. Provide a helper function that provides the security blob pointer. Signed-off-by: Casey Schaufler Reviewed-by: Kees Cook --- security/smack/smack.h | 9 +++++++-- security/smack/smack_lsm.c | 32 ++++++++++++++++---------------- 2 files changed, 23 insertions(+), 18 deletions(-) diff --git a/security/smack/smack.h b/security/smack/smack.h index 62a22ad8ce92..add19b7efc96 100644 --- a/security/smack/smack.h +++ b/security/smack/smack.h @@ -366,12 +366,17 @@ static inline struct smack_known **smack_file(const struct file *file) return file->f_security; } +static inline struct inode_smack *smack_inode(const struct inode *inode) +{ + return inode->i_security; +} + /* * Is the directory transmuting? */ static inline int smk_inode_transmutable(const struct inode *isp) { - struct inode_smack *sip = isp->i_security; + struct inode_smack *sip = smack_inode(isp); return (sip->smk_flags & SMK_INODE_TRANSMUTE) != 0; } @@ -380,7 +385,7 @@ static inline int smk_inode_transmutable(const struct inode *isp) */ static inline struct smack_known *smk_of_inode(const struct inode *isp) { - struct inode_smack *sip = isp->i_security; + struct inode_smack *sip = smack_inode(isp); return sip->smk_inode; } diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index d1430341798f..364699ad55b9 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -166,7 +166,7 @@ static int smk_bu_task(struct task_struct *otp, int mode, int rc) static int smk_bu_inode(struct inode *inode, int mode, int rc) { struct task_smack *tsp = smack_cred(current_cred()); - struct inode_smack *isp = inode->i_security; + struct inode_smack *isp = smack_inode(inode); char acc[SMK_NUM_ACCESS_TYPE + 1]; if (isp->smk_flags & SMK_INODE_IMPURE) @@ -198,7 +198,7 @@ static int smk_bu_file(struct file *file, int mode, int rc) struct task_smack *tsp = smack_cred(current_cred()); struct smack_known *sskp = tsp->smk_task; struct inode *inode = file_inode(file); - struct inode_smack *isp = inode->i_security; + struct inode_smack *isp = smack_inode(inode); char acc[SMK_NUM_ACCESS_TYPE + 1]; if (isp->smk_flags & SMK_INODE_IMPURE) @@ -228,7 +228,7 @@ static int smk_bu_credfile(const struct cred *cred, struct file *file, struct task_smack *tsp = smack_cred(cred); struct smack_known *sskp = tsp->smk_task; struct inode *inode = file_inode(file); - struct inode_smack *isp = inode->i_security; + struct inode_smack *isp = smack_inode(inode); char acc[SMK_NUM_ACCESS_TYPE + 1]; if (isp->smk_flags & SMK_INODE_IMPURE) @@ -824,7 +824,7 @@ static int smack_set_mnt_opts(struct super_block *sb, /* * Initialize the root inode. */ - isp = inode->i_security; + isp = smack_inode(inode); if (isp == NULL) { isp = new_inode_smack(sp->smk_root); if (isp == NULL) @@ -912,7 +912,7 @@ static int smack_bprm_set_creds(struct linux_binprm *bprm) if (bprm->called_set_creds) return 0; - isp = inode->i_security; + isp = smack_inode(inode); if (isp->smk_task == NULL || isp->smk_task == bsp->smk_task) return 0; @@ -992,7 +992,7 @@ static void smack_inode_free_rcu(struct rcu_head *head) */ static void smack_inode_free_security(struct inode *inode) { - struct inode_smack *issp = inode->i_security; + struct inode_smack *issp = smack_inode(inode); /* * The inode may still be referenced in a path walk and @@ -1020,7 +1020,7 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir, const struct qstr *qstr, const char **name, void **value, size_t *len) { - struct inode_smack *issp = inode->i_security; + struct inode_smack *issp = smack_inode(inode); struct smack_known *skp = smk_of_current(); struct smack_known *isp = smk_of_inode(inode); struct smack_known *dsp = smk_of_inode(dir); @@ -1358,7 +1358,7 @@ static void smack_inode_post_setxattr(struct dentry *dentry, const char *name, const void *value, size_t size, int flags) { struct smack_known *skp; - struct inode_smack *isp = d_backing_inode(dentry)->i_security; + struct inode_smack *isp = smack_inode(d_backing_inode(dentry)); if (strcmp(name, XATTR_NAME_SMACKTRANSMUTE) == 0) { isp->smk_flags |= SMK_INODE_TRANSMUTE; @@ -1439,7 +1439,7 @@ static int smack_inode_removexattr(struct dentry *dentry, const char *name) if (rc != 0) return rc; - isp = d_backing_inode(dentry)->i_security; + isp = smack_inode(d_backing_inode(dentry)); /* * Don't do anything special for these. * XATTR_NAME_SMACKIPIN @@ -1714,7 +1714,7 @@ static int smack_mmap_file(struct file *file, if (unlikely(IS_PRIVATE(file_inode(file)))) return 0; - isp = file_inode(file)->i_security; + isp = smack_inode(file_inode(file)); if (isp->smk_mmap == NULL) return 0; sbsp = file_inode(file)->i_sb->s_security; @@ -2056,7 +2056,7 @@ static int smack_kernel_act_as(struct cred *new, u32 secid) static int smack_kernel_create_files_as(struct cred *new, struct inode *inode) { - struct inode_smack *isp = inode->i_security; + struct inode_smack *isp = smack_inode(inode); struct task_smack *tsp = smack_cred(new); tsp->smk_forked = isp->smk_inode; @@ -2256,7 +2256,7 @@ static int smack_task_kill(struct task_struct *p, struct siginfo *info, */ static void smack_task_to_inode(struct task_struct *p, struct inode *inode) { - struct inode_smack *isp = inode->i_security; + struct inode_smack *isp = smack_inode(inode); struct smack_known *skp = smk_of_task_struct(p); isp->smk_inode = skp; @@ -2719,7 +2719,7 @@ static int smack_inode_setsecurity(struct inode *inode, const char *name, const void *value, size_t size, int flags) { struct smack_known *skp; - struct inode_smack *nsp = inode->i_security; + struct inode_smack *nsp = smack_inode(inode); struct socket_smack *ssp; struct socket *sock; int rc = 0; @@ -3327,7 +3327,7 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode) if (inode == NULL) return; - isp = inode->i_security; + isp = smack_inode(inode); mutex_lock(&isp->smk_lock); /* @@ -4559,7 +4559,7 @@ static int smack_inode_copy_up(struct dentry *dentry, struct cred **new) /* * Get label from overlay inode and set it in create_sid */ - isp = d_inode(dentry->d_parent)->i_security; + isp = smack_inode(d_inode(dentry->d_parent)); skp = isp->smk_inode; tsp->smk_task = skp; *new = new_creds; @@ -4596,7 +4596,7 @@ static int smack_dentry_create_files_as(struct dentry *dentry, int mode, /* * the attribute of the containing directory */ - isp = d_inode(dentry->d_parent)->i_security; + isp = smack_inode(d_inode(dentry->d_parent)); if (isp->smk_flags & SMK_INODE_TRANSMUTE) { rcu_read_lock();