From patchwork Fri May 5 13:14:48 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stephen Smalley X-Patchwork-Id: 9713531 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id CEE1A60362 for ; Fri, 5 May 2017 13:11:41 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id E2F1C28236 for ; Fri, 5 May 2017 13:11:41 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id D3B6D2869A; Fri, 5 May 2017 13:11:41 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-1.9 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_NONE autolearn=ham version=3.3.1 Received: from emsm-gh1-uea10.nsa.gov (smtp.nsa.gov [8.44.101.8]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id F229128236 for ; Fri, 5 May 2017 13:11:40 +0000 (UTC) X-IronPort-AV: E=Sophos;i="5.38,292,1491264000"; d="scan'208";a="6692394" IronPort-PHdr: =?us-ascii?q?9a23=3APSr4CBWTokwaqBz9qDcUEPAc8U7V8LGtZVwlr6E/?= =?us-ascii?q?grcLSJyIuqrYYhSDuadThVPEFb/W9+hDw7KP9fuxBypevd3c6DgrS99lb1c9k8?= =?us-ascii?q?IYnggtUoauKHbQC7rUVRE8B9lIT1R//nu2YgB/Ecf6YEDO8DXptWZBUhrwOhBo?= =?us-ascii?q?KevrB4Xck9q41/yo+53Ufg5EmCexbal8IRiyrAjdrMgbjIRtJqsx1hfCv2dFdf?= =?us-ascii?q?lRyW50P1yYggzy5t23/J5t8iRQv+wu+stdWqjkfKo2UKJVAi0+P286+MPkux/D?= =?us-ascii?q?TRCS5nQHSWUZjgBIAwne4x7kWJr6rzb3ufB82CmeOs32UKw0VDG/5KplVBPklC?= =?us-ascii?q?EKPCM3/2HNjsx7kbxVrhSvqRdix4LYeZ+ZOOZ7cq7bYNgUR3dOXtxJWiJBHI2y?= =?us-ascii?q?coUBAekGM+ZArYTxulUDogWlBQS3GO/j1iVFimPs0KEmz+gsFxzN0gw6H9IJtX?= =?us-ascii?q?TZtMj7NLsMXuCtzKnH0zPDZO5L1zf48ofIdhQhru+MXLltdsfR0lQgFxjeg1WM?= =?us-ascii?q?qY3qIzOV1uMXv2id9OpvT/iji2EgqwFvuzWiwNonhIrRho8N11zJ+ip0zJw1KN?= =?us-ascii?q?GlUkJ3f9GpHIVKuy2HMYZ9X9ksTHtyuCkgz70LoZu7fC8Xx5s53xPfcPmHc5SQ?= =?us-ascii?q?4hLkSeaRPS90hHJ7d7K7gBa/6VSgxffmVsm1zVZKtTBJksXMt38R1xzT7dKLSv?= =?us-ascii?q?1h8Ue6xTmDzQXT6uBAIUwslKrbLYAuwqIom5YOvknOETX6lUXrgKOMaEkp9fak?= =?us-ascii?q?5/76brn+o5+TLY50igXwMqQ0ncy/BPw1MhMQUGif+OS80qDj/ELgTLpRif02j6?= =?us-ascii?q?/Zv4zEKsQAvaO5Hw9U3Zoj6xa4FTum1s8YkmMdIFJKfxKHkZDlO0vSL/DgEfe/?= =?us-ascii?q?n1OsnS9px/DBOL3uGInNLnjZn7fnZrt96UlcyAw2zd9F/JJUFq8OIOjoWkPrs9?= =?us-ascii?q?zYFBA5ORSuw+n7ENV9yp8eWWWXD6+bMqPdq0OH5uE0I+mLYo8VuSj9JuMr5/7q?= =?us-ascii?q?kH84lkQSfbSv3ZsLdXC0BPNmI1+WYXD0mNcODX8KvhYiTOztkFCNTDlTZ3C0X6?= =?us-ascii?q?0h+D47DIOmAJzZSY+zmryB2z23HppMZmBJElqMC2vnd52YW/cQbyKfOtJukiAe?= =?us-ascii?q?Wri7UIIuyRautArmxLV9NerU5jcUtZT929hp/+fTjw099SRoD8SB1GGAV2B0nm?= =?us-ascii?q?UURzAo2KBwv0l9xUmf0ahig/1VDttT5+tXXQc8MJ7T1e16C9TpVQLGcdaFUlGm?= =?us-ascii?q?Qs+pATspVNI+38cOY1phG9Wllh3C3yurA7gTl7GQAZw09rvQ33n3J8pnzXbJzr?= =?us-ascii?q?Mhj1onQstRK2KqnKh/+BbPB4TRiUWWi76qdbgA3C7K7GqCw2uOvEVdUAFuS6XI?= =?us-ascii?q?Rn4faVXLotT+/EPNVaeuCa4gMgtD18GNNrdKZsfujVVcS/fpIM7ebH6pm2esGR?= =?us-ascii?q?aIwauBbITwe2oH2iXSFEkEkxsI8HaDLQg+Bz6to3nQDTx1D17vZFns8eZmonOh?= =?us-ascii?q?UkA01x2Kb1Fm17et+R4an/+cS/QO3r8fuycusTZ0HFGg397MDNqAvQVhdr1GYd?= =?us-ascii?q?wh+FdHyX7ZtwtlM5O6Mq9inF8efBptv071zRp4FoBAndItrHMwwwp4MbiY309Z?= =?us-ascii?q?dzOEwZDwPaXaJXXo8xCrdaHWwU3e0daR+qoU8/Q3t1Tjsx+vFko+8nVoycNZ03?= =?us-ascii?q?2C6ZXWFAASS47+Ul4r9xhmoLHXejI9543O1X1rKqm0riTP28kvBOsixBeges1Q?= =?us-ascii?q?MKWeGA/0DcIaG9CkKPY2lFixchIEIOdS+bY6Psy8c/uGxLCkPPx7nD+9k2RI/p?= =?us-ascii?q?p93VmR9yp5UOLI2IwFw/6A1AudSzj8lEuhstzwmY1ceTEdA3ewySn+C45VfaB9?= =?us-ascii?q?YYELCWKyLMKt3dV+m4ThW3hG+16/H1kGwtOmeQKOb1zh2g1dzVoXoX27liukyD?= =?us-ascii?q?x0iSslobaf3CzJxeTiewEKOmpKRGlkl1jsO4+0g8odXEiyYAgjjAGl6lrix6hH?= =?us-ascii?q?uKR/KHHeQUNJfyjtM2FuS7CwuaSGY85O7pMorCpWXf+nYVCCS779pRoa3D/4H2?= =?us-ascii?q?dEwjA0aS2qsI3jnxNmkGKdMGpzrH3BdMFqwhff4NjcSuBL3jUaQyl5hyLaBkOh?= =?us-ascii?q?P9a15tWYjZDDsvqxV2i5TJ1cbTHrzZ+ctCu8/WBqGQewn+23mtH9Cwc2yzT019?= =?us-ascii?q?5uVSXUqxb8ZJLm16GmPeJheUlnGEXw68xkFYFiioEwno0f2WAGhpWJ+noKiWTz?= =?us-ascii?q?Pstd2aLld3cNRiAEw9jO4AjjxkJjMmiFx4XjVnWS2sFhfcW1YnsK2iIh6MBHEL?= =?us-ascii?q?+U46ZZnStxvFW4tRjeYf5hnjgD0/sj82Mag/oXtwo31SWRGKsSHU5FPSz2ixuH?= =?us-ascii?q?8d6+rKJNZGagb7e8zkx+ks69DLuauAFTRG75eos+HS939sh/LlTM32Do54H6ft?= =?us-ascii?q?nfcNITugeSkxjek+hfMIgxmeYShSp7JWL9umUoy/Yhghxz2ZG3p5SIK2Rx/KO5?= =?us-ascii?q?GxJYOCf6Z8UJ9jHql6Zekd6c35qzEZV5BjULQJzoQOqrEDMSsfToKR2DEDg7qn?= =?us-ascii?q?eVF7rQAxOf6Ftmr3LIFpCkKWubJH8HwtV+XBOdPlBQgBgIXDUmmZ40Dg6qy9bn?= =?us-ascii?q?cEdl4TAR40X1qhVSxe11MBn/SH3QpB+yajczSpiQMgZZ7h1Y60fSK8ye4fp5Hz?= =?us-ascii?q?tE8Z25sAyNNmubahxSDW0TVE2IHVXjMaOq5dnH8+mVHfCxIOfLYbmUruxeTfiI?= =?us-ascii?q?z4q10oR65zaMKtmPPn56Av01wEpMQ212G9/DlDUJVywXkDnNYtWBqxig/y17tM?= =?us-ascii?q?e/8O7kWAj3/4uAF6NSMclz+xCxmaqDMfSQizxhKTZAzZ4My37IyKIE3F4OhSFu?= =?us-ascii?q?dj+tHq4GtSHRTaLfgKtXAwQcayNpO8tC97g80RVVOc7HltP10aZ1geUuBFtCUV?= =?us-ascii?q?zhm9qpZdARI22nL1PIGlqEOK6dJTLVx8H3YKW8SaBfjehPqxKxuSybE1L4PjiZ?= =?us-ascii?q?mTjmTQyvMfpLjCGdJhBev5u9chl1A2j5UN3mcgG7MMNwjTAux700h3fKNWoCPj?= =?us-ascii?q?hnaE5CtKOf7TlfgvllHGxB9HVlJ/GemymF9+nYNooWsfxzDytvluJa73M6y71O?= =?us-ascii?q?4S5ZWvN6gyrSocRoo128lemP0DVnWgJUqjlXnIKLoVliOaLB+5ZaVnbL5gwN4n?= =?us-ascii?q?uLBhQNv9tqFNvvu6VKxdjOkKL8MzBC8t3O8csbHcjUJ9qNMGA9PhrxBD7UEAwF?= =?us-ascii?q?QCa3NWHYgkxRiuuS9nqUr5ckrJjjg4AOSrhFW1w2Df4VFkNlHNkeL5htRTMkja?= =?us-ascii?q?SXjMgW6nqitBPRXtlVvojbVvKOBvXiMDCZgqdeaBsM2r74LoMTNpbn20N4bFl6?= =?us-ascii?q?h4fKG0vKUdBLvCJhchc+oF9R/3hmUm0zx0XlZxu34HANDv67gAQ5ihFibuQt7z?= =?us-ascii?q?rj+FY3JkDXqys3nkkxgc/lji6RcTLrKqe/Q51WATLut0ctKpP7Xxp1bQqqkEN5?= =?us-ascii?q?LjjEWbNRgKZ7dW1wkgDco4FPGflSTK1ffhAf2eyXZ+8p0VRAqiSr30lH6vXZCZ?= =?us-ascii?q?F6jgslbYasr25c2wJkdNM6OLfQK7RTwVhfnKKBpDGo2/sqwAAEJEYN7XmSdzQS?= =?us-ascii?q?tEwMK7kmITCn/vZ15QyenDtDe2gNV/0wrvJs6Ew9J/yKzzj83L5bNkCxK+ufIr?= =?us-ascii?q?udu2jHj86HXFUw10IPl0Re8rh219ojf1CTV0A1w7ubDw4JOtbaKQFJc8pS82De?= =?us-ascii?q?fT2QvuXJwJJ1OZi9F+/zQOCSs6YUh16rExwyH4QQ9MgBGIej0F3AJ8f9MLEF0Q?= =?us-ascii?q?kt5BjsJFidEftGZBeLkDABo8Gj0ZN6xpddKS8HAWV8MCS34bDXqhUsgPWdQNc8?= =?us-ascii?q?em0aUZccNnIqRM26nDZUv3daDDi3yO0ZzhSC7z/nqyTfCzn8d8ZsaO2SZRxyFN?= =?us-ascii?q?G84S8//LSuiV7L7pXeIHn3Nchjut/K7uMau5aHCvNPQLZgskfdm5NXSGewX27J?= =?us-ascii?q?D9G1O4D6a5MwYtzsFna6Tlu/hio6T8frJtmtKLSIjBrpRYZTvoib2iwjNc+jGT?= =?us-ascii?q?EfHRdwu/8M5LhmaQ0FfZU7fQbitx4iOKynPAeYztKuTn63JjtSTvlQ0fu1aKRS?= =?us-ascii?q?zyssaO+6z30gQYshwuas8E4CXpcKggjQxfa+fYVeVzb8GmBFcQXVuSU5j3RhNv?= =?us-ascii?q?o1wuon2xzHr18cPiuRe+N0dmxLocs8BUiILnVsCms0XVicjZDM4gS0xbAd4zNd?= =?us-ascii?q?n8pI0e1CqHX+pJnfYDOwV6yrrpXVtzEgY8A/raNsK4LuPsyIuYjCkTzYSZnfrh?= =?us-ascii?q?eKUDWmF/ZAnNhfPj5YSuFSmW45IcwGpZZB6U0pW8giJbxAErUjq6u2ZjpjCS4S?= =?us-ascii?q?yS4ZWJ2a3DwenOizx7vamg2XcJQ4PxwOqI9CjccFUy5qfiMeo7euV5/MmG+eTW?= =?us-ascii?q?gEOxwe7RhW5A0aiI9/YOTl4IvOTJ9Dzz5Wov10UivXFplm7VT7UGSWjUL+SPq/?= =?us-ascii?q?j+yjxRhSw+700tkHRB5/DlBQxuhMmkQ0KLF3KqwQvo/QvT+Lbk76vXzix/W4K1?= =?us-ascii?q?VLzs3UbVL4BpLftWXgSi0c5WEURYhXxXHHEpQSlxB2aLwlpVVLJICmdF3z5zkj?= =?us-ascii?q?x4RuBLm3S9ykx0wirXYdXCeqEtxBC+58vFLQQj1lbIihqI/5NJVKXm9Q5Jqdpk?= =?us-ascii?q?9Dn0V3Li65z4BQK8JW7z4NXThPoCmds8CoRM1Fx8B2E4cGIs1jtHflBKNEJJ+R?= =?us-ascii?q?rmUqurzoz3/U4Cw8vEu/xDqoAaO4SfxW/3EGEAUzO2ueslUvD/cr8mrK8lDCqE?= =?us-ascii?q?p08P1fBreSlkh+vShyHohWBjlX0XCqMU5zQGNBs+VAJ6Tfa9ZcTOUqZR+zJxw+?= =?us-ascii?q?EuYr306O/U5qhnr2fjJ9thBE9CDHQwk7SzQajq3rmTIAtsGtISUaRI5QbTU9cy?= =?us-ascii?q?fFLBqWljtZvBlDd01nWY0VD9he9r4H2otU+9bNRly3KSEZRhBiMBw30eZHn05Z?= =?us-ascii?q?rEqYYTzdDRavdfvXqB14Y9qerM6zI/Tl5wpHjoTnsP4m+KkdW3KmnhCiTs7Eo4?= =?us-ascii?q?/6qNKKqlOEdL3kPO2kfX/BUD/MgAiohbc/E5nF5TXcMBZAJplhznokfILhBnLV?= =?us-ascii?q?MhRAO6IbPVBUVaRgZdVBuOBaaNdueLwV9q91GhKHWhTvFZSzrPlcMFncWynRIj?= =?us-ascii?q?6c8uy7vYLT96bSSfbhZsyLw3bIXb53Mo196TnhFLfgyZVe9Vbu2vdx6kN6TkDL?= =?us-ascii?q?MyWbo9TlIgME+tWidlf4sZIzBj7WBol/kGb2xk5cbcUXWzOl/I4eyJxH9Hb6Uf?= =?us-ascii?q?h43VTrsO1O67lk7pE647JzxseuIqfSMvBavlV5AhWPAwVq65EtAHR+R29NY+8e?= =?us-ascii?q?MvHRfb8DgcDpseD3GLQd6AeJ9OxBddvHO0bBl9G9Cj6GTxxEkh0BqTkHIQSCzP?= =?us-ascii?q?OFh7V7ScC+pej+wE4t5UaxLgIexrB3+YiE4raIpPPQbxbJwrgER6nqRsf3rrsy?= =?us-ascii?q?vkOf/uArm6AVdWx0eQKnFvIRVskHxmfv1aoq1z4jE9vfH7L8//5OT3Q5njb7lp?= =?us-ascii?q?B8GVUWH+kYHbuN/YRQhGc3gffZNsEMcqBfhmmPCQOkEqUcxnKx7CuXOmZliAnU?= =?us-ascii?q?0x7sWWOz8EP2rShgTCvJyNfjlFZVVrapCkpJWiqpOFV3sDWRMwr0utv3vr417E?= =?us-ascii?q?ItMmD+stKCinehMqtNH8LjPNycPTU0pFUPgZ0rW9OgxJsWGdW4INYe6n1+aOXR?= =?us-ascii?q?63+zmS9bv6hHn5be4t2S+vjPGXmglKiaprWWyTBW1Hc3oFY/6sq6OfHW/d2KRP?= =?us-ascii?q?ao2HgNQCdjoQfBWAS1qrPDpVAOJUOLyFvLmJANPtxBxnk3zF/m6/IsQN0t7wVT?= =?us-ascii?q?DZ3AaOkcpT/pNzv7302fb8gxViaAzztdBkj1HkVgGKggxGLwu9rElXXR+10tXY?= =?us-ascii?q?RwclLohBxpAIUiKEIt7lcXzjAFEQcTdRCRFKuoClj9LYsYSUgDbgyK3Lm7e6gt?= =?us-ascii?q?x0J83qii5PTNYuxgGaUCKuxRjgmUnFhUApgWq7ERQKpge19B867avhPtC4n8X/?= =?us-ascii?q?noj3UwN/y1QtxC8c8Dqnsi5h2ySAan6Zhe8bkUko2IdrRDYZjWps9w9UBn5SQA?= =?us-ascii?q?diZVmhhwkwu5UfwApODk+tXbqICn6vqyW6YtSeQX8AI0B2dng5vrnl8jpdDX1+?= =?us-ascii?q?FBSozakon/6BpCI2KWt4ba3Rh8LvAOK4GxcLZj6XoHPS4eKGwKPdaMbPk8+SBt?= =?us-ascii?q?Oi3J51NeGsMMec8YPM3VlABIkE3mRrVT+dDdGlCGEIp8asEo72X2yDAp65Q8Sf?= =?us-ascii?q?zv6CWrJZzF6VFCIe9Dhj12lN3evOgV3ebSCC8P7HmWcRd12D2Ny4WNC/vr+eWM?= =?us-ascii?q?yc3UWE0GHiEsToddPyCO+Qq5SeqpjJ/pSB+b6tfvgJIic0KdXnOxk7oDsqZQFu?= =?us-ascii?q?5AjSL33iNAGYDxhvKVtces6WRMu11DDolz9x3EF79FMpV9Jxv4itGhRlJgCSvn?= =?us-ascii?q?ZMHUah0utfKQxucN/+p+ME/+apUAIh4eyrL67n1VThB1SLPtu1aUUu0QaMFhSP?= =?us-ascii?q?PeoXBf8ZhgJLMXPFiBuJzqqS9FqF8qDw8yc788tyFUeEbIkg1UXab0pbEBhxAT?= =?us-ascii?q?Ud58o0BMH3y/NHg55zrdWqRflLORB+AN8jWPUqwOVF1lMiF5QxO13pViYaemnf?= =?us-ascii?q?BDsmNbgyx8ofkq0zp9RBu/uC3hvLwN2TM++L6isDUOpH1FQv+YkyjWFVVJ1O4K?= =?us-ascii?q?grsEC3b+9Vy8Z2EObIrs4LZ9I8Tt7o0h42kibhUieC0GRv6sCybqj6OHGoaPqs?= =?us-ascii?q?5ThAaRuMXSar++NSoSOaozyRLtQ3hwyQbfkwxu8GQVXjWs9tkkK5uhOcw93Cqn?= =?us-ascii?q?BXDbdEoQ4qNOqMbxuloLTOw4aFx/xGVj1tOKRjYKRMzJGmY6khIoaWNaf5Jf8R?= =?us-ascii?q?UaDbUngi6Uvqla+QEZeDXUEoSl+4nImsfI3Xg9Tct0yW/No62Fh48q0Gd7lN9u?= =?us-ascii?q?6S6OonsSffTCU8BwGnjzyptfyevmavWir+AHSZZpyLO6Xf8eKMms52222IlwVU?= =?us-ascii?q?+h3LseGUa2MO4ZybvBVSeqV3GYU/yRc2eQhzY5LlLy5R6wI10racdKqlQwMvfD?= =?us-ascii?q?hpFAlA3uT7d0Sj+WpVDF0GwpKfkaeB4uuIe7ZwwKS/YcZ+2dJegtw/0+D0ABb3?= =?us-ascii?q?3TEit1DO+2t0CinI5hN3Vm/0r6ffzn8hr6P9uKBhkEDYnao4Zq9vOkQGKBJWRt?= =?us-ascii?q?zAZ2PElz6+ffC0oxufFBfJqLmtjQndt72/Yfd/hxKS09psITmoV75ImazsiKdR?= =?us-ascii?q?DRzo7sKtzOo/mYAvjfz0E0dWFAVroWfxn554IgPt42Q7fTB6dWvQwABagmR5ws?= =?us-ascii?q?L2nw9LluLANybgHeeq+5gszrpuKXfJtbuWXa7lUqLCfToxcD0OC7TRRnb5C2gH?= =?us-ascii?q?X/OJcwRjZfoNB2EhtmGJFAG9gcrwqmH5GUhLu7hMGv9E9gve8Fr7bwAOjQ1Nul?= =?us-ascii?q?x4VxQ4Ra5UuTMTbVBalrhFllj+urjvfE05nxEt/iecgfWeh6WGHFbLjGEp+4Kj?= =?us-ascii?q?KUNcL2Y1RG/KKE0LJlThWRYzj0X7GYuy2gNfVk51g7y4N/cOTc0Dwt76/U2MHs?= =?us-ascii?q?aGFDvCiutn2JO4VF7FzMG+PeWwlbSeeK8Gp/Gq0Xd4T0/v8UMdM+2Nic/xVz7D?= =?us-ascii?q?Na3cuAOaeusk/M2kN9dZLcN0bpxSc5WY8ULxS7MEssh3LZq3vHDXRbNMikJtFn?= =?us-ascii?q?gMyJARz1+0lxhWYta3ZDGmXyRteRPnMU1tmjZA2M6AJLD9EDn/O4eU44qq2+U+?= =?us-ascii?q?9oNYtZme+yrrUIjc5pKz3TRMhdJyzQI6V5MSFLDuXOulcoZgUJs6YxWogvfpiO?= =?us-ascii?q?IV4HPF2GySzs0QvIyVf0eMC01KaVPCYW9W1Kz7DA0ThLvQm5o/eZgtb4XbDfdp?= =?us-ascii?q?72WeDdMCs/WjGdXzQyHl6j+U24tPocoPqYPWAfr0gPYiKcDQ4cuqFioNvLA2/N?= =?us-ascii?q?h+JjZpwKhfGdWyD2UiF4krQ9BjoY/XyLFuIKCA3+d3b8hC9Zvwu4K7lH+ne2Qa?= =?us-ascii?q?efw/9uR+EOAoZKOsacSt/cdOEWcywkjR0FKe28eJvatL9/3VXWGzhKW5LU/UGT?= =?us-ascii?q?GRbFCseXwCjmCMBP54U=3D?= X-IPAS-Result: =?us-ascii?q?A2H2AgCCeQxZ/wHyM5BcGwEBAQMBAQEJAQEBFgEBAQMBAQE?= =?us-ascii?q?JAQEBgwEpgW6Oc484BpkcKopMVwEBAQEBAQEBAgECaCiCMyKCSAJ2AwMJAhcxC?= =?us-ascii?q?AMBbAUWh22CCw2zdCYCinCGGYlxfYUZBZ1vik6IPA2CBIkTDIZDApQ3WIEKJQk?= =?us-ascii?q?CHggfD4dUWoY4AiQBAYIVAQEB?= Received: from unknown (HELO tarius.tycho.ncsc.mil) ([144.51.242.1]) by emsm-gh1-uea10.nsa.gov with ESMTP; 05 May 2017 13:11:37 +0000 Received: from prometheus.infosec.tycho.ncsc.mil (prometheus [192.168.25.40]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id v45DAqUG018936; Fri, 5 May 2017 09:11:02 -0400 Received: from tarius.tycho.ncsc.mil (tarius.infosec.tycho.ncsc.mil [144.51.242.1]) by prometheus.infosec.tycho.ncsc.mil (8.15.2/8.15.2) with ESMTP id v45DAnDr080005 for ; Fri, 5 May 2017 09:10:49 -0400 Received: from moss-pluto.infosec.tycho.ncsc.mil (moss-pluto [192.168.25.131]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id v45DAlqY018923; Fri, 5 May 2017 09:10:48 -0400 From: Stephen Smalley To: paul@paul-moore.com Subject: [RFC][PATCH] selinux: add a map permission check for mmap Date: Fri, 5 May 2017 09:14:48 -0400 Message-Id: <20170505131448.8718-1-sds@tycho.nsa.gov> X-Mailer: git-send-email 2.9.3 X-BeenThere: selinux@tycho.nsa.gov X-Mailman-Version: 2.1.20 Precedence: list List-Id: "Security-Enhanced Linux \(SELinux\) mailing list" List-Post: List-Help: Cc: selinux@tycho.nsa.gov, Stephen Smalley Errors-To: selinux-bounces@tycho.nsa.gov Sender: "Selinux" X-Virus-Scanned: ClamAV using ClamSMTP Add a map permission check on mmap so that we can distinguish memory mapped access (since it has different implications for revocation). When a file is opened and then read or written via syscalls like read(2)/write(2), we revalidate access on each read/write operation via selinux_file_permission() and therefore can revoke access if the process context, the file context, or the policy changes in such a manner that access is no longer allowed. When a file is opened and then memory mapped via mmap(2) and then subsequently read or written directly in memory, we presently have no way to revalidate or revoke access. The purpose of a separate map permission check on mmap(2) is to permit policy to prohibit memory mapping of specific files for which we need to ensure that every access is revalidated, particularly useful for scenarios where we expect the file to be relabeled at runtime in order to reflect state changes (e.g. cross-domain solution, assured pipeline without data copying). Signed-off-by: Stephen Smalley --- NB I chose not to define a new policy capability for this permission, since it is adequately covered by handle_unknown for compatibility and others seemed to agree that this does not fall into the category of changes requiring a new policy capability. I also chose to define the permission for socket classes in addition to file classes and let it be checked for both. security/selinux/hooks.c | 12 ++++++++++++ security/selinux/include/classmap.h | 2 +- 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index e67a526..5432628 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -3550,6 +3550,18 @@ static int selinux_mmap_addr(unsigned long addr) static int selinux_mmap_file(struct file *file, unsigned long reqprot, unsigned long prot, unsigned long flags) { + struct common_audit_data ad; + int rc; + + if (file) { + ad.type = LSM_AUDIT_DATA_FILE; + ad.u.file = file; + rc = inode_has_perm(current_cred(), file_inode(file), + FILE__MAP, &ad); + if (rc) + return rc; + } + if (selinux_checkreqprot) prot = reqprot; diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h index 1e0cc9b..3e49a78 100644 --- a/security/selinux/include/classmap.h +++ b/security/selinux/include/classmap.h @@ -1,7 +1,7 @@ #include #define COMMON_FILE_SOCK_PERMS "ioctl", "read", "write", "create", \ - "getattr", "setattr", "lock", "relabelfrom", "relabelto", "append" + "getattr", "setattr", "lock", "relabelfrom", "relabelto", "append", "map" #define COMMON_FILE_PERMS COMMON_FILE_SOCK_PERMS, "unlink", "link", \ "rename", "execute", "quotaon", "mounton", "audit_access", \