From patchwork Fri May 12 16:44:23 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stephen Smalley X-Patchwork-Id: 9724585 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id E26C960348 for ; Fri, 12 May 2017 16:40:23 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id C90BB28864 for ; Fri, 12 May 2017 16:40:23 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id BD97028868; Fri, 12 May 2017 16:40:23 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from emsm-gh1-uea11.nsa.gov (smtp.nsa.gov [8.44.101.9]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 8F3BD28869 for ; Fri, 12 May 2017 16:40:22 +0000 (UTC) X-IronPort-AV: E=Sophos;i="5.38,330,1491264000"; d="scan'208";a="5730127" IronPort-PHdr: =?us-ascii?q?9a23=3AG3QCbRySTp/scsDXCy+O+j09IxM/srCxBDY+r6Qd?= =?us-ascii?q?1eofL/ad9pjvdHbS+e9qxAeQG96KtLQc1KGP6/yocFdDyK7JiGoFfp1IWk1Nou?= =?us-ascii?q?QttCtkPvS4D1bmJuXhdS0wEZcKflZk+3amLRodQ56mNBXdrXKo8DEdBAj0OxZr?= =?us-ascii?q?KeTpAI7SiNm82/yv95HJbQhFgDiwbaluIBi0ogndq9UajIR/Iast1xXFpWdFdf?= =?us-ascii?q?5Lzm1yP1KTmBj85sa0/JF99ilbpuws+c1dX6jkZqo0VbNXAigoPGAz/83rqALM?= =?us-ascii?q?TRCT6XsGU2UZiQRHDg7Y5xznRJjxsy/6tu1g2CmGOMD9UL45VSi+46ptVRTnhj?= =?us-ascii?q?0HNzok+2/JjMJ+gr9QrBa4qxBh34LYZYeYP+d8cKzAZ9MXXWpPUNhMWSJPAY2y?= =?us-ascii?q?aJMPAugcMetWsYb9vEADoQeiCQS2GO/i0CNEimPw0KYn0+ohCwbG3Ak4EtwTrH?= =?us-ascii?q?Tbss31NKcMXuCz0aLG0DDDYOlS2Tf59ofJcg0qrPaXXb1tasrc0lUvFgPZgVWQ?= =?us-ascii?q?rozpJTWV1v8XvGSB4OpgUvyvhnchpgpsoTav3t8hhpTGi48a0FzJ9Th1zJwrKd?= =?us-ascii?q?C3VkJ3e8OoHZ1NvC+ALYR2WNktQ2RwtSY/zb0JpIC0cTARyJQi2x7fc/uHc5WU?= =?us-ascii?q?4h77VOaePzN4hHV9dbKjnRmy60mgyvDnVsWuzFZLrjZKktnLtnwX0Rzc9tOHRe?= =?us-ascii?q?dn8kek2DaP0xjf6uBCIU8qiarWM4Mtz7E/m5YJsUnPAzX6lFv5gaOIbEko5/Ck?= =?us-ascii?q?6+H9bbXnop+cOZV0igb7Mqk2gcywH+A4MgkIX2iG9uWwzabs/UrkQLVMkvI5jL?= =?us-ascii?q?LZvYvGJcUbuqG5AwhV3pwl6xakFTiqytsYnX4ZLF5dYhKIk5DpO03SIPD/Ffq/?= =?us-ascii?q?gVOskDFxyPDaPr3uGJPNI2PBkLfme7Z97lRTyBEvzd9B/ZJUEasNIPXpWk/+rN?= =?us-ascii?q?bYFAM2MxSow+b7D9VwzoEeWWCVDaCFM6PSqliI5uQuI+mSf4IVtjL9K+Uq5vH1?= =?us-ascii?q?kH85n0MdfbSz0ZsQcnC4EexsI1+Fbnr0ntcBDWAKsxImTOP0k1KNTzhTZ3euX6?= =?us-ascii?q?I7/Tw7CZypApndSYy3h7yBxii7FIVMZm9aElCMDWvod4KcVvgRbyKSJMlhnSEa?= =?us-ascii?q?WrilSo8szguhuxHgy7pgNObU/TcYtZ373thv++LTjQ0y9SBzD8mFzm6NU3t7nn?= =?us-ascii?q?kTSjAq26B/pFByxU2Y0ahkmfBYE8Jc5+9RWAcgKZHc1/B6C8z1Wg/Zf9eJTkqm?= =?us-ascii?q?TcuiAT4vS9I+3cMOY1x9Gti5iRDDxzSlA7kQl7ORBZw09rnT33/+JspnzHbGzq?= =?us-ascii?q?YhhUE8QsRTLW2mmrJ/9w/LCo/JkkSZkKCqeL8Z3C7J7WuDzGyOsFteUAFqS6XF?= =?us-ascii?q?XnEfZlXIotjj4EPNUaOuA6w9MgRd0c6CNrdKatrxgFpdX/jvP9DeY2Oqm2esHh?= =?us-ascii?q?aE3KiMY5T2dGkHxyXSFkwEkwEV/XabOgkzHTuuomLEDDxzDlLjeU3t/vNiqHOg?= =?us-ascii?q?SU80yRuGb0p717q64hQVn+CTS+sP3rIYvycssyt7HE6n0NLMCtqAvBFsfL1Gbt?= =?us-ascii?q?Mn4VdHznrZtwhnMZO8Ma9unFkecx54v0n2zRV4Fp1AkdQ2rHMt1AdzJ6OY0FdE?= =?us-ascii?q?dzyGx5D9IbPXJXfv8xCoca7ZwEne0MyR+qcN9vs3t0njsBuuFko4/HVty8NV3G?= =?us-ascii?q?eE5pXWEAoSVor8Ukgt9xdgobHVfig955jP2H1pKam0sybO28knBes+0BqgeM1f?= =?us-ascii?q?MKycHg/oD8IaH9SuKPAtm1WxbRILJuNS9KkpP869dPuJwq2rPOF9nD68imRH+o?= =?us-ascii?q?992FqW9yVgUu7Iw4oFw/aA0wSdSjj8llahvd7tmY1ffz4dAm+/xTLjBI5Laa14?= =?us-ascii?q?ZZwLBnu2I82r2tV+gIbgVGJC+16nGVwGw9OpeBqVb1Hmxg1fyUUXrmKhmSukzj?= =?us-ascii?q?x7iSslrqyB0yzS2+7ibgYIOnZXRGl+ilfhOZO0j94AXEivdAgpiACo5V38x6hc?= =?us-ascii?q?qqV/KnPcQUFScyjwMW5iTrO6tqCebM5X9JMorSJXXfyyYF+ATr79vwUV0zn4H2?= =?us-ascii?q?ZF2jA0aSuqtY7knxx/km6dK2xzrHXBc8Fq2Rjf/MDcReJW3jceWCl3lCTYBlmm?= =?us-ascii?q?MNmt5tibi5DDsuWiWG27TZ1TbTPnzYWeuyun/WdqGwGwn+ivmt37Fgg3yTH719?= =?us-ascii?q?h2WiXUqxb8eJPn2Li6MeJgeEloC0Tx6857GoF4iIQwnpYQ1WIdhpWP8noNiX3z?= =?us-ascii?q?PslD2aLicHoNQiYGw9rU4Aj+xE1vN2mJyJz9VnWcxMtheta7b3gN2iIl7sBKDq?= =?us-ascii?q?aU46BfnSdvpFq3sx7Ra+BnnjgB0fsu9GIag+YRtQo3ySWdBrQSEldCPSPwkBSJ?= =?us-ascii?q?4cuzrL5KZGmzari8zk1+ncquDLuauAFTRG75eos+HS939sh/KEjD0GD36o3+Yt?= =?us-ascii?q?bcd8kcthqQkxfciOhVLok8lv8WiSphPmLyoWcpy+glghxyxZu6ppSIK31x/KKl?= =?us-ascii?q?BR5VLj71aN0V+jH2lqtendiZ34a0HpVnBDoLQIHkTfWyEDIdrf7nLRqBECUgqn?= =?us-ascii?q?eHHrrSBRef5117r3LLDZ+rL2uYJH8Fzdp8XhmQP1FfgBsKUzUghZ41DBuqxMv8?= =?us-ascii?q?cEdj+j8e+FD4qhxWyuJnKRbzSGHfqxm0aj0sUpiQMAJW7h1e50fSKcGe8ORzED?= =?us-ascii?q?xD852/qgyCN2ybax5ODW4XRkyOH0rjMaW25dnc7+iYAfKzL+PUbrWTrexTTOuH?= =?us-ascii?q?xZOz0opm5jqMON+APn94A/08wEpDUmhzG97FlDUXVywXiyXNYtaYpBa8/i14sN?= =?us-ascii?q?uy8PHsWALh64uAFadSMclv+xCxhKeMKfSchCBnJjZEzpkM32PHyKAD3F4OjCFj?= =?us-ascii?q?bzetHq4GtS7RS6LQn7RaDxAFZCxuM8tI9bgz3hFXOc7ciNP6yKJ3juIvB1dCT1?= =?us-ascii?q?zhldmjZdYWLGGlKFPHGEGLOaycJTLW3s76eqy8SbhfjelOsR2/pyqbGVf5Pjuf?= =?us-ascii?q?jznpSwyvMeZUgSGBJhBftpuxchN3BmjnS9Lnaga2P8Vrgj0z27E0gWnKNWEEOz?= =?us-ascii?q?hmb0xNtqGQ7T9fgvhnFWxB9GRqIvSfmymD6enYNpEWseBwDytui+1a5W42y7xP?= =?us-ascii?q?7CFLXPZ1gjfdrsZyo1G6lemC0jxnUABUpTZTnIKGpktiOaTD9plbRXbE8hMN7W?= =?us-ascii?q?OKBBQMu9RlC8fgu6RKxtjIjqLzJy9I88jI8ssEG8jUNMWHPWI8PhryBjHbFgQF?= =?us-ascii?q?TSSxOmHBnEFdi+ud9n6IrpggsJfggp4OSqJdVFMvDPMWE1hlHNsBIJZ3WTMoi7?= =?us-ascii?q?ibg9AU5XCmthneWN1avozbVvKVGfjvLjeZjb1AZxQW2rP1Np4cOZPh20xlcFV6?= =?us-ascii?q?m57KG0XIV9BXviJhdhM0oFlK8HVmVWIz2k3lagSr4HIICPG7gAU5igpkbuQr7j?= =?us-ascii?q?vs5E03JlXSrisqjEYxgcnlgSyWcDPpNqiwUptZCzTquEUqNZP7Wxh6bQu3nUN+?= =?us-ascii?q?NTfEQ6lej7xvdGxxjw/co5RPE+ZGTaJYeB8Q2e2XZ/Iw3FRArSWnwFVL5fHCCZ?= =?us-ascii?q?pjigQqd4Wjr2hH2w19b944PrDfJK1MzldMnK2OpTOo2vo3wAAAO0YH6HmSdzIQ?= =?us-ascii?q?uEwUKrkmIDKl/upy5gOYnztOY2sMV/0xovJ27Ew9Pf+AzyHh07JZLEC+KfCfJb?= =?us-ascii?q?uDu2fcjc6IXk8w1kQQmklf47d2ytksfFCOV08zzLucDA8GNcvYKQ5IaMpS+mDT?= =?us-ascii?q?fTyQvuTN2551OZuyFvzwR++UqKkUml6kHBouH4kU88sOBIes0EDFIsf8N7MK0w?= =?us-ascii?q?8t5B7sJFSLF/RGZg6EkCodo8G+0J923ZNRJjcDDmVhKS+3/KrYphc2gPqfW9c7?= =?us-ascii?q?enMaXoweNn0oXs27milZsm9PDDmxz+IV0g+C7yXzpi7IFjnzc8JjZOuIZRNrEN?= =?us-ascii?q?y24isw86y3iV7R75XfKHr3Oshlut/K9ewVvY2HC+9OQbl7rUjch5FSR2a2XG7X?= =?us-ascii?q?Dd61O5/wZpExYtPoD3a6VVq/iy4oQ8rqItaiMLKIgQDpRIZTtomXxjYjOtGhFj?= =?us-ascii?q?sGARd/u/kD5L5gZQ0Ee5c7YgTotgQkOKy5PAeY0s6jQ2mqKTtOU/ZT1+O6aKJL?= =?us-ascii?q?zyA0dO+11GMgTo0mz+mw6UMNWJAKjhTZxfa/Z4lfUTP+FWFcewTPvyU2jHJtNu?= =?us-ascii?q?Aszecj2BnIq0UTMyiXdOx1b2xJp948BUmILnVwFmo1XF6cjY3N4w6qw7AS/zVS?= =?us-ascii?q?n9dS0e1Zrnf+pIXTYDSyV6y3sZ/VqTYvbcA6o61tNozuOtGJtJffnjPDUpbfqg?= =?us-ascii?q?iFUS68F/pdnNhfOjlVT+JJmW4/P8wKoIRB6VcrWsc4ObNPFLEmpqq2Zjp8ES4S?= =?us-ascii?q?0SgZWpub0zMchOexwKHVmQqOcJs8KhwEq49NgsEdUiJsZSMevqCjXZ3Ml2CYUm?= =?us-ascii?q?gLPBsT7QNU6QIakI9wf/zq4IrPTJ9I0D5Yu+t6XDbRGJR08FX2UX2ZgV/9SPq9?= =?us-ascii?q?ieOpxh5SwOjq0tYFRB51EVJdyPpOlks0NLF3LLEdsZLIsjCSaUz3p37iyOyiJF?= =?us-ascii?q?lVyM3baUf4DJbbumXgUi0Q43oURZVAyHvHD5QdjxJ5aLo3pFVLOI2mYFzx5yYj?= =?us-ascii?q?x4tyBLS4SdqryEw7rXkYQyeqEtxBC+5isFLWVz1lY4yrqJv/NJVIR29c4pudpE?= =?us-ascii?q?lFkE91KS621YJcK91R4j4LRDVOry+Rs8eySM1C3M92DoUDItRktnf8BqxLJoae?= =?us-ascii?q?r2cxurz1xX/T4yo8v0uixDWvB6+4SPpU/3UZGgUtPWuesEcuD+wo8mfc6V3Nt1?= =?us-ascii?q?d0/+BABreRkUpxujF9HotVBjZI03ClIE5/TH5cs+VVMK7VadBTQ+EuZR+zPBwz?= =?us-ascii?q?DeQp31aU/UFyh3v5YDd/tgpb+yDcQwk7TjMZgrHzlj0CssunIyMVS4pUbTU9aC?= =?us-ascii?q?fIMx6bmSdSvBtEd0FmR5UZDc1f97Edw4RU4tLISVywJiEdQBxiKgU43OJflUFZ?= =?us-ascii?q?qkWXYyTdAhezePnSrBJ3Zd+Ro9CtLPvn5gdLkITnsPo3968bXX2phRWtQczCr4?= =?us-ascii?q?/7rtCKtEyOe7njPuKhf3DBVybDjQqshbg6EpbG5S7TPxRHK5Ni03orfYDhCXLX?= =?us-ascii?q?PRRBP68UPERbWrxmZdhEv+xXadRpd7oO+a9oGh2IXAjvGJC1oPlAMFnTWSzULz?= =?us-ascii?q?+d/eynvYLT8bvdRPD6ZsOS2nnHQ7h4Poth5Dn/HLfqz5FR9lTq1fdq60x1V0LK?= =?us-ascii?q?Myafo9T9PgkL/tWtdlP+vp01GjPbGI9wkGHxxk5aasUXXzan8I8fyJNE8nb/Vf?= =?us-ascii?q?x30k7vsO1I7bZk7ZM747dzyce7Pa3SM+hVsVd7AhiIAQVn7oktAHJhSG9Pf+Ac?= =?us-ascii?q?M+rRfaAFjcD0se/3Ca0X6BqR++NHddvLPUbBmtOwCjuEUxxLgB8BqSIGLgubz/?= =?us-ascii?q?OFnrV7ScKhpefnxkIt/0KxIQQdwbBr+4iE5rGIq/PNYBvJ07cIQK7qSd3vrr40?= =?us-ascii?q?oUOd+eUklKISemxyewCnEvISVtQaxmf7yaAl1zwsHtjGH7L9/P5DS3M5kS7hm5?= =?us-ascii?q?9nGVUWAekYHb2R/YRRhm04gfDWNsUKcqBenWaCDRykHaUEyX6l8SuXJ3RqjQ/V?= =?us-ascii?q?3hHsW2yz6kT2rShiTSvK0djjjlJfVqOrCkdKQyqpJUh4vSuAPAr1tdr3vaA141?= =?us-ascii?q?8zMmH/qd2CinCuOLJNEM35PtCcJjM0pF0Php0rWtOvwZwbGca6INoJ9nF+auDT?= =?us-ascii?q?62Ktky9EuatHhoze4s+P+vrNBnmgk7eaq6iRyzBE13g4p08w5sqnNvHU6N2AW+?= =?us-ascii?q?6o2HoJTydjpwvBWAa4qrncr1ASJUyL31nElZcPPtFYx3Y40F/p5PQtQdI07gVe?= =?us-ascii?q?FZ3Aa+kEpT/tJDv+2UyfbM4vVimCzztXGUr4EV1jGKg52G/9p8zJmmnN9F0vXI?= =?us-ascii?q?l/bVTnhQZwD4U6N00i9EQXzjAEEQgXZhCRFKuoClj9LYsYSUgDbgyK3KOgdacp?= =?us-ascii?q?x0Jzza2g5PTIYOxnHaUNKOxSjgGQk1hAAJ4Wt7MRQK5kcV9H6KHXvhTiC5TgX/?= =?us-ascii?q?X+l3owNPi1T9tf8c8Ht3ot/By/Rxum6ZdM9bobjo6HdrJca5jWoM9891tn5SII?= =?us-ascii?q?diFVgRh+jgm2XvoAq+34+djUroao5fiyW6o3QOUX7Rc0DXxkj5TsmFAjvc3X1+?= =?us-ascii?q?BER4LOiIT/6w5MLGSIuIbbzxl8MfABK5+vfLt763oHIDURKGwUMtqLcfk85DVt?= =?us-ascii?q?Py/J61xFGMMMassSPNDRlgBMlk3pRLZT+9LDGlCCF4d8a8Ao7mTwyDAv8pswS/?= =?us-ascii?q?3g5yGyJZDe6VFNIvxCgT50lN3YuOga3frSCSYQ4XmDaBh52CCCxIeXC/b24+qM?= =?us-ascii?q?zMvYV1QcHi45S41dPiaN+RS7Ruqpk5XkSh+U6tXtj5I6bk2QQGK+kb8YvaZNHu?= =?us-ascii?q?5Aizn70SJFFo/vnfKVrsCg6G1JuV1bCIxz9wHKGL1DPpVnPhT1jsarSVJmBiTh?= =?us-ascii?q?ZMHUdgEjuO6XxucQ/ep+N1HxZZIAIh4ezbL192ZVRBN0SLHqplaZQf4RZNx+Rf?= =?us-ascii?q?PLsH9V755gK6gIPFSav5zlsDNIqFEwAA80Z749tThaeVfUnAxVQan4orgAhRUA?= =?us-ascii?q?UdRho09DBXqwOH4i5zrATalViqiRB+AS8jWXVKMOSF9kMiJ5QxOyw5VuYKCknf?= =?us-ascii?q?VIv2JJhC99p+Iq0zN+ThumpSLsv74N2S4n+LyguzUOpWdFTv6HnynVBltNyvUK?= =?us-ascii?q?jaEBC3ft8lG8b3wDY5H04LZ5P8jg8pMh43snaxU5YyIGRfigCz33j66QAIyPt9?= =?us-ascii?q?JchBiXtMrSbb+zKTUSOak8yBLiQXh9yQvenBdz/WsVQzWg8sUrJIGgNsYk3Cao?= =?us-ascii?q?H3bUdEoU6KNTrMTxrUILTPcxaV55wWVjzNKIRisWSczLBmY6kwkkaWJfcJ5Z7h?= =?us-ascii?q?8aDaYoiC6SvqZa5gEUfCvUEoO994nSg8jI13c9TdNxy2PYvKKFgI0l0GF/l9Ny?= =?us-ascii?q?8CGOpGwYd/bEXM90HnjzyoBfxPTxZ/WpteAGRpVpyLClUPIZKcmj/m222JR2VU?= =?us-ascii?q?O/wLQRAUa5OvcZxrjHSyelVXGYWeOTfmiOnzY4Mlby5R6sLl02dMdFsVQwMu7D?= =?us-ascii?q?hp5AjQ3uT6l4RiKKpV/U1GYjK/8VdxoquIe7fAwHVPIRZ+mZJeU13P0+CUcDb3?= =?us-ascii?q?zXEityEeO2t0CinJRjMXV6/Ur6efjt8hzhMNaKHxkEEI3arp12+fGhRGKOI3xg?= =?us-ascii?q?zBp0PEZq8efTDVIxufFAc5yJh9jfm8x70fIZd/dqKSAyocAcmoR/6YSPy8eKdR?= =?us-ascii?q?bRzoruJdHLvPeXHufTz0MwemFVSrAZex/6550mPt4lXL3eBbVZsgoYBag7WJwu?= =?us-ascii?q?KXz89aB1LAN2dw7eeq60gs30qe6RYZtUvXDW5EoqLCjAox0D1uC0TQtjYpGkn3?= =?us-ascii?q?XyOpEwSS5foNB2DxtmHZdPG9keoAa9BJ6Ugq67gcer+0xmo+8KrbbwCvfS2dS+?= =?us-ascii?q?24V+QYNX5VSPPDnLH6lrnkVlgfiugvfazJb+F9nuedUaW+hnWmTFcKPJHp2jKj?= =?us-ascii?q?KSPcLxY0pG87+a0LJkXRSdfST5X6udtC24L/Vp+kQ7xZZ+fOrU1jAt6Kvb2NTq?= =?us-ascii?q?bWFBuiijtWKJNIdY7FHSHuzRQRZUSfuD8GZ4EqwbaoT69PsOMdM82tiT/RFz4y?= =?us-ascii?q?5Z3cuGPaehtEnM1Vx/dZ3AMUvp1Dw1WY4QIBSwKUEsm3PWqmzBAXRAKcipMcxt?= =?us-ascii?q?j8yJARzt5klxn2Yta3VfGmrpQ9eeJ2wb28O4ZA2X+wNHFdEDn/S4eUQgrK29Vf?= =?us-ascii?q?FoOolZmeWtrLgHk8xmKyLIRMdBJCzQMbl2PiZRDuXIuVgobR4Es6QvVocze5eO?= =?us-ascii?q?PFsNMF2cxiPq0QvCzUr0esSj1KmTOykW6HRHwKzB0TVXuQm5veyWgtbiULDEdp?= =?us-ascii?q?32WuDdMDY9XDGAWTsyCVqp+Uuju/ccvvqYJGAfokoOYiKTEw4evaZvosLVDmDN?= =?us-ascii?q?mO1vZpoKhOqVWyroUi13iLIyBjpXtUCLW/cDDgfWb3r9j2dduwGvPeFM8mz/b7?= =?us-ascii?q?2Zx6tVXOoWDpFKcvKHX9uLMcxZci8hizExIO+he5jZqLEj3xTDSm5KPbPP8Qil?= =?us-ascii?q?UEOOQvGajwnuVIERspl87jEk4frMjyR3FOLOJL/ZqDmwpN3rxB2EsPHTAzF+K3?= =?us-ascii?q?c+h/gPVSzbmBQ=3D?= X-IPAS-Result: =?us-ascii?q?A2HgAQAu5RVZ/wHyM5BcGgEBAQECAQEBAQgBAQEBFQEBAQE?= =?us-ascii?q?CAQEBAQgBAQEBgwEpgW6Odo8/BpkiKIseVwEBAQEBAQEBAgECaCiCMySCSQJ2A?= =?us-ascii?q?wMJAhcxCAMBbAWIAoIPDbFkJgKKWIYZkBQFiUSGXo1okw4NixmGUpRDWIEKJgk?= =?us-ascii?q?CHggfD4U8HIF/WohrAQEB?= Received: from unknown (HELO tarius.tycho.ncsc.mil) ([144.51.242.1]) by emsm-gh1-uea11.nsa.gov with ESMTP; 12 May 2017 16:40:19 +0000 Received: from prometheus.infosec.tycho.ncsc.mil (prometheus [192.168.25.40]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id v4CGeEXS032534; Fri, 12 May 2017 12:40:16 -0400 Received: from tarius.tycho.ncsc.mil (tarius.infosec.tycho.ncsc.mil [144.51.242.1]) by prometheus.infosec.tycho.ncsc.mil (8.15.2/8.15.2) with ESMTP id v4CGeCe1223212 for ; Fri, 12 May 2017 12:40:12 -0400 Received: from moss-pluto.infosec.tycho.ncsc.mil (moss-pluto [192.168.25.131]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id v4CGeB5k032528; Fri, 12 May 2017 12:40:11 -0400 From: Stephen Smalley To: paul@paul-moore.com Subject: [PATCH v2] selinux: log policy capability state when a policy is loaded Date: Fri, 12 May 2017 12:44:23 -0400 Message-Id: <20170512164423.17190-1-sds@tycho.nsa.gov> X-Mailer: git-send-email 2.9.3 X-BeenThere: selinux@tycho.nsa.gov X-Mailman-Version: 2.1.20 Precedence: list List-Id: "Security-Enhanced Linux \(SELinux\) mailing list" List-Post: List-Help: Cc: Stephen Smalley , selinux@tycho.nsa.gov Errors-To: selinux-bounces@tycho.nsa.gov Sender: "Selinux" X-Virus-Scanned: ClamAV using ClamSMTP Log the state of SELinux policy capabilities when a policy is loaded. For each policy capability known to the kernel, log an informational message with the policy capability name and the value set in the policy. For policy capabilities that are set in the loaded policy but unknown to the kernel, log a warning with the policy capability index, since this is the only information presently available in the policy. Sample output with a policy created with a new capability defined that is not known to the kernel: [ 43.812265] SELinux: policy capability network_peer_controls=1 [ 43.812266] SELinux: policy capability open_perms=1 [ 43.812266] SELinux: policy capability extended_socket_class=1 [ 43.812267] SELinux: policy capability always_check_network=0 [ 43.812267] SELinux: policy capability cgroup_seclabel=0 [ 43.812268] SELinux: unknown policy capability 5 Signed-off-by: Stephen Smalley --- v2 drops the Resolves line since I think we are not supposed to include bug tracking info in upstream kernel commit messages (correct me if wrong). security/selinux/include/security.h | 2 ++ security/selinux/selinuxfs.c | 13 ++----------- security/selinux/ss/services.c | 23 +++++++++++++++++++++++ 3 files changed, 27 insertions(+), 11 deletions(-) diff --git a/security/selinux/include/security.h b/security/selinux/include/security.h index f979c35..c4224bb 100644 --- a/security/selinux/include/security.h +++ b/security/selinux/include/security.h @@ -76,6 +76,8 @@ enum { }; #define POLICYDB_CAPABILITY_MAX (__POLICYDB_CAPABILITY_MAX - 1) +extern char *selinux_policycap_names[__POLICYDB_CAPABILITY_MAX]; + extern int selinux_policycap_netpeer; extern int selinux_policycap_openperm; extern int selinux_policycap_extsockclass; diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c index ce71718..ea2da91 100644 --- a/security/selinux/selinuxfs.c +++ b/security/selinux/selinuxfs.c @@ -41,15 +41,6 @@ #include "objsec.h" #include "conditional.h" -/* Policy capability filenames */ -static char *policycap_names[] = { - "network_peer_controls", - "open_perms", - "extended_socket_class", - "always_check_network", - "cgroup_seclabel" -}; - unsigned int selinux_checkreqprot = CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE; static int __init checkreqprot_setup(char *str) @@ -1750,9 +1741,9 @@ static int sel_make_policycap(void) sel_remove_entries(policycap_dir); for (iter = 0; iter <= POLICYDB_CAPABILITY_MAX; iter++) { - if (iter < ARRAY_SIZE(policycap_names)) + if (iter < ARRAY_SIZE(selinux_policycap_names)) dentry = d_alloc_name(policycap_dir, - policycap_names[iter]); + selinux_policycap_names[iter]); else dentry = d_alloc_name(policycap_dir, "unknown"); diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c index 60d9b02..0abdec2 100644 --- a/security/selinux/ss/services.c +++ b/security/selinux/ss/services.c @@ -70,6 +70,15 @@ #include "ebitmap.h" #include "audit.h" +/* Policy capability names */ +char *selinux_policycap_names[__POLICYDB_CAPABILITY_MAX] = { + "network_peer_controls", + "open_perms", + "extended_socket_class", + "always_check_network", + "cgroup_seclabel" +}; + int selinux_policycap_netpeer; int selinux_policycap_openperm; int selinux_policycap_extsockclass; @@ -1986,6 +1995,9 @@ static int convert_context(u32 key, static void security_load_policycaps(void) { + unsigned int i; + struct ebitmap_node *node; + selinux_policycap_netpeer = ebitmap_get_bit(&policydb.policycaps, POLICYDB_CAPABILITY_NETPEER); selinux_policycap_openperm = ebitmap_get_bit(&policydb.policycaps, @@ -1997,6 +2009,17 @@ static void security_load_policycaps(void) selinux_policycap_cgroupseclabel = ebitmap_get_bit(&policydb.policycaps, POLICYDB_CAPABILITY_CGROUPSECLABEL); + + for (i = 0; i < ARRAY_SIZE(selinux_policycap_names); i++) + pr_info("SELinux: policy capability %s=%d\n", + selinux_policycap_names[i], + ebitmap_get_bit(&policydb.policycaps, i)); + + ebitmap_for_each_positive_bit(&policydb.policycaps, node, i) { + if (i >= ARRAY_SIZE(selinux_policycap_names)) + pr_warn("SELinux: unknown policy capability %u\n", + i); + } } static int security_preserve_bools(struct policydb *p);