From patchwork Tue Apr 4 14:47:38 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Stephen Smalley X-Patchwork-Id: 9661861 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id CDE786032D for ; Tue, 4 Apr 2017 14:44:38 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id C7EB5284F3 for ; Tue, 4 Apr 2017 14:44:38 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id BCC612851B; Tue, 4 Apr 2017 14:44:38 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-1.9 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_NONE autolearn=ham version=3.3.1 Received: from emsm-gh1-uea10.nsa.gov (emsm-gh1-uea10.nsa.gov [8.44.101.8]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 6275F284F3 for ; Tue, 4 Apr 2017 14:44:35 +0000 (UTC) X-IronPort-AV: E=Sophos;i="5.36,275,1486425600"; d="scan'208";a="5580298" IronPort-PHdr: =?us-ascii?q?9a23=3AXE8fwR84G2WHe/9uRHKM819IXTAuvvDOBiVQ1KB5?= =?us-ascii?q?0OISIJqq85mqBkHD//Il1AaPBtSFraocwLeH+4nbGkU4qa6bt34DdJEeHzQksu?= =?us-ascii?q?4x2zIaPcieFEfgJ+TrZSFpVO5LVVti4m3peRMNQJW2aFLduGC94iAPERvjKwV1?= =?us-ascii?q?Ov71GonPhMiryuy+4ZPebgFJiTanfb9+MBq6oAXVu8ILnYZsN6E9xwfTrHBVYe?= =?us-ascii?q?pW32RoJVySnxb4+Mi9+YNo/jpTtfw86cNOSL32cKskQ7NWCjQmKH0169bwtRbf?= =?us-ascii?q?VwuP52ATXXsQnxFVHgXK9hD6XpP2sivnqupw3TSRMMPqQbwoXzmp8rxmQwH0hi?= =?us-ascii?q?gZKzE58XnXis1ug6JdvBKhvAF0z4rNbI2IKPZyYqbRcNUUSmpbWsZaSjJPDIWy?= =?us-ascii?q?YYASC+YNJPhUo5X4q1YIsBCwBxSjBPn3xzFLm3H43bM03eojHgHI2wwuGN0BsG?= =?us-ascii?q?zWodnoOqodTe+7w7fTzTjYc/NZwi3w5JTSfxw9o/yBW697f8rLyUkoEgPIlkie?= =?us-ascii?q?qZD7MDON1uQCrW6b5Pd9W+KqkWEnrwVxrSavx8wxjYTJnZ8aykvf+CVlwIc6Od?= =?us-ascii?q?24SElhbd6iC5tfrTuWN4RxQsM8WmxlvjsxxLMBuZ6+ZicKyZInygbZa/ycaYeE?= =?us-ascii?q?+B3jVOGPITp+mXlre6q/ig6v/UWvxeDwTMm53EtQoiZbndTAqGoB2wHV58OaUP?= =?us-ascii?q?Vy5F2h1iyK1w3L7+FEJl07mrTDJp46x74wioITsUPeHi/qgEn2jLGZdkEj+uWw?= =?us-ascii?q?9+ToeK/mpp6BN49vkA3+LqQvldC/AeQ/KAQOWXSU+f+g27H5+E35QbFKguU3kq?= =?us-ascii?q?nfrp/aOdwWqrO2DgJayIou6wuzAy243NkXg3ULNk9JdAqCj4fzOlHOJP74De24?= =?us-ascii?q?g1SpiDpr3O7JPrngApXLM3jCn67tcq16605Bzgo80c5Q54lPB7EdIPP8Rk/xtN?= =?us-ascii?q?vCAh8/KAy72fzrCNp61oMAQW6PGLOWMLvOsV+U4eIiO+uMZIgTuDnnN/gl5+Th?= =?us-ascii?q?jXkilF8feqmp254XZ2qjHvR6PUqZe2Hsjs0GEWcQsQo0VPbqh0GaUT5Pe3ayWL?= =?us-ascii?q?ox5jM5CI28EYjDRZutgLuH3Ce6AJ1bfW5GClSREXbnbIqERvEMaD6PIsN7lTwE?= =?us-ascii?q?T7ehQZc71R6yrA/616ZnLu3M9ywWtJLj0N116PPJlRwp+zx7EdmS02aXT25uhm?= =?us-ascii?q?MIXTg23KJhrkNh1lePy694g+ZXFdZL/fNGTh86NYLAz+x9E939Rx7OftKOSFag?= =?us-ascii?q?XtWqHCo8TswvzN8UYkZ8GtKijhbZ0yqsHbAVi6SBBIYo/aLEw3jxO8F9xm7b26?= =?us-ascii?q?k9lVYmWNBCOnGhhq566wfcHZXJk1mDm6asa6scwDbH9H2fwmqWoEFYTAlwXL3F?= =?us-ascii?q?XHEeYUvWq8/05kbGT7O3CLQnNBFNyciYJatQad3pjEtGS+n5NNTYfW2xh3+6BQ?= =?us-ascii?q?yUybOUcIrqZ2Id0T3DB0gciQ8T53eGNRMlCye5uW3eFj1uFUn3Y0Po6+ZxtG20?= =?us-ascii?q?QlUzzwGQYE1rz6C19QINhfyAV/MT2aoJuCk7qzpuGlayw9PWC8GbqgpkZKVcYM?= =?us-ascii?q?ox4ExJ1GLCrQB9OYagL696jF4Ebwt3p1/u1wlwCohYksgltnAqzA1vKa+D01NO?= =?us-ascii?q?bTCY3ZftOrHNLWny5h+vYbbM2l7CyNaW5rsP6PMgplr5oQ6pDEsi/Gt909ROyX?= =?us-ascii?q?ST+pDKABAVUZLrXUY97wJ6qK3CYikh+4PU0mVhMbK6sj/Y3NIpH/clxw27f9dZ?= =?us-ascii?q?N6OFGgryHNccB8S0LuwlhUSpZAoePO9O7K40I9+md/ye1a+lJulgmC6mgnpd4I?= =?us-ascii?q?BmyU+M6TRzSvTT0JYYxvGUxAyHVy3zjF25qMD4hZhEZS0OHmq40SXkGJNeabBz?= =?us-ascii?q?fYkRDWejONG4xtJ7h5HxQXFY70KjC0kA2MC3ZRqYd0b90hFI1UQLvXynnjO1zz?= =?us-ascii?q?p1kzEtqqqQwjfOzv/4exUZIG5LQ3NujVD2IYi7l9oaRlSnbxA1lBu54kb337Zb?= =?us-ascii?q?pKVjIGnPRkdIZTL6IH1iUqu3sLqCbNVC6JcpsSVRSuu8e1eaRqT6oxsA3CPpB3?= =?us-ascii?q?FeyywjdzG2ppX5mAR3iGacLHZosHrVYNpwygnb5NzdQ/5RwzUHSTJjiTnPB1i8?= =?us-ascii?q?Odip8smPl5vZtOCxSX6hXIVJcSb31YOAqDe75WpyDB2lmPCzntnnHhYg0SDn0N?= =?us-ascii?q?lrWz7FrA3hYob3zKS2K+VnflNnBFXk8cp1Bpl+kpcshJEXwXUano+a/WcDkWvp?= =?us-ascii?q?K9pXw7nxbH0JRT4XxN7V5hPo2Eh/InKPwIL2Sm+Rws1/aNmmemkWwD4y79hWCK?= =?us-ascii?q?eI67xJhSh1rUS+rQLKevV9nSkSyf016H4cne4JpBAhziKHArAdBUNYJzDjlwyU?= =?us-ascii?q?79Ciq6VafHivcb6t20dlg9ChCqyNogFGVHb/ZJgiATd67t9jP1LUzH3z9obkdc?= =?us-ascii?q?HIbd0Jqx2UlwzNgPRUKJItlvsGnCRnNnj7vXE/zO47lxNu14mgvIebM2Vt4L65?= =?us-ascii?q?AhlAOz3tfcwT5zXtgrhGnsmM2YCvAotuGi8QUZv1VvKnDigSte/9OwaVFz08t2?= =?us-ascii?q?2bFqbBEg+R70dmtX3PHI6xO3GROnYZ0c1oRAOBK0xHnAAUQDI6k4Y3Fg+wwszh?= =?us-ascii?q?bEB55jUK6172tBRD1+VoNwPlXWfHvgeobTU0R4aDIxpK9A1C4F3VMcOG5OJpAy?= =?us-ascii?q?5Y5oGhrBCKKmGDYgRHF2UJWkiaCFD/Irmh/8PP/vOeBuWgM/vOeqmBpvZGV/iW?= =?us-ascii?q?356v1JVp/yqUPMWVInZiF+E72lZEXX1hAcTVgTsORzYSly3Xa86boxe99zZtoc?= =?us-ascii?q?+j9fTnQgXv5ZGAC7FKK9Vg5wi2gbufN+6XnCt5JyxY2Y0Ryn/T0rcf2kISiyZ1?= =?us-ascii?q?dzS2C7sPqSvNQLjXmq9NAB4RczlzO9dQ76IgwglNPtbWitXv1rFilv41E0xIVV?= =?us-ascii?q?LgmsGzfswKP2+9NFLBBEmRMrSJOTzLzNvzYa+mTr1QlupUvQWquTmHC0/jIiiD?= =?us-ascii?q?lz7xWhC3L+5Dlz+UPBpfuIGhdRZgEmnjQ8z4ZRKlKtN3iic2wbIsjHPQKWEcKS?= =?us-ascii?q?R8c19KrrCI8CxYmetwFHZO7np/N+aEhT2U7/LCJZYVrPtrGD57m/he4HQnzbta?= =?us-ascii?q?9jtESOVpmCvVrd5vo1amnvOJyjV5TBpEsixLi56TvUV+JaXZ8YFNWW3e8xIT92?= =?us-ascii?q?qQBAoFp8B+B930oa9Q1MLAlK3tJzdZ6d7U+9UTB9TMIsKdLHUhKQbpGCLTDAYd?= =?us-ascii?q?VjGrNG7fh0tbkPyJ63KasIM1qpn2l5oIULNbU0Y1FvwCAER/ANMCOIt3Xi8jkb?= =?us-ascii?q?ODlsEI6mCxrAfPS8hBuZDHTuydAfPqKDmDjLlEYwAHwbT3LIgJMY37wUNiYEFg?= =?us-ascii?q?nIvWA0rQQcxNoip5Yw8op0VN9WJyTnc020PkdAyt5mQcFeSznhEoiQtzevgi9D?= =?us-ascii?q?Dp41grPFXKvzcwnFM3mdr7nTCbaCTxI7uoXYFKFyr0sFA8MpD7QgZxcwK/hklk?= =?us-ascii?q?NDDKR7JfkbRgaXxriA/buZtKB/FQV6tEbwEMxfuPffUnzUxcqjm7xU9A/ebFD4?= =?us-ascii?q?VtmxEucZO3rHJA3BljbMIvKqzWP6pJzVlQiriIviC2yuA72BUeKFoV8GOOZC4I?= =?us-ascii?q?v1QFNqM4KCqz4ONj8xaClCdDeGUXTPUqo+hq+V46O+SO1yLgyaBMK0CrO+yZMa?= =?us-ascii?q?yZp3DKldSUTVMoykMIi05F8KBr3sckdUqUUV0gw6WVFxQILsfNMx9ab9BV9HTJ?= =?us-ascii?q?eiaOq+rNy4pvP4qhDuDoUfOOtKEMj025BgkpAYUM4dkaHpS3yk7YN93nLLkLyB?= =?us-ascii?q?U2+gvkOEiFDO5IeBKXkDYLuce/w4Fr3YNFPDESHX19MTmr5rbQvgIqhP2DXM0o?= =?us-ascii?q?bXccX4oEMWk7WMK8my5EpXhACyO30u0BwgiY8zD8vjjQDCX7b9d7f/ebexdsCN?= =?us-ascii?q?Cw+TUi/Km7kkLY8pLbJ27mL9tiocPP5fkcp5mZF/NeVaN9vFvEm4lEW3yqVHbC?= =?us-ascii?q?Ed2vJ5nwcYYsa8D0CnahX1ywjDI1V9v+MMyrLqeWnQHiXZxUv5WD3DA/Kc+9ES?= =?us-ascii?q?kTGwtxp+EG46J8eQ0DYpogbBH1tgQ/N7awLxyC3tWoXWmtNSNcT+NDwuWie7xX?= =?us-ascii?q?0y0sY/egx3skT5E10/e4/lYIRJAKiBHewvCjaJNFXCfoG3xSYQPPqTM3l2h8LO?= =?us-ascii?q?oyxPkwwA/Qu1kGLz+LbPBpaHBDv9wkHlydP3N2B3EiSFCBk4rM/BSs36sI8CtH?= =?us-ascii?q?n9dYy+pFsGLxvpXHejKjRLSrqYnJsyonddUmrLBxMY3nIsuCqpzemyfSQ4TOvQ?= =?us-ascii?q?KeUS61DfxalsJXICJCT/lCgXslNtAeuYpd9UoxUd8zJ6ZJCKktur+qaT1kDSoJ?= =?us-ascii?q?zSEBTo2OwSYMj/u71bbBihiQd5EiPwAev5VZntsRSSh2bT0CpKW7TYXZi3eESn?= =?us-ascii?q?QXIAcU9QlM/h8PmZJrc+Dq5YrJQ4VAyzhIrPJoSiHLDIVn90PnSmGKhlj1UO+h?= =?us-ascii?q?nPaz3QJV1/3hycUbWARlBkhD2elWkkooKLd4K6kUv47KvT+IdV/0vG330uumIU?= =?us-ascii?q?NdycvKeF3kFIDFr3bzUjUA+X0IQo9C0H/eGY4OnAp5aaYroVRML5qlekvl5jwr?= =?us-ascii?q?2ZpmEKeiWcCs3VYlom4MRz22HNpZF+FmrFXXVSV/bJCxtZXlPY9eQmxL9Z2cql?= =?us-ascii?q?dZkVltPDWjxZpaNc5N/iYGXCJTrjWFoNuyVMpD1Nd3D58KPtdwpXP9F71BOJeP?= =?us-ascii?q?v302oLzux2Te+zAkrli6wjCzFLW5T+Jd5GIeHQooK36Zqkk1AOsm6n3S/UzVsl?= =?us-ascii?q?Bo4+dbAaCCjUproDlnGJBOGi1E1XGiL1V9SnlGr+VaJ7rUc8xaX/k9ewWvNwY4?= =?us-ascii?q?FfE4w0yD5Vt0kmvhYyxuqgta/DjQXxUzVSkQmbrthSESqsS8NjMATZJHcykhZT?= =?us-ascii?q?/fKw2HgSBXoApfa0ZyVpAZGNlF4asU3Y9J8cfZVEmjNzkFXAR8OQI8z/Vfj1RP?= =?us-ascii?q?sEKCeSDSFQCob+rAsgVrfceNq86kNPb5/ABZhY78re836b4DSGO8mQ2xX9/Rsp?= =?us-ascii?q?XwttuUuUuSbK34KfGzYWfdTDjQihC9nawrD5fW8CTPMgdXNpd3xGE4bpjmDG7E?= =?us-ascii?q?IQ5JJ7kHJ0ZBU6B1d8lGqPhAZ8B4YKYJ5bNtBhWfSxP1BoOgsflGIUzPRTnFKy?= =?us-ascii?q?WB9fK/rpzN4bPBTujve9KDy2zBQ61pIpdw8SP7FKvy0Y9C5kr23e9g9lthSVja?= =?us-ascii?q?KS+OscjhKxgQ5Mmla0vipIEmEi3QAJdsinri3EVAe9AQQy2w/5QS0IlZ52roSe?= =?us-ascii?q?Jkzkjzt/Vf96V+6YYp/b9m1Ny5JbrWKfRGq09oGAaUBgRt9pUpHmd/W3pdYugL?= =?us-ascii?q?KPfeZa4Zl9zhq/jrF6wL7x2Y4/FWad3dKEzah8a/DCuTRQZDnAcbpj4QNhGc2O?= =?us-ascii?q?Kdm69oVcalovD02kA37FikKR4G17Rt6p2a+qeToe/Xch/RzaQFWqf2R8P8tLIs?= =?us-ascii?q?u1iI6f0jjr4OdXR/Yxe7H+gFSs4d2mDgwLgozS02FcPDEajg+PleWH0nhT/gh4?= =?us-ascii?q?pyH1MNGvMTB7aL+5pRnnsgkezDKtIWarxCmnqIFRO8FL8CzWWm6yqRIGlgmB3O?= =?us-ascii?q?0hfwQW2p7FDsti94XTHMz8r/nUpJS7m3H1ldUzCuOU9ivzOFJBDou8bvuaQp8E?= =?us-ascii?q?E2NXTptNSMlGS9P7NXG9fwJMeGLSk1o1IXi4YxRse01IAeFte8L80d8HZkbvvR?= =?us-ascii?q?82mriTNOo79bh4rC5cGY4unYEmOkj6KEsLWN2DBZyn8jsFEk9t+gN+/B59uWQ/?= =?us-ascii?q?SpzWkdVSF/tBXdXxStsLzUs0gUOVCX0EfMgIEKOspZ3Xw420z96ugsXs889AJE?= =?us-ascii?q?Fonaf/MCvzfzODnqzlmDf9I7TC6e0yFYHljtC1l3BLA82H7svMLOjXrQ+VwoRo?= =?us-ascii?q?xrekzimxN2D5s3KVgs6FgRzSoPCw4NZg6HDLuwH0TqMZMEVVQfaRSAxLW6e6Y2?= =?us-ascii?q?0ldpzbyz/+LTdvJzB7YTOflBlAKOm0JbGp0Ou60EXL18Y0Nd9LLQpgX6EIfnXu?= =?us-ascii?q?PmlHQqOv23Q8Ba7dgZuGE/4ga7XBev9ZBD4KsFh5+Sa65Ee5/MvNpm4Et94j4P?= =?us-ascii?q?bCNNigBljxylSeAcuPzj4t/DvZqw8OmuSLoiR+UZ9hgzHWR+jIL8gEs9rtHT1u?= =?us-ascii?q?dcTJDViIvk/QBVOXGKpJrV0xlyKOoJMYKrf6xs93YZKCgEIXIBI96WZ+M74y93?= =?us-ascii?q?PzXZ/0ZCDd8UZdMEIMrNnhhZilHzWL5N8srUAFmYBJloes817mr3xzE18YcmXe?= =?us-ascii?q?b78jC2P43f40tLP/xdkCVmjMjCq/QNwfrOFCgX5mGUaxdvzSOY1ZaNF/bw8P6I?= =?us-ascii?q?yNHVS1MJAC42XJ1AJDqZ4wCnQPS6lInxWAOO9sDzmI4+dF6XRnGpk6QKrKBMEf?= =?us-ascii?q?JHiiX82TReDZ76h/aUs9qq9WtWuUZKEIJt4h3fGKRQJI93ORLmmcm3XkJ8HDfw?= =?us-ascii?q?eNnIdhoyv+qb3vsD4+dkOETifoIUPhUEy7b+6XpUUARuUqL2sUiFUuIRftdmT+?= =?us-ascii?q?nErn9N44J6N6APJESdpIDtrjpQrVA2BwkpaKM/rjNEbUTOmQxVVLzyuLEelgsd?= =?us-ascii?q?X9l5uVVPGWKrIm4+4STIVbhNhqmLFPMV6imTTrAJU0hwPSNxXwi12I53d7W0kv?= =?us-ascii?q?5JtGJGniVgoPklyDFmSx68tjfqp60Twz4g/6u4tDoZs3xfUuqeizvICUlEzPkS?= =?us-ascii?q?j6ccDHbi6VqmbHYfbIvy5KRnKtnh9Ikg5XQ/ehYjfywdUOS+CiHwkbmHAoiSv9?= =?us-ascii?q?JdnhKNvtvBbaOrJygIKrs90Q7jR2R60gXGnRZo7nEEQjO74d8gOYWyJMclxi2z?= =?us-ascii?q?GWTBc1YM+KxJutPrtVEXVOs2dU9hwGJ738iFWCINSsLPG2Iugwkqc2pEdoxM6Q?= =?us-ascii?q?MAG6kunDmIorFM/hsIbzfMDoSl5o7QkN/H2Xk5StdryHzZpqmBhp4xy31lnNV0?= =?us-ascii?q?7i+St3gIcezXTdNsCGDp1ohD0ez+e+mtsucfRYtkyLSgUOcCMs6n+Wu3xJVlRF?= =?us-ascii?q?SoxrEfH1qlKu8M2K3XUyC/SW2XQe6LaXSDny4lMk7u4hmlNkE3aMZPr0ImLuvC?= =?us-ascii?q?h4JTlw7/XrNwXCmQo0HUzHA7O+MAaw02oJunexANTOMJYuicJOsuwP45CFYXbX?= =?us-ascii?q?/GByh2C+iwsVGzmoh3IXNg7lvmYe716ADpLMOSGgUYEY7dtpN+4uK1RmSdOXJ7?= =?us-ascii?q?1x1yOE509/vDF1QvqOBTboydnd/Kh9R0yeQFbetiMTUhut4PnYJu8ZGU0MCOcR?= =?us-ascii?q?7L1JbzK9bVovyWA/DEykQqfWZaUqEHbgzp/YU6OcU5W6bSHbtfshQQH686QIYu?= =?us-ascii?q?N23p7qF7MBtzchLNZLSzmsTqqPyEZp9Vp3/O8F09NybduxwGyvyxUwN7dZSqiG?= =?us-ascii?q?voLJA3XDJBoMVnCgF6E4tXB8MAsw2nDoaamaGjkd+x+l91tPERvKr1C/DKyM65?= =?us-ascii?q?0JtrU5hd/0yLMy7bBLN3jUR9kuSynvDA34H2CcPmZ9wJT/B7QmrfZb/dAoW/Ky?= =?us-ascii?q?6BOt7me0FY7bGQyrR5XQuNZCrhRaqJqDWkNOl44UU80oF4eOvTzDow77DUwdfy?= =?us-ascii?q?Y2Bbpjy/rX6SL5Zf7UbFBerZXx5OTvqF6mllF7UNbYTo7OcOLcAiwN+E7glo8j?= =?us-ascii?q?tC1MqFI668rk7D3U51eo7bLEv31CYjR4YKOA6wPFAvgWDHsHTdB2pTLsy/Jslw?= =?us-ascii?q?j9aZFBvt51N+mWs1fG5OBnLoRcuNOWgcw8++YReF+x5LD9YCme63flU1trOzSe?= =?us-ascii?q?luJJpFneSqtLMakddmMS3PQ9JaPy7IJr9sIjVRFvnPpEQvYhMcsbg6QIQ1ZZ+V?= =?us-ascii?q?L04cLUeAzz/yzQvF0U3peNys1LqJLDwQ8npZ07LPySJMqBWhufaFns3jV6jUY4?= =?us-ascii?q?rtU/LVNColVyqaRSgpEUqz4lerpeYLsOCDIWgBplAUYySSCBMcp610sdfRDnXT?= =?us-ascii?q?mfB4fJEQivGVQTzwSDZ/lKo0HCpLslqMQ/UbHwnMc3DhmHZcuBClJvJU8nLqda?= =?us-ascii?q?aXxrBUW+MIBotBaeOZQ9/CdvBFJjcoiy8VOOCicN3At7w5yE7HTXMFE6nU812T?= =?us-ascii?q?VEyWQvmbxzLxR4UVvpM0tzEu+t3Kmy94DaXIM6yYpz60/Y6ylDyYtvHGVmkxf0?= =?us-ascii?q?w1h/oPAHKPwBlFNG4JCtIYtVrzQqGefUZM1XMoieVo2xMWfgR8TGFu2GVMnPmh?= =?us-ascii?q?As1ZVUIUjGS2Tf0Ea1B3Cjcw8FSP4gLsfNMAt8fTR3VC+bQSU4YdKucn6JWEcJ?= =?us-ascii?q?YW2+sjiSNtoCt8tT6USVxakFG59P/qFaJ5z7FDrVUi/vR/WEiJTzqXJnLb0Iuj?= =?us-ascii?q?AsRG7TploDbp29eC+qhSNb9epoh8SG0NCy9sOsuVqTpAVWWy002ouBy2BiiFCD?= =?us-ascii?q?0c6TcPYycCc7Axh9Vmqw3FctKJwkSTurhp/FG2Eh2GDr6c05tIB9uv3gK9LyBW?= =?us-ascii?q?J2aFDZdz/81Rmc4SbKVvXo23B1TMP0CqFQ6Dkzwd/xjt5LKwBIxFxXtIwfZkE8?= =?us-ascii?q?3gQ4RfVYqR5zp/2XsdgcNVlWA=3D?= X-IPAS-Result: =?us-ascii?q?A2GOAgBQsONY/wHyM5BcDgsBAQEBAQEBAQEBAQcBAQEBARU?= =?us-ascii?q?BAQEBAgEBAQEIAQEBAYMAKWGBC4NjiwWPOQEBAQEBAQaBI5cePyMDgXeECRyDJ?= =?us-ascii?q?VcBAQEBAQEBAQIBAmgogjMEAgMZAQQIRiYxAQEBAQEBAQEBAQEBAQEBARoCHhE?= =?us-ascii?q?hAQEYAQEBAQIBAQIgERogCwMDCQEBCAINAQYEAgIiBAICAgEBLRUBEAYBBwsFG?= =?us-ascii?q?ASHZIF8BQiQJZ1cgiYmAoo0AQoBAQEkgQuEfoU0hCYRARyDBoJfBYkZhk6BTYR?= =?us-ascii?q?mhlOGfYtTgX1VhFmDTQyGOJN1WH0IHAkCFAgeD0GEWR2BJllZhm1HgWcBAQE?= Received: from unknown (HELO tarius.tycho.ncsc.mil) ([144.51.242.1]) by emsm-gh1-uea10.nsa.gov with ESMTP; 04 Apr 2017 14:44:34 +0000 Received: from prometheus.infosec.tycho.ncsc.mil (prometheus [192.168.25.40]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id v34EhkWF012522; Tue, 4 Apr 2017 10:43:58 -0400 Received: from tarius.tycho.ncsc.mil (tarius.infosec.tycho.ncsc.mil [144.51.242.1]) by prometheus.infosec.tycho.ncsc.mil (8.15.2/8.15.2) with ESMTP id v34EhhsA266751 for ; Tue, 4 Apr 2017 10:43:43 -0400 Received: from moss-pluto.infosec.tycho.ncsc.mil (moss-pluto [192.168.25.131]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id v34EhhCn012519; Tue, 4 Apr 2017 10:43:43 -0400 Message-ID: <1491317258.31785.11.camel@tycho.nsa.gov> Subject: Re: Running Java and JVM on SELinux From: Stephen Smalley To: Rahmadi Trimananda , William Roberts , Russell Coker Date: Tue, 04 Apr 2017 10:47:38 -0400 In-Reply-To: References: Organization: National Security Agency X-Mailer: Evolution 3.22.6 (3.22.6-2.fc25) Mime-Version: 1.0 X-BeenThere: selinux@tycho.nsa.gov X-Mailman-Version: 2.1.20 Precedence: list List-Id: "Security-Enhanced Linux \(SELinux\) mailing list" List-Post: List-Help: Cc: selinux@tycho.nsa.gov Errors-To: selinux-bounces@tycho.nsa.gov Sender: "Selinux" X-Virus-Scanned: ClamAV using ClamSMTP On Mon, 2017-04-03 at 19:12 -0700, Rahmadi Trimananda wrote: > This is the result of "dmesg | grep avc". Please let me know if you > need more information about my system (RaspberryPi 2 running Raspbian > Jessie). > > [    2.275229] audit: type=1400 audit(2.249:3): avc:  denied  { > associate } for  pid=1 comm="systemd" name="pts" > scontext=system_u:object_r:devpts_t:s0 > tcontext=system_u:object_r:device_t:s0 tclass=filesystem permissive=1 > [    2.577155] audit: type=1400 audit(2.549:4): avc:  denied  { > wake_alarm } for  pid=1 comm="systemd" capability=35 >  scontext=system_u:system_r:init_t:s0 > tcontext=system_u:system_r:init_t:s0 tclass=capability2 permissive=1 These two are harmless and allowed in Fedora policy. > [    2.601211] audit: type=1400 audit(2.569:5): avc:  denied  { > execstack } for  pid=95 comm="systemd-fstab-g" > scontext=system_u:system_r:init_t:s0 > tcontext=system_u:system_r:init_t:s0 tclass=process permissive=1 > [    2.601321] audit: type=1400 audit(2.569:6): avc:  denied  { > execmem } for  pid=95 comm="systemd-fstab-g" > scontext=system_u:system_r:init_t:s0 > tcontext=system_u:system_r:init_t:s0 tclass=process permissive=1 These two are undesirable for security. Suggests that your userspace binaries are legacy or built insecurely, with RWE segments. > [    2.605393] audit: type=1400 audit(2.579:7): avc:  denied  { > execmod } for  pid=95 comm="systemd-fstab-g" path="/usr/lib/arm- > linux-gnueabihf/libarmmem.so" dev="mmcblk0p2" ino=144391 > scontext=system_u:system_r:init_t:s0 > tcontext=system_u:object_r:lib_t:s0 tclass=file permissive=1 This implies that this particular .so file should be assigned the textrel_shlib_t type instead. > [    3.201440] audit: type=1400 audit(3.169:8): avc:  denied  { > execstack } for  pid=107 comm="mount" > scontext=system_u:system_r:mount_t:s0 > tcontext=system_u:system_r:mount_t:s0 tclass=process permissive=1 > [    3.201499] audit: type=1400 audit(3.169:9): avc:  denied  { > execmem } for  pid=107 comm="mount" > scontext=system_u:system_r:mount_t:s0 > tcontext=system_u:system_r:mount_t:s0 tclass=process permissive=1 > [    3.217575] audit: type=1400 audit(3.189:10): avc:  denied  { > execstack } for  pid=108 comm="kmod" > scontext=system_u:system_r:insmod_t:s0 > tcontext=system_u:system_r:insmod_t:s0 tclass=process permissive=1 These fall into the same category as the init_t denials above; not desirable; indicate legacy or insecurely built userspace. > [    5.291711] audit: type=1400 audit(1491249900.889:59): avc: >  denied  { mmap_zero } for  pid=243 comm="alsactl" > scontext=system_u:system_r:alsa_t:s0-s0:c0.c1023 > tcontext=system_u:system_r:alsa_t:s0-s0:c0.c1023 tclass=memprotect > permissive=1 This along with your java denials raises a question about your kernel config, particularly the value of CONFIG_LSM_MMAP_MIN_ADDR. Should match the value of /proc/sys/vm/mmap_min_addr in general. Defaults to 32K for ARM, 64K for others. > [    5.304205] audit: type=1400 audit(1491249900.909:60): avc: >  denied  { execstack } for  pid=243 comm="alsactl" > scontext=system_u:system_r:alsa_t:s0-s0:c0.c1023 > tcontext=system_u:system_r:alsa_t:s0-s0:c0.c1023 tclass=process > permissive=1 > [    5.304582] audit: type=1400 audit(1491249900.909:61): avc: >  denied  { execmem } for  pid=243 comm="alsactl" > scontext=system_u:system_r:alsa_t:s0-s0:c0.c1023 > tcontext=system_u:system_r:alsa_t:s0-s0:c0.c1023 tclass=process > permissive=1 More evidence of insecure userspace. > [    5.306197] audit: type=1400 audit(1491249900.909:62): avc: >  denied  { use } for  pid=120 comm="systemd-journal" > path="/dev/pts/0" dev="devpts" ino=3 > scontext=system_u:system_r:syslogd_t:s0 > tcontext=system_u:system_r:plymouthd_t:s0 tclass=fd permissive=1 Harmless, allow. > [    5.355105] audit: type=1400 audit(1491249900.959:63): avc: >  denied  { execmod } for  pid=243 comm="alsactl" path="/usr/lib/arm- > linux-gnueabihf/libarmmem.so" dev="mmcblk0p2" ino=144391 > scontext=system_u:system_r:alsa_t:s0-s0:c0.c1023 > tcontext=system_u:object_r:lib_t:s0 tclass=file permissive=1 Label with textrel_shlib_t. > [    5.357519] audit: type=1400 audit(1491249900.959:64): avc: >  denied  { write } for  pid=243 comm="alsactl" name="/" dev="tmpfs" > ino=5104 scontext=system_u:system_r:alsa_t:s0-s0:c0.c1023 > tcontext=system_u:object_r:var_lock_t:s0 tclass=dir permissive=1 > [    5.357705] audit: type=1400 audit(1491249900.959:65): avc: >  denied  { add_name } for  pid=243 comm="alsactl" > name="asound.state.lock" scontext=system_u:system_r:alsa_t:s0- > s0:c0.c1023 tcontext=system_u:object_r:var_lock_t:s0 tclass=dir > permissive=1 > [    5.358083] audit: type=1400 audit(1491249900.959:66): avc: >  denied  { create } for  pid=243 comm="alsactl" > name="asound.state.lock" scontext=system_u:system_r:alsa_t:s0- > s0:c0.c1023 tcontext=system_u:object_r:var_lock_t:s0 tclass=file > permissive=1 > [    5.358671] audit: type=1400 audit(1491249900.959:67): avc: >  denied  { read write open } for  pid=243 comm="alsactl" > path="/run/lock/asound.state.lock" dev="tmpfs" ino=1816 > scontext=system_u:system_r:alsa_t:s0-s0:c0.c1023 > tcontext=system_u:object_r:var_lock_t:s0 tclass=file permissive=1 > [    5.358893] audit: type=1400 audit(1491249900.959:68): avc: >  denied  { getattr } for  pid=243 comm="alsactl" > path="/run/lock/asound.state.lock" dev="tmpfs" ino=1816 > scontext=system_u:system_r:alsa_t:s0-s0:c0.c1023 > tcontext=system_u:object_r:var_lock_t:s0 tclass=file permissive=1 Allowed by current refpolicy, commit efce2657e248b5b0ff61fc05e5cae036760a1294 Author: Sven Vermeulen Date:   Sat Jul 5 18:19:14 2014 +0200     Enable asound.state.lock support          asound.state.lock file when managing alsa state operations.          Signed-off-by: Sven Vermeulen > > On Mon, Apr 3, 2017 at 6:54 PM, William Roberts .com> wrote: > > Do you see any "avc: denied" messages in dmesg/syslog? If so send > > them. > > > > On Apr 3, 2017 16:28, "Rahmadi Trimananda" > > wrote: > > > Hi All, > > > > > > I am trying to run javac and java on my Raspbian while SELinux is > > > enabled. However, I keep getting "Segmentation fault", even when > > > I just run "javac" or "java". This happens in enforcing mode, but > > > it doesn't happen with "gcc". I am wondering why, because both > > > are in /usr/bin directory and both binaries have the same > > > context. > > > > > > Can somebody please help? > > > > > > Thank you so much! > > > > > > Regards, > > > Rahmadi > > > > > > > > > _______________________________________________ > > > Selinux mailing list > > > Selinux@tycho.nsa.gov > > > To unsubscribe, send email to Selinux-leave@tycho.nsa.gov. > > > To get help, send an email containing "help" to Selinux-request@t > > > ycho.nsa.gov. > > > > --  > Kind regards, > Rahmadi Trimananda > > Ph.D. student @ University of California, Irvine > "Stay hungry, stay foolish!" - Steve Jobs - > _______________________________________________ > Selinux mailing list > Selinux@tycho.nsa.gov > To unsubscribe, send email to Selinux-leave@tycho.nsa.gov. > To get help, send an email containing "help" to Selinux-request@tycho > .nsa.gov. diff --git a/alsa.te b/alsa.te index 814b426..6f7f2f9 100644 --- a/alsa.te +++ b/alsa.te @@ -24,6 +24,9 @@ files_tmpfs_file(alsa_tmpfs_t)  type alsa_var_lib_t;  files_type(alsa_var_lib_t)   +type alsa_var_lock_t; +files_lock_file(alsa_var_lock_t) +  type alsa_home_t;  userdom_user_home_content(alsa_home_t)   @@ -57,6 +60,9 @@ fs_tmpfs_filetrans(alsa_t, alsa_tmpfs_t, file)  manage_dirs_pattern(alsa_t, alsa_var_lib_t, alsa_var_lib_t)  manage_files_pattern(alsa_t, alsa_var_lib_t, alsa_var_lib_t)   +allow alsa_t alsa_var_lock_t:file manage_file_perms; +files_lock_filetrans(alsa_t, alsa_var_lock_t, file); +  kernel_read_system_state(alsa_t)    corecmd_exec_bin(alsa_t)