From patchwork Thu Jan 25 13:48:58 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stephen Smalley X-Patchwork-Id: 10184053 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 3001160383 for ; Thu, 25 Jan 2018 13:48:11 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 1CEB128A1C for ; Thu, 25 Jan 2018 13:48:11 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 100E628A38; Thu, 25 Jan 2018 13:48:11 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from USFB19PA15.eemsg.mail.mil (uphb19pa12.eemsg.mail.mil [214.24.26.86]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 1A33428A1C for ; Thu, 25 Jan 2018 13:48:09 +0000 (UTC) Received: from emsm-gh1-uea10.ncsc.mil ([214.29.60.2]) by USFB19PA15.eemsg.mail.mil with ESMTP/TLS/AES256-SHA; 25 Jan 2018 13:48:00 +0000 X-IronPort-AV: E=Sophos;i="5.46,412,1511827200"; d="scan'208";a="7983148" IronPort-PHdr: =?us-ascii?q?9a23=3Ahy/5IhF75NpXqKdgwCNDXJ1GYnF86YWxBRYc798d?= =?us-ascii?q?s5kLTJ7+oMW9bnLW6fgltlLVR4KTs6sC17KM9fmxEjZZqdbZ6TZeKMUKD0dEwe?= =?us-ascii?q?wt3CUYSPafDkP6KPO4JwcbJ+9lEGFfwnegLEJOE9z/bVCB6le77DoVBwmtfVEt?= =?us-ascii?q?fre9FYHdldm42P6v8JPPfQpImCC9YbRvJxmqsAndrMYbjZd8Jqor1xfEpnREd/?= =?us-ascii?q?pLyWh1IV6fgwvw6t2/8ZJ/7ihcoe4t+9JFXa7nY6k2ULtUASg8PWso/sPrrx7D?= =?us-ascii?q?TQWO5nsYTGoblwdDDhbG4h/nQJr/qzP2ueVh1iaUO832Vq00Vi+576h3Uh/oiT?= =?us-ascii?q?wIOCA//WrKl8F/lqNboBampxxi347ZZZyeOfRicq/Be94RWGROXtxVVydcHI2y?= =?us-ascii?q?aYUBBPcFMepBsoXxu14CoB2jDgeuGezv0CdFiHz206Mk3eohHx3J0gsvENwBrX?= =?us-ascii?q?rUtNf4OLocXO+r16nF1inDYvFM1Dvh8oXEbhIsrPeRVrxwa8rRzkwvGhvYgFWM?= =?us-ascii?q?t4PlJzOV2foLs2OG8uRgUPigi2ojqw5vojmk28AhipLUiYIO0V3E6SV4z5o1Jd?= =?us-ascii?q?2/UkJ7Z8WkH4FKuyGVMIt2XNovTmd1syg0zb0GvIS0fCkMyJk/xB7QdeaHc46W?= =?us-ascii?q?7RLnTuqRJi14hH1jdbmihBiy6VCtxvDzW8S7ylpHrjdJnsPSun0CyRDf8NWLR/?= =?us-ascii?q?1g9Um7wzmPzRrc6uRcLEAxkqrUNoAuz6YrlpoWrUTDBij2mFjqjKOOdkUr5Oyo?= =?us-ascii?q?6+P/b7X6vJCcLY50ihzlMqg0hsy+Afg3MggJX2SB/+SzyKbj8lHjTLVPj/02lr?= =?us-ascii?q?HVsJHcJcsFuq60GxJZ34ks5hqlDzqqzc4UkWcIIV5bYh6LkpDlO1TUL/D5Cfe/?= =?us-ascii?q?jU6skDBux/3eJb3uHJHNLnnFkLf8crdx8lVTyA0uzdBZ+51bFKoBLenvWk7xqN?= =?us-ascii?q?PYDhg5Pxayw+b8EtpxzIweWWWRAqOBKqPdrUeI5v4zI+mLfIIVujH9K/4/6P7y?= =?us-ascii?q?jX82g1kdcLKr3ZsQbnC4G+5pI16FYXXymNcBCn0Gvg0kTOzlkFeCSyJcZ26uX6?= =?us-ascii?q?Ig4TE2EICmDYXZSY+xg7yBxyC7HptXZmBYEV2MH3Pod5iLWvgXdSKSJNNhkiEe?= =?us-ascii?q?WbimUY8h2gmktBXmxLp/MurU5ioYuIrt1dh04+3TkA899SZvAsSTzW6CUmZ0nn?= =?us-ascii?q?kSSD8uxqB/pk59xUmf3qhkmfBYEsZT5/xRWAcgKZHc1/B6C8z1Wg/ZY9iGVFOm?= =?us-ascii?q?QtKgATEtU9482MEObFhnG9WjjxHD2CyqD6UTl7OVGJw+6rjc0GTpJ8Zh13bG07?= =?us-ascii?q?EsgEQ6QsRVL22rnbJw9w/WB4HViUqZjLqqeb4a3CHT6GeJ1XCOs11AUA5sTaXF?= =?us-ascii?q?WmgSZ0vXrNT+4EPPVLquCbA+PgtAz86OMK1KZcfzjVVFRffjJsrRb3i3m2iuGR?= =?us-ascii?q?aC3qmMY5bye2UBwCXdD1AJnB4L/XmcLwg+BzyhrnnGDDN0D1LvYljs8fF6qHyh?= =?us-ascii?q?UkA70RuGb0p717q64hQVn+CTS+sP3rIYvycsszt0HEyn0NLQF9WAphFhcb5ZYd?= =?us-ascii?q?Ml4VdLzHnZtgJmPpC6KKBinFEeeRxtv0zyzxV3FplAkc8yoXMp1gVyKqWY0E5a?= =?us-ascii?q?ejObx5/wObrXKnTo8BCoca7W1UnU0MyK9acX9PQ4t1LjsRmzGUU/6XVn0sda02?= =?us-ascii?q?GH65rQEAUSVIj9UkEt9xh1v7vaeDUy55vI1X1wNqm5qiXC1M80C+Y+xRagethe?= =?us-ascii?q?PLmCFADsD80QH9KuJ/Aym1i1chIEO/hf9LU6P8O8cPuGw7KrMf17nDKgimRG7o?= =?us-ascii?q?V93ViK9yZmTO7HwYoFyemC3gSbTzf8kEuhssfvlIFKfz4SGna/xjb+BI5KfaBy?= =?us-ascii?q?Y5gECX21LM2qw9VynZntW2RX9FS7HVMJxNepeQaOb1z6xQBQ00UXoXijmSSm1D?= =?us-ascii?q?x5iCsmobSF3CzJ2ejicwAHOmFTTml4kVjsOZS0j8wdXEWwcQgplQeq5Vr9x6hB?= =?us-ascii?q?vqhwM2nTQUBOfyj5NGxiVqqwtryYbM5V75MkqyJXUP6zYVqCUL7yvwMa0z//H2?= =?us-ascii?q?tZ3D07czCquo7lnxBjk2KSMnJzrHvfecFtyhbS/8fcReZQ3joARSl3lSLXCkK6?= =?us-ascii?q?P9a34dWej43DvfymV2K9Sp1TdjHmzZmHtCu/4W1lHwe/kOy0mtzpCgU6yjL72M?= =?us-ascii?q?VxVSnSqxb8eIbr3bygMe17ZkloGEP8681iF4F9jIQwgooQ1GMZhpqL+3oHimHz?= =?us-ascii?q?PstH2a7ka3oNXzELycbP4Af5wE1jMm6Jx4XhW3WF2MRhet26bX0O2i0n6cBKFL?= =?us-ascii?q?mb7KZfkCtouVq3sxjRYeNnkjcGzvsu9WQajP0XtwojySWdGL8SEldCMSzqiRuI?= =?us-ascii?q?88i0rL9La2a3bbiwyE1+kMi/DLGEvw5RQ2j5epE/Ei9w9Ml/NkzD0GHr4IH+ZN?= =?us-ascii?q?bQdc4TtgGTkxrYl+haMo8xlv4RiCV7OGL9oX0kx/c1jRN025G2po+HK39i/Kih?= =?us-ascii?q?GB5XKiX1Z98P+jHqlatekNyZ34azHpVmHzUGR5XoQuy1HzIVr/ToLR6OECc7qn?= =?us-ascii?q?eZB7XQAROf5F1hr3LVHJChL2uXK2UBzdV+WBmdI1RSgAUOUzU+mp42CByqxND7?= =?us-ascii?q?f0hj/T0R4ED3qgdXyu10LRb/SnnQqB2uajgqVJiVNABW4R1a50fJLcye6fp+Hz?= =?us-ascii?q?tC8pyvtgCNL3aUZwBPDWAJQUGLHUzsPry06dnH6eiYCfK0L+HSbrWWtexeS/CI?= =?us-ascii?q?yIqh0ot84TmDK96PMWNkD/0n3UpDRmt0FN7FlDUKUSAXkDjNb8GDrhem5iJ3tt?= =?us-ascii?q?y/8OjsWA/344uPEaFdMc13+x2tj6eDNvSQhD1lKTZW15MMw2XHyL4D014TkS5u?= =?us-ascii?q?cyOhEbMatS7CVKjQgLNYDwYHayNvM8tF97o80RdWNsHFjNP116J4jvkuBldES1?= =?us-ascii?q?PuhN+madYNI2GnO1PNHFyLO6ieJT3X38H3ZruxRqZLg+lTsx2wuC2bE1P4PjiZ?= =?us-ascii?q?jDnmSQygPftXjC6FOBxeuYe9cgtiCGX4UN3nage7MMJsjTEsz7w7nG/KNXUbMT?= =?us-ascii?q?h6aU9NqaeQ7SxAiPVlB2NB9mZlLfWDmyuB9ObYK5kWsfxtAilviu1V/m81y7pP?= =?us-ascii?q?4yFCXvB1nzHSrtF2qVG8juaP0iZnUAZJqjtTno2Lsl9tObvH+ZRbXnbE5AwC7W?= =?us-ascii?q?OVCxsQpttlDsbgu6dfy9TVk6LzMjhC+crO/cQAH8jUNN6HMH05PBr1Hz7UCREJ?= =?us-ascii?q?TSSsNWDemUNdluqd9meSrpckqZjhg4YBSrheVFMpDPwaEVhlEMYEIJhpQjMuia?= =?us-ascii?q?Sbg9IQ5XqisBnRQ91XvpPHV/KWH/riMzOZjb5KZxsG37z4MZgTNo3820xndFZ2?= =?us-ascii?q?hoLKFFTMXdpVuC1uchc0oFlR8Hh5VmAz3VzqZRmp4HIIFv60mQU2ihdkbuQr7z?= =?us-ascii?q?fs4FY3KkDMpCQujEk7gc/ljiyJcD7tMKewWplbCzDquEgqLJz0WRx1YhGynUF/?= =?us-ascii?q?LzjERqhRgKZndWBlkA/co4VAGP5GQa1CfhAQ2emdZ+803lREtiWn2UhH6PPYBp?= =?us-ascii?q?tlkgsqd4OjoGxE2wJid9M6P7LfJLBOzlRKgaKOpCCo3PgrwAACP0YN7H+SeCkQ?= =?us-ascii?q?tUMVLLYmOSuo8fF36QGZgTRDYnIMV/0ko/Jx6EwyJ/mAzzjh075fKkG9LeqfIL?= =?us-ascii?q?2Fu2LYj86HXksw1l8Ul0lC5bV21cAjc1CKWEApzbqREA8ENcXEKQFIdcZS82LT?= =?us-ascii?q?fSmWu+XX3Z11J5m9FvzvTeKWr6YbnEakHAcvH4QR4cUMBYWj0EbdLcj7NrEF0g?= =?us-ascii?q?kt6B7tJFqbEPRDYAiLnysfo8Gj0J932pFQJi0cAWV4NiW3+rbXpw8xjfWeXdc3?= =?us-ascii?q?Ym0VUZAeOnIwRsK6hzZTv25cAzmvzuIZ1A+C4ifmqSTUDTnzc8Rsa++RZRJsDt?= =?us-ascii?q?G2/jM//LKthFHM85XRPWf6Oc1sut/S8+8aoYiIC+9MR7lnr0jcg5VYR2CtU2PX?= =?us-ascii?q?CtG6OZ7wZpI2YtPpFHa1TEa/iykvQMfrPNehNK+IgRvnRYxMqomUwCgjNdOhFj?= =?us-ascii?q?EZAxpwqPwD5KN4ZQ0HfZU7ZAXluBkgOKOkIQeXyNOuT3yqKTtMQPlV1f+6aKBP?= =?us-ascii?q?zyowcu+6z2MtTos8z+m27UENRJYKjhXFxfi7fodQTDL9F2BadQjUuSU5kG1hOf?= =?us-ascii?q?oozeck3BPEq18cPC6XdOZxcmxLo8k8BU+OIXVxEmc4XUWTjZDE4gG3xL0S4zFd?= =?us-ascii?q?kMxK0eJbtHj+v5nfYD2oWKyqppXVszYgbdY8rK1rNIzvOM2Gu43CnjbHVpnfrh?= =?us-ascii?q?WFUDKmF/pdgtVRLjhUT+VImWEkPMwGuJBO6UkqW8c/ObNAFrcjqqqtaTp+Ai4Y?= =?us-ascii?q?1TUZWJ+Y3Dwenue83KPXlhKKf5Q4MxwLrolCgtobUy55eS4fqrWsV4PKmG+ATW?= =?us-ascii?q?gLPRoc7R9W6AIGiIBwYvjv4JDUQ59U1z5Wv/V0XzPRGZly6lv7THuagVvjRfWg?= =?us-ascii?q?kuyp3B5Sw+n23tkdRhF/FVBXx/xKmUswNLF3N64Qs5bLsj+OaUP1ombtx/WjJF?= =?us-ascii?q?ZP1c3UbV35AZHCtWrkTCIc/3gUSpVOyHHbDpsSlAV4ZLwspFVWL4CsYlz+6CA8?= =?us-ascii?q?x4R1A7m4Utimx0oirXYDXCqqD8ZNC+R9v17NXj1qfYyroo3/O5pOWm9Q5IGdq1?= =?us-ascii?q?BBnUVtKSG504BTK8VQ7TMXQTdAvy2dvMOsR81Hx8B2FYUAItBlu3fyAKlEIoSe?= =?us-ascii?q?o2UqurzzzX/U4zI8sFCkyzioBqC3UflZ8HMEGgU1OWuRt1MjD+0y/WfO6lrNqE?= =?us-ascii?q?x7//9HBriTikV8uCp9EY1TCTZIz3+lK09+Q2VBs+VfNKvaaddcQ+UoaR+pJRM+?= =?us-ascii?q?CeYs31aV8kFsgXf5fytyuxNB9CDTQwY4SSsYjqrjlDAFts6nPjoaRI5SYjU6cy?= =?us-ascii?q?fJMQSblj5LvBxHcUFlR4gZAspZ+7EcxYZU5NTNRlusKS4fQBxvLQY40f1BlUFd?= =?us-ascii?q?rkmXZSfdAhe2evrVtB14Y9uRptazLPvl5AdHlp/nsOcg+qUbXH2mhReiTs3Cr4?= =?us-ascii?q?Lnrd2KsVaOdL3kPOKiZ3/BUCLMggq0hbs+CJnK5SfTOhJBK5Zm0XokfYThCWnT?= =?us-ascii?q?MBRaPaIUOVRUWr1hZNVbpuBae9Vkd7wX+a9sARKHQg3gGJC1oPlBNFbTSizULz?= =?us-ascii?q?+d/eynvYLT8bvdRPDiZsOW3XbHRLl3PpNg5jnlALrq1JJe+k7q2vds6kx6SELJ?= =?us-ascii?q?MyaarNj7IQML/saifFP4vpI1BTPWHItwkH31y0FCbcUXRSOq8I4fyJxE9nn9Uv?= =?us-ascii?q?543VL1sO1J8Llo84837K51yc2sP6fdNexasVN7AhiTHghq8JEtDXN+R2BXZ+8d?= =?us-ascii?q?MvbRfaIXjcD0se/3DLAX6AeI++NFddvHOlvBldelBjGbUxxEkx8LqSQGIQuEy/?= =?us-ascii?q?6Fh6h0RN6jpej4xk0t5Fy+IQQdzLx35IeE/a2IpPTMbxbKyLgJVafrStn0rrQ2?= =?us-ascii?q?tEOY/eckm6IWemxpfw2nF/AQWdIHyWfk068q1j4sEsPEH7/74/5MS3M5kSzmm5?= =?us-ascii?q?BhHlUZAOkYHbyV8oRChm04gfDWNsUKcqBenWaCDRqkEqQHyXOr8CaXLndqjQzJ?= =?us-ascii?q?0xHqW2yz9EX2rSh6QSTS09jjjlBZVr6tBUddRyCpI1N3sCuTPAr0s9r6oaY17E?= =?us-ascii?q?AzMmH/sdKCimugN61NH83+ItycLjM4pFQJg50tXtavw5wUGcKhINcN93Fzdvre?= =?us-ascii?q?6mKxnCBbv6hKnJHe7d+J+vrJAXaslaqaq6+CxDpA0Hg3oUk/6sy8NvHJ/9CFWP?= =?us-ascii?q?Wo130fTihluQvBXgK1qqTBoFAJPUyGy1vEmIsXMd5Hx3Y4y1vm5O85QN0p7gle?= =?us-ascii?q?EZzAZ/warzDpJDT02UqfY84wViSGyztYBE71HkV4GKky32LwpsHJmW7L+1I2Qo?= =?us-ascii?q?lwdkrnhQF4DogjMUIi8kQXzTYDEQkDbhCbFrKoCV7mLYQaT0gDbwqI3Lygdqcw?= =?us-ascii?q?x01zzaul5PXPYuxkG6oNKvFdgxaBnFdBAJIZr7EeQLJndl9Z9a7XuhbtC4j9UP?= =?us-ascii?q?j7jno8L/u1Td5G8coBrXst/h6/Rwa86ZdE97sbh46HdqhYYZjLu8Bw6Fxn6iAL?= =?us-ascii?q?dixMhhh/khy4XPsYpO/9+NjasICn5vyoVKkzW+Ud7wI0CHhmj5vsnFAjpsna2P?= =?us-ascii?q?teSoLPlYvy6xxCI3mOuIbe0hlzN/AOK561c7l893ULPS8eJ2gBPdCOcfkz/zdt?= =?us-ascii?q?MCnP51xFGs4MYNQYPMzRmQBblELkQ7RT9svBFV+eFYhza84p723tyDA26pswSO?= =?us-ascii?q?Dg5yGqJZrH9VFCI+tDjDlwlNLFvOUVzubdCDMM4XWAdhZ7zSWMy5iLC/bt8uSB?= =?us-ascii?q?097UV1YcES4wTYhRPj2C+RaoRuCtjpXmThuU6tPvgJI5bE+QRHuxnKQDsqpWDe?= =?us-ascii?q?FAiiH73iVDGYH0hvKVtcGs6GhWtlBcDoZz7APFF79bPppmOBT0jM+rSVZgBiHn?= =?us-ascii?q?YsHbagIuuPaKxucL++h+NlX+apUdIh8fz7L69GdaTgppSL7tpFqZWvgRZNR+Qv?= =?us-ascii?q?Pesn9V8Z5gK7MIPFWFppzlsDlIqF4yAAIyZr4/tDpaeVfSnAFPXab7pqIAgBMG?= =?us-ascii?q?UdFloU9MBX6wOGUm6jrIUaRVi6eQB+IR8jWXVaEOSEJoMiV/QxypwplufaWmne?= =?us-ascii?q?xfuGNcgix9uOQq0yBhRBakuy3sp6IM2Son+LG8tTUBpWJKQ/6bkyfJFVVD1uoF?= =?us-ascii?q?gb0bC3b45ly2eGMDY5fq4Ll7OcTg8pEs42g+YRUmZCAGQeWgBD3zj6yWBoyDqt?= =?us-ascii?q?RciwCRuM/Wd7+8MTASNqghyRLkX3V91wnenBVr8GsMWTig7sUrJIa6OcYj2CWo?= =?us-ascii?q?H3LXdFAS7aNVqMHxr0IETPMqaVN9x2VuytOISTMLRMzTAGs1lQwkaWJYcJJf9x?= =?us-ascii?q?8VCbQnjiyPvqlc8QEeeC3UHZi9+onMgcfI3mEwTc9txmLSvKKFnJ0r0Hphm9N6?= =?us-ascii?q?9SOOvXMSd+vDU8ByHnfzzIBfyfflZ/WstOAHR5FqyLO7UP8NKsOj43e52I12Wk?= =?us-ascii?q?+5wbQTB1S5P/EHxrfaSyeqV3aVWOWKc2iJmjY2LFTy5R22IVEtb8dKtUA9OPPY?= =?us-ascii?q?hpFAjw3hTa90RiKIqF7V1GwjK+IaeB4ot4q8fgwKTfIRZ/KCKuQ0x/0+ElQMZW?= =?us-ascii?q?fTHSRqE++2rUKtnI9jNnVn5UX1f//g8hjiMNSIARkEDY/aoYJt+fygWG2OJ2Vs?= =?us-ascii?q?zBtsM0lo7+3fDUg+tvdAc5aNmtjdn9B70e8Dd/dwPiwxo9oTmoN46YmIy8eHah?= =?us-ascii?q?DRwYz0JdHSuPSYBOffz0sycGFATrUZeR/155k9PtMhXr3cB6dWvRQdBag8R5ws?= =?us-ascii?q?LHnx9KByLAxtdg7RZbK0gtTlp+6RYZtUvXDW5EoqLCjAox0D1uC0TQtjYpConX?= =?us-ascii?q?ryI5cwSSlaot1wDBtmAItPG8QdrwqoA56UhLu3i9mv9ENmo+UKq7b/CujW1NSl?= =?us-ascii?q?2IV8R5pa5UmMPDbLHqlrg19lg/+0gvja15n+F8LidckDVOhhTW7PcqXGEZmnKj?= =?us-ascii?q?KSJsL8fFZL86WS0LJ8ThqcZSP0UrGYtCK6LvVk4EQ6yot+fObJyjwi8a3bi5PP?= =?us-ascii?q?YXpGrHKjsWKRZtwY8lPHH6rdUghSRP7D93xqWqgeb4zu+OALNpkjxtabpQlv6T?= =?us-ascii?q?AR7MzQOKWlr0nRympnZJnbKw3vwC9/Vo4UczqlNk55unPUsnTQBzxnK8GgLcR8?= =?us-ascii?q?yIKOAgfF+1h6mWZrYHVIXGXvW4HCaiAgx8uiaVjSp0pwBNEZkrvyIBY1?= X-IPAS-Result: =?us-ascii?q?A2C4AwCg32la/wHyM5BdGgEBAQEBAgEBAQEIAQEBAYMVLWZ?= =?us-ascii?q?0FBODXYsYjXOBWyeJEpBBKQuFGAKCFlgUAQEBAQEBAQECAWoogjgFAgMaBoJBA?= =?us-ascii?q?QMDAQIgBCcuAwkBARsDAQIDAiIEAgIDAR0QHggOCwUYBIdrVYE8AwgNELQ3gW0?= =?us-ascii?q?6hz8NgxcmgQ+DQoIVg3SFZEQDAYE4IYJwPYJlBZI5gRWPfz2IFYhHhQaDApEjj?= =?us-ascii?q?VxGinQ2IoFQKwgCGAghDz2CKgmCSxwZgWxaAYwGBVOBcwEBAQ?= Received: from tarius.tycho.ncsc.mil ([144.51.242.1]) by EMSM-GH1-UEA10.NCSC.MIL with ESMTP; 25 Jan 2018 13:47:58 +0000 Received: from prometheus.infosec.tycho.ncsc.mil (prometheus [192.168.25.40]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id w0PDlnCf007866; Thu, 25 Jan 2018 08:47:52 -0500 Received: from tarius.tycho.ncsc.mil (tarius.infosec.tycho.ncsc.mil [144.51.242.1]) by prometheus.infosec.tycho.ncsc.mil (8.15.2/8.15.2) with ESMTP id w0PDljVZ016849 for ; Thu, 25 Jan 2018 08:47:45 -0500 Received: from moss-pluto.infosec.tycho.ncsc.mil (moss-pluto [192.168.25.131]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id w0PDlk9J007864; Thu, 25 Jan 2018 08:47:46 -0500 Message-ID: <1516888138.9570.0.camel@tycho.nsa.gov> From: Stephen Smalley To: selinux@tycho.nsa.gov Date: Thu, 25 Jan 2018 08:48:58 -0500 References: <1516850875-25066-16-git-send-email-takondra@cisco.com> X-Mailer: Evolution 3.26.4 (3.26.4-1.fc27) Mime-Version: 1.0 Subject: [Fwd: [PATCH v2 15/15] selinux: delay sid population for rootfs till init is complete] X-BeenThere: selinux@tycho.nsa.gov X-Mailman-Version: 2.1.21 Precedence: list List-Id: "Security-Enhanced Linux \(SELinux\) mailing list" List-Post: List-Help: Errors-To: selinux-bounces@tycho.nsa.gov Sender: "Selinux" X-Virus-Scanned: ClamAV using ClamSMTP -------- Forwarded Message -------- From: Taras Kondratiuk To: H. Peter Anvin , Al Viro , Arnd Bergmann , Rob Landley , Mimi Zohar , Jonathan Corbet , James McMechan Cc: initramfs@vger.kernel.org, Victor Kamensky , li nux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, linux-security-m odule@vger.kernel.org, xe-linux-external@cisco.com Subject: [Non-DoD Source] [PATCH v2 15/15] selinux: delay sid population for rootfs till init is complete Date: Thu, 25 Jan 2018 03:27:55 +0000 From: Victor Kamensky With initramfs cpio format that supports extended attributes we need to skip sid population on sys_lsetxattr call from initramfs for rootfs if security server is not initialized yet. Otherwise callback in selinux_inode_post_setxattr will try to translate give security.selinux label into sid context and since security server is not available yet inode will receive default sid (typically kernel_t). Note that in the same time proper label will be stored in inode xattrs. Later, since inode sid would be already populated system will never look back at actual xattrs. But if we skip sid population for rootfs and we have policy that direct use of xattrs for rootfs, proper sid will be filled in from extended attributes one node is accessed and server is initialized. Note new DELAYAFTERINIT_MNT super block flag is introduced to only mark rootfs for such behavior. For other types of tmpfs original logic is still used. Signed-off-by: Victor Kamensky --- security/selinux/hooks.c | 9 ++++++++- security/selinux/include/security.h | 1 + 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index f3fe65589f02..bb25268f734e 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -716,7 +716,7 @@ static int selinux_set_mnt_opts(struct super_block *sb, */ if (!strncmp(sb->s_type->name, "rootfs", sizeof("rootfs"))) - sbsec->flags |= SBLABEL_MNT; + sbsec->flags |= SBLABEL_MNT|DELAYAFTERINIT_MNT; /* Defer initialization until selinux_complete_init, after the initial policy is loaded and the security @@ -3253,6 +3253,7 @@ static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name, { struct inode *inode = d_backing_inode(dentry); struct inode_security_struct *isec; + struct superblock_security_struct *sbsec; u32 newsid; int rc; @@ -3261,6 +3262,12 @@ static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name, return; } + if (!ss_initialized) { + sbsec = inode->i_sb->s_security; + if (sbsec->flags & DELAYAFTERINIT_MNT) + return; + } + rc = security_context_to_sid_force(value, size, &newsid); if (rc) { printk(KERN_ERR "SELinux: unable to map context to SID" diff --git a/security/selinux/include/security.h b/security/selinux/include/security.h index 02f0412d42f2..585acfd6cbcf 100644 --- a/security/selinux/include/security.h +++ b/security/selinux/include/security.h @@ -52,6 +52,7 @@ #define ROOTCONTEXT_MNT 0x04 #define DEFCONTEXT_MNT 0x08 #define SBLABEL_MNT 0x10 +#define DELAYAFTERINIT_MNT 0x20 /* Non-mount related flags */ #define SE_SBINITIALIZED 0x0100 #define SE_SBPROC 0x0200