From patchwork Tue Aug 21 00:04:40 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Schaufler, Casey" X-Patchwork-Id: 10571427 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id DA51E921 for ; Tue, 21 Aug 2018 12:15:17 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id D0FAC29F7C for ; Tue, 21 Aug 2018 12:15:17 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id C4D3C29F9E; Tue, 21 Aug 2018 12:15:17 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.2 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_MED autolearn=unavailable version=3.3.1 Received: from uhil19pa10.eemsg.mail.mil (uhil19pa10.eemsg.mail.mil [214.24.21.83]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id E9E9129F9D for ; Tue, 21 Aug 2018 12:15:16 +0000 (UTC) Received: from emsm-gh1-uea10.ncsc.mil ([214.29.60.2]) by uhil19pa10.eemsg.mail.mil with ESMTP; 21 Aug 2018 12:15:16 +0000 X-IronPort-AV: E=Sophos;i="5.53,269,1531785600"; d="scan'208";a="15037543" IronPort-PHdr: 9a23:nodMoBBpT6ncYlRWAPOhUyQJP3N1i/DPJgcQr6AfoPdwSPn9pMSwAkXT6L1XgUPTWs2DsrQY07WQ6/iocFdDyK7JiGoFfp1IWk1NouQttCtkPvS4D1bmJuXhdS0wEZcKflZk+3amLRodQ56mNBXdrXKo8DEdBAj0OxZrKeTpAI7SiNm82/yv95HJbAhEmDiwbaluIBmqsA7cqtQYjYx+J6gr1xDHuGFIe+NYxWNpIVKcgRPx7dqu8ZBg7ipdpesv+9ZPXqvmcas4S6dYDCk9PGAu+MLrrxjDQhCR6XYaT24bjwBHAwnB7BH9Q5fxri73vfdz1SWGIcH7S60/Vjq476dvVRTmliEJOTAk+23Tk8B8kb5XrBenqhdiwYDbfZuVOeJ+cK3Dc90URm1PUcRfVyJcGoOxbZYDAuQOMulEoIfyuUAOoACiBQSuHu7j1iVFimPo0aA8zu8vERvG3AslH98Wrnnbts71O7kSUOuo0afH0TXDYOlL2Tfz7IjHbAohquyLUL1sa8XR0lcgFgPfglWLtYPlPyma1vkDs2if8eVgT/mii28hqwFtvDevwt0ghZXOhoIQ013J8zhyzoUtJdCgVUJ2btGpHIFQui2HLYd6XMwvT39ytCon0rEKpJq2cSsQxJg6xRPSa+aLfoyM7x75WuucITF1j29/dr2lnRa9602gx/X5VsmzzVlFsDJIksLJtnARzxzT7dWHSudl8kehxzmP0wfT5/lYIU8uj6rbKoMhwqUqmpoSt0TDECj2mF7og6CKbEkk5uip5PjnYrXhvJOcMZN7ihriPag0n8y/AOA4PhAPX2id5+u8yKXu8VD2TbhFlPE7krTVvIrEKckUuKK1GRJZ3p4m6xmlDjem1NoYnWMALFJAYB+HlJbmO1XPIPD+EPe+jE2gnyxsx/DbOL3uHovCLmPYnbf9fbdy905cyA0pwdBZ/JJbEKsNIP30Wk/vrNDYFAM2MxSow+b7D9VwzoEeWWWJAqCDLKPSsUWH5uQ0LumOY48VvjP9JOI+5/7yk3A5g0QdcbOu3ZsNZ3CyBu5mLFmBYXrwntcBFn8Hvgg8TOPwlFKCUiVTZ3G0X6I9+DE2E4ymDYPeRoGim7OBwSG7HoFLZmxcDVCMC3jofZ2eW/gQcCKSPtNhkjscWLi5VYAuzg+htAn7y7p7KerZ4SwYuoz929dr/eHTkgsy9TNsBcSHz26NV310nn8PRzIuwa9/pkp9ylGe3qdmh/xYFMde6OlXXQcgMp7Q1et6C8r9WgjZZNeGVE6mQsm6ATE2Vt8+3sMObFxnG9i5kh/D2C+qDKMPmLyQGJw46KTc0GbtJ8xl0XbJyLEhj0U6QstILWCmh6h/9xTNCI7NjUqZkrildbgG3C/N72qDynKOs19eUA51S6rFXHQfaVDRrdX2/E/CSKWuCbs/OAtb1cGCMrdKasHujVheSvbjOdDeY2evlGeqHhuIyK2DY5fte2UHxirdEFIEkwcR/XmYKQc+Gj2to2XEDDxhDVjveV/j8fFiqHOnSU851wKKYFdi17qy5x4Ynv+cROkQ3rIDpSctsTJ0HEyy39jOEdqPuxJhfLlAYdM6+FpIz3/WtxZ8PpO+NaBvnUQRfBhyv0/00BV3EIpAm9AwrHw21ApyNb6Y0FRZejyEx5/wPqPYKnLu/BGvbK7bwUre38qX+qgR7vQ4t1TjsxuzGkok7Xpnz8Ff02GA6ZXSEAoSTZXxX14t9xdnur7XeSY954bb1HF2N6m7rCPC0cozBOQ50hagY8tfMKScGQ/pHc0aHc+uKPc2m1WydRIEOudS9aAxP8y8cfuKwqirM/h8nDi+l2RI/Jh90l6Q9yp7UuPJ0YwKw/WE3gSZTTf8l0ysst7ploBefj4SA2+/xTLjBI5Laa14ZZwLBnu2I82r2tV+gIbgW3hZ9F6nA1MJxtSpdAGIYFPjxw1Q0l4boXu9mSu31zZ0iS0mrrKD3CzSxOTvbAQHOm9XS2l+ilfsO5K4gMwaXEivaQgpmwCo5UL7x6hdvqt/NW7TTV1PfyjsIGFoSrGwuaaaY85T9JMotj1aUOC9YVCBVr7xugAa3D3nH2tfwjA7aj6rt47inxxiiWKdKndzo2bCec1qwxfQ+sDcT+ZL3jUaXCl4lSXXBl+kMtmz+tWUk5PDvf6kV229UZ1SfzLmzZidtCSn/m1mGxq/n+q8mtf/Cwg1zTf718V2VSXPtBv8YZfk16KhMe98fUlnGln869F8Go5gjos8npYQ2WIVhp+N53oIjX/zMclH2aL5dHcNXSQEw8PR4Af7wE1sNHSJx57nWXWH2cZhesK6bX0M2iIm9cxKE6CU7KFenSRpvFW4owXRYeJynjgD0/cu7mAVg/0Rsgo30iqdGqwSHVVfPSH0iRSI6c2xob5JZGapbLew1FBynda/A7GeugtcQmr2eo8+HS9s6cVyKErM32fu6oHgY9TfcdMTtgGUkhvZgehaMpQxmuANhSp9NmL3pWclxPIjjRxywZG6u5CKK2Zt/aK9HBFVLTj1Z8Qd+jHjk6legtqW34CoHpVkBDoHRp3oQuy0EDgKr/ToKx6OECEgqnecAbffExWQ6EF6r3LIFpCmLH+XK2cEwtVlXhmSPlRfgBoTXDU4gJE2ChyqyNbmcEdj6TAb/kT4pQdUyuJ0Kxn/VX/SpAmyajgqVZefNwBZ7gde50fSKsyT9fh8ED1d/pG7qwyNMGObbRxSDW4VQkyEG0zjPr626Nbb6OeUAe6+L/rVYbWSsuxSTeyIyoyz3Yd85DaDKMGPPnhkD/0m1UtORmx2GsTDmzUSUCwbjSzMYNSHpBen/S13qNqz8PPxWALg/YGPEaddMc1z+xCqhqeOL/WfhCd2KTZf0JMB3mLHx6YE014TkS5ucSOhEbMatS7CVKjQgLNYDwYHayNvM8tF97gz3gZXNs7FlNz4zbl4juYrBFdDUFzugMCpZcgRLGG6O1LLHkGLNK6JJTfT2cH4fbu8SaFMjOVTrxCwpTGbE0r5MjSZkDnoVg6gMedXgyGBOxxRpoK9fw1xBmjkSdLpdge0MMRrjTEsx707mG/KP3YGMTdga0NNsqGQ7SRAj/V9G2xA7mJlLe6AmyaY8+nXNI0bsf5qAiRojeJV/m42y7xP7CFLXPZ1gjfdrsZyo1G6lemC0iRoUAJUpTZRhYKLpl5vOb3D+ZlaWHbE5woN7WGKBBsWudRpENrvu7pfytLXjqL8NC9C887I/csbH8XULtyIP2AlMRfyGz7UCxAFTSKxOmHZnExdk/CS+meTrpcktpjmgIAORaNDVFwpCvMaDVxoHMYcL5dsQDwri6Sbg9II5XeltxbRRd9asY3AVvKcGfXvMiiWjLleaxsO37z4MZwZNpfn1Ex6dll6gIPKFlLNUt9XvC1hbxI7oF5W/XdkVG0zwUXlaw224HANCfG0gwQ2igpiYeUt7jvs5Uk4JkbSrisqjEYxgcnlgSyWcDPpKKewWptWBDTyt0kwNZP2WAl1bQuvnUB+MzfEXb1RhaN6dW93kA/cpYdPGflEQK1ffhAQwfCXZ/M10VVTsSio2UhH5e7ZBpR4jwsqbYSgr3Re1AJ/dNQ1P7DfJLJVzlhMgaKDpjKn2fw0wA8ZIUYN7H6edTUWuEMWLLkmJiup/utq6QCYnTtMZnQMXeIwov127kM9J/iAzyX43r5fK0CxMuufL7+Zu2nAjsOHX1Iw10MSmEZe57R219ksc1aMXUA10LSRDwgJNdbFKQxNdcVS8HnTcjqQvurVxJJ0P4O9FufuTeCUr6sbmUOkExwvH4gV4MQBA4Og0EfGIsf7NLQF0wki5Bz3JFWZC/REYAmEnykBo8yk1pB4wJddKS8HAWVmKyq3/LbWqhUtgPqZU9c8em0aUZccNnIqRM26nDZUv25GDDm2zu0ZyA+C7zvnpirIFTfycsBtaeuTax53FN62/jA//LSshl7M7pXSPWf6Osp+utXX8+MVu46HC+9ITbl6q0rTh4tYSGa2XGPUDdG1IJzwa40tbdPqEHa6TkKwhC41T8vrO9atNKeIixnyRYlIqImbwCwjNcilGzEEARhwveYD67lnaA0feZo0ewDouBo6N6y+JgeY3dGuQ2eiKTtWU/lfw/+1Z6ZSzyY2aO+11mcgRIkgz+ar6U4NWI0KjhbGyPetfYVRTSjzGn1YewXOvyU5lHNsNucszegh3hzEq14cMyqEdOZxcmxLo8k8BU+OIXVxEmc4QkWTjZDA4gGyw7AS/i1dn9lP3OxLqnf+uIPQYDarWKy2tJrVqDAsbd44rK1tKYbjONeJtIvCnjzDS5ndqhWFUCm+F/VAgNhRLiVYQP1GmWw+PMwGvo1B6VEvWcgiPbxPD7IspquraTpiAi4e1ygZV5mP3DYamOezx6PalguMcJQlKBELqo9CgsYbUyJsYSMTv66jV4TXl2+YUWcHOgET4hpQ5AgYjI9/Yvjl4JbUTJ9L0zNWv/V0Ui7QG5l061f7T3qZjUL+SPq/j+yjxRhSw+700tkHRB5/DlBQx+RRlkQ2M7x4NrcfvpXUvT+SaUP1on/ixPGgJFZP1c3eb0f4A5bdtWrgTi0c/mUZRYFVyH7FE5Qdjwt5aL0wqVVJOICme1/y5ycqxoRyBbW4Utqrx1k9p3YcWyiqC8ZBC/1hsF/PRD1qfo2kqJT/NJVWWWJf5Jqdq1JFn0p3KC651YBQK8dT7T4QRDJPuymSvMOuSM1f3s97F4cMIsxju3jnBaxEJIOco2Yxurzy0H/W5y4zsFGmxDWpAaC4S/hV/2oEGgUmP26esFUgD/Mw8mfO9VDAqkt7/+lHCbSTj0h9vThwE4tSCTZO0HCqM058TGJas+lALqTabdBcSeEoZRCzIxw+CeIm30uR8EFug3j2fixyuRFG+y3GWwk0UjcVjanzlTICrcGoJCEVR4hObTo/cyfPMxibljxPvBZDd0FqXIgUAspf+74Fw4Rb49HPSVuoKSEZRhxtLBw40ftYlU5HrkqYZTrRDQ2ydfbAqhd3Z9uerNa1LPTl+wdKkobnv/o896UHWXKmhRGtTsrEoILnsN2FqFeOdLzkPOKmeX/OUiLAjRauirc4F5PK5TTcMBJHK5lmznopeZrhBnTRPRRBPKIbI1BUVb5hZNVDv+BaY9NkeKcV9q9sHB2HQAjvFJaorPlcIVbZXS7eIDmZ8uyjvYLT6qTQSer6acyKyXbHWaV3MYpk5jTgB7fly4le+lHx2vt38EN1V0TGOTibrNv9PgML+NWidkz6s50mADPWAZNwkH7zyUFFbMcYXjOl/48ZyJxD7nb8U+V40lL8sOdK7blr9ZE346x1ycezParSK/VasUp8DxiRGApr9osiAHJ+R2BXbe8dMvHRcroFjcr2seD4C7QX6AGJ++xecdbHIUXBl9K+CjGaTBxIhgYBqTgULguGzfGFgLN0Sdy4peflxkIt/kK+IQAcwLBq/4eE9bKCpPXLYBvJ0bgERq/qS9v2rrQrvUOS+fIkm6AVd2xwYg2oCu4dWdABxmbuyqAq1yEsE9jZE7Lm5vFDS2oznij8lJBlA1UWBvQUEKKP/YRFm2c1m/fUNtMIfa9fnWaPDwSrEqcYyX6s6SuYPnVqgg3U3xH3W2Oz40f8rTVkTivU09fjjk1VW6G2BUZTRSWmI1N3vSiUPAX2qNr4p7g64FsxMmz+u9KHjHGhN69PH83jONycJjE5q0kWjJ0qSN2gw4IbGduhINcJ6n5+c//e5ni3nC9GvqhImZDR4tyP+vXQB3mvlbeWq7KXxDBX0nI4p00w6si8NvHS4N2HW+yo2HwNTyhjuwvAURm1qqbYr1wNIkyEzkPLmI0MPtFE0ng1zVnm6/I/QN0v9AVfGIHAZ+kBpTzpOzv730yfY9QpWSmayTdXGUj1EVZgEqgmxG3wpN7JlWvX+1AwSYl/aUrnhQBwD4U/Lk4t80YYwi4CEQgLdBCaA6qlBUD7IoseVUkMcw6L3L6kdacrxUdz2K+g5PfPbexgAKoALvBdjg+Sk1hcHpIZq7YeTKh9e19a867XvRPiBpPiX/Xpmns8L/q1QtpV8coBrXst/h6/Rwa86ZdE97sbh4yHdrVfYZTVoc5y4EFp5T8JdixQjxlylBy5UeUGq+Dl/NfXqp2o6vyhVKw1XeUY6wA0B3hij5v3mF0jo9bX1+daSoHPlYv/8ARNI2OXt4fb0hl8L/EOK4GqfLt76XUHJjYeKGgKPdWLavkw+SltPyvP51ZaGMMDecsYPNbRmQBTkkDpWa9T+dDdGlKDD4dzat0n72vwyDAu65c8Vfzg6DCuL5DF815NJ+9DjDlrlN/apuga3/TSCCYT4XSCZRl62CWCxIeRC/rq++WD1s3UXUscHiEqS4ddOCaC+Qu/S+q6kJXpVQ2V5dH3gJI6b0+QXXuxnKIEsqlQC+JAjDv03iRGHIDvm/2Vq8as6HdQtlBfFYZz7B7FGKZYPphgOxT3jMqrRk96BiThfsHYbBwut/SKxu0U+eVxK1P+ZZMHIhID07/18mRaTg1ySLPtpVaZWeURZMd6SPPasH9a9JhsK6gVPFiSvJbqtCtHqEgqAA81b789tjJaeVfKnA1UQ6b7pqUNiwodUd58vE9DB3iwOGYg6DbdUqRVlqaRAuQP8jqPVqwOT1loMiRmThK7wJVuYbqpkuxZvW5dmyN9oeQq0yZ4Sxemvi3sva0N0yo6+L6krDUBpWBFTuKGnifPDVVM0u8Hjb8YC3n48ly8fHgDY5fu4Ll9O8vv65Mt43IhbhU/ZycGR/ivCznsj6OUBYyCqNZchB+LuMXTYr6/NCwSNrUmyRL/XHhwyQnekwxu8GsMWDmg68UkJIqlM8Y/2iWoAXTbdEoL4q5Rtcv+r0IETOs3aVNnx2VuydaHRiwLRMPRH2Y1jw4kaXhLcZ5Z7h8aDaYoiC6SvqZa5gEUfCvUEoO994nSh8jI2n49Qsxxy2LLoK2FmpMq0Hp4m9N77i6OpG4ed+rGXM9wGnLzzJtQyfTiZ/WxteAKUIlmyLGmUP8YKMmj+HC21Y5sWkC/w7QRAVu5PPUExrfBXCevUXeYVviTc2iQgzY5NVb/5QKmLl0ydMhHrkwwP/DchpFCjQ3hULJ1RiKWpVPBymwsL/8aJEoKv9KkdhYMQepUZ+GGKeUowfsxIF8NdGPSWyxuBumpuFqp2oN8PjEo5UT8fPSo8Q38NtaWMgcLHJScrZNr//G+AGWbNjsoyBx0IVkx7OrUCk4wqv4ZdpGdgNzdr8p03PRDdPp3NyA5/NkJlcYr8oSQ0cGXYTnN353yIpfTufHeDPrBiwwhc3pXQ/wCagP8+os+M8QRWrvPEL8fthMZQeA2SYIscWf48rp5KitydBLcYPK/hcyu7u6GYJZZoTnKqF43JyT0uhsfx/jyRgt+K9ipnXTpPJ02bjZAqcB9TBpgAIZLXcgHqk7vCoSWkaeTj9635lM8uukWvK62AffPh/qj2IAkdJFB6F3DBz3RDbRlhkl/xrC5i+zNw9/qAsPrZN0AWfJTQ2jZZ7uAFYK6fGHdcvngclJLpubPmIlyVQ+cMWWgB6c= X-IPAS-Result: A2AbBAAmAXxb/wHyM5BaHQEBBQELAYUgEhYSjFujaRSBXxIYFIg9NhYBAgEBAQEBAQIBbCiCNSSCXwMDAQI3FCAOAwkBAUAICAMBLRURBwcLBRgEgwGCAqcQimCGUYQfP4N2hHkBEgGFdwKNTTCNCAcCggIEjVILFY45kzOBSA4jYXFNI1CCaYIlF443T32MHYI6AQE Received: from tarius.tycho.ncsc.mil (HELO tarius.infosec.tycho.ncsc.mil) ([144.51.242.1]) by EMSM-GH1-UEA10.NCSC.MIL with ESMTP; 21 Aug 2018 12:15:15 +0000 Received: from prometheus.infosec.tycho.ncsc.mil (prometheus.infosec.tycho.ncsc.mil [192.168.25.40]) by tarius.infosec.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id w7LCFEdg023668; Tue, 21 Aug 2018 08:15:15 -0400 Received: from tarius.infosec.tycho.ncsc.mil (tarius.infosec.tycho.ncsc.mil [144.51.242.1]) by prometheus.infosec.tycho.ncsc.mil (8.15.2/8.15.2) with ESMTP id w7L04mpA033215 for ; Mon, 20 Aug 2018 20:04:48 -0400 Received: from goalie.tycho.ncsc.mil (goalie.infosec.tycho.ncsc.mil [144.51.242.250]) by tarius.infosec.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id w7L04la9014327 for ; Mon, 20 Aug 2018 20:04:47 -0400 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: A1AaBgDBVntbfSNjr8ZdHgEGDIUxFhKYGJgkgXoLhGwCg00hNhYBAgEBAQEBAQIUAQEWOoVnAwOBCVFXBxKDIoICqROKZIZRgkeBWD+DdosEAo13jQUHAoIABI1RCxWOOJMogUgBL4FTTSODOYIlF443HzCPCwEB X-IPAS-Result: A1AaBgDBVntbfSNjr8ZdHgEGDIUxFhKYGJgkgXoLhGwCg00hNhYBAgEBAQEBAQIUAQEWOoVnAwOBCVFXBxKDIoICqROKZIZRgkeBWD+DdosEAo13jQUHAoIABI1RCxWOOJMogUgBL4FTTSODOYIlF443HzCPCwEB X-IronPort-AV: E=Sophos;i="5.53,267,1531800000"; d="scan'208";a="350580" Received: from emsm-gh1-uea11.corp.nsa.gov (HELO emsm-gh1-uea11.nsa.gov) ([10.208.41.37]) by goalie.tycho.ncsc.mil with ESMTP; 20 Aug 2018 20:04:47 -0400 IronPort-PHdr: 9a23:KSO1lBQ8j7fISDz1I6b13InQXdpsv+yvbD5Q0YIujvd0So/mwa6zYhSN2/xhgRfzUJnB7Loc0qyK6/+mATRIyK3CmUhKSIZLWR4BhJdetC0bK+nBN3fGKuX3ZTcxBsVIWQwt1Xi6NU9IBJS2PAWK8TW94jEIBxrwKxd+KPjrFY7OlcS30P2594HObwlSizexfbF/IA+qoQnNq8IbnZZsJqEtxxXTv3BGYf5WxWRmJVKSmxbz+MK994N9/ipTpvws6ddOXb31cKokQ7NYCi8mM30u683wqRbDVwqP6WACXWgQjxFFHhLK7BD+Xpf2ryv6qu9w0zSUMMHqUbw5Xymp4qF2QxHqlSgHLSY0/mHJhMJtgqxVoxWvqB5xw4PPfI2ZKOBzcr/HcN8GWWZMWNtaWSxbAoO7aosCF/QMMvxDr4bjp1oFsAawChWsBOz11z9IiHv20rMg0+88FgzJwBYvH8kQv3XUttn1L7sdUeCvw6nVwzXDa+1Z2S3m5YjJdBAhve+DXbZqfcXNzkkvEhrIg1ONooLmJzOYzvkBvmyY4uZ6SO6iiW4qpxt1rzWr3MshhInEi4QIwV7e7yp52pw6JdigRU57f9GkFJxQujmUN4tzWcMiRm5otzwmxrEap5K3ZSkKx4g7yBLFZfyHdpKE4hPlVOaNPzh4gGhpd664hxa36USgy+v8Wdeo0FtSsyZIltrBumoQ2xHR6sWLUP9w80O71TuB1w3f8uRELlo1larfJZ4h2Lkwlp8LvEvfBCD2g1v5ja+MekU/5ueo6/7oYqjopp+YKYB0kBrzMqUomsyjH+s4NhICUHSc+eS5zLHj51H2QK1Wjv0qlanUqIvaKtofpq64BQ9Vz4ki5g2jDzamzNsYnX4HIEhDeBKclYflIV7OIPfmDaT3v1P5kzpxwf3Ce73oGJnAKHnFn5/lfK1h8Ahb0Ac10tlb49RfDbRFaPbyXFLh8d/VFBk0NySqzOv9TtZwzIUTXSSIGKDdeKfTt0KYo/kiKPSWZZME/TP6J+Uh6tbwgnIj31wQZ6+k2d0Qcn/8Vu9rJ0SffGrEnsYKEWBMuBE3CuPtlhnKWjdIamf0RKk87yw1DI+8JYbFWo2pxreG2WPzEpRIayZGA1aXHHHAdoOYVvNKYyWXZodtnzoJWL7nV8kt0hqtnA7817djaOHT/2lQtojiz8R44cXXlBcv5Xp1CdiQ1yeGSGQw1moSRTYw9KR+p1FtjFaFzaV8xfdfEI99/fRMBywzLpPNh9dxC9nvVAbMZJ/dQ1+9T8TgGjoxR88/x9IUS0d7B9imyBvE2nz5UPcui7WXCclsoern1H/rKpMlxg== X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: A0GjBQDBVntbfSNjr8ZdHgEGDIUxFhKYGZgkgXoLhGwCg04hNhYBAgEBAQEBAQIBAQIQAQEWOi+CNSKCYgMDgQlRVwcSgyKCAqkTimSGUYJHgVg/g3aLBAKNd40FBwKCAASNUQsVjjiTKIFIAS+BVE0jgzmCJReONx8wjwsBAQ X-IPAS-Result: A0GjBQDBVntbfSNjr8ZdHgEGDIUxFhKYGZgkgXoLhGwCg04hNhYBAgEBAQEBAQIBAQIQAQEWOi+CNSKCYgMDgQlRVwcSgyKCAqkTimSGUYJHgVg/g3aLBAKNd40FBwKCAASNUQsVjjiTKIFIAS+BVE0jgzmCJReONx8wjwsBAQ X-IronPort-AV: E=Sophos;i="5.53,267,1531785600"; d="scan'208";a="7622026" X-IronPort-Outbreak-Status: No, level 0, Unknown - Unknown Received: from fmsmga002-icc.fm.intel.com ([198.175.99.35]) by emsm-gh1-uea11.nsa.gov with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 21 Aug 2018 00:04:46 +0000 Received: from orsmga005.jf.intel.com ([10.7.209.41]) by fmsmga002-icc.fm.intel.com with ESMTP; 20 Aug 2018 17:04:46 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.53,267,1531810800"; d="scan'208";a="250527755" Received: from cschaufl-mobl.amr.corp.intel.com ([10.252.136.122]) by orsmga005.jf.intel.com with ESMTP; 20 Aug 2018 17:04:45 -0700 From: Casey Schaufler To: kernel-hardening@lists.openwall.com, linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, selinux@tycho.nsa.gov, casey.schaufler@intel.com, dave.hansen@intel.com, deneen.t.dock@intel.com, kristen@linux.intel.com, arjan@linux.intel.com Date: Mon, 20 Aug 2018 17:04:40 -0700 Message-Id: <20180821000444.7004-2-casey.schaufler@intel.com> X-Mailer: git-send-email 2.17.0 In-Reply-To: <20180821000444.7004-1-casey.schaufler@intel.com> References: <20180821000444.7004-1-casey.schaufler@intel.com> X-Mailman-Approved-At: Tue, 21 Aug 2018 08:10:45 -0400 Subject: [PATCH v3 1/5] LSM: Introduce a hook for side-channel danger X-BeenThere: selinux@tycho.nsa.gov X-Mailman-Version: 2.1.21 Precedence: list List-Id: "Security-Enhanced Linux \(SELinux\) mailing list" List-Post: List-Help: MIME-Version: 1.0 Errors-To: selinux-bounces@tycho.nsa.gov Sender: "Selinux" X-Virus-Scanned: ClamAV using ClamSMTP There may be cases where the data maintained for security controls is more sensitive than general process information and that may be subjected to side-channel attacks. An LSM hook is provided so that this can be check for where the system would take action should the current task have potential access to the passed task. Signed-off-by: Casey Schaufler --- include/linux/lsm_hooks.h | 7 +++++++ include/linux/security.h | 1 + security/security.c | 5 +++++ 3 files changed, 13 insertions(+) diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h index a08bc2587b96..fd2a7e6beb01 100644 --- a/include/linux/lsm_hooks.h +++ b/include/linux/lsm_hooks.h @@ -698,6 +698,11 @@ * security attributes, e.g. for /proc/pid inodes. * @p contains the task_struct for the task. * @inode contains the inode structure for the inode. + * @task_safe_sidechannel: + * Check if a side channel attack is harmless for the current task and @p. + * The caller may have determined that no attack is possible, in which + * case this hook won't get called. + * @p contains the task_struct for the task. * * Security hooks for Netlink messaging. * @@ -1611,6 +1616,7 @@ union security_list_options { int (*task_prctl)(int option, unsigned long arg2, unsigned long arg3, unsigned long arg4, unsigned long arg5); void (*task_to_inode)(struct task_struct *p, struct inode *inode); + int (*task_safe_sidechannel)(struct task_struct *p); int (*ipc_permission)(struct kern_ipc_perm *ipcp, short flag); void (*ipc_getsecid)(struct kern_ipc_perm *ipcp, u32 *secid); @@ -1897,6 +1903,7 @@ struct security_hook_heads { struct hlist_head task_kill; struct hlist_head task_prctl; struct hlist_head task_to_inode; + struct hlist_head task_safe_sidechannel; struct hlist_head ipc_permission; struct hlist_head ipc_getsecid; struct hlist_head msg_msg_alloc_security; diff --git a/include/linux/security.h b/include/linux/security.h index 3410acfe139c..69a5526f789f 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -366,6 +366,7 @@ int security_task_kill(struct task_struct *p, struct siginfo *info, int security_task_prctl(int option, unsigned long arg2, unsigned long arg3, unsigned long arg4, unsigned long arg5); void security_task_to_inode(struct task_struct *p, struct inode *inode); +int security_task_safe_sidechannel(struct task_struct *p); int security_ipc_permission(struct kern_ipc_perm *ipcp, short flag); void security_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid); int security_msg_msg_alloc(struct msg_msg *msg); diff --git a/security/security.c b/security/security.c index 4927e7cc7d96..353b711e635a 100644 --- a/security/security.c +++ b/security/security.c @@ -1165,6 +1165,11 @@ void security_task_to_inode(struct task_struct *p, struct inode *inode) call_void_hook(task_to_inode, p, inode); } +int security_task_safe_sidechannel(struct task_struct *p) +{ + return call_int_hook(task_safe_sidechannel, 0, p); +} + int security_ipc_permission(struct kern_ipc_perm *ipcp, short flag) { return call_int_hook(ipc_permission, 0, ipcp, flag);