From patchwork Thu Apr 20 19:17:20 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stephen Smalley X-Patchwork-Id: 9691173 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id A136760383 for ; Thu, 20 Apr 2017 19:14:27 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 8B78D28491 for ; Thu, 20 Apr 2017 19:14:27 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 7E14F284DD; Thu, 20 Apr 2017 19:14:27 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from emsm-gh1-uea11.nsa.gov (smtp.nsa.gov [8.44.101.9]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id A515428491 for ; Thu, 20 Apr 2017 19:14:26 +0000 (UTC) X-IronPort-AV: E=Sophos;i="5.37,225,1488844800"; d="scan'208";a="5074103" IronPort-PHdr: =?us-ascii?q?9a23=3AAxG8jx3Np9PLYVQbsmDT+DRfVm0co7zxezQtwd8Z?= =?us-ascii?q?sewULvnxwZ3uMQTl6Ol3ixeRBMOAuqwC0LCd6vu9EUU7or+5+EgYd5JNUxJXwe?= =?us-ascii?q?43pCcHRPC/NEvgMfTxZDY7FskRHHVs/nW8LFQHUJ2mPw6arXK99yMdFQviPgRp?= =?us-ascii?q?OOv1BpTSj8Oq3Oyu5pHfeQtFiT68bL9oIhi6swrdutQYjIZiN6081gbHrnxUdu?= =?us-ascii?q?pM2GhmP0iTnxHy5sex+J5s7SFdsO8/+sBDTKv3Yb02QaRXAzo6PW814tbrtQTY?= =?us-ascii?q?QguU+nQcSGQWnQFWDAXD8Rr3Q43+sir+tup6xSmaIcj7Rq06VDi+86tmTgLjhy?= =?us-ascii?q?kdNz497WrZlMp+gqxGqx6lvhBz3ZLYbISTOfFjfK3SYMkaSHJBUMhPSiJPDICy?= =?us-ascii?q?YYwXD+cDIOpVoZfyp0AVoBeiGQWhHv/jxyVUinPq26AxzuQvERvB3AwlB98ArW?= =?us-ascii?q?jUo8vtNKcST++1yrTDwyjGb/xM3Tf97JbHcxA8qvyLRrJ/bNHRxFIzFwLFklqQ?= =?us-ascii?q?qYvlMymT1uQWqWeX9eVgVeWxi2M+rQx6vzuhxt80h4XUiY8YxUrI+CVkzIovO9?= =?us-ascii?q?G1R1B3bcS5HJZWqiqULZF5Qtk4TGFtoCs6z7oGtoOlcyUS05QnwgLfa+SAc4iV?= =?us-ascii?q?/hLvTOaRLil8hHJiYL+/mwy98VKhyu3hTcm4ykpKrypZndnMsXABzRrT5dScSv?= =?us-ascii?q?Rh5Euh3DeP1wTL5uFFJ0A7i7bbJoY8zrM/mZcfq0TOEjLslEnog6KaaF8o9vWw?= =?us-ascii?q?5+TieLrmp5ucN4FuigH5N6Qjgte/Dvo8MggPWWib5Ou92KT48k3+XbVKiOE5nb?= =?us-ascii?q?fCsJ3BOcQaprK2Aw9S0oo57Ra/FC2p3M4XnXkAMlJJYAiHgJTxO1HSPPD4Cu+y?= =?us-ascii?q?g1arkDdt3f/GIr3hDY/LLnXYkrfherB960tGxwoo0dBQ+YhUCqobLPL0QE/xu8?= =?us-ascii?q?TSDgUlPAys3+bnFNJ925scWWKNGKCWLKDSsUSP5uIpIumMepQYuDj5K/g46P/h?= =?us-ascii?q?lmI5mVkBfam0x5cXb2q4Hvt+KUWDfXXsmssBEXsNvgcmQu3qiVmCUTtNaHaoRK?= =?us-ascii?q?886C80B5+hDYfZXI+tmKaB3CC5HpJIem9GFkqAEXDyd4WLQ/0Mcj6dItd9kjwY?= =?us-ascii?q?UrisU5Iu2g2rtA/9zbpnMvfY9zYGtZ39zth15uzSlRY09TBuCcSSzX2NRXlunm?= =?us-ascii?q?wUXz82wLx/oUtlx1iezah3meZYGMdP6PNOVwc1KYTTz/dmC9zoXALOYMuJQk68?= =?us-ascii?q?Qtq6GTExUs4xw9gWbkd9GtSiiRbD0jGvA78RjrCLBZo0/rja33frPcZ9yHfG1L?= =?us-ascii?q?c/gFU8RMtAK3GmjLZl9wfPH47Jj1mZl6GyeKsHxyHB82ODzWuVvEFESw58S77F?= =?us-ascii?q?Um4DaUfMttT2+EfCT76oCbQ6PQpM0tKNK6tQat30llVKXvniN87CY2KqnGewAw?= =?us-ascii?q?yExrSWbIrlY28dxjnSCFAYkwAP+naLLRYxBj+7rGLEDTxuDkniY1v2/ulkqXO7?= =?us-ascii?q?VVc0zwWQYEJ9ybW54BkVheaTS/kLxLILpD8hqyloHFa6x9/WBcCAqBBnfKpAYN?= =?us-ascii?q?M9+0xK1WfBtwx8J5CgNK5jhkUEfwRwpUPu2A19Cp9cnsgysHMq0A1yJLqb0Fxb?= =?us-ascii?q?dDOY2o3wN6bUKmbo/xCvbLPW1kvZ0NaM9acF8O44pEn7vAG1Ckoi9G1q3MNI3H?= =?us-ascii?q?uG55XFEhASXInrXUkr8hh2vbbaYjMy54nMz31jLbG0siPe29IuHOYl0Rigf81Y?= =?us-ascii?q?MKOfCA//CNYaB86pKO0knlimdBQEMPpU9KEqI8Osb+GG17KzPOZ8gDKminxK4Y?= =?us-ascii?q?5n3UKI6ypzVPTI340ezvGGwASHTSzzjEqkssztnoBEfz4SFHKlySf4HI5RerFy?= =?us-ascii?q?fYETBGeyPsK429R+iITpW3ND6FGjAFYG19OzdhqJc1zxxwtQ2loLoXa/gyu30y?= =?us-ascii?q?R0ky01rqqYxCHOxeXidB4DOmFVX2lvlk3jLpauj9AdRkSoaBIplBS970bg26db?= =?us-ascii?q?vLh/L3XUQUpQYSj2Ln1tUre3trqYecJA9JMosSJRUOSzel2aTr/9ox0A3CP5GG?= =?us-ascii?q?tS3jc7dyulup/hhRx1lHqdLGpvrHreYcxwwRbf5MfARfJIxToJWi14iTjRBlih?= =?us-ascii?q?MNik5s6Ul4/CsuC4VmKuSoZTfTPtzYyeqCux/XdqDgGnn/Cvht3nFhA30TX819?= =?us-ascii?q?luUSXHsgz8bZXs16W0Ku9nZVRoC0Pn68ZgHYF+iIQwjokK2XcGnpWV4WYHkWDr?= =?us-ascii?q?PNVDw63+cX4NSSQRzNLP+wfl30ljLm6Ox4L/TXidx9dtZ9+9YmwKwC496d5FCL?= =?us-ascii?q?uM5rxegSR1uka4rR7WYfVlnTcS1/0u6GUBjuEKpgUtyD6dArYMEklEJyDskA6I?= =?us-ascii?q?79+mpqVNeGmvaaSw1FZ5nd25ErGCpBxTVW3nepckACBw7t9zMFTS333v8ovkYs?= =?us-ascii?q?XfbcoPth2IlBfNl/BVJ4gslvoOnidoJWP9vWElyuIigxxhx5e6sJKAK2V386Kz?= =?us-ascii?q?GgRYOSHtZ8MP5jHtir5Tnt6M0ICyGpVuBC0LU4HuTfK0Dj0Sr+/qNxuVEDIisH?= =?us-ascii?q?ebAqDTHRSY6Ed7tXLAD46kN3+QJHkDwtVtWgORJEpBjwAIRD86hII2Fhi2xMz9?= =?us-ascii?q?d0d0/j4R6UT+qhtQzeJoMgLyUmnBqwi1bTc0UoKQLAJM7gFF5UfaL9CR7v5pEy?= =?us-ascii?q?Ff5J2hoxSHKnaHaARQEWEJRkuECkjmPra04dnA9/aXBvaiL/TUe7qDsupeWOmU?= =?us-ascii?q?xZK0zoRp5S6MOduVMnlkEfI7xlJJXWplFMTBhzUPVysXmjrXb8KBqhaw4Ch3od?= =?us-ascii?q?q78PTsWAPi/pGABKdXMdl1/BC2m6iDPfaKhCllMTZYyo8MxXjQxbgRxl4dlTxh?= =?us-ascii?q?dyK3HrQGqS7NS7nQl7RNABEHbiN/LsxI77gz3gNVI87Ulsv11qJkjv4yE1pFU0?= =?us-ascii?q?bhlduxZcwSOGy9OlLHBFyQNLSaKz3Lwsf3brm6SbJMjeVbrRmwtSycE0/5MTSJ?= =?us-ascii?q?jyPpWAy3MeFQkCGbOwRTuJmjfRl2F2fjStPmagG8MNJsjD0536M7iW3QOW4bKz?= =?us-ascii?q?h8fFtHrqeM4iNAnvV/B2tB42J4IumfhSmW9ebYKowMvvt1GSl0jPhV4Hcny7tP?= =?us-ascii?q?9i5IXvh1mDbUrtF0uVGqi/WPyj1kUBtOrTZHnoSLslt+Oa/B7JlPRW7E/A4R7W?= =?us-ascii?q?WXExkKvMFqCsP1tKBf1NfPj7n+KCxY/NLK58QcCNbbKNmdPHonLxXpBCbeDBEZ?= =?us-ascii?q?Qj6zKWHfm0tdnemJ+X2UoZg6rZ7slYETRbBFT1M1F+kVCkJ/ENwFOpd3USsuka?= =?us-ascii?q?SHg84Q+Xq+sB7RSd1AsZDITP2SH+vgJS2ejblceRQIx7b4Ip4SNo3/wENibVZ7?= =?us-ascii?q?kJ7NG0rKUtBHujdhYRMsoEVR7Hh+SXU+217iagOo+nMTD/m0nx8ohQt4eust7j?= =?us-ascii?q?Ds7Ek0JlfRuCQwl0wxlsn/jjCKbD79NqGwUp9KCyDsrUg+Lov7QxppbQ21hUFk?= =?us-ascii?q?NzfFR7ZPgLZ7cGBrjwHcuZVRFv5AUa1EYBgQxfSJaPky11RTtDmnz1dd5eTZEZ?= =?us-ascii?q?tiiBcqcZm0onJGxQ1sdto1KLfTJKpO1VhQmriBvimz1uAywQ8SPUAN/32OeCQQ?= =?us-ascii?q?okwHKqEmJza0/uxr8QGCgSVMeHMSWPUwuPJl6kM9Nv+bwCLhyb5MN0exN+KHL6?= =?us-ascii?q?ODpWfBldSEQlUu2UMUj0NF56R50d8/c0qIUEAi1KaeFxMPNcrENA5acc5S9HnI?= =?us-ascii?q?cCmUr+rN25V1M5+6FuDyQu+ErLwUjV68HAY1A4QM6dwMEYS230HGLMfoMaUFxA?= =?us-ascii?q?436wTxPlWFC/pIeAmVnzgbvsG/1p533ZVdJz0HB2VyLzm37K7NpgA2mPqDQMs2?= =?us-ascii?q?YnACU4sAMXI2QtO1myhYvnRHFzS33eQZyBWY4z/7vCTQAyH2b8B/a/eMeRNsFN?= =?us-ascii?q?a29C0k86eojV7X85PeJ3z1NNl5ptDP7uYaqIqdBPNPUblxqUHclJdER3aySW7A?= =?us-ascii?q?Dca1J4Tsa4krddH0CWy6U1ylhDIzU8fxPM2gLqePgQHwWYlYqo+b0y4/NcWlDD?= =?us-ascii?q?ERBw9wp/0f5KJ7fQADf5s7YRvvtwQiN6y+IByV3civQ2etMzRZVONTzeOkaLxL?= =?us-ascii?q?1yAsdPO1yGM8TpEmyOm66VQCRJULjh7C2/msf4xeUCj1GnxafQXAvzE0mHNgNu?= =?us-ascii?q?koxOcz2R3IsUQGPzCNauNpdHROv8sgClOKPXV2Fm04SkeHgoXd5A6hxKod8DZD?= =?us-ascii?q?n9lKy+1Fq2LxvoXfYT62X6yrs5rVuTI6bdc6u61xLZDjIsyeuZPRgzzfTZ3Qsg?= =?us-ascii?q?mbXy6/DPdVh8ZfLzlZQPZSn2EpI8sGuZBO6UApTMcxO6RPCLUwprCtcTdkFygS?= =?us-ascii?q?zS4FWIOA2zwChvy81aPDmBmNapovLBsKvY5ejdsaVi55fjkRpLS/V4nMkW+LVH?= =?us-ascii?q?QLKh8J7QtQ/AIAipNwfuf97YrSUZBD1iVbo/1xUirEDJVo8UX0Sn2Oi1jiVPqh?= =?us-ascii?q?i/Cp3R5VzP/0yNkUQgR/CU9GyOtNiksoMqt4K7cOsY7Osz+Ic0z6vGbsyOupJF?= =?us-ascii?q?lR1cPUeEfiDIrAr2b8VDMT+WEMT49V1H7fDYgSkxZ+aKszqlRAOpypekb/5zwh?= =?us-ascii?q?xoRmBbq4WNuqx1k7s3kJWT2mE91bC+FpqFjXQiFqY4i3qJX5PJVfWnVf+IeAq1?= =?us-ascii?q?dfikltMDW0yZtdK8FM/j4DRyJDoTODs9uuUMdDw9N5D4cQItdjvHfwAKJEOJ6N?= =?us-ascii?q?o3Iovrzg1HrZ9C4gsFegxDS+AKi4T/pH8G0YHwUmPWWeqk00AOsr/Wbe6FfNsk?= =?us-ascii?q?p7/+1DHLiAkV1xoCphHpBJHjtJ2mqlIE51THlaqOhaKaPVcsJaQ/kuZR+gJR0+?= =?us-ascii?q?Ffg630OX50F4h3H5bDJutgFC4SDSQxE0VTUJgrfqgTAetsanOToBRpJUcTkhaj?= =?us-ascii?q?zKJxidmS9JoBZVc1tqVIwBAtZZ57Eb2pNZ/srYRka2My4FWAFtOxkl3vVBjU5D?= =?us-ascii?q?qFuXeSTDAgqyb/rPtQd3fciJps6zMPv55BtHip/gsO0g9aUDQGOplBawTt/AtI?= =?us-ascii?q?/zqMeKtleQe6jlKeG8Z2HOTCTUhxCqmbgkF4XK/zTUMAdDMJZ6x2YrbYTjBGLW?= =?us-ascii?q?MxlLPL4UJ01eVa9mc9pGufxaa9VieKkX5a9nHgiHSQ/3GIyzsPlGKU7eRS7AIC?= =?us-ascii?q?qc8uywu57T4KfZSejneMyD2WjLTL5wPphn9zb3AbHq3pFC+kDuwPdi6lt6SUTa?= =?us-ascii?q?MyCGtNnhPhgL5NW4eUT/op0kBijWAJBtkHr32k5PacwXQzGw8JsCzJNV8nHwSf?= =?us-ascii?q?h30kLrqu1d66Fk6ZUr47Bu0cq0Ob3SJupEvkB6GRWUGwFq9ok3AGdlWWBRY+gR?= =?us-ascii?q?KPPPcqQFl8zurPr3F6MP4h2P5+NZccfHJ13GmsSnFz6cTwZLkRwcpj4cNASQzf?= =?us-ascii?q?mFm7V7Scy9v+j2xlot40SiLh4B1L1t552L+rCPpO/Maxve16YEV7PvRsPuqrQs?= =?us-ascii?q?p0KS6uEllLEUfGx1eBerEO8HVs4S3m3g17wlzTowE8PfGLLt4PxDWGg/njLugZ?= =?us-ascii?q?B9GEgZFe0PELqX54temHw4m+vDOt0QbK9Chn6FFQS4Hb8a1X6r9yyXLXFjghHK?= =?us-ascii?q?yBzwQGWz7FrsoS95RyvMwc3jnVBOVrmrH0dSQjamOVNlsDOVIgXkrt33ub467E?= =?us-ascii?q?suKGzrqMqNlHe9OLNQB8D/It2cLjUzpFITlpIxXcaj2YEcGdq6O9cR62pzbv7R?= =?us-ascii?q?5mKkiSNBpL1Hh4XG6MGP5vrXBWWgj7Gdq7iV2D9X0Hw4sk8k6tC8NvDO4MaHQ+?= =?us-ascii?q?+02GYQUSh/vRfBXx+vpbDBqVAbJ1CL2l/RmIMWJtFZwWU41kb+6egnW9Iz8QVT?= =?us-ascii?q?G53OZ/wcuD/zPyH0zkyHY9ItUSme0SVYEU7pEVViH6g8wm3wttrTlXjM410oWp?= =?us-ascii?q?Vwd0v/iBx1DoU4LFkg6F0JzSsDDwcNcxGbDLenBUj/K4sLS1QDYwyd3LemYqc3?= =?us-ascii?q?wVFzwrS36e/SbO1zHbACOepGgw6VgldbBowZvrEETLJ7YV9d+7bdphL+BIj/Q/?= =?us-ascii?q?jmiX0wOOWuTcBb6sAYuWEt4gS+Rxq88ZdM9asbiJSTe6FYZpjDod5z4F165T4V?= =?us-ascii?q?cSxNmgJwgwm+UeAGq+Dp+sLbv4aw6uaySKYtQP0a9wAuCGRik5TwgF4iodbN1+?= =?us-ascii?q?dfU4HVkprw8ARMI36MpYbb3AJxKfIUJIK3YLlg93sGJy8EJ3INJ9aWaOcz4zVr?= =?us-ascii?q?MDrN41xOGMQMZckXPMDVgwBbllXpWK1P9srcAlKYF51zeN4s72XtzjA674AxXf?= =?us-ascii?q?vh6D+5JJDf80tCP+hZgyV2idLOvu4VzuTOCCIP+3mWdwB1wj+ey5mKE/vw8v+D?= =?us-ascii?q?yMvKWFMaHi47SINdJDue+QO5Ruq6jojpUhiO5s/1np0+aFqaRmatk6QdrqZMDe?= =?us-ascii?q?lAhz303jdAEID1m/WVs92r5GtMqFJHFIdz7RvYGKRQJZh7PQr3ltOrR0dmHCf/?= =?us-ascii?q?ft/bdgY2suqM2ugM+/l+N1f5ZYIDPh0Eyaj15mZOQwRyT772ulKZXeMPa9t8VP?= =?us-ascii?q?PLsGxa6YJ6J68IJlidq4Tgri1Up1AuHA8pdLgwoyRfdknJmg1VR6n0t6AbhwsZ?= =?us-ascii?q?UN52o0lMFnysOGMw4DrHT6dVjLKLBPwT7DqTUrQEU190PSNmXxO1xJJudqOmnf?= =?us-ascii?q?9bqWNGhTpxruUl3TJgRRu8vzDspq0W1DIv/bG3rjMBtmJfQuWZiSfIBk1JzO4W?= =?us-ascii?q?gqcEF3bi9Vu8bWEBbIv14LlnI97s+pUh43Q7fBUsYiwHXeWmCyHrjKOIA5eCsM?= =?us-ascii?q?xdhB6TosrOaaK8LSkIOrQ71x3jW2B30hLCkxZw7GsLXjKg4cclJIWjI8klwDGl?= =?us-ascii?q?GWzGdFkR46NJt9DxuUQMTOssZlNr2H9j3dSfRi0RWMzPHH44jgo6ZmVKfpJD7Q?= =?us-ascii?q?QXFqcyjTaOoKZG4hsYYDHKHYS54oPQh9vH2WEhTdd2wWLbvqKFhpct0Hxrhdx0?= =?us-ascii?q?6iqOtW8Jd+zfVc9sA2T82p1ZyePge/WnqvoHR5d+yLS9TP8CNdGu+Wm22JRqQk?= =?us-ascii?q?+lwbAeH1ulMOAd3brbVialSXGCWeuVaWSMmCw5MkHq7xmyMlI3cNtKr1M6Muba?= =?us-ascii?q?iZ5cigzhXq5zRiiLuV/b1nIsMeUGdw0svIeoYQoKQ/IQZ+eGP+QuxuMxCEcUZX?= =?us-ascii?q?/TASR2E/O2sUKqnIVjJ3Vg4ED6bP/x8gDnLNSSGQcLEYrAop535/O6WnqLOWV8?= =?us-ascii?q?wx1qIEl06+DfGkw0tu9dcJaRnt/Qis950eEfdPdtNis9tcAVmo5574mbztuKew?= =?us-ascii?q?nLzpnuPdHVvuSYA/rHwksxZG5aVKYZbBju54U+Od45R6HTHaVHshsBH6Q6R4Yh?= =?us-ascii?q?N2jp/qFuMAxzahLRZKizgsTyvuKLYZ9UqGXM7lM+KyfcvxMDx+exTQx8aJCqnG?= =?us-ascii?q?v9L4wqRjJGtN1tERpmHI1AG88aqAqnGZGUkrmhi9Ct40N6p/MKsa3oB/DEytu5?= =?us-ascii?q?24RxX4BE6kGQPTfRBaxrgkF7geSohvfPzIP9CcT4edMLTOJ7WHLKaqfaHoWjLT?= =?us-ascii?q?KDIsz9e1Zc876dzL12TA6cZCX4X6qari2rKu9o4UIhyox3ZODT1iAi76nH2Nvu?= =?us-ascii?q?YGFWviCjrXqXO5ZE9FzKAfbRXwlISfqE7GllAbcXYpXq++sUN9wt3sSc6RFp7D?= =?us-ascii?q?teyMuFP7ShrkjU10J/dJLbKlbp2ikgVYkOIRS/KlcsgXTCp3TcG3tcKM+kJdNq?= =?us-ascii?q?gNaPARzn/1Nxln01Zm5dBmroQs+cOXMF1MK6ZQ2K8h9LDtkEk+C4ZU44trO9Sf?= =?us-ascii?q?N2NZVdg+qnr7YHnshzKyHJWsdaOzrfLKJ5PjZLCeXPvlcoaAYes7cpQoc1eYSO?= =?us-ascii?q?IEQfPUeF0yz90QvC0Uzyd9yrz6uJPicW8nNZwLLB0DhMoRS5uPmDjs3kSrDZY4?= =?us-ascii?q?n8XOTOPyo9SjGaWTMyHF6r+Vi+uPoEu+GXLHwColASfiKSCAkTpr1grdjQEm/f?= =?us-ascii?q?g+tjc4MWhPqCQSD/VDV4lLYuBiZMrU2MTOAMGhLMb3/gnmVcvBevJuFI/X3/dL?= =?us-ascii?q?2Yx7dVV/YQAoRSbv2TW8HYduxGJzc0ijUZP/6xf9/Zr7Y+yFLIV2oZE7LT+V2Y?= =?us-ascii?q?VkGWR+KTxzPxUYUSpYg0tTIi+sjMkS9vD6TII7Gfqia18o62iSaXpezTW2o2bk?= =?us-ascii?q?wrnu0CGmiBwRhHKGECEd0Vvl/iQrKYbUZWyH0pkf5u2wMLeAlrUH1u1XtWnPKm?= =?us-ascii?q?F81cV1EbkW2uQPocbF9rEjw850mK7RPuYY9IhceGXGJa970RWaIBPfIo78/RI6?= =?us-ascii?q?JWz/E3jxx8pylviDmQF1NQiEq+9qPUGK9tjulZ6XIQ4+B9XkbJRSjWNGfA1Nz1?= =?us-ascii?q?WIp02S5yrCW8hILvted3Oe4f/dl0?= X-IPAS-Result: =?us-ascii?q?A2H1AgDVB/lY/wHyM5BUCRsBAQEDAQEBCQEBARYBAQEDAQE?= =?us-ascii?q?BCQEBAYMAKYFbEo5vqF0oigJXAQEBAQEBAQECAQJoKIIzIoJIAnYDAwkCFzEIA?= =?us-ascii?q?wFsBYgBS4E+Dax4JgKLKo95hgwFnTSSdg2LCoZLSJNMWIEFHQkCGwgeD4dFWYk?= =?us-ascii?q?uAQEB?= Received: from unknown (HELO tarius.tycho.ncsc.mil) ([144.51.242.1]) by emsm-gh1-uea11.nsa.gov with ESMTP; 20 Apr 2017 19:14:24 +0000 Received: from prometheus.infosec.tycho.ncsc.mil (prometheus [192.168.25.40]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id v3KJDcwS005733; Thu, 20 Apr 2017 15:13:50 -0400 Received: from tarius.tycho.ncsc.mil (tarius.infosec.tycho.ncsc.mil [144.51.242.1]) by prometheus.infosec.tycho.ncsc.mil (8.15.2/8.15.2) with ESMTP id v3KJDZFB027557 for ; Thu, 20 Apr 2017 15:13:35 -0400 Received: from moss-pluto.infosec.tycho.ncsc.mil (moss-pluto [192.168.25.131]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id v3KJDYxm005726; Thu, 20 Apr 2017 15:13:34 -0400 From: Stephen Smalley To: selinux@tycho.nsa.gov Subject: [PATCH v2] selinux-testsuite: Add CAP_MAC_ADMIN tests Date: Thu, 20 Apr 2017 15:17:20 -0400 Message-Id: <20170420191720.22000-1-sds@tycho.nsa.gov> X-Mailer: git-send-email 2.9.3 X-BeenThere: selinux@tycho.nsa.gov X-Mailman-Version: 2.1.20 Precedence: list List-Id: "Security-Enhanced Linux \(SELinux\) mailing list" List-Post: List-Help: Cc: Stephen Smalley Errors-To: selinux-bounces@tycho.nsa.gov Sender: "Selinux" X-Virus-Scanned: ClamAV using ClamSMTP Add a set of tests for SELinux CAP_MAC_ADMIN checking, which controls the ability to get or set a raw, uninterpreted security context unknown to the currently loaded security policy. Signed-off-by: Stephen Smalley --- v2 fixes the last test to pass a well-formed context to mkdir --context. It technically makes no difference for the test itself, since the context is undefined regardless, but we want to ensure that userspace does not reject the context before it reaches the kernel. policy/Makefile | 2 +- policy/test_mac_admin.te | 52 +++++++++++++++++++++++++++++++++++++++++++++ tests/Makefile | 2 +- tests/mac_admin/Makefile | 2 ++ tests/mac_admin/test | 55 ++++++++++++++++++++++++++++++++++++++++++++++++ 5 files changed, 111 insertions(+), 2 deletions(-) create mode 100644 policy/test_mac_admin.te create mode 100644 tests/mac_admin/Makefile create mode 100755 tests/mac_admin/test diff --git a/policy/Makefile b/policy/Makefile index 6537b68..661f27a 100644 --- a/policy/Makefile +++ b/policy/Makefile @@ -20,7 +20,7 @@ TARGETS = \ test_task_create.te test_task_getpgid.te test_task_getsched.te \ test_task_getsid.te test_task_setpgid.te test_task_setsched.te \ test_transition.te test_inet_socket.te test_unix_socket.te \ - test_mmap.te test_overlayfs.te test_mqueue.te + test_mmap.te test_overlayfs.te test_mqueue.te test_mac_admin.te ifeq ($(shell [ $(POL_VERS) -ge 24 ] && echo true),true) TARGETS += test_bounds.te diff --git a/policy/test_mac_admin.te b/policy/test_mac_admin.te new file mode 100644 index 0000000..579a017 --- /dev/null +++ b/policy/test_mac_admin.te @@ -0,0 +1,52 @@ +######################################## +# +# Policy for testing mac_admin permission checks. + +attribute mac_admintestdomain; + +# Domain that is allowed mac_admin. +type test_mac_admin_t; +domain_type(test_mac_admin_t) +unconfined_runs_test(test_mac_admin_t) +typeattribute test_mac_admin_t mac_admintestdomain; +typeattribute test_mac_admin_t testdomain; + +# Relabeling a file to an undefined label remaps it to the unlabeled context, +# which may have a different SELinux user identity (e.g. system_u). +# This would go in the common section below but the interface only +# accepts types, not attributes. +domain_obj_id_change_exemption(test_mac_admin_t) + +# Relabeling a file to an unknown label requires mac_admin permission. +allow test_mac_admin_t self:capability2 mac_admin; + +# Domain that is not allowed mac_admin permission. +type test_no_mac_admin_t; +domain_type(test_no_mac_admin_t) +unconfined_runs_test(test_no_mac_admin_t) +typeattribute test_no_mac_admin_t mac_admintestdomain; +typeattribute test_no_mac_admin_t testdomain; + +# See above. +domain_obj_id_change_exemption(test_no_mac_admin_t) + +# +# Common rules for all mac_admin test domains. +# + +# Relabeling a file to an undefined label requires relabelfrom +# the old file label and relabelto the unlabeled type. We also +# require getattr to both types for stat and getfilecon calls. +allow mac_admintestdomain test_file_t:file { getattr relabelfrom }; +allow mac_admintestdomain unlabeled_t:file { getattr relabelto }; + +# Creating a directory in an undefined label requires search/write/add_name +# to the parent directory and create to the new directory. We also +# allow getattr to permit stat and getfilecon. +allow mac_admintestdomain test_file_t:dir { search write add_name }; +allow mac_admintestdomain test_file_t:dir { getattr create }; +allow mac_admintestdomain unlabeled_t:dir { getattr create }; + +# Entry into the test domains via the test program. +corecmd_bin_entry_type(mac_admintestdomain) +userdom_sysadm_entry_spec_domtrans_to(mac_admintestdomain) diff --git a/tests/Makefile b/tests/Makefile index 4e5e7c0..fb8a0aa 100644 --- a/tests/Makefile +++ b/tests/Makefile @@ -10,7 +10,7 @@ SUBDIRS:=domain_trans entrypoint execshare exectrace execute_no_trans \ task_setnice task_setscheduler task_getscheduler task_getsid \ task_getpgid task_setpgid file ioctl capable_file capable_net \ capable_sys dyntrans dyntrace bounds nnp mmap unix_socket inet_socket \ - overlay checkreqprot mqueue + overlay checkreqprot mqueue mac_admin ifeq ($(shell grep -q cap_userns $(POLDEV)/include/support/all_perms.spt && echo true),true) ifneq ($(shell ./kvercmp $$(uname -r) 4.7),-1) diff --git a/tests/mac_admin/Makefile b/tests/mac_admin/Makefile new file mode 100644 index 0000000..e7c006f --- /dev/null +++ b/tests/mac_admin/Makefile @@ -0,0 +1,2 @@ +all: +clean: diff --git a/tests/mac_admin/test b/tests/mac_admin/test new file mode 100755 index 0000000..9df32e7 --- /dev/null +++ b/tests/mac_admin/test @@ -0,0 +1,55 @@ +#!/usr/bin/perl + +use Test; +BEGIN { plan tests => 8} + +$basedir = $0; $basedir =~ s|(.*)/[^/]*|$1|; + +# Verify that test_mac_admin_t can relabel a file to an undefined context. +system("rm -f $basedir/test_file; touch $basedir/test_file"); +$result = system ("runcon -t test_mac_admin_t -- chcon -t UNDEFINED $basedir/test_file 2>&1"); +ok($result, 0); # we expect this to succeed. + +# Verify that test_mac_admin_t sees the undefined context. +$result = `runcon -t test_mac_admin_t -- secon -t -f $basedir/test_file 2>&1`; +chomp($result); +ok($result, "UNDEFINED"); + +# Verify that test_no_mac_admin_t sees the unlabeled context +$result = `runcon -t test_no_mac_admin_t -- secon -t -f $basedir/test_file 2>&1`; +chomp($result); +ok($result, "unlabeled_t"); + +# Delete the test file. +system("rm -f $basedir/test_file"); + +# Verify that test_mac_admin_t can create a directory with an undefined label. +system("rm -rf $basedir/test_dir"); +$result = system ("runcon -t test_mac_admin_t -- mkdir --context=system_u:object_r:UNDEFINED:s0 $basedir/test_dir 2>&1"); +ok($result, 0); # we expect this to succeed. + +# Verify that test_mac_admin_t sees the undefined label value. +$result = `runcon -t test_mac_admin_t -- secon -t -f $basedir/test_dir 2>&1`; +chomp($result); +ok($result, "UNDEFINED"); + +# Verify that test_no_mac_admin_t sees the unlabeled context. +$result = `runcon -t test_no_mac_admin_t -- secon -t -f $basedir/test_dir 2>&1`; +chomp($result); +ok($result, "unlabeled_t"); + +# Delete the test directory +system("rm -rf $basedir/test_dir"); + +# Verify that test_no_mac_admin_t cannot set an undefined label on a file +system("rm -f $basedir/test_file; touch $basedir/test_file"); +$result = system ("runcon -t test_no_mac_admin_t -- chcon -t UNDEFINED $basedir/test_file 2>&1"); +ok($result); # we expect this to fail. + +# Verify that test_no_mac_admin_t cannot create a directory with an undefined context +system("rm -rf $basedir/test_dir"); +$result = system ("runcon -t test_no_mac_admin_t -- mkdir --context=system_u:object_r:UNDEFINED:s0 $basedir/test_dir 2>&1"); +ok($result); # we expect this to fail. + +# cleanup +system("rm -rf $basedir/test_file $basedir/test_dir");