From patchwork Fri May 11 00:53:54 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Casey Schaufler X-Patchwork-Id: 10394423 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id A40E9601A0 for ; Fri, 11 May 2018 14:40:53 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 9573228EC4 for ; Fri, 11 May 2018 14:40:53 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 8938628EAB; Fri, 11 May 2018 14:40:53 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.4 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,MAILING_LIST_MULTI,NO_RDNS_DOTCOM_HELO,RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from ucol19pa09.eemsg.mail.mil (ucol19pa09.eemsg.mail.mil [214.24.24.82]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 32FFA28EAF for ; Fri, 11 May 2018 14:40:52 +0000 (UTC) X-IronPort-AV: E=Sophos;i="5.49,389,1520899200"; d="scan'208";a="695327820" Received: from emsm-gh1-uea11.ncsc.mil ([214.29.60.3]) by ucol19pa09.eemsg.mail.mil with ESMTP; 11 May 2018 14:40:51 +0000 X-IronPort-AV: E=Sophos;i="5.49,389,1520899200"; d="scan'208";a="13190328" IronPort-PHdr: =?us-ascii?q?9a23=3A52rKsxOS9YSc998dfH8l6mtUPXoX/o7sNwtQ0K?= =?us-ascii?q?IMzox0LPz4ocbcNUDSrc9gkEXOFd2Cra4c0KyO6+jJYi8p2d65qncMcZhBBV?= =?us-ascii?q?cuqP49uEgeOvODElDxN/XwbiY3T4xoXV5h+GynYwAOQJ6tL1LdrWev4jEMBx?= =?us-ascii?q?7xKRR6JvjvGo7Vks+7y/2+94fcbglUijexe69+IAmrpgjNq8cahpdvJLwswR?= =?us-ascii?q?XTuHtIfOpWxWJsJV2Nmhv3+9m98p1+/SlOovwt78FPX7n0cKQ+VrxYES8pM3?= =?us-ascii?q?sp683xtBnMVhWA630BWWgLiBVIAgzF7BbnXpfttybxq+Rw1DWGMcDwULs5Qi?= =?us-ascii?q?qp4bt1RxD0iScHLz85/3/Risxsl6JQvRatqwViz4LIfI2ZMfxzca3HfdMeWG?= =?us-ascii?q?FPQMBfWSJcCY+4docDEvYNMeNeoob6pVQBtxu+BQ6rBO/20zNFmnH70Kwn3+?= =?us-ascii?q?g4DQ3KwRErE9YQvHjIqdn4MroZX+Kow6nS1TjNcf1W1zf+5obGfB8urvODUq?= =?us-ascii?q?5/f8TM0UkiFR7Jg1uOpoz+JD6VyuYAvnKH4+Z8W++iiWgqoBxxrDi1wccsj5?= =?us-ascii?q?HEi5wPxVDf6yp4wJs+K8CkR057e9GkDZVQtyWEOItsX8gvRH1ntzwhyrIYuZ?= =?us-ascii?q?+2ZzMKx4gnxxHFdvyHfYyI7Qz5VOqIPTh3nmhpd664hxa36EWtzPD3WMqs0F?= =?us-ascii?q?tSsyZIndbBumoN2hDO8MSLVPRw8lm71TqSzwze6+NJLVopmafaL5Mt2L89m5?= =?us-ascii?q?oJvUjdACP7l0P7h7KMeEo+4Oin8eHnb63jpp+bKoB7lBnzMr8rmsyjGeQ4NR?= =?us-ascii?q?UOX3SD9eS8yrLj+Ur5Ta1WjvIsiKnZsY3aJd8Bqq6lAw5azoYj6xGlAzegzN?= =?us-ascii?q?sYhmUIIEhAeBKGi4jlI1DOIPbmAvejm1mgjThmyv/cMrDhH5nBNGbPnbj/cb?= =?us-ascii?q?pn9kJQ0A8zwspe55JQBLEBOvXzWkrpudzDEBA5Nw20w+D6CNRyz48RQmWPAr?= =?us-ascii?q?KfMKzOr1CI/fkiI/WMZYAJuDb9LOIp5/j1jXAjg1Mdcq6p3YUPZHCiAvtmO1?= =?us-ascii?q?mZYWbrgtoZE2cKuQw+Q/b2iF2CSzFTYW2/X6A75jE9DYKpF5zDRpyzj7ybxy?= =?us-ascii?q?e3BJpWZnpJClqUC3fna52EW+sQaCKVOsJhkD4EWqK9RI8izhGuswn6y7t5Lu?= =?us-ascii?q?fP9C0YsY/j1ddu6O3OkxEy6SF0A96a02GXQGF+hnkISCMu3KBjvUx9zU+O0b?= =?us-ascii?q?BmjPNDC9NT4fJJUhs9NZPHzux1Fc79VRzbcteOUlamTc2sASstQdIp398Of0?= =?us-ascii?q?F9Fs2/gRDE2SqqBaIamKKPBJw16a/TxWb+J9x6y3rc06khlVYmSNNVNWK6nq?= =?us-ascii?q?5/6xTTB4nRnkqEi6alb74c0TXR+2eEyGqBoFtXUBVsUanfW3AQeFfWp8zj5k?= =?us-ascii?q?zeV7+uFagnMgxZxM6DLKtKdsPmjVFYS/fmJtvef3ixmmerCBaP3rODcozqe2?= =?us-ascii?q?AH0yXcDEgLiAcT/HmcOQg5HCehrHrUDCZyGlL3f0Ps7e5+pWu7T041yAGKaV?= =?us-ascii?q?Zs17+x+hIMhPycTekf3rQetyc7qDV0HUi90MzMB9qGuQVhYL1WYckh71dfyW?= =?us-ascii?q?LZqwt9M4S+IKB6nFEeaQV3v1j12hVvEIpAi8kqrGgyzAp2M62XzE1Oeymf3Z?= =?us-ascii?q?DqNb3dMnPy8wy3a67KxlHe186b+6kO6PQ8rlXsohupG1Es83p5ztZV1GGc6Y?= =?us-ascii?q?/SDAoIVpLxUFg4+ARmp73AZSk9/YzU32V2Maaoqj/Cx84pBOw9xxauZddQKq?= =?us-ascii?q?WEGxPzE80BHMWuLfQqm1mwYhIfMuFS77Q4P8S8d/uJwKSrJvpvnCq6jWRb54?= =?us-ascii?q?BwykGM+DB/Su7PwpYI2PKY0RGEVzf7kVetqMf3mZpLZTsKBGqw1TDkBJJNZq?= =?us-ascii?q?11ZYsEE3qhI9e2xtpgnZ7gQGRX+0KmB18c38+pYxWSZUTn3QJMzUQXvWCnmS?= =?us-ascii?q?ygwjNoiT4pqrSQ3DfSw+XicxoKIXVLS3VjjVjyJ4i0k9EaU1KyYwgvihSl+V?= =?us-ascii?q?7wx7JHq6RnM2nTXUBIcjDsL25/T6S9rbWCY8tA6Z8ytyVYTvi8a0iASrHhux?= =?us-ascii?q?sazz/jH2xGyTAgeTGqoJL5nwdmiG+GN3Zzqn3ZeM91xRjF4tzQX/hR0SQaRC?= =?us-ascii?q?NgkznYGkC8P8W1/dWTj5rCvPqxV2a9VpJNaynr1piNtDWl6m1wGhK/gvWzls?= =?us-ascii?q?fgEQgg3i/xz8NqWjnQrBbgfonr0Ly3MfxmfkZ0GF/87NB6FptinYswg5EQ33?= =?us-ascii?q?cai46R/XoGl2f8K89b2aXkYHoKXz4LzMbf4BL51017MnKJ24X5W22ZwstgfN?= =?us-ascii?q?m6fnoa2jkj4MBOCaeU6qFEnCRur1qjtQLRYP59njYBxvs18nIahf8GuBY1xC?= =?us-ascii?q?WHHr8SBVVYPTDrlxmQ9dC+q6FXZGKxfriqyEV+mt6gAaqZogFBRHn5YY0uHS?= =?us-ascii?q?hq7sVwKFjMymH86pn4eNnMatIerh6UnAnGj+hOM58xleQFhSx8OWL7o3Il1/?= =?us-ascii?q?Q3jRt03ZG1pIKHMXli/LqlAh5EMT34f9sT9SvwjaZagMmWx5qgHpN9GjoVRp?= =?us-ascii?q?vlVu+oECkMuvT9LAaCCiY8qnCGGbrFAQCQ9klmr3XVE5CkKX6bPn8Zwst+RB?= =?us-ascii?q?OFPkxQnBgUXCkmnp4+Dg2q2srhf1pi6zAP4F73txtMxvhuNxbhTmfVvB2oZS?= =?us-ascii?q?ssSJiDMBpW6RlP51/PPsyD6uJ+BD1X/py9rA2NM2CbaR5HDWcTVkyDHVDjMa?= =?us-ascii?q?Gk5cPc/OiAGuq+M/zObK2Nqe1eU/eH24mi0o5h/zaCOMWAIGViD+E72kpEWH?= =?us-ascii?q?B2Bd7VmzMRRCwLjyjNddKUpA+g+i1rqcCy6PrrVxjp5YuTDLtSNM5i+x6ojq?= =?us-ascii?q?ieMO6Qnjx2KS5C1pMLx3/H1qQQ3EIIhyFpbTmtHqwKtTTRQ6LIhq9XExkbZj?= =?us-ascii?q?tuO8RU6qI82Q9NOdLGht7uyL53kOQ1C1ZEVFzmnMGlf8oKLH+hNFnfHkaEKK?= =?us-ascii?q?yGJSHXw8Hwea68R6dQg/tJuB2rozmbFVPjPjOYlzTyTR+gLeRMgDucPBxEt4?= =?us-ascii?q?G3agxtBnT7TNL6dh27N8d6jTsswbIunnPKLXURMTZ9c0NXtb2Q8S1YgvR5G2?= =?us-ascii?q?Nb6HpqMeiElDyd7+XCLZYWq/RrCDxul+1G+HQ616dV7CZcSfNugyTeqdpuo1?= =?us-ascii?q?C9kumT0TprSgFOpShXi46RpkVtJ6HZ9phGWXbZ8xMA9nmfChQQp9t4Ed3joa?= =?us-ascii?q?5RxcLTlKLoLzdC9cjY/cwGB8jbMMiHKmYuMQL1GD7ICwsIVTirNWDbh0xZjv?= =?us-ascii?q?6S7WaYoYIkpZj2n5oCULhbVEY6FvkCEERqAMQCIItrXjMjibOUl88I5XW5rB?= =?us-ascii?q?nXX8hVo47IWemTAfr1LjaVl75EZwEHwbngN4QcKpX721B+all9hInFAUXQUs?= =?us-ascii?q?pToiJ/dQI0p11N/2Z4Tm02wU3lawet72QUFf+7hBI2jRF+Yes1/jf2/1g3Pk?= =?us-ascii?q?bKpDc3kEQphdXlhjWRfCTrLKe3XIBZFSz0uFMrMpP8XQl1bha/klBjNDfBW7?= =?us-ascii?q?1elaBgdXxxhA/ap5RPBeZWTbdYbx8I2fGXe/Io3ExeqiWnxU5H/ezFCZ9jlA?= =?us-ascii?q?s2b5GhtHdA2wN/bN4vO6PcPq1JzkJfhqiWpC+nyvgxwBMCJ0YK6G6SfjAHt1?= =?us-ascii?q?YMNrQ9JCqo+fds6RCYlDtFY2gMVPsqruhs9kwjJ+SK1zjg3KJbKkCtK+yfKL?= =?us-ascii?q?uUu3Lems6TXFw/zFkImFVF/bVtysgjclCUWF0ozLufDxQJL9TNKAFPY8pU6n?= =?us-ascii?q?fTYT6Esf/RzpJtI4W9CufoQPeTu6kOnEKkHRsmH58X48sbBJmsykbYLMn8LL?= =?us-ascii?q?Eb1Rot+R7rJFSZDPVJYh6LlikIo92nxp9twYZdPi0dAXl6MSiv4rbXoRUqj+?= =?us-ascii?q?SFXNY3ZXcXRYQENnQrWMGgnC5ZpXtABiGt0u0F0AiC8yP8piPIATnncdVjYP?= =?us-ascii?q?aUZRVxCNC54jgw76+2iVvL/ZrEPGH6Kc5uutnR5uMGv5yHEe9bTaFhs0fAnI?= =?us-ascii?q?lVX2CqU2/KEd6yO5jwa4ktYMfpBXa7Ul2wkSk6Q933PNmzMqiCmRvoSppMsI?= =?us-ascii?q?mHwDAjMtewGSsaGxdxu+4M+rpzZQgDYpo9Zh7osR4xOrekLweZyNquRX+hKT?= =?us-ascii?q?VLT/VFy+W1eaBXxTI2buCm0HsgUo06z+6v/EEWWp4KiArTyuy+aIlATyfzAG?= =?us-ascii?q?dddB/VpSs5jWRhMfwywugnyhPSrVYcKyyLdPBuaGFcpdE8A1KSLml2Cmo/Q1?= =?us-ascii?q?+clpLN7Bex0b4I4yZTmM1Z3vFCsHj7opDQeimsWLCxpZXTrSUgccAso7dtPo?= =?us-ascii?q?z7PsuGqJTekyTDQ5nSqAKKTDW3GOZdmthUJCJYQedHmXs5OcMYpYVB6VA9Vs?= =?us-ascii?q?AkJ7xAEKMsvKylaSJ4DS4Oyi8UT5mA0yYYgue7wLTXjQuQcI44PxwarppCht?= =?us-ascii?q?odUyh5YiMapa+jWIXWl3OKSmcROgcT6B5A5AQemY9sZurl+pbHTIdQyz5KpP?= =?us-ascii?q?J5SiXKGoN0+Fv7S2GWhFn4R++ik+Gy3AJd0uzj3ccBVB54E0hdyP5cllE0J7?= =?us-ascii?q?FvN6kQoonKvyeNdUzgpmLty/WpJEVQyc3SeF31F4TEunD6UiIA/X0UQpJPx2?= =?us-ascii?q?zEFZgIlQp2drorrk1WII+6Ykb++yAkx4NxErmgUsCrw0wqrWwIRietF9pBBf?= =?us-ascii?q?prsFfQWD1ieJCktonqO49VQm9L452dqlFZkEp3Py6+05pcJNlH4iQQUzhXvT?= =?us-ascii?q?WdoNyyRdVZ1s9sEp8MJM1zu3TmFaNFOZiRomE2taf1xn/f5T88rE+wxC+vFK?= =?us-ascii?q?+gU+JZ42oeFx01J2SZr0kiFPcs/nvX8l/WqFx0+flUBqSXh0VrvDl9BoxOBi?= =?us-ascii?q?pO1X29L1R8VmNGvP9eKKvIaMFTXuc9ZQe3OxMgEf4pwVaJ8VtznXfjbCx4rh?= =?us-ascii?q?Fa9DzFXwkoSSkVha/gmT8Zqs65IjIVVoxHbS4/YCffNwKUhz1YsAxZa050R5?= =?us-ascii?q?ATGsxF9K0D3YtI4srCTl6hKT0YUxN/NwI3y/5fmFVfv0WffCDSERCnde3Tsh?= =?us-ascii?q?Fte8eestKpJuzj/AhbkoPnrPw496IbSnK9lw2iXczSoo3hutCErUaBaKD4M+?= =?us-ascii?q?igbnDbVzjMkQq8hbE6AJnW5yLTKhZUK4FmyXo4ZpjsEXTLMgpbKKIbPUVbSb?= =?us-ascii?q?t3adFBouBEecBoZroG+ahwCR2ZXB/vHpKgrOVeJFbJWTveNzmB8vC4oY/L9b?= =?us-ascii?q?zdUvTgadaRyHbbWK93JZB66SThG7j2z4Be/Fb22u13+UN+U1TGNDqBrNv5LA?= =?us-ascii?q?MR+MaiblfivoEuHT7OHJdwimTiyV9deMcMXi2q9IgYyIlD53buSOJ41Uzzv/?= =?us-ascii?q?NO97V+7ok3+b9pw9+uJajOMfRarVNnAh+MCwVv7JotBGx/SH5NYu8NMvjeZ7?= =?us-ascii?q?8UjcbwpODrDKwY9Aea+/RHZtfdIUHOhNW/ACmGSRNYhAcBtSIaLgyE2v6Hga?= =?us-ascii?q?B0U8GlpfP92k03/VizNRsGzK1p5YeY+6qHuO7XYAHXzbgfQKTqQdnzrrs0sU?= =?us-ascii?q?OI+fIkjKIOenByYwC/EugSTMgdxmn6zaAt0C0jDdjOH6769/5FTHI5mSjsm5?= =?us-ascii?q?ZjEFUKAvkUB6aE/ZxCnmcknOzULtIWcr1DmmaLER6rDLoCxGW25CSJO2Zlgw?= =?us-ascii?q?vB0xfqTWO09l/2ojdyQTHQwNf7jkpVSr63CF9QXyqoPE91qzaPMxTotdXpo6?= =?us-ascii?q?Q17Uc2MmP+uNKLimShJKtdH9fjK9yEPSk0uFUXgYU3Rtyrwo0bGNy9INIL/H?= =?us-ascii?q?F/aPve5XmrnDVao6dbnYre/92a+unKHXm6kaKWsbKNxCpXynIgp1Ew9sigNu?= =?us-ascii?q?3S592NW/mo0mERTyFjuwvOQRG4sbnbr1EONkyNzkjLhIILPtZD3Xk7zUHq/u?= =?us-ascii?q?4jT8wv9A9GDIbPe+sCpSzvODvz2VufZ8k3Viye3jZMEFL6D0R3GK8m2G3qpM?= =?us-ascii?q?LJj3DQ+182SYZsa0zrnxt3D583KUg18lgY3jIDERQRaRCcFLyoBEXkIpEeWk?= =?us-ascii?q?cfchmHx6a1ersp0kJv2L+v4/XTbeNkDaoXKvldlhKOnERcGp8OqqIeQal8el?= =?us-ascii?q?FH+67VpwjiF5DnUOL7lXo0LvC6Xsda/t0HuHQ4/wa/XR2g6Y1Z4LoBj5CIbK?= =?us-ascii?q?FEa4DWvM9g90dn+SIPditVjRhnlRy5TfwTpODt49jcqpqo6f+iVL0zSOUT9h?= =?us-ascii?q?g0AXl+jpTrjVA7u97Xy/tTSo3biIT46gBNIGSGuIXE3BlmL+oBNYarcKxn93?= =?us-ascii?q?UdKCgUP2gOMsaOa/kg/y9tNy3e51NYDcMWe9wYIMrNlBtQik3oRLFc6MrbFU?= =?us-ascii?q?WFC4dobcwo6XT4yCwt+5smTung8CO2JYzY71xVMPNMkiNslM7FpOgSxvbSEz?= =?us-ascii?q?YY4X2Yaxhz3yODxIKAC/Lu8uWWyNDbTUkKHigoXIdBPDCC4xCoRvKplJX1VQ?= =?us-ascii?q?OZ8snzgJMie0KXQny+hr8FvrxNEe5HjSX7xSNeG5vwh/+avNug8mxXtkdIEI?= =?us-ascii?q?xr9x3KBL1fPolnORT/jsSrSVRzBjDkeM3NaxQgt+yYxuYK4+VjOErzfoAbIh?= =?us-ascii?q?cexLL893VZVAxuSKT5vlyBR+IeeMNmSO/YrnBS8Y9gKagPPFibpJDwsjhIqF?= =?us-ascii?q?Q2ABI0Z74xrzxacFLOnA5UW6vvpr4AixUcXsR9uUBRGGK8ImQ+6CTbVa5Nlq?= =?us-ascii?q?meFOQV8imPTqwJS0hoMz1+TAmz2Jh1f7upgO1IsmJBniNmuvQq1CZmRBSksy?= =?us-ascii?q?32u60NwS4g+K2/tDgZu3xKUOuekynMCVhYwvUFl6EcBGj+6VCmZnkMcpfy6q?= =?us-ascii?q?F9Jcv87Ykh/2g/YRI7ci0JWeSgDC/xgL2MAoyLq99cnxmNuMPPbbCvNyQSMK?= =?us-ascii?q?oyyQ77TXhnzgfehApo8HcMQji46d8kJYa9OcUixiezG2jUblUM4qRPsMTvs1?= =?us-ascii?q?4HVu02Zk19wG97yMiIWjUNRNDTG2YylgUrcntLcJRf6RIBDKkohjGIvrVa/g?= =?us-ascii?q?EKfjjbD56p+o7KncfHwXM9V8tlxnrKpq2ZgZMnyHNllM1w7i6PoHQdaffVUs?= =?us-ascii?q?5tAnj204dQ1/b+Z/GzvewdT4tm0ruhWucYMsa/4Wu2xIlqWki9y7UQB1q5Ku?= =?us-ascii?q?4DyavFXCq+TG2YWPiLc3KSkDojNU7y/xaoJEUtaMhWt089LvfChplEmg3mVb?= =?us-ascii?q?N7WD6dpUffzGM5KuMaawM2t5u7ewwQUuEeefKQJe4wz/0iEFEMdWPGHTNqC+?= =?us-ascii?q?+qtl6ghIx7O3Rm4UXnbuXh6wTmMNqJGhkYCo7XtZ9x9ua8RmKGI3NgywdyPE?= =?us-ascii?q?Zs/efFC1sxrvNcc4qWndXIgtR0y/IKd/dsMS07vd4egZxj6YiS0MiUdRHRz5?= =?us-ascii?q?DyJczao/SCBP3f1UsqcHlAUrUFeQP1+5k6PtkhVr3RB7RZvhMcCrMhTZw8MW?= =?us-ascii?q?fx6KF0LARucg7eZLS0ntPmpuSVaZtIv3XW9E4/LD/Aux0fzfy5VRd7b56vh3?= =?us-ascii?q?ruIZ09RSlMr8NzBRt8HYtOGsQArwy9D56Shq67l4z5x0Qvn9Qv+f70C/bXxJ?= =?us-ascii?q?Gi0o5sRZlG9AmOOzrMAKRDnEtolKKxj+3G3523DtntL5dMcMtfZyaRbr7AA5?= =?us-ascii?q?X6KT+UPM/4U1BJ/qTa079jVBiVIifjUPzC/BWtKfEsxEI80IEwKPLa0TgF97?= =?us-ascii?q?jG3J73YGZBq2GoqnvfcNNk8FHSBeHYFylRQP6B/XctSbYbdqPo5ewONpok29?= =?us-ascii?q?Ha7A5tunAK6+bNB6mns1+Ejll2cZPdMVvBxzcyWY5MJg+2d0Qrnzmd4j7mJF?= =?us-ascii?q?13DY2oKNJmnc2OJhjs/FVq3zl0IGlbFSCgEey0EEM4ns6/fwaX7xljC9cYg/?= =?us-ascii?q?XxIRd+sbe9H60gGJJFn62Is7UOl81kLWmbRs9aOWfSK79/OCFcCM3ErV4vZB?= =?us-ascii?q?8PurxzUYAwM9zGA04KKw+rziTxhV/B3EDvfNur146CIDwR93RayvTCyzca40?= =?us-ascii?q?GFtOqCn8qrcLnfYJi+CObfNiU4VzffRjkoF0ut0Vbhv/0asbyDKGQCuFlSZC?= =?us-ascii?q?/UChZF4uhNpN3dFSf2nvd5fYZC0PKfXDrqSTZQkqM3CycNslqDFaktDw7TOl?= =?us-ascii?q?Tom2dN8DepJvZR83bodfXMzaNOVv0+GYBMe+CXR9bCPPtXYTwvk2NKa66HY9?= =?us-ascii?q?TAouNhgRrzRmwDHvyNpQXEFhyfX+CcyjT3XI4co4kzvG8y98nNmjNsTPWaAo?= =?us-ascii?q?22m2WFyqfh1GCVtOjFWS8oak0xxucDBDrkolFMK2ABXskco1qlArWBaEBFyG?= =?us-ascii?q?8zhKpw1gUNdgV+Xjwm0nBfkPunXMwMYU8djGSpBvYBaV0=3D?= X-IPAS-Result: =?us-ascii?q?A2DKCQDMqvVa/wHyM5BcGwEBAQEDAQEBCQEBAYNAA4FcK?= =?us-ascii?q?INyiGKMEYF5dRqBQJNfMRMBhQeCQyE4FAECAQEBAQEBAgFrHAyCNSSCTwEDA?= =?us-ascii?q?wECIAQZAQE4AgMJAQEbAwECAwIiBAICAwFBCggGAQwGAgEBAYMegWkDFQOhR?= =?us-ascii?q?4oYbYFpM4JvAQEFgQIBAV6CNAOBNYJACBdyhHiCJIITgQ8jgjOCCYYfglSHG?= =?us-ascii?q?RkIhF5jPIp8CY5LZIcThHiLNYZKMyGBUk0jFTuCQ4IUDBeDRYocAVVPegEBk?= =?us-ascii?q?BUBAQ?= Received: from tarius.tycho.ncsc.mil ([144.51.242.1]) by emsm-gh1-uea11.NCSC.MIL with ESMTP; 11 May 2018 14:40:50 +0000 Received: from prometheus.infosec.tycho.ncsc.mil (prometheus [192.168.25.40]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id w4BEenIk003467; Fri, 11 May 2018 10:40:49 -0400 Received: from tarius.tycho.ncsc.mil (tarius.infosec.tycho.ncsc.mil [144.51.242.1]) by prometheus.infosec.tycho.ncsc.mil (8.15.2/8.15.2) with ESMTP id w4B0rsB8007147 for ; Thu, 10 May 2018 20:53:54 -0400 Received: from goalie.tycho.ncsc.mil (goalie [144.51.242.250]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id w4B0s1iZ001623 for ; Thu, 10 May 2018 20:54:01 -0400 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A1AIBACA6PRaly0WGNZcHQIFDINBgV8og?= =?us-ascii?q?3GIYIwQgXl1GoFAk2uEdwJFgjshOBQBAgEBAQEBAQIUAQEBAQEGGAZLhTQBAwM?= =?us-ascii?q?jBBkBATgPHAMBAgMCJgICRQoIBgEMBgIBAYMfgWkDFQOgaIoYbYFpM4JvAQEFg?= =?us-ascii?q?QIBAV6COgOBNYJACBdyhHiCJIITgQ8jgjOCCYYfglSHFxkIhF5jPIp6CY5JZIc?= =?us-ascii?q?ShHWCK4kHhkkzgXNNIxU7gkOCIA4JEYM0ihwBVU+QOwEB?= X-IPAS-Result: =?us-ascii?q?A1AIBACA6PRaly0WGNZcHQIFDINBgV8og3GIYIwQgXl1GoF?= =?us-ascii?q?Ak2uEdwJFgjshOBQBAgEBAQEBAQIUAQEBAQEGGAZLhTQBAwMjBBkBATgPHAMBA?= =?us-ascii?q?gMCJgICRQoIBgEMBgIBAYMfgWkDFQOgaIoYbYFpM4JvAQEFgQIBAV6COgOBNYJ?= =?us-ascii?q?ACBdyhHiCJIITgQ8jgjOCCYYfglSHFxkIhF5jPIp6CY5JZIcShHWCK4kHhkkzg?= =?us-ascii?q?XNNIxU7gkOCIA4JEYM0ihwBVU+QOwEB?= X-IronPort-AV: E=Sophos;i="5.49,387,1520913600"; d="scan'208";a="274396" Received: from emsm-gh1-uea10.ncsc.mil ([214.29.60.34]) by goalie.tycho.ncsc.mil with ESMTP; 10 May 2018 20:54:00 -0400 IronPort-PHdr: =?us-ascii?q?9a23=3Avz9+3xV9Jyy3fqGbiZTH1gxeLc/V8LGtZVwlr6?= =?us-ascii?q?E/grcLSJyIuqrYZRaGuadThVPEFb/W9+hDw7KP9fy4AipYud6oizMrSNR0TR?= =?us-ascii?q?gLiMEbzUQLIfWuLgnFFsPsdDEwB89YVVVorDmROElRH9viNRWJ+iXhpTEdFQ?= =?us-ascii?q?/iOgVrO+/7BpDdj9it1+C15pbffxhEiCCybL9uIhi6txndutULioZ+N6g9zQ?= =?us-ascii?q?fErGFVcOpM32NoIlyTnxf45siu+ZNo7jpdtfE8+cNeSKv2Z6s3Q6BWAzQgKG?= =?us-ascii?q?A1+dbktQLfQguV53sTSXsZnxxVCAXY9h76X5Pxsizntuph3SSRIMP7QawoVT?= =?us-ascii?q?mk8qxmUwHjhjsZODEl8WHXks1wg7xdoBK9vBx03orYbJiIOPZiYq/ReNUXSm?= =?us-ascii?q?1DUclLVyxBBYS8Y5IWA+cdM+tVrpTxq0ISoRejGAKgAP3jxiNNinLwwKY00f?= =?us-ascii?q?kuERve0QI9AdwOvnTaotb7OqgcXu+6zrXHwzrYYvNK2zrw8pTEfgwvrPyOW7?= =?us-ascii?q?97bMrfyVMoFwPAllidt5bqPyiL2eUNrmOV8vZvVeK1hG46pQFxpiagxt0xgY?= =?us-ascii?q?TOmo0a0EvE+jt5wYsuPt23VE57bsS5EJtesyGVKZF2Tto+TG5yoio11roGuZ?= =?us-ascii?q?uicSUM1Z8pxAbfZuSZf4SV7R/vTvidLDhiiH57Zr6znRm//Ei4xuD9VMS4yk?= =?us-ascii?q?tGoytBn9XWt30A1wbf5taZRvZy+EqqxCyB2BrJ6u5eJEA5jarbJIAlwr43jp?= =?us-ascii?q?ccv1nNEzPolkj4kqKYbFkp9vSq5uj9fLrpuJqcN5R7ig3kN6QhgM2/AeAiPg?= =?us-ascii?q?gLXmib/fyw1Lzl/ULnXLVHluM6nrTWvZzAO8gWqbS1DxFL3oo55BuyDy+q0N?= =?us-ascii?q?ECknkGKFJFdgiHj4/sO1zWPP/3F+y/jEqskTpw3PDJIr3hDY/QLnjNlLfuY6?= =?us-ascii?q?x951dAxwUp19xQ+5VUCrQZLPLpRkDxrMDYDgM+MwGs2OboFtF91oIYWWKSDa?= =?us-ascii?q?6UK7/SsF+U6eIvJOmAfokVuC3nJPQ/6P7uimE5yhchevyN5r5fPHS5GOl2Zl?= =?us-ascii?q?6Uamf2g8sQVGINshc6QcT0h1CYFz1efXC/W+Q7/D5tTMqCLqPmDtSpgbqczG?= =?us-ascii?q?K4E4dQa2RuFF+BCzHrep+CVvNKbziddIspqjUZUfCETIg72Fn6rAbnz5J/J/?= =?us-ascii?q?fQvygfsojuktNy4ruX3Sou+CR0AsLV6GSES2V5jytcXDMt9Lxuqkx6jFGY2O?= =?us-ascii?q?53hOIOUZRoyrttUwEnJdaI1OF+CtbvSirdb9yJTxCgWdzgDjYvGJZ5ieQrSm?= =?us-ascii?q?1eXtmjlRvexDGCB74Oi6fNXMVy9bjTlTClHONU4FWD2Kg6hEQ9WeNLNHa6ne?= =?us-ascii?q?gnrk7UHYGf1w27kKasPYYb3CfL72qFhT6Mu0FeFgx3UazDRn0ZTkDfq9P/50?= =?us-ascii?q?jLS/mlDrFxdkNixMOZYoBNbd6h2VZLSezoP9PdS2mxgWC1BAuNgLSWY9yuM1?= =?us-ascii?q?kQwD7ADwAkmgYf9D7SLQU4CTqgpSfdASZoGFbHYgbo9vdz7miyTVIuxkeMYg?= =?us-ascii?q?tjz+zxsjwcgPGHA9YUxKgFo291qTBzBky8xPrQAt+NpkxmZqoKMv0n51IS/m?= =?us-ascii?q?vCuh01BZegJr1sglMEO1B8tljjxj1sAYVJjMYuoWlvxwM0IqWdhgASPwiE1I?= =?us-ascii?q?z9b+WEYlL5+wqiPuuGgguEgt+L5qcC7ug5oFz/vQavU1Av6Ghjz8IKjCmh3b?= =?us-ascii?q?z2VyEqeMupFEs68gN14bTTYy174oLQhjVgMqix5yfLwMlhRPAkxRCpY8pFPe?= =?us-ascii?q?uaGRXzHcwXC4nmKOEjl1WzKBNRFPFb9KkzecihcvY=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0C6AwD46PRaly0WGNZcHQEBBQELAYN?= =?us-ascii?q?AgV8og3GIYIwQgXl1GoFAk2uEdwJFgjshOBQBAgEBAQEBAQIBEwEBAQEBBhg?= =?us-ascii?q?GSwyCNSSCTwEDAyMEGQEBOA8cAwECAwImAgJFCggGAQwGAgEBgx+BaQMVA6B?= =?us-ascii?q?oihhtgWkzgm8BAQWBAgEBXoI6A4E1gkAIF3KEeIIkghOBDyOCM4IJhh+CVIc?= =?us-ascii?q?XGQiEXmM8inoJjklkhxKEdYIriQeGSTOBc00jFTuCQ4IUDA4JEYM0ihwBVU+?= =?us-ascii?q?QOwEB?= X-IPAS-Result: =?us-ascii?q?A0C6AwD46PRaly0WGNZcHQEBBQELAYNAgV8og3GIYIwQg?= =?us-ascii?q?Xl1GoFAk2uEdwJFgjshOBQBAgEBAQEBAQIBEwEBAQEBBhgGSwyCNSSCTwEDA?= =?us-ascii?q?yMEGQEBOA8cAwECAwImAgJFCggGAQwGAgEBgx+BaQMVA6BoihhtgWkzgm8BA?= =?us-ascii?q?QWBAgEBXoI6A4E1gkAIF3KEeIIkghOBDyOCM4IJhh+CVIcXGQiEXmM8inoJj?= =?us-ascii?q?klkhxKEdYIriQeGSTOBc00jFTuCQ4IUDA4JEYM0ihwBVU+QOwEB?= X-IronPort-AV: E=Sophos;i="5.49,387,1520899200"; d="scan'208";a="11679312" X-IronPort-Outbreak-Status: No, level 0, Unknown - Unknown Received: from usat3cpa07.eemsg.mail.mil ([214.24.22.45]) by EMSM-GH1-UEA10.NCSC.MIL with ESMTP; 11 May 2018 00:53:59 +0000 X-EEMSG-check-005: 0 X-EEMSG-check-006: 000-001;7f765788-6748-4b49-9469-db753767aac7 Authentication-Results: USAT3CPA10.eemsg.mail.mil; dkim=pass (signature verified) header.i=@yahoo.com X-EEMSG-check-008: 13883334|USAT3CPA10_EEMSG_MP25.csd.disa.mil X-EEMSG-SBRS: 3.5 X-EEMSG-ORIG-IP: 66.163.185.40 X-EEMSG-check-002: true X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: A0ChAgBZ5vRahyi5o0JcHQIFDIUgKINxiGCOCXUagUCTa4R3AkWCOyE4FAECAQEBAQEBAhQBAQEKCwkIKCMMhSgBAwMjBBkBATgPHAMBAgMCJgICRQoIBgEMBgIBAYMfgWkDFaBuihhtgWkzgm8BAQWBAgEBXoI6A4E1gkAIF3KEeIQ3gQ8jgjMHggKGH4JUhxcZCIReYzyKegmOSWSHEoR1izKGSTOBc00jFTuCQ4IgDgmDRYocAVUfMJA7AQE X-IPAS-Result: A0ChAgBZ5vRahyi5o0JcHQIFDIUgKINxiGCOCXUagUCTa4R3AkWCOyE4FAECAQEBAQEBAhQBAQEKCwkIKCMMhSgBAwMjBBkBATgPHAMBAgMCJgICRQoIBgEMBgIBAYMfgWkDFaBuihhtgWkzgm8BAQWBAgEBXoI6A4E1gkAIF3KEeIQ3gQ8jgjMHggKGH4JUhxcZCIReYzyKegmOSWSHEoR1izKGSTOBc00jFTuCQ4IgDgmDRYocAVUfMJA7AQE Received: from sonic313-17.consmr.mail.ne1.yahoo.com ([66.163.185.40]) by USAT3CPA10.eemsg.mail.mil with ESMTP; 11 May 2018 00:53:57 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1526000037; bh=KS+luML7wjt455KOgxI5jmmUYUeYU65VhT6GYBfyCFA=; h=Subject:To:References:From:Date:In-Reply-To:From:Subject; b=IEgTndw/nXiNd36JuYNs2tXYGjN7FMhyCdILXs1wbtZvBbpc6Qr/JIZoqsrrwOEMUTF72T3+ExvFBGNN5lpMcSrS5wAX9oXn8XbQL76pPCj/nXKV3TmtfERYsOpNaA3zMo4v3mETckSl6XIBzn8ZujdtacEQKT02uUf4LpKr8lsVDQrLaJUqSUWGTvrQmBMGn/wcKbKhjFSgMVXieaKGylhQrjduQZHoQtZojRe/hhoIppZgHYTtCFaxYwhlVFk0INlqepiMuOdObhG2iBaVN9udOgpjKXXZoSJrJqrJWHcwWvHPGvao2EuyLe6e3nAjYRlFUn7Np1UIuAYxSK4ulw== X-YMail-OSG: 62ScL8sVM1lFHhLegbqgwZAOFw1hr269seVVNBxqfnlYD0nqzrN3RTU1Mgvj36Z Y35Qay3GRL7NGqrESWmeIXWRBdb_OjKsfN_S6r8Vwjx7NS063En4cNQECweCiOgmcSeYSa4eZ2BW kZhxAUnbPyblSFccfiJ2T4WDqw8Og_iDyVfOnae49KCkJhPSs9.4Q.wu2H8II3XKK.O1ZPVRxV6s MC6D7z.MkdIG86Szm8.al1tt4dWkHVEfydPmRyxsio_sr4fbCp2HI51L1rgJEgbRumuYo3x87As6 kOXmidnHbFWeBVCIZN.uxKyJvuKhTQj_NmoiJEWJL8kJezicwWe211TFyD3vGo.ajxJqisa55KLN 5GLgD4qDNBkjwBY.KJSGlKPbdJF9QW3JOTuaW7bZtnRXZRjEVFBpZXdX94desDDsA.P7elVQrFmW Ixa95Hv.21SxDz.J3Bv0hzTlCQsEoZdhGP0J8LQXPjvY63AQueuZ5kKfMvHclK1OqYpusNxzdWwS EgLj.ydAeiwdRcuP034WDNJNWc19ZMIR7pIFE_MjeBrU_LzwFXhY1_AefEQiAAOFr8lQVFPyX.ny 7ILXxAq2NJS22YHeybR3K9yQ2NjkLoRBcvZiZ2grKLGZCaugrxAf32cQShzI3Uvy5wWM_V0ykQU2 g51g- Received: from sonic.gate.mail.ne1.yahoo.com by sonic313.consmr.mail.ne1.yahoo.com with HTTP; Fri, 11 May 2018 00:53:57 +0000 Received: from c-67-169-65-224.hsd1.ca.comcast.net (EHLO [192.168.0.105]) ([67.169.65.224]) by smtp408.mail.ne1.yahoo.com (Oath Hermes SMTP Server) with ESMTPA ID 9741cbb4dec0ea104b959077c4fc6f8b; Fri, 11 May 2018 00:53:57 +0000 (UTC) To: LSM , LKLM , Paul Moore , Stephen Smalley , SE Linux , "SMACK-discuss@lists.01.org" , John Johansen , Kees Cook , Tetsuo Handa , James Morris References: <7e8702ce-2598-e0a3-31a2-bc29157fb73d@schaufler-ca.com> X-EEMSG-check-009: 444-444 From: Casey Schaufler Message-ID: Date: Thu, 10 May 2018 17:53:54 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.7.0 MIME-Version: 1.0 In-Reply-To: <7e8702ce-2598-e0a3-31a2-bc29157fb73d@schaufler-ca.com> Content-Language: en-US X-Mailman-Approved-At: Fri, 11 May 2018 10:37:08 -0400 Subject: [PATCH 10/23] LSM: Infrastructure management of the inode security X-BeenThere: selinux@tycho.nsa.gov X-Mailman-Version: 2.1.21 Precedence: list List-Id: "Security-Enhanced Linux \(SELinux\) mailing list" List-Post: List-Help: Errors-To: selinux-bounces@tycho.nsa.gov Sender: "Selinux" X-Virus-Scanned: ClamAV using ClamSMTP From: Casey Schaufler Date: Thu, 10 May 2018 14:23:27 -0700 Subject: [PATCH 10/23] LSM: Infrastructure management of the inode security blob Move management of the inode->i_security blob out of the individual security modules and into the security infrastructure. Instead of allocating the blobs from within the modules the modules tell the infrastructure how much space is required, and the space is allocated there. Signed-off-by: Casey Schaufler --- include/linux/lsm_hooks.h | 3 ++ security/security.c | 85 +++++++++++++++++++++++++++++++++++++-- security/selinux/hooks.c | 32 +-------------- security/selinux/include/objsec.h | 5 +-- security/smack/smack_lsm.c | 70 +++++--------------------------- 5 files changed, 99 insertions(+), 96 deletions(-) diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h index 3ba96e406827..a935ab92906d 100644 --- a/include/linux/lsm_hooks.h +++ b/include/linux/lsm_hooks.h @@ -2017,6 +2017,7 @@ struct security_hook_list { struct lsm_blob_sizes { int lbs_cred; int lbs_file; + int lbs_inode; int lbs_task; }; @@ -2080,10 +2081,12 @@ static inline void loadpin_add_hooks(void) { }; #endif extern int lsm_cred_alloc(struct cred *cred, gfp_t gfp); +extern int lsm_inode_alloc(struct inode *inode); #ifdef CONFIG_SECURITY void lsm_early_cred(struct cred *cred); void lsm_early_task(struct task_struct *task); +void lsm_early_inode(struct inode *inode); #endif #endif /* ! __LINUX_LSM_HOOKS_H */ diff --git a/security/security.c b/security/security.c index b414186ad45f..02df9b608b7e 100644 --- a/security/security.c +++ b/security/security.c @@ -41,6 +41,7 @@ struct security_hook_heads security_hook_heads __lsm_ro_after_init; static ATOMIC_NOTIFIER_HEAD(lsm_notifier_chain); static struct kmem_cache *lsm_file_cache; +static struct kmem_cache *lsm_inode_cache; char *lsm_names; static struct lsm_blob_sizes blob_sizes; @@ -98,6 +99,10 @@ int __init security_init(void) lsm_file_cache = kmem_cache_create("lsm_file_cache", blob_sizes.lbs_file, 0, SLAB_PANIC, NULL); + if (blob_sizes.lbs_inode) + lsm_inode_cache = kmem_cache_create("lsm_inode_cache", + blob_sizes.lbs_inode, 0, + SLAB_PANIC, NULL); /* * The second call to a module specific init function * adds hooks to the hook lists and does any other early @@ -108,8 +113,9 @@ int __init security_init(void) #ifdef CONFIG_SECURITY_LSM_DEBUG pr_info("LSM: cred blob size = %d\n", blob_sizes.lbs_cred); pr_info("LSM: file blob size = %d\n", blob_sizes.lbs_file); + pr_info("LSM: inode blob size = %d\n", blob_sizes.lbs_inode); pr_info("LSM: task blob size = %d\n", blob_sizes.lbs_task); -#endif +#endif /* CONFIG_SECURITY_LSM_DEBUG */ return 0; } @@ -285,6 +291,13 @@ void __init security_add_blobs(struct lsm_blob_sizes *needed) lsm_set_size(&needed->lbs_cred, &blob_sizes.lbs_cred); lsm_set_size(&needed->lbs_file, &blob_sizes.lbs_file); lsm_set_size(&needed->lbs_task, &blob_sizes.lbs_task); + /* + * The inode blob gets an rcu_head in addition to + * what the modules might need. + */ + if (needed->lbs_inode && blob_sizes.lbs_inode == 0) + blob_sizes.lbs_inode = sizeof(struct rcu_head); + lsm_set_size(&needed->lbs_inode, &blob_sizes.lbs_inode); } /** @@ -348,6 +361,46 @@ void lsm_early_task(struct task_struct *task) panic("%s: Early task alloc failed.\n", __func__); } +/** + * lsm_inode_alloc - allocate a composite inode blob + * @inode: the inode that needs a blob + * + * Allocate the inode blob for all the modules + * + * Returns 0, or -ENOMEM if memory can't be allocated. + */ +int lsm_inode_alloc(struct inode *inode) +{ + if (!lsm_inode_cache) { + inode->i_security = NULL; + return 0; + } + + inode->i_security = kmem_cache_zalloc(lsm_inode_cache, GFP_KERNEL); + if (inode->i_security == NULL) + return -ENOMEM; + return 0; +} + +/** + * lsm_early_inode - during initialization allocate a composite inode blob + * @inode: the inode that needs a blob + * + * Allocate the inode blob for all the modules if it's not already there + */ +void lsm_early_inode(struct inode *inode) +{ + int rc; + + if (inode == NULL) + panic("%s: NULL inode.\n", __func__); + if (inode->i_security != NULL) + return; + rc = lsm_inode_alloc(inode); + if (rc) + panic("%s: Early inode alloc failed.\n", __func__); +} + /* * Hook list operation macros. * @@ -594,14 +647,40 @@ EXPORT_SYMBOL(security_sb_parse_opts_str); int security_inode_alloc(struct inode *inode) { - inode->i_security = NULL; - return call_int_hook(inode_alloc_security, 0, inode); + int rc = lsm_inode_alloc(inode); + + if (unlikely(rc)) + return rc; + rc = call_int_hook(inode_alloc_security, 0, inode); + if (unlikely(rc)) + security_inode_free(inode); + return rc; +} + +static void inode_free_by_rcu(struct rcu_head *head) +{ + /* + * The rcu head is at the start of the inode blob + */ + kmem_cache_free(lsm_inode_cache, head); } void security_inode_free(struct inode *inode) { integrity_inode_free(inode); call_void_hook(inode_free_security, inode); + /* + * The inode may still be referenced in a path walk and + * a call to security_inode_permission() can be made + * after inode_free_security() is called. Ideally, the VFS + * wouldn't do this, but fixing that is a much harder + * job. For now, simply free the i_security via RCU, and + * leave the current inode->i_security pointer intact. + * The inode will be freed after the RCU grace period too. + */ + if (inode->i_security) + call_rcu((struct rcu_head *)inode->i_security, + inode_free_by_rcu); } int security_dentry_init_security(struct dentry *dentry, int mode, diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index baefd36b44df..493328a1c789 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -148,8 +148,6 @@ static int __init checkreqprot_setup(char *str) } __setup("checkreqprot=", checkreqprot_setup); -static struct kmem_cache *sel_inode_cache; - /** * selinux_secmark_enabled - Check to see if SECMARK is currently enabled * @@ -245,13 +243,9 @@ static inline u32 task_sid(const struct task_struct *task) static int inode_alloc_security(struct inode *inode) { - struct inode_security_struct *isec; + struct inode_security_struct *isec = selinux_inode(inode); u32 sid = current_sid(); - isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS); - if (!isec) - return -ENOMEM; - spin_lock_init(&isec->lock); INIT_LIST_HEAD(&isec->list); isec->inode = inode; @@ -259,7 +253,6 @@ static int inode_alloc_security(struct inode *inode) isec->sclass = SECCLASS_FILE; isec->task_sid = sid; isec->initialized = LABEL_INVALID; - inode->i_security = isec; return 0; } @@ -338,14 +331,6 @@ static struct inode_security_struct *backing_inode_security(struct dentry *dentr return selinux_inode(inode); } -static void inode_free_rcu(struct rcu_head *head) -{ - struct inode_security_struct *isec; - - isec = container_of(head, struct inode_security_struct, rcu); - kmem_cache_free(sel_inode_cache, isec); -} - static void inode_free_security(struct inode *inode) { struct inode_security_struct *isec = selinux_inode(inode); @@ -366,17 +351,6 @@ static void inode_free_security(struct inode *inode) list_del_init(&isec->list); spin_unlock(&sbsec->isec_lock); } - - /* - * The inode may still be referenced in a path walk and - * a call to selinux_inode_permission() can be made - * after inode_free_security() is called. Ideally, the VFS - * wouldn't do this, but fixing that is a much harder - * job. For now, simply free the i_security via RCU, and - * leave the current inode->i_security pointer intact. - * The inode will be freed after the RCU grace period too. - */ - call_rcu(&isec->rcu, inode_free_rcu); } static int file_alloc_security(struct file *file) @@ -6794,6 +6768,7 @@ static void selinux_bpf_prog_free(struct bpf_prog_aux *aux) struct lsm_blob_sizes selinux_blob_sizes = { .lbs_cred = sizeof(struct task_security_struct), .lbs_file = sizeof(struct file_security_struct), + .lbs_inode = sizeof(struct inode_security_struct), }; static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = { @@ -7061,9 +7036,6 @@ static __init int selinux_init(void) default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC); - sel_inode_cache = kmem_cache_create("selinux_inode_security", - sizeof(struct inode_security_struct), - 0, SLAB_PANIC, NULL); avc_init(); avtab_cache_init(); diff --git a/security/selinux/include/objsec.h b/security/selinux/include/objsec.h index 168a96104fa0..60d109caaeef 100644 --- a/security/selinux/include/objsec.h +++ b/security/selinux/include/objsec.h @@ -59,10 +59,7 @@ enum label_initialized { struct inode_security_struct { struct inode *inode; /* back pointer to inode object */ - union { - struct list_head list; /* list of inode_security_struct */ - struct rcu_head rcu; /* for freeing the inode_security_struct */ - }; + struct list_head list; /* list of inode_security_struct */ u32 task_sid; /* SID of creating task */ u32 sid; /* SID of this object */ u16 sclass; /* security class of this object */ diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index b9db97470e06..cfabb9f5cc9b 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -287,24 +287,18 @@ static struct smack_known *smk_fetch(const char *name, struct inode *ip, } /** - * new_inode_smack - allocate an inode security blob + * init_inode_smack - initialize an inode security blob + * @isp: the blob to initialize * @skp: a pointer to the Smack label entry to use in the blob * - * Returns the new blob or NULL if there's no memory available */ -static struct inode_smack *new_inode_smack(struct smack_known *skp) +static void init_inode_smack(struct inode *inode, struct smack_known *skp) { - struct inode_smack *isp; - - isp = kmem_cache_zalloc(smack_inode_cache, GFP_NOFS); - if (isp == NULL) - return NULL; + struct inode_smack *isp = smack_inode(inode); isp->smk_inode = skp; isp->smk_flags = 0; mutex_init(&isp->smk_lock); - - return isp; } /** @@ -823,17 +817,13 @@ static int smack_set_mnt_opts(struct super_block *sb, /* * Initialize the root inode. */ - isp = smack_inode(inode); - if (isp == NULL) { - isp = new_inode_smack(sp->smk_root); - if (isp == NULL) - return -ENOMEM; - inode->i_security = isp; - } else - isp->smk_inode = sp->smk_root; + lsm_early_inode(inode); + init_inode_smack(inode, sp->smk_root); - if (transmute) + if (transmute) { + isp = smack_inode(inode); isp->smk_flags |= SMK_INODE_TRANSMUTE; + } return 0; } @@ -962,48 +952,10 @@ static int smack_inode_alloc_security(struct inode *inode) { struct smack_known *skp = smk_of_current(); - inode->i_security = new_inode_smack(skp); - if (inode->i_security == NULL) - return -ENOMEM; + init_inode_smack(inode, skp); return 0; } -/** - * smack_inode_free_rcu - Free inode_smack blob from cache - * @head: the rcu_head for getting inode_smack pointer - * - * Call back function called from call_rcu() to free - * the i_security blob pointer in inode - */ -static void smack_inode_free_rcu(struct rcu_head *head) -{ - struct inode_smack *issp; - - issp = container_of(head, struct inode_smack, smk_rcu); - kmem_cache_free(smack_inode_cache, issp); -} - -/** - * smack_inode_free_security - free an inode blob using call_rcu() - * @inode: the inode with a blob - * - * Clears the blob pointer in inode using RCU - */ -static void smack_inode_free_security(struct inode *inode) -{ - struct inode_smack *issp = smack_inode(inode); - - /* - * The inode may still be referenced in a path walk and - * a call to smack_inode_permission() can be made - * after smack_inode_free_security() is called. - * To avoid race condition free the i_security via RCU - * and leave the current inode->i_security pointer intact. - * The inode will be freed after the RCU grace period too. - */ - call_rcu(&issp->smk_rcu, smack_inode_free_rcu); -} - /** * smack_inode_init_security - copy out the smack from an inode * @inode: the newly created inode @@ -4589,6 +4541,7 @@ static int smack_dentry_create_files_as(struct dentry *dentry, int mode, struct lsm_blob_sizes smack_blob_sizes = { .lbs_cred = sizeof(struct task_smack), .lbs_file = sizeof(struct smack_known *), + .lbs_inode = sizeof(struct inode_smack), }; static struct security_hook_list smack_hooks[] __lsm_ro_after_init = { @@ -4607,7 +4560,6 @@ static struct security_hook_list smack_hooks[] __lsm_ro_after_init = { LSM_HOOK_INIT(bprm_set_creds, smack_bprm_set_creds), LSM_HOOK_INIT(inode_alloc_security, smack_inode_alloc_security), - LSM_HOOK_INIT(inode_free_security, smack_inode_free_security), LSM_HOOK_INIT(inode_init_security, smack_inode_init_security), LSM_HOOK_INIT(inode_link, smack_inode_link), LSM_HOOK_INIT(inode_unlink, smack_inode_unlink),