From patchwork Sat Sep 22 00:16:59 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Casey Schaufler X-Patchwork-Id: 10612349 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 8E4BA6CB for ; Mon, 24 Sep 2018 12:29:26 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 7B12429E7E for ; Mon, 24 Sep 2018 12:29:26 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 6EB6629EA5; Mon, 24 Sep 2018 12:29:26 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.3 required=2.0 tests=BAYES_00,DKIM_SIGNED, MAILING_LIST_MULTI,NO_RDNS_DOTCOM_HELO,RCVD_IN_DNSWL_MED,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from upbd19pa10.eemsg.mail.mil (upbd19pa10.eemsg.mail.mil [214.24.27.85]) (using TLSv1.2 with cipher DHE-RSA-AES256-SHA256 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 6B4A229E7E for ; Mon, 24 Sep 2018 12:29:24 +0000 (UTC) X-EEMSG-check-008: 170403039|UPBD19PA10_EEMSG_MP10.csd.disa.mil Received: from emsm-gh1-uea11.ncsc.mil ([214.29.60.3]) by upbd19pa10.eemsg.mail.mil with ESMTP; 24 Sep 2018 12:29:20 +0000 X-IronPort-AV: E=Sophos;i="5.54,297,1534809600"; d="scan'208";a="18575153" IronPort-PHdr: 9a23:uw96LRaU+lFPKRKX5lTEvLv/LSx+4OfEezUN459isYplN5qZosu9YB7h7PlgxGXEQZ/co6odzbaO7Oa4ASQp2tWoiDg6aptCVhsI2409vjcLJ4q7M3D9N+PgdCcgHc5PBxdP9nC/NlVJSo6lPwWB6nK94iQPFRrhKAF7Ovr6GpLIj8Swyuu+54Dfbx9HiTahY75+Ngm6oRnMvcQKnIVuLbo8xAHUqXVSYeRWwm1oJVOXnxni48q74YBu/SdNtf8/7sBMSar1cbg2QrxeFzQmLns65Nb3uhnZTAuA/WUTX2MLmRdVGQfF7RX6XpDssivms+d2xSeXMdHqQb0yRD+v9LlgRgP2hygbNj456GDXhdJ2jKJHuxKquhhzz5fJbI2JKPZye6XQct0ARWpFQ81fSSpPDI2hZIcLFuYNIPpUo4z7qlQJrxSxHwmsBOToyjNRn3P7waM33uU8HQ3fwAAsAs8FvHDKoNnpMasfV/2+wqvVwjXZd/5Yxzn95ojLfB4vr/6DUrB/f9fJyUQtCg/IgEmfp4P7MDOOzekNr2qW4vB8We6zhWMrtQd8qSWvyMc2jYnJg5oYx07e+iVi3ok0JcCzRlNnbt6kCpRQqi+aN49oTcM4Xmplvzo1xacduZGlfCkH048nyALfa/OdboiI7BbjW/iLITthmH1qYqiziAq18Uil0+DxUNS/3lhNripAiNbMt3YN2gTX6siGSfty4Emg2TeU1w/N8O1EJ0c0lKTdJpU8wbAwjoIevVnMEyL5gkn7jLKael869uWn9ejreKjqqoedOoJ2kA3yL6Ujl8ilDek5MgUCRXaX9fqz2bDl4Eb3Wq9FjucsnancqJ3aIMMbqbOnDAJNyYYj7gq/Dy+h0NQFgXkLNFJFdwyDj4juI1zOPOr3De2+g1Sxizdn3ezGP739DZXNKXjPirHhcqpm60FA0gYzyNFf55ZMBrEAJvL8RFPxucTFAhI2PAG42ebqBMhn2o8AVm+DHLWVPL7KvV+N/O0vIu2MZIEPuDb6Lvgo/+XugmE9mV8ce6mpwJQWZGmjEfRhPkWZZ2bjjckaEWoRogo/TPDliF2FUTJJYXayRLgz6is0CIKhE4fPXpqtj6CZ3CenAp1WYXhLClKLEXfubYqER/cMZziUIsJ6kDwEUr6hS4o72hG1qA/11aBnLvHO9i0fr5Lj28B/5/fPmhEq6Tx0E8Od3nmPT2F2hGwHWzw23Lt4oUx7y1eDz7N1g/JcFdxO6PJGSRo6NZjAz+xnEdzyXRjBftiRQla8XtqmGS0xTs42w9IWbUd9GtGijhXd0CqwGLIVmaKEC4Ez8qLGxXfxP9x9y3HE1KY/k1YmXtFDNWq8hq5w7wLTHZLGk12Fl6a2cqQRxDPC+3uGzWqJukFYTBN8XL7bXX8BfEvWrNX45kTET7O0D7QoLBdBw9aYKqRWct3pkUlGRPD7NdvAe2K+gX2wBReTxr6XdIrlYX8d3CTGCEgclwAc52qJOhYkCiemuWLeAyRkFUjzbEP07el+tHS7Q1c3zw6QbE1h0Ke19wUWhfOGSPMT2a8EtD0mqzVuE1a3x8jWBMaYpwp9YKVcZssw701a2mLDtgxyIIagIrt4iVECdgR7pUTu1w94Co9Yi8glsGsqzBZuKaKfyF5OaymX3ZTuNb3MNmnz/BevZrXN2l7C0daZ5KEP6Og5q1r5pg2pEFQt82l/2dlPz3Sc/onKDBYVUZ/pSEY46gV1qqrVYik46ILYz3tsPreosjXawdImGPMlygq8f9dYKK6EDwHyE9cdB8i1NOwngEOpbhQDPOFc8a47JcWme+GA2KG1IOZqhCimgnhf4IBhzkKM8DJxS+DS0JYB3/GXwBGHVyzngVe/rM/3g5tLZSwXHmalzijkHoFRbLVofYkXEWeuP9G3xtJmip7rWn5Y8FqjCE0d2MKyYxWdcUb93QpK2UQQu3ynljOyzyZonDExsqqfwCvOzvz/exobIGFLXnJvgkvrIYixk98VRlOobxQzmBuj+0n627BRpL5jIGnLXUdIYy/2Inl8UquxqrWCf8lP6IkyvSpLUOS8ZlaaSrHmrhse0iPjGXFRxCo8dz2wvZX5hRN6gnqHLHlvtHrZZd1wxRDH6dzYRP5RxSYGSDBjiTbJAli8Pt+p/ciblprYqeC+T2OhVptScSb31oOMri276nN2ARenhfC8hsXnERQm0S/8z9RqTyLIrBL4Yob1zaS1LeVnf0dzCV/n9sp1Bpp+npE3hJEK1ngQno+V8mYfkWfvLdVb3rrzbHkTSj4N2N7Y+wvl11NlLnKSwYL2SGmdztFmZ9mgbWMcwjg94NxSCKeI8LxEmjN4okKiogLMZfhygC8dxuEo6H4Gne4JohEgzjiGAr8MB0lYJjbglw+P79CjtqVYeHigcba31EpkktCuEquOogdCV3blYp0iBzN/7t1jMFLQ133+8p/keN/NYt8IqB2UlQrPj+hPJJI3iPUKmTJtOXjhsn091+47kRtu0ImivIedNmVt+Lm0DQJZNj3pZ8If4z/tgrxYnsqM2ICvBJphEC0RXJT0VfKoDC4StfP/OgaACjI8rGubGb3aHQKE5kdpsW/AE5exN36NPHkZ19JiRBuDK0NDnAAYRjI6noQ2Fgqy3szubF955iwN5l7/shZMz/hnNx37UmjBuAeodi07R4KEIRpQ8A5C+1zVPtCE4eJrAS5U5JuhoxKRKmaDfQRHEXkJWlCYB1DkJrSu68PA/PaFCeqlNfTOZ6mOqetFV/qT352gzo5m8yyLNsWVMXloF+c71VZbXXBlB8TZnC0CSzQJmC3WccGboha8+jFwrs2k8fTkRhzg6pWVB7tVK9Vv9Ai8gb2fOO6ImCZ5NTFY24sXynDTz7Qf2F8Sizpydzm2C7gArjDCQ77Klq9MEREbbyJzNM1V76MzxQRCJc7aisno1r5jlPI0BU1KVUD6msGuY8wGOWa9NEnIBEyTLrSJOSXLw93rYaO7UbBfl+RUtxK3uTadCELsIyqMmCLoVx+1N+FAliabPAZRuIulaBZiFXDjTM76ah28KNJ3jz02wL0shnPNMW4cMCR8fF1Wo72V7CNYnu9/FHJb4npiN+mElD6T7/PEJZYOrftrHiN0mvpZ4HU6z7ta8jpJRPlymCvcoN5hvU2mkvWPyjpgVRpBtCxHhISVskV+Ia/Z7IVPWW7Y/BIR6mWdExIKqMV/Bd3roK1Qyd/PlLnvKDhY9dLU5sgcB8nOJMKBLnUhLQLjGCTIAwsdUT6rKWbfilRHkP6M7X2asII1qoLwl5oOUbJUT101FukHBURiEtwCOI13US0kkLKBis4H+2a+pgHLRMpGppDHSu6SAfL3JTmEirlEYR0Izq7mIoQXN432wFZtZUdgnITNAUbQWspNoiJ5ZA8uvEpN6GR+TnE020/9dwyi+mETFf+pkR4tkQZxe/4t9C3r41Y5PVrFujc/kFQrmdXknTCQcCT9LKGuUoFKEyD0rVQ+MovnQwZpag2/hUhkNDDeR71PibthdGdrhRTTuZtJBP5QV6pEYAUfxfuPffUnzUxcqjm7xU9A/ebFEoVtlA8rcZ6qsnJB1BluY8IyJazVOKVG1ENQhr6Usi+uyO8x3BcUJ1wR/2OKZC4IpEsIO6E6Jyqp++xs7hCCmztDeWUXSvUqo/Jr+VkmNOiaySLvzaJDIFirN+ODN6OZp3TAlcmQT1wq0kMIllVK8qZu3scmc0uUUUcvzL2LGBkSLsXCKBtab8xL+HjdYCaCq+PNzoxpP4+lDODnUfeOtLoIgkKjBAsmBJoD7sIaE5a2zU7YM9noLKQeyRo3/gTqJE+JDPNTeBKEiD0Hud2wzIdr3YlBITEQGWp9MTi25rbTog8lnv+DUcwrbXgERYQEN2g5WMugly5epXRAAyG90vgFxwia8z/8uiPQASHmb9plZfebeRNsCNay+TUk66a4kEPZ/I/CKm/9LtltptjP6eYGqJmdEPNUUaNxs0HClIlEX3aqSXLAEcapJ5jsbIkhdcb0BWygUly4kD04VNvxPMy3IaiWnw7oQYdUsI+U3DAnNM+9GTEeGwt+p+4Z/qJ8YBcPY5wlbh70rw4+LbCwIB+E0tWyRGagMTVXQ+NDwuW6ZrxXyissYfW5yHY7T5E10fe4/lAXSJENlBHeyu6pZ5NCXijrBnxdZwLPqDI8l2d7LOYywfkwwA/JsVkaPDCGb+JoZ3ZCv94gAVOSJmh2BXcjR1OGi4rM/BKs1agI/yRBh9ZUzfFFsH/ms5DFejKsRaqrpY/Wsyc7bNgmoqxxMZD4LcecspPRgCDfRoHKsgKZSC66C+Zamt9ILSJER/lInHooOdAatYpE8kU9TME+KKJTCKM0vLCldSJkDTIOzS8eT46A3jsCjfmn1rTHiBiQa4otMAYYsJpcn9QRSSh2bT0CpKW7TYXZi3eESnQXIAcU9QlM6hgAmZV2fu/54YrIV4RByztOo/J1SyfLDZdp90DhRmGRm1j4R+2rk/a10gJK0PLszt4bVQZjCUdA2ulWl1EnKLVsJqYMuY7KtyOHelnhvGLx0uemIkdeydHMfV3iEIXFrXb8UjEb+XAMXY9P023fGo4PnAplc6srv1JMIJ28ekni+TMkwZhpH6OiWsCv3VolqmwGRyiyGdpbF+5mqE7XWCFiY52zs5rlNYldTnNS9ZGApVpUi1liMym8yZVAMc5N+SIMUCJJoTqDoNu4UNdD1tNuD58QPtd/vG/wGLlaN5eMo305oKDvx2Td+zA7rle12iu/FLO/T+1E4WISAAMpKHqCqkM3Fesj7n/S8kzRslBz5+pbGqKPgltvrzlgBZ1OGzJJ1Wy/L1tpUnlGsuJaKKDLfMxAWfUyYgWvOxMmH/48w0OJ5V10nWv+YyFqtAtV4TrdXw4vVSkRmLjthyYTqsS6OT8eV5JIbCkubybfJAKdgiBbphFfa1tlW5oBGNZK56kb3ZdI/srFUUusKzsKXBpsNgIi1vpQiFBMvV6EeS/HCwqobvHPvgdxfciPsM6jNO758xtfioP7rOA48L0OR3uimQC2QNDeqYr8useLtkuIeqf4KfezYWTdTDjWkBC/maskD4TQ/yfNKgZbLIN6yXU8a5j7FWHLJQhGJ74cJ0dDU6B6aMlJoudeZ8B+Y6YF465tBhWARhP0A4yit/xGI1ncRDjEKCWB6OO/q5rJ7bPBUejgetCMx3HfTqJzJZd67Dn2Fqzk0YBA50X23e1t+VliSVjcNCCBrsruKR8X5MW4cUvipJIpFyvMAJhsiHrt2l1Ad80PTi2o8ZQYzYhU6HPuRuN4zEfzquxS979r6YUt5bBm19u0L7/IKftGqU9nHgSUBgJy+5UsAWlwXXpebfMKJffKY6sZkd7hpPztG6wQ8h2V9PRTacHbKEHZhsm/FjacRARfkwcAsj4bIBGT1/yEm69oUcaqv/X52kY27leiKR4J0a5i6p2Z+qqSo+/XdQHewaIDWqjwScP5tq4stF+K5f04iL4OfXR4YxW9H+gBSsEdxmnhzacwzSIvCs/DBKzv+PpCV3I/gzLhlItwH00MFfMIAbWL/YpfnmAim+zaLNEWcb5NmnyJFRG6Fr8O03mr6zGYIGN9mBHBzwnwQX+v7F/xtSJ4TjXDz9H/kkpSUbm7AlxSUDStOU95tjOPIQXpucHzuasr9kE3MnbruMiLlGS/JLNdB9f/K8CEISkouFIXi4U8ScCt2Y8BBdWwO8se8HZ6bvva6mOkjTVBo7tZiIXC4sGZ4PLXHWOvj6eCsbWC2ChYymQkvVE48t2gM/bO59uWQ/SnyWkcVCJ/uwrbUB6ztLPbs14VOUuR0EfIg4wGJNdZ0mck1kv+/ugsXMoz9BlCFobHf/4Cqiz8OCDvwVqGftw5WS+Q0zpRHlLoHlh1A6c82Gfqs8LPi3jc4VooRpN/d0b/nxx4E504KV4x6FgQ2icDEw8NaRCdDL2yGUvlLY8EVVUeZhWG3bi6fLw33U5ywr60+u/TbPJ8CLAJNvlAjw6Chl5bFYwKsacGWrJzZ0dd9LLLpgjlE4XnXubmmmA2NfCuRsBa7N0Wt3ol4gakXRag7o1D77kDgpCSaqFEeYTMvNx770p/5z4AaCJNgBZ7jx6iX+ETvubj7cbHsJay7OahSrotTf0N9xcoH2R+k4fwgFc7rNHY0+dcTYPUhpr78ABJOHOKo4Ha0x99KeUSMY6reqhv92kfLSgEO30OJcaWa+U74yJ1NTXT5l9CAsALZd4DPsrCgwNUikrvWL5N8MrXAFmYBJlvd8ow9Wr41Cg18YcgUubn8DK5Po7Q71dRP/5YlyVskNXCpPQJwfrMFicY/GOVax9vwiON05ONEer//f2QyNHIUFMLBjY2U4BZJDWY4wymSO21lJHnUg6P78/zh5U+dFmOSXOthqQFtb1MEfVBiiX90ThSDIf1h+ias9C08mtYqkVHEJpv7R3CAKhfMIt0ORD5lsmzWEdxHSr+eMDRdhorpuWW3OMM7PtkO0v5f48bLQoOy6jm5npNUgtuVLn2s06XXOIJfttmSe/LoW5O5IJlKq8PIEKdq4LwojdPslA2DxcjaKUsoTxCaknOgApVVr7zuL4ElAQRSsZ5uUtWFmKrJGI+5ibIVbhPjKaPFvMZ6DOTQbISU09wKCNxXwu12Ilye7uuhf1HtmJGniVgoPklyjBmQBq8uTbwp6IWwj8g+au3tDMGuXBfSeWeiSjIA01ZzPsWlaccF2ri6VukbXkGdoT9/LlnJcXm9Ykm+Hk/fxQjfysYUuSkCiHwib6IA4OVvNJbnh6Nt93EbaWvIigKKrQ91RXjSmB/0gfEnxZo93AETy697N8iOIW9OcElxjenGWjbaFYA+KVJv9XttVQTVus5dUthwHl/0siAXiANX8LPG2MpgQUlamhJa4xD5gEAF6kpgzeIua9G8hsSYDjKDoT2srXXyOPz/DFpSdZs23KTvaCOm4krzGwgntR48yqDkGodevaeUMJ2BHX3kIBFxrq6L9ekt+0cAK5h0q6gS7dWMMyk43G3w71sU0qox/IZBVXvdKc46///UiG4WSXMQumPcm6Rjx4lI0Xy4l+uNVRxZ8BU+Qt1Fsjmo9YIkwznTKMxRSiKo1Lf5HIsPPlcdA8svoqjPQsQQ7hVL8qbJe5m4vo+AV0XYnmBSSlxC+nws1mtlY5gNnNI6kz8ZuLs+QnidtCVH09AWa3Xo4U50vu9RSrVOnJt1xZ1O0pc/OfFEFEwq+oadIyey5yYu9lnyvMCP9dkNyE08ooLl4Rs9IiSlcSHaxfcyr7zYNXSvPXeGPTc0l4jPGdXFLgBN0e934wnOpYcXLrJEPMNpR0BAYAiSYElcmL287t5agh0d1iVLI+oj9Hqq+TDXZ5do3vb/xpkNyvHkwESwfyzCwpgZtalgGukZNh6QjNHss0oBABqEZVCH+seoAe9RZ2Zgqe2j5m24Uww87sOsKztGrXEz9i0wYh1d4ZV6FbNPzvLAqRvxEN/gbL2yt7E34n8GIvOftkeVflyRCaRY7PBFJ++OzuIEs35ck9CtbWb1eQ9GjCQbyPw3K6xjySgPWFiqRE+y4dQcOvczT8q4/fd1cekIylgryO9pGKOLpYXyVHRAvbXVBscHeHD9Wt+GrceZoKtqs8BNNUjxJ6X5AwlvxpY187QCKG6o16E4Ul7fI/VKEbzk3IyUJIHMTykOkslnGHdp26YCn0aJc+hf5o+yO2JBwDgshEi0VomYXRMTy+5HY3La2EGx8KzYhGL/wtXDtEF2vS6YlM8qrboFbI6J55Cnbz7rLxfwZBkJiTUS45fNiDUarp3Omk0bK3UvFZ9RBkCvvAuX5stI4CUKRYMOVyN2AvpxgvLzEPwesbp36/PKyEToRAlh6nd321qoA+08e2cntWlVbnYaJ/sW/uHOyM+WyCyXj8yGFun/Vq+/vEN+vGfJDR6wBgPeizHLgkVq+h0qMTISG/eneo2ZJoRmPWTQDz9UgVjk6wzDX0T6QXVE7wIEg/NamWnhWNdvEqoKKUK7HvlaLreza1QCIl0SodPc/jMW9LDYrgePDYnkDwFJfyxN8PRtbc301/EDCMZHqDE+UfYTRu+U/WcwDWtVoIQsg== X-IPAS-Result: A2BRAgCF16hb/wHyM5BaHAEBAQQBAQcEAQGBVIFhJwOBCFwojGiLSYFogn6UCoFiJxMBhQSDFiE3FQEDAQEBAQEBAgFsHAyCNSSCYAMDAQIkEwYBAQwgDAIDCQEBQAgIAwEtFAERBgEHBQYCAQEBGASDAIFqAxUDlxGKHIFqM4J1AQEFgQQBAXWCMAOCUwgXimEXggCBEicMhyoBEgGFd4g4PIULQTGOEAmCDIc+hlkdWWyHTwiGEI57h2YiZHFNIxU7gmyCGQwXewEOgjyKHAFVT3sBAYl9gj0BAQ Received: from tarius.tycho.ncsc.mil ([144.51.242.1]) by emsm-gh1-uea11.NCSC.MIL with ESMTP; 24 Sep 2018 12:29:17 +0000 Received: from prometheus.infosec.tycho.ncsc.mil (prometheus.infosec.tycho.ncsc.mil [192.168.25.40]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id w8OCTDa9028666; Mon, 24 Sep 2018 08:29:15 -0400 Received: from tarius.tycho.ncsc.mil (tarius.infosec.tycho.ncsc.mil [144.51.242.1]) by prometheus.infosec.tycho.ncsc.mil (8.15.2/8.15.2) with ESMTP id w8M0HAA7018219 for ; Fri, 21 Sep 2018 20:17:10 -0400 Received: from goalie.tycho.ncsc.mil (goalie.infosec.tycho.ncsc.mil [144.51.242.250]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id w8M0H9hP009796 for ; Fri, 21 Sep 2018 20:17:10 -0400 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: A1AUAADYiKVblywYGNZbHQEBBQEHBQGBUYFkJ4FnKINziBVfi0uBaIJ+k3aBeoR3AkKDBCE0GAEDAQEBAQEBAhQBAQEBAQYYBkyFRQMDIwQZAQE4DyUCJgICRRIGAQwGAgEBgx2BagMVA5gmihxvezOCdQEBBYEEAQF1gj4DglEIF3SJZReCAIESJwyKXoJXiDg8hQlBMY4NCYIMhz6GWR1ZbIdPCIYMjneHTIINTSMVO4JsghkMDgl7AQ6CPIocAVVPjlQBAQ X-IPAS-Result: A1AUAADYiKVblywYGNZbHQEBBQEHBQGBUYFkJ4FnKINziBVfi0uBaIJ+k3aBeoR3AkKDBCE0GAEDAQEBAQEBAhQBAQEBAQYYBkyFRQMDIwQZAQE4DyUCJgICRRIGAQwGAgEBgx2BagMVA5gmihxvezOCdQEBBYEEAQF1gj4DglEIF3SJZReCAIESJwyKXoJXiDg8hQlBMY4NCYIMhz6GWR1ZbIdPCIYMjneHTIINTSMVO4JsghkMDgl7AQ6CPIocAVVPjlQBAQ X-IronPort-AV: E=Sophos;i="5.54,287,1534824000"; d="scan'208";a="375804" Received: from emsm-gh1-uea11.ncsc.mil ([214.29.60.35]) by goalie.tycho.ncsc.mil with ESMTP; 21 Sep 2018 20:17:09 -0400 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: A0ATAACWiaVblywYGNZbHQEBBQEHBQGBUYFkJ4FnKINziBVfi0uBaIJ+k3aBeoR3AkKDBCE0GAEDAQEBAQEBAgETAQEBAQEGGAZMDII1JIJgAwMjBBkBATgPJQImAgJFEgYBDAYCAQGDHYFqAxUDmCCKHG97M4J1AQEFgQQBAXWCPgOCUQgXdIllF4IAgRInDIpegleIODyFCUExjg0JggyHPoZZHVlsh08IhgyOd4dMgg1NIxU7gmyCGQwOCXsBDoI8ihwBVU+OVAEB X-IPAS-Result: A0ATAACWiaVblywYGNZbHQEBBQEHBQGBUYFkJ4FnKINziBVfi0uBaIJ+k3aBeoR3AkKDBCE0GAEDAQEBAQEBAgETAQEBAQEGGAZMDII1JIJgAwMjBBkBATgPJQImAgJFEgYBDAYCAQGDHYFqAxUDmCCKHG97M4J1AQEFgQQBAXWCPgOCUQgXdIllF4IAgRInDIpegleIODyFCUExjg0JggyHPoZZHVlsh08IhgyOd4dMgg1NIxU7gmyCGQwOCXsBDoI8ihwBVU+OVAEB X-IronPort-AV: E=Sophos;i="5.54,287,1534809600"; d="scan'208";a="18546016" X-IronPort-Outbreak-Status: No, level 0, Unknown - Unknown Received: from ucol3cpa06.eemsg.mail.mil ([214.24.24.44]) by emsm-gh1-uea11.NCSC.MIL with ESMTP; 22 Sep 2018 00:17:08 +0000 X-EEMSG-check-005: 0 X-EEMSG-check-006: 000-001;d7be80a1-b09d-467a-b7c7-5ccd8634948c Authentication-Results: ucol19pa08.eemsg.mail.mil; spf=None smtp.pra=casey@schaufler-ca.com; spf=None smtp.mailfrom=casey@schaufler-ca.com; spf=None smtp.helo=postmaster@sonic304-18.consmr.mail.bf2.yahoo.com; dkim=pass (signature verified) header.i=@yahoo.com X-EEMSG-check-008: 165869177|UCOL19PA08_EEMSG_MP6.csd.disa.mil X-EEMSG-SBRS: 3.4 X-EEMSG-ORIG-IP: 74.6.128.41 X-EEMSG-check-002: true X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: A0BQAACniKVbhimABkpbHQEBBQEHBQGBUYFkgg4og3OIFV+NM4J+k3aBeoR3AkKDBBkGBjAYAQMBAQEBAQEBAQETAQEBCgkLCBsOIwyCNSSCYAMDIwQZAQE4DyUCJgICRRIGAQwGAgEBgx2BagMVmCiKHG97M4J1AQEFgQQBAXWCPgOCUQgXdIl8ggCBEicMil6CV4g4PIUJQTGODQmCDIc+hlkdWWyHTwiGDI53h0yCDU0jFTuCbIIZDA4JewEOgjyKHAFVHzCOVAEB X-IPAS-Result: A0BQAACniKVbhimABkpbHQEBBQEHBQGBUYFkgg4og3OIFV+NM4J+k3aBeoR3AkKDBBkGBjAYAQMBAQEBAQEBAQETAQEBCgkLCBsOIwyCNSSCYAMDIwQZAQE4DyUCJgICRRIGAQwGAgEBgx2BagMVmCiKHG97M4J1AQEFgQQBAXWCPgOCUQgXdIl8ggCBEicMil6CV4g4PIUJQTGODQmCDIc+hlkdWWyHTwiGDI53h0yCDU0jFTuCbIIZDA4JewEOgjyKHAFVHzCOVAEB Received: from sonic304-18.consmr.mail.bf2.yahoo.com ([74.6.128.41]) by ucol19pa08.eemsg.mail.mil with ESMTP; 22 Sep 2018 00:17:06 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1537575426; bh=jHBtr0AdnC7HFoorw5G0+KjOkREodldpcutS/tFxros=; h=Subject:To:References:From:Date:In-Reply-To:From:Subject; b=FdAG7YriFXOxj9hVM0L0mh8vUJodJygEMWQMv212Go+HXvdpfw4GGr4z7ZVbmUO9AAjIGP9jF/NTVULoQqf6d8t63Di5Ha0Ej34mO2aHHoEgKv2TcUKkZdnxbrW4LYJTekry3q/NwLRLG2Urkey/Jv1AsA8V6WgnsBzVoNFasACwaXmDUnbuiF2w007dJkyxTxcS0IvGBsfkpW5YvEk45vcb2BWJZpyCKYKVkDM8SL4seVD7uxcqDPYSvkMMdC+86ge8VZ5jUixkBZilh+6elC4pTU7jLAFqSyeGgV392nRuke/GMoYTFOV5p3PxI6vX2t5lyph/WrX38fLESOXKAQ== X-YMail-OSG: e6PIVnEVM1k7TjjkI0Og4ZaYbDTORr4c5SW0ltMJo0kh.1OHLUmz0gFssqVtC6N YKJmANtUFk9eQZlq_.1RvI59rkIk4cgjTKwiCvnRw1mxP7hX20of0SeGF7fqR4sOrak4gBiTtCES 6ek7NbCwxfiTRXandtj8GI5g7XBQgVsZLq1I1S7evyorE0REphy8tBeQ.t8po0wvRW8XGBAS_2id Ygr0cK6J4lQt6dk2SVwFKIdo6CVMwIH_Pgrva1P_e65AE6vQt2uUXQ0hqsQszDTnj1a6MbAYaN6G LmaHtoV9JGpm5fcsjS8mu6M93zZzZRRMaGbLG8SGmeAOJSiwCUv93wgKV.lxkJZWelR0UFBQUq8F mvKB4ZM7hgRNz.98IT5_qB2Ea.4KUeRgUzsm5WFZJKBFSXfnKuSQWJ72E7IOYQz2XDo63B.AXmBi eNtv1iszyoWF21zoGl0KtI2iDgMZQRCCywNOaEcc4VtjmZV43Pzzl_hAfTa0REkQ2aBdfKtvc79H jzhwRxAWzkzEidMHsUqupwhW.O.1aG5hAFMz.IuOAV4MPP8IcRK4dSHkxd4gFYR07asVbt1lEKvZ NTcU2j1ZjxJU8dC9okOMA8Di6C07x6Q.hY674zAy8Ws8hSosEADPmuxnjRYuecmuJiGUQYtq3h14 PZ53NQH0M4im1g9kgIwfPnGnAPC27IGwsfDjG9TLSOS0rSafNJjipp87xTYWJNfwprqMkbsuGpJw Dtm.OYdKZLgN8mIT2FLyHrAvRYmJi5JT.1c.43nFRurRxYP1_PY1qgb7kcWd7I0BnQbd6KYTf4Pg b5up1gLLAJ4J_z41Lm84.Bfd7GO3YEcQB2fiArW2ktm5MPlddiF1TQd1m.C0z64dB1B3XpE0eu7j IcULUrr_WJXB9PRvPVW7c91SS3acrbpBStt51YYSxVhtekthy5dxMbe7zdsseZGFWdyecWE0_vtw ZqqOnN60JNAqnxljxb6oBagPF6qZxEoB4zvFUG2M52GYlvZFFdDjCT8BGWQ_uTvggJkirjFABl1J msRt8tau3WkYQBPVatizL1YXOuA.ShI0- Received: from sonic.gate.mail.ne1.yahoo.com by sonic304.consmr.mail.bf2.yahoo.com with HTTP; Sat, 22 Sep 2018 00:17:06 +0000 Received: from c-67-169-65-224.hsd1.ca.comcast.net (EHLO [192.168.0.102]) ([67.169.65.224]) by smtp401.mail.bf1.yahoo.com (Oath Hermes SMTP Server) with ESMTPA ID 3614f4a7d4c794340334f868c447edd8; Sat, 22 Sep 2018 00:17:04 +0000 (UTC) To: LSM , James Morris , SE Linux , LKLM , John Johansen , Kees Cook , Tetsuo Handa , Paul Moore , Stephen Smalley , "linux-fsdevel@vger.kernel.org" , Alexey Dobriyan , =?utf-8?q?Micka=C3=ABl_Sala=C3=BCn?= , Salvatore Mesoraca References: X-EEMSG-check-009: 444-444 From: Casey Schaufler Message-ID: <5f2520f2-fddd-3af8-2142-e89ca402ea5b@schaufler-ca.com> Date: Fri, 21 Sep 2018 17:16:59 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: Content-Language: en-US X-Mailman-Approved-At: Mon, 24 Sep 2018 08:26:06 -0400 Subject: [PATCH v4 01/19] procfs: add smack subdir to attrs X-BeenThere: selinux@tycho.nsa.gov X-Mailman-Version: 2.1.21 Precedence: list List-Id: "Security-Enhanced Linux \(SELinux\) mailing list" List-Post: List-Help: Errors-To: selinux-bounces@tycho.nsa.gov Sender: "Selinux" X-Virus-Scanned: ClamAV using ClamSMTP Back in 2007 I made what turned out to be a rather serious mistake in the implementation of the Smack security module. The SELinux module used an interface in /proc to manipulate the security context on processes. Rather than use a similar interface, I used the same interface. The AppArmor team did likewise. Now /proc/.../attr/current will tell you the security "context" of the process, but it will be different depending on the security module you're using. This patch provides a subdirectory in /proc/.../attr for Smack. Smack user space can use the "current" file in this subdirectory and never have to worry about getting SELinux attributes by mistake. Programs that use the old interface will continue to work (or fail, as the case may be) as before. The proposed S.A.R.A security module is dependent on the mechanism to create its own attr subdirectory. The original implementation is by Kees Cook. Signed-off-by: Casey Schaufler Reviewed-by: Kees Cook --- Documentation/admin-guide/LSM/index.rst | 13 +++-- fs/proc/base.c | 64 +++++++++++++++++++++---- fs/proc/internal.h | 1 + include/linux/security.h | 15 ++++-- security/security.c | 24 ++++++++-- 5 files changed, 96 insertions(+), 21 deletions(-) diff --git a/Documentation/admin-guide/LSM/index.rst b/Documentation/admin-guide/LSM/index.rst index c980dfe9abf1..9842e21afd4a 100644 --- a/Documentation/admin-guide/LSM/index.rst +++ b/Documentation/admin-guide/LSM/index.rst @@ -17,9 +17,8 @@ MAC extensions, other extensions can be built using the LSM to provide specific changes to system operation when these tweaks are not available in the core functionality of Linux itself. -Without a specific LSM built into the kernel, the default LSM will be the -Linux capabilities system. Most LSMs choose to extend the capabilities -system, building their checks on top of the defined capability hooks. +The Linux capabilities modules will always be included. This may be +followed by any number of "minor" modules and at most one "major" module. For more details on capabilities, see ``capabilities(7)`` in the Linux man-pages project. @@ -30,6 +29,14 @@ order in which checks are made. The capability module will always be first, followed by any "minor" modules (e.g. Yama) and then the one "major" module (e.g. SELinux) if there is one configured. +Process attributes associated with "major" security modules should +be accessed and maintained using the special files in ``/proc/.../attr``. +A security module may maintain a module specific subdirectory there, +named after the module. ``/proc/.../attr/smack`` is provided by the Smack +security module and contains all its special files. The files directly +in ``/proc/.../attr`` remain as legacy interfaces for modules that provide +subdirectories. + .. toctree:: :maxdepth: 1 diff --git a/fs/proc/base.c b/fs/proc/base.c index ccf86f16d9f0..bd2dd85310fe 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -140,9 +140,13 @@ struct pid_entry { #define REG(NAME, MODE, fops) \ NOD(NAME, (S_IFREG|(MODE)), NULL, &fops, {}) #define ONE(NAME, MODE, show) \ - NOD(NAME, (S_IFREG|(MODE)), \ + NOD(NAME, (S_IFREG|(MODE)), \ NULL, &proc_single_file_operations, \ { .proc_show = show } ) +#define ATTR(LSM, NAME, MODE) \ + NOD(NAME, (S_IFREG|(MODE)), \ + NULL, &proc_pid_attr_operations, \ + { .lsm = LSM }) /* * Count the number of hardlinks for the pid_entry table, excluding the . @@ -2503,7 +2507,7 @@ static ssize_t proc_pid_attr_read(struct file * file, char __user * buf, if (!task) return -ESRCH; - length = security_getprocattr(task, + length = security_getprocattr(task, PROC_I(inode)->op.lsm, (char*)file->f_path.dentry->d_name.name, &p); put_task_struct(task); @@ -2552,7 +2556,9 @@ static ssize_t proc_pid_attr_write(struct file * file, const char __user * buf, if (rv < 0) goto out_free; - rv = security_setprocattr(file->f_path.dentry->d_name.name, page, count); + rv = security_setprocattr(PROC_I(inode)->op.lsm, + file->f_path.dentry->d_name.name, page, + count); mutex_unlock(¤t->signal->cred_guard_mutex); out_free: kfree(page); @@ -2566,13 +2572,53 @@ static const struct file_operations proc_pid_attr_operations = { .llseek = generic_file_llseek, }; +#define LSM_DIR_OPS(LSM) \ +static int proc_##LSM##_attr_dir_iterate(struct file *filp, \ + struct dir_context *ctx) \ +{ \ + return proc_pident_readdir(filp, ctx, \ + LSM##_attr_dir_stuff, \ + ARRAY_SIZE(LSM##_attr_dir_stuff)); \ +} \ +\ +static const struct file_operations proc_##LSM##_attr_dir_ops = { \ + .read = generic_read_dir, \ + .iterate = proc_##LSM##_attr_dir_iterate, \ + .llseek = default_llseek, \ +}; \ +\ +static struct dentry *proc_##LSM##_attr_dir_lookup(struct inode *dir, \ + struct dentry *dentry, unsigned int flags) \ +{ \ + return proc_pident_lookup(dir, dentry, \ + LSM##_attr_dir_stuff, \ + ARRAY_SIZE(LSM##_attr_dir_stuff)); \ +} \ +\ +static const struct inode_operations proc_##LSM##_attr_dir_inode_ops = { \ + .lookup = proc_##LSM##_attr_dir_lookup, \ + .getattr = pid_getattr, \ + .setattr = proc_setattr, \ +} + +#ifdef CONFIG_SECURITY_SMACK +static const struct pid_entry smack_attr_dir_stuff[] = { + ATTR("smack", "current", 0666), +}; +LSM_DIR_OPS(smack); +#endif + static const struct pid_entry attr_dir_stuff[] = { - REG("current", S_IRUGO|S_IWUGO, proc_pid_attr_operations), - REG("prev", S_IRUGO, proc_pid_attr_operations), - REG("exec", S_IRUGO|S_IWUGO, proc_pid_attr_operations), - REG("fscreate", S_IRUGO|S_IWUGO, proc_pid_attr_operations), - REG("keycreate", S_IRUGO|S_IWUGO, proc_pid_attr_operations), - REG("sockcreate", S_IRUGO|S_IWUGO, proc_pid_attr_operations), + ATTR(NULL, "current", 0666), + ATTR(NULL, "prev", 0444), + ATTR(NULL, "exec", 0666), + ATTR(NULL, "fscreate", 0666), + ATTR(NULL, "keycreate", 0666), + ATTR(NULL, "sockcreate", 0666), +#ifdef CONFIG_SECURITY_SMACK + DIR("smack", 0555, + proc_smack_attr_dir_inode_ops, proc_smack_attr_dir_ops), +#endif }; static int proc_attr_dir_readdir(struct file *file, struct dir_context *ctx) diff --git a/fs/proc/internal.h b/fs/proc/internal.h index 5185d7f6a51e..d4f9989063d0 100644 --- a/fs/proc/internal.h +++ b/fs/proc/internal.h @@ -81,6 +81,7 @@ union proc_op { int (*proc_show)(struct seq_file *m, struct pid_namespace *ns, struct pid *pid, struct task_struct *task); + const char *lsm; }; struct proc_inode { diff --git a/include/linux/security.h b/include/linux/security.h index 75f4156c84d7..418de5d20ffb 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -390,8 +390,10 @@ int security_sem_semctl(struct kern_ipc_perm *sma, int cmd); int security_sem_semop(struct kern_ipc_perm *sma, struct sembuf *sops, unsigned nsops, int alter); void security_d_instantiate(struct dentry *dentry, struct inode *inode); -int security_getprocattr(struct task_struct *p, char *name, char **value); -int security_setprocattr(const char *name, void *value, size_t size); +int security_getprocattr(struct task_struct *p, const char *lsm, char *name, + char **value); +int security_setprocattr(const char *lsm, const char *name, void *value, + size_t size); int security_netlink_send(struct sock *sk, struct sk_buff *skb); int security_ismaclabel(const char *name); int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen); @@ -1139,15 +1141,18 @@ static inline int security_sem_semop(struct kern_ipc_perm *sma, return 0; } -static inline void security_d_instantiate(struct dentry *dentry, struct inode *inode) +static inline void security_d_instantiate(struct dentry *dentry, + struct inode *inode) { } -static inline int security_getprocattr(struct task_struct *p, char *name, char **value) +static inline int security_getprocattr(struct task_struct *p, const char *lsm, + char *name, char **value) { return -EINVAL; } -static inline int security_setprocattr(char *name, void *value, size_t size) +static inline int security_setprocattr(const char *lsm, char *name, + void *value, size_t size) { return -EINVAL; } diff --git a/security/security.c b/security/security.c index 736e78da1ab9..3dfe75d0d373 100644 --- a/security/security.c +++ b/security/security.c @@ -1288,14 +1288,30 @@ void security_d_instantiate(struct dentry *dentry, struct inode *inode) } EXPORT_SYMBOL(security_d_instantiate); -int security_getprocattr(struct task_struct *p, char *name, char **value) +int security_getprocattr(struct task_struct *p, const char *lsm, char *name, + char **value) { - return call_int_hook(getprocattr, -EINVAL, p, name, value); + struct security_hook_list *hp; + + hlist_for_each_entry(hp, &security_hook_heads.getprocattr, list) { + if (lsm != NULL && strcmp(lsm, hp->lsm)) + continue; + return hp->hook.getprocattr(p, name, value); + } + return -EINVAL; } -int security_setprocattr(const char *name, void *value, size_t size) +int security_setprocattr(const char *lsm, const char *name, void *value, + size_t size) { - return call_int_hook(setprocattr, -EINVAL, name, value, size); + struct security_hook_list *hp; + + hlist_for_each_entry(hp, &security_hook_heads.setprocattr, list) { + if (lsm != NULL && strcmp(lsm, hp->lsm)) + continue; + return hp->hook.setprocattr(name, value, size); + } + return -EINVAL; } int security_netlink_send(struct sock *sk, struct sk_buff *skb)