From patchwork Fri Nov 18 16:13:02 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stephen Smalley X-Patchwork-Id: 9436981 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id A107260237 for ; Fri, 18 Nov 2016 16:12:43 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 90C9629984 for ; Fri, 18 Nov 2016 16:12:43 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 827692998F; Fri, 18 Nov 2016 16:12:43 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from emsm-gh1-uea11.nsa.gov (emsm-gh1-uea11.nsa.gov [8.44.101.9]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 27AA429984 for ; Fri, 18 Nov 2016 16:12:41 +0000 (UTC) X-IronPort-AV: E=Sophos;i="5.31,510,1473120000"; d="scan'208";a="896971" IronPort-PHdr: =?us-ascii?q?9a23=3AJ0+mhhS2qbPKgfHzbIN+J+mbfdpsv+yvbD5Q0YIu?= =?us-ascii?q?jvd0So/mwa68ZxWDt8tkgFKBZ4jH8fUM07OQ6PG7HzVQqsjQ+Fk5M7V0Hycfjs?= =?us-ascii?q?sXmwFySOWkMmbcaMDQUiohAc5ZX0Vk9XzoeWJcGcL5ekGA6ibqtW1aFRrwLxd6?= =?us-ascii?q?KfroEYDOkcu3y/qy+5rOaAlUmTaxe71/IRG4oAnLq8UbgoRuJ6c1xxDUvnZGZu?= =?us-ascii?q?NayH9yK1mOhRj8/MCw/JBi8yRUpf0s8tNLXLv5caolU7FWFSwqPG8p6sLlsxnD?= =?us-ascii?q?VhaP6WAHUmoKiBpIAhPK4w/8U5zsryb1rOt92C2dPc3rUbA5XCmp4ql3RBP0ji?= =?us-ascii?q?oMKjA28HvTisdtkqxVphyvrAF7z4LNfo2ZKP9yc6XAdt0YWGVBRN5cWSxfDI2h?= =?us-ascii?q?YYUBDO0PPf5aooXgqVYBogexCwayC+P00TJImn370Lcm3+k7DQ3KwgotFM8Ovn?= =?us-ascii?q?TOq9X1Mb8fX/2pzKbW1TXDb+1Z2THg44bVdxAuu/WMXbZufsvR1EIiEBjFgUiL?= =?us-ascii?q?qYH+IzOU1vgCs2ic7+Z6U+KvkHQopxt+ojio2Mchk4/EjZ8WxFDc7Sh13Yk4KN?= =?us-ascii?q?KiREN7fNKoCoVcui6EO4dsX88vRXxjtjwgxb0co5G7eTAHyJEgxxHCdfOKa5OI?= =?us-ascii?q?4hf/VOaJJjd4mW5ldKq/hxms9UigzfXxVtWu31ZQrypFj8LMumoR1x3T9seHSv?= =?us-ascii?q?x98l2n2TmTzADc9vtIIUU1larfM5Ihw7gwmYQPsUnbAyP7l0r7gLWWe0k54OSk?= =?us-ascii?q?9evqbqv8qpOBL4N0jxvxMqUqmsyxG+Q4NQ0OUnCA+eui0L3j/Ev5QKhFj/Evia?= =?us-ascii?q?bZt43aJcIHqaGnGA9YyZoj6hajADem19QUh38HLElfdx6dgIjpPE/OLOjiDfij?= =?us-ascii?q?m1SsjCtrx/feM73vGJXCNH7Dn6vgfbZm8ENczRIzzdFG65JPBLABO+j/WkjrtN?= =?us-ascii?q?zXFhU5KRC7w/77CNVh0YMTQWGPDbWaMKPVrF+F/eEvLPOPZI8SpTbxMf8l5+Th?= =?us-ascii?q?jXUhg18SYbGp3YcLaHC/BvlpOViWYWDtgtgfC2cHpRAxQ/DviFGYVj5TfXmyVb?= =?us-ascii?q?om5j4nEIKmEZvDRoe1jbyBwii7GplWZmddB1CIDHfoa4KEW/IWZy6IJc9hiDME?= =?us-ascii?q?X6C7S4A9zRGuqBP6y71/I+rP9C0Yr5Xj1MNp5+DIjhEy8zt0DsqY026XSWF4hG?= =?us-ascii?q?UISCEq3Kpnu0xy1k+D0bRkg/xfDdFS6elGUgMmNZHC1ex6EMv/WhzfcdeTU1mm?= =?us-ascii?q?X9CmDSs2TtIrzN8Ee1x9FMm6jhDfwyqqBKcYl6CWC5Mp86LTxXzxKt1hxHbB0a?= =?us-ascii?q?kuk0MpQtBTNWG8gK5w6RTTDZbTk0qFj6aqabgc3CnV+WeFzGqOuEVYXxBrUaje?= =?us-ascii?q?R38QeFHWrdPj6kPFVb+uBqwtMhFdxs6aNqtKdtrpgE1bS/j5JNTReXy+m2m/BB?= =?us-ascii?q?uT2ryMbJDle38B3CrDEkgIiQYT8miaNQImHCeuv3reDCByFVLoe07s7+h+p2+n?= =?us-ascii?q?Tk8z1QGGdVFu17qy+h4TivyRUPcT3rMCuCg7sTV0G0yx39XMC9qPvwBhZrlTYc?= =?us-ascii?q?sh4Fdb0mLUrwh9Pp27L6B+n1IeaBp4v0fv1xVxF4VBntMnrGgyzApzL6KY0U9O?= =?us-ascii?q?dyiC0ZD2JLLXNnH4/AqzZK7OxlHezNGW978V6PQ/r1XjuB+mFlA+/HVg3dhYyG?= =?us-ascii?q?Cc5ojWAwoJS57xVVw39xdirbHAfiY9/5/U1WFrMaSsqj/Nwc8pBO8/xhm6ZdtQ?= =?us-ascii?q?K6SEFAvuE80dAcijM+kql0SvbhIDIO9e7qg0MN26d/Gewq6kIP5gnC66jWRA+I?= =?us-ascii?q?1910aM+zNiRe7OxJsF3e+X3g+DVzjilletqMb3lp5YZTsKBGqw1TDkBJJNZq11?= =?us-ascii?q?ZYsLCnmhI8usxthlhJ7iRXhY9EWlB1wYxM+lYx2Sb0by3QdIz0QYvWSnmTekzz?= =?us-ascii?q?xzizwpsKyf0zHVzuT8choIJ25LSHNkjVjyPYi+l8oaU1Swbwg1iBul4l73x7BB?= =?us-ascii?q?q6RiK2neWltHfynqL2BiS6ewuKCNY8hV5JMvqyVXX/y2YUqGRb7lvxsazyTjEn?= =?us-ascii?q?NExD8maj6noZr5nxl1iW6HKnZ8smbZc9lqxRjD/NzcWeJR3j0eSSlgkzbXG1y8?= =?us-ascii?q?MMex/dqOkZfDrv6xV3i6W51Oaink05mAtDCh6W1xBh2/guqzlcH5Hgg01i/7zd?= =?us-ascii?q?ZqWjvSoBb6fIbry7ywMfh7cUlwGF/89816F5lwkoQqgpEQxX8ahpCO8HoJj2j8?= =?us-ascii?q?LNJb2bjkY3oVXz4LxNzV7xb5101/NH6JwJj5VnqFyMt7e9a6en8W2j46781SB6?= =?us-ascii?q?eU7KBLnTF1o1qgsQLRZuNwnjEDxvsy834Vn/sGuBIzwSmHBLAdA1VYNzT2lxuU?= =?us-ascii?q?99C+sLlXZGG3fLi1zkV+mdShA6+eogFAQnn2YIwvHSlu4cVjK1LDzGf86pn6d9?= =?us-ascii?q?XKa9IcqAGUmQ/aj+dJMJIxiuYKhS1/NGLnp3EkxfQ3jRl00pG+u4iGK35g87il?= =?us-ascii?q?DR5dLDH1YNkT+j71h6ZEgsmWx5yvHolmGjgTWpvoV+inECoKtfn8OQaOESc8qm?= =?us-ascii?q?yHGbrRHA+f7l1pr3TTHJCqLX6XIGMVzdJ4RBmSPEZfmhwbXC0mnp4lEQCn3NTh?= =?us-ascii?q?f1li6T8P4F74qwdMyuVzOhn+TGjQuhmnZi0zSJiFIxpc9htC6FvNMcyC8uJzGD?= =?us-ascii?q?lV8YC6rAOTMGObaB5IAnsXWkGfHFDsJLqu5cTa8+eCHOa+K+bOYbOUpuxETvuI?= =?us-ascii?q?2ZWv0ohm/jaLLMmPOGdtD+Ej0EpZQX95A9jZmykISyEPjCLCddCbqw2z+iJptc?= =?us-ascii?q?Cy6+/rVxjx5YSVBLtdL85v9wqwgaidK+6anDx5JipA1pMQ2X/Iz6AS00UTiyFh?= =?us-ascii?q?cDmtF68NujPTQ63Lm69YFRgbZzl0NMtS4KI2xhNNNtLDitPpyr54ieY4BE1KVV?= =?us-ascii?q?P7hMGme9cHI2alNFzZAkaLMa6JJTzPw87sZqO9RqdcjOJOtx2/oTybCVPsPiyf?= =?us-ascii?q?lzn1UBCiKf1MjCaePBBEooG9dRdsBnblTN39cB27N8F4jT4tzLIogXPKMHITPi?= =?us-ascii?q?Jnc0NRtLGQ6z1XgulnEWxb8nVlNfWEmzqe7+TAKZYXsf9rDTpvmuJf53Q6xbVV?= =?us-ascii?q?4z9YRPxpmCvSqdturE+8numJ1DVnTAJEqixXi4KToUViJaLZ+4FBWXbC4BIC82?= =?us-ascii?q?GQBAoPp9R7Ft3voaBRx8PIlKLrNjhC9dfU8tEdB8jQM82HN3UgPQDuGD7OAwsP?= =?us-ascii?q?VSSrOn3Hh0xBjPGS8WWYrp4kpZf2nJoDUbxbVFsuFvMGEEtlGscCIJR2Xj8+l7?= =?us-ascii?q?6UktII72KkrBbNXMVaoozHVvWKDPX1NjmZlqdLaAESwbzkLYQeLZb02014alZn?= =?us-ascii?q?m4TKFVLQXcpTrSxhdAM0pltC8GRmRG0px03lch+t4GMUFfOsgxE2jQ1+YeIw+z?= =?us-ascii?q?jy51c3J0HHqzEun0krntXpmzeRcCT+LK2oR4FZFzL0t1QtMpP8Wwt6cBe9nVJl?= =?us-ascii?q?NDjZXLJclKFvdXpxiA/bt5pPAuBTQrFZYB8KxPGXe/Up3U5aqiq52U9N/fHFBo?= =?us-ascii?q?d6lAs2bZ6sqGpN2wx5bNErOKPQP7BGzl5MhqKJpS+lzfo+zxMbJ0oX92OSYiEI?= =?us-ascii?q?slQSNrY6Pyqo4vBs6QualjtHf2gMTeQlovRr90M6IOmAwCTg06NZJkC2LeyfIL?= =?us-ascii?q?uTu3Lcms6QXlMwykQImlFe/bdo1ccjckyUV10gzbaKCxsJMs/CJh1PYMpJ6Hjf?= =?us-ascii?q?ZyCOvvvRwZhtJYWyCvjoTfOStKYTmk+kHxwpHoQW4cQHApms0FrVLcjgLL4d1R?= =?us-ascii?q?oh/gLrK0uZDP5RYhKEjC8Ho92jzJ9wxYRdOjAdAWB6MSWr5rbWphQnj+eCXNY2?= =?us-ascii?q?eHgVRZEINnQoV82mgyRZpWhPDCGr0uIFzwiP9z/8piPOAznycdVjfuyZZRJyB9?= =?us-ascii?q?6o5zoz6a+2iUTY8p/GPWH1KcxiusPT6eMdv5uIEfdUTbhhvEjCg4ZYQnyrU2jI?= =?us-ascii?q?Ed6zPZf9cJIjbd3uBXa8S1C/hS81Q933PNmzMqiCmRvoSppMsImHwDAjMtewGS?= =?us-ascii?q?oAFBd2vOwM/r9zZRMdbJoheh7nrR4+NqylLAefyNWuTH6nKSFKQPlH0eW6e7tX?= =?us-ascii?q?wjIjbu+nyXsgSpU6wPey8UMWWZ4FkArRxfe5aIlYSyTzHWZdewrXryoji2dhLv?= =?us-ascii?q?oywvs4wB7Qq1kcNTGLe/BpaGxDu9E8HkucL2xrBGQiW1KSipHO7RKr37AX4yRS?= =?us-ascii?q?hc1U0fFfvHj4oJDffCqmWLa3ppXNryogcd8mrrVtPozhOMSJqIjTkSDYTJnUtg?= =?us-ascii?q?2FUTC1F+BGmtdOPC1YQONEmWY/OcwJoYBB81Y+Vt8iJ7xTD6khvqqqZiB+DS4V?= =?us-ascii?q?1iAUTJ+A3CYYjeeixbTakhaQcJItMBwAsZVCjdsdUzJ4YiwEvq+jUp/al2maRW?= =?us-ascii?q?gXOA0T9xhD5Boclo9seeDo+IrJQ4VXyzFMpvJ0Uy3LG4Jp91vnUG6WmkT3R++7?= =?us-ascii?q?n+yvww1S0Orm0sMHVx5nFUhd2+FWm1MmKb1tN6YQvo/KsjqJdUzgv2Lg0+qmK0?= =?us-ascii?q?dPxsLKbVH4C5DFtWXkWC0G5XIUXZNPyG3YFZkKiQV5crsrpFNWLIClYUv+5j0k?= =?us-ascii?q?x4V1H7ajT8yrwUgqrWoeTSewD9VBE/1msE7QWDB9bJCrso/qO5NOQmJL+Z2drF?= =?us-ascii?q?lYkENxMy6515VcKsdN4iISUzhVuzmdusW9SNFb089sE5AMOst/u2v6GK5cJJiR?= =?us-ascii?q?pHg2t6fzynPF/jAzq022xDOtFK+kV+hZ5XERGh01J2SCrUkiF+ss/X3I8l/Xtl?= =?us-ascii?q?B74vxWCaWRgkVpuDZyAJROCShT1Xy/KFRzVnZGuf1AKKvJa8xcX+UyZRi3Nhw8?= =?us-ascii?q?Ev4pwVeE8lxqknfifSNyrBda9D7AUAUuUykanKvtkyUEqs67IT8aV45IbTI5Yi?= =?us-ascii?q?jeJQKUhTxbsRRCZ0xkQJ0WHtFF+7QH0oRO5crCVVygKScbUxx+Lgg4y+ZQlVZf?= =?us-ascii?q?sEWEfiDQFRCoeujSvR13Z8iRsNWkLPD+/AdZlIzrrvw396IeSHK4gwGtR87Rr5?= =?us-ascii?q?PkvN2QqkSObLv4M/G7YXLZVDjMlgywiq05AJnW5CXTKw1bK4RgyXU4f5fhD3LL?= =?us-ascii?q?PQ5cKKIfPUZbUrp6adpeqOBAe8BkYLoJ+bNqBh+fWhPvApKgo+dbIVvIWDTeKz?= =?us-ascii?q?mB8valroLN7LzdTuzgadKQx3rdRKJ3JJh64yHhG7j2yY9e5lb22vB1+0xnT1jJ?= =?us-ascii?q?KTuMo8nnJgwR/sWicVHivpIxFzPMHJhwiGbtxl1Hd8cPQS2l6o4YyJRC6Hb0U+?= =?us-ascii?q?14zFP+sOhP97lg9Yk34qxmycauKqfUMvRWq0hnAgKbBg9y7JUiHHB/R3xNYu8W?= =?us-ascii?q?MPrRf74Wjcbgq+DtEKwY9QOa9vdFadTdIUHBgc6/BiuaSRNagAcLsSQaIReE1/?= =?us-ascii?q?6Zh690Tt6ope792k824li+KBsGwKps5YeC9KqIvvXYbwDNzbgeR6jlWt/zrqk2?= =?us-ascii?q?u0yM//Ekk6QOemNtaQ29DOcdTtIdxnvnza0yyyIsEt/MH7Xk+PFZTHI1hDPgm5?= =?us-ascii?q?d6H1UNAfMZBr+L8ItRn2sinOzZLNIWeLhYmmmTDR6kDqMCyXmz5iSLOmZlhg/B?= =?us-ascii?q?0wrsQWKz61/7tjR4TjfNz9j9lEpVSri3Cl1IUyqvJ0B4rCuFPBD0u9rvpaQ18E?= =?us-ascii?q?Y2P3TgtNKWkWusOKhaH8PhK9OBJik0vkgYjIUrRtyo24AUB8ayIMsL/HF5dPve?= =?us-ascii?q?5HuhkzVdrKdfm4re/saV9+3SHXmkkaKarrKNyy5cynUjslEw9NegNurW59KQX/?= =?us-ascii?q?So1nweTyN+uwvHQx66tLjbr1QVOUyEzkjLnpAFMc9D0Xk+yE7m+PApQMgv+wVG?= =?us-ascii?q?CobAe/QCqCjxODv1xFaSeNc3WTee0jRJBFL1EF94GKcm1GL2os3JiW/a+0c0SY?= =?us-ascii?q?loa0znmRt3Ap05KUMs8lcY2DYMHBMWaR+FELGnG1jqIZEDVUgZZhSNxKK6dbsv?= =?us-ascii?q?3U1v3rOv4/feYvd9B6oWOPdSlAyOnFlHGpIOq6IeXbZ8dkRB+67QuwftFZLoX+?= =?us-ascii?q?X8lXo3L/26WNpW8ccDt3st+gy/XQav6Y9f77YHj5CFbrZEboLQvM9g70dm6zkP?= =?us-ascii?q?djZOgBRmlBO2T+QcpOHl4tjGv5ul8f6uW7wxR+oL9xg1CWN+j4HzgFw5otHYyf?= =?us-ascii?q?1cSovLhoT76gxNJGSKuInC2RlmNeUOM56rfKpn93gfOygePWwBPd6MZPk6/SBg?= =?us-ascii?q?Kyjc511NAsMNedMXJtHNlhpOik30Qr1T8NTUGkOAAYdpa88o93b3yCwy8ZYkXe?= =?us-ascii?q?bv8iW2Ko7D71FNJP5DiCRslM7cq+gV2/XSFTMX7WOfaxdr3iOI04ONBOro/eWQ?= =?us-ascii?q?1NHUUEsLHiEoXIdbODqC/gunSu2ulJr3VgOU68nzgI8xdU+LQny+gr4Fs6ZWHu?= =?us-ascii?q?JajCX0wCReHJjvh/2Jq9qs9HdXtlpfHYZ26h3FHrlfPpplNhnjk8mrR1JzBi3h?= =?us-ascii?q?d8HIeBsuv/CWxuQX4+lkMUvxe5MbKAoey73m8XpVUhduSLnus1aWQe0Rf8BmRO?= =?us-ascii?q?rZoH5a74xgKqkPPEWSpZHxoTdIrUo5AAk3Z7MqqTxabEbOlhVPW6nooL4Alhcc?= =?us-ascii?q?UdlhtE9OHmKwOGQ+6yDbWqRViKmRFeEa8zSSTqwISEVoMSJ+Tgir2JVvZbumh/?= =?us-ascii?q?RHvX5Hni9npvglzSBmTgOmuSLwv6INxS4g+LaguTUAp3xKVOOenjzMCVVe0fsK?= =?us-ascii?q?jKAcC2345Vy7enkDY5P44KN7KsT46Ykh/3M/bA0hfyIYU+SgBSXwgriGA4OVtt?= =?us-ascii?q?JTmgKNtN/IbbCtMSgYLq49xg77R3hhzgjemw5l8GQPQjWn4t4rOoG9OcI+yyqz?= =?us-ascii?q?HmjbclcM7b9TvMv3q1ELUPM8aUl9z2V7zsiHWioNSdTNG2Y1jgkkcWJEcJZC6R?= =?us-ascii?q?8GCaYlmTOIvqha/gEOfjjYCIOl+pPfnc3Qw3kyUc9qxn7Kpq2Cnp4qzHxlm9Zv?= =?us-ascii?q?4y6SuXQda+/YXNFoAnTp0IdQ1/D+be23su8bUItm1KihUPgaP8mm+Gu225ZqWk?= =?us-ascii?q?i+y7QcBVW5M+gDxrHFXCejU2GYX/qEc3SUlTYjLkHy/QWoLkEwaMpStEAyLO3C?= =?us-ascii?q?hoJHmg36VbN0QTmQpUPFzGM9LOwWbQU2uJ2oewYSVu4ee/CcJfQywP05EFYMd3?= =?us-ascii?q?jJHS9sBO+sv1+tm4x7O3t77EX/ZuTt9RvmP8WOFRkeFo7atYVx+f28RmKOI3Ng?= =?us-ascii?q?ywdyPEZs/efFC1sxrvNcc4qWndXIidR0z+oFd/Z1MSIjodMSm4Nj6YyR0MiUax?= =?us-ascii?q?HRyoj9KcvSoviCDP3V114qdX1CUroFfQP14J03Pt4lW73TGrtZuA4TBbMhTZwk?= =?us-ascii?q?Nmfx6Lt0Ix1pfg7WfrS0jdHgpviXaZtMu3/W8lUwIT/Suh0b0Py0TBB0YI6xin?= =?us-ascii?q?X3IZAwWihBoMN3BhthBotPFNsKrxC7DJ6MhKG7l9ix9lt9u+8Or6X9EejK1NCj?= =?us-ascii?q?0IVqQ5ha5FCEPCrLBKZ1nEtplOKyjenc0pPpE8PtZcsEVPRnQm7CcrLGGoS/Kj?= =?us-ascii?q?STOsPzYkJG97+c0KllUhWKfy35XrCJtCujNPl+5kU70IN4dvLJzDMx97HbxMfy?= =?us-ascii?q?Z2ZDqye4s3GJMJpf7FrXBe3RWB5aRuaF8GZ7Eq0Nc4T07P0BPMchwNeC+Qlz6i?= =?us-ascii?q?pN0M+eLKi8oU/AwEV7dYjULEHxwSY2RZEKIAijMUsrmWLZrnXdAW9ALsW/KMht?= =?us-ascii?q?mdCVAQb360l3h24tenZLGnD0SteJJWgbx8W+aRWP9A1RE9kDn++3eUg/tqCpV+?= =?us-ascii?q?loO5NFlvuutLUGl9ZpNi7OSNJdPyHKI798JiBRAfnXpFg0fh4EtKA4WoUvapiN?= =?us-ascii?q?J0MIK1yNyT70zQve0U30cMGs1KmJICYK6HlHyazK0SRUrQmjpfmZmtHjUKzebJ?= =?us-ascii?q?zuR/HdKy0pVjWbRTQpDUap4k2ou+Eas/WEO2sfuU4bYiaTCA4Vu6BuosPdAXPT?= =?us-ascii?q?mO15YZ0Kn+qWWi7qRy1kj6oyASBLuVqLQ/oZGgncd2Xhj3ZEuAy+Ov9M+mrob7?= =?us-ascii?q?KCyaVOQewWA5VDcvmCTtvGffBRPSwoljQEOOqmed3Tsao52ErSTWQFC6nI6EGe?= =?us-ascii?q?TEmOT/yewjLrWp8Vv5I1uioz4d/QmDV4E6HWMLaevTKu9ZS4jCmAs+3ESmYte1?= =?us-ascii?q?A1gP4FAGSZ3hZAKmYEC9ETuEH2Ra6AYV1B1H0zieJzxR8DZh5zXmdo0nJIgPa3?= =?us-ascii?q?AtdZRkIMjGOyXP0Ga0h6DCg+/U+P/gL/YN8NtNvNR2BA7LsMSIscLP4u6IXNPq?= =?us-ascii?q?sf3uop1ip8oCMmqyWdE09djgWd/qrSG6J8wLlC6HI9//5oQ06PTTTfcnLbxYW4?= =?us-ascii?q?Ec5PwzlhoWy3n/bT6/tgMLpcupFRHEYBASUwIMvUuz9GTzLawgy36i2nESyeLT?= =?us-ascii?q?RR2zMCISgIZ64h1ONgmArZfdbGr0WLvuQur1X9WlXDMaa9xJEeUpKh7g6/cyQe?= =?us-ascii?q?NG/zGg=3D=3D?= X-IPAS-Result: =?us-ascii?q?A2GQBQDLJy9Y/wHyM5BeHAEBBAEBCgEBFwEBBAEBCgEBgww?= =?us-ascii?q?BAQEBAR+BSBC7LymIEFMBAQEBAQEBAQIBAl8ogjMagiMCJBMUIAsDAwkCFykIC?= =?us-ascii?q?AMBLRUfCwUYBIhLrgE9KgKLLSWPMREBaIUVBY9limaQcgKKGIYLApFmVV0RAg8?= =?us-ascii?q?MHYU/VIYdgi0BAQE?= Received: from unknown (HELO tarius.tycho.ncsc.mil) ([144.51.242.1]) by emsm-gh1-uea11.nsa.gov with ESMTP; 18 Nov 2016 16:11:44 +0000 Received: from prometheus.infosec.tycho.ncsc.mil (prometheus [192.168.25.40]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id uAIGA9eR021698; Fri, 18 Nov 2016 11:10:35 -0500 Received: from tarius.tycho.ncsc.mil (tarius.infosec.tycho.ncsc.mil [144.51.242.1]) by prometheus.infosec.tycho.ncsc.mil (8.15.2/8.15.2) with ESMTP id uAIGA7I5221301 for ; Fri, 18 Nov 2016 11:10:07 -0500 Received: from moss-pluto.infosec.tycho.ncsc.mil (moss-pluto [192.168.25.131]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id uAIGA7Na021692; Fri, 18 Nov 2016 11:10:07 -0500 From: Stephen Smalley To: selinux@tycho.nsa.gov Subject: [PATCH] checkpolicy: treat -self as an error Date: Fri, 18 Nov 2016 11:13:02 -0500 Message-Id: <1479485582-7028-1-git-send-email-sds@tycho.nsa.gov> X-Mailer: git-send-email 2.7.4 X-BeenThere: selinux@tycho.nsa.gov X-Mailman-Version: 2.1.20 Precedence: list List-Id: "Security-Enhanced Linux \(SELinux\) mailing list" List-Post: List-Help: Cc: Stephen Smalley MIME-Version: 1.0 Errors-To: selinux-bounces@tycho.nsa.gov Sender: "Selinux" X-Virus-Scanned: ClamAV using ClamSMTP checkpolicy wrongly handles "-self". At the least, it should handle it as an error. At best, it should support it correctly (which would involve libsepol support as well). At present, it looks like it will end up negating (-) the next type/attribute in the list after self, or if there are no entries after self, ignoring it entirely. This originally was raised by the Android team, which wanted to support something like the following: neverallow domain { domain -self }:dir search; to prohibit cross domain access to some resource but allow access within the same domain. This change just makes it a fatal error during compilation. Implementing real support for -self is left as future work. Signed-off-by: Stephen Smalley --- checkpolicy/policy_define.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/checkpolicy/policy_define.c b/checkpolicy/policy_define.c index 128869c..8b56a29 100644 --- a/checkpolicy/policy_define.c +++ b/checkpolicy/policy_define.c @@ -1978,6 +1978,11 @@ int define_te_avtab_xperms_helper(int which, avrule_t ** rule) while ((id = queue_remove(id_queue))) { if (strcmp(id, "self") == 0) { free(id); + if (add == 0) { + yyerror("-self is not supported"); + ret = -1; + goto out; + } avrule->flags |= RULE_SELF; continue; } @@ -2437,6 +2442,11 @@ int define_te_avtab_helper(int which, avrule_t ** rule) while ((id = queue_remove(id_queue))) { if (strcmp(id, "self") == 0) { free(id); + if (add == 0) { + yyerror("-self is not supported"); + ret = -1; + goto out; + } avrule->flags |= RULE_SELF; continue; }