From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 5AAA3C636CC for ; Tue, 31 Jan 2023 07:49:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1675151357; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding:list-id:list-help: list-unsubscribe:list-subscribe:list-post; bh=ZsVu1ayPRWuH1Y6A/LyX3C2o6ymKuiBOo7mvz83TDUg=; b=KkDKWM6jmOPAKaSIJK0MNdX7Be4y0VzRT05zWebqegbdZnA1zV0eS991G2sATUyWtduCtl 91uc5iTS+aK+nbfyPsW4JxX7nhkgUalSDf6c2nmXrlKVNB7Mn8GxAnKCLhuCmJZquxjRxF 6dzTtH6MLRadV44l5ui0pYz5rxDq5Bo= Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-182-3H4FwAytNy6ujglRjp_Ayw-1; Tue, 31 Jan 2023 02:49:14 -0500 X-MC-Unique: 3H4FwAytNy6ujglRjp_Ayw-1 Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.rdu2.redhat.com [10.11.54.2]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 9C1FE811E6E; Tue, 31 Jan 2023 07:49:12 +0000 (UTC) Received: from mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (unknown [10.30.29.100]) by smtp.corp.redhat.com (Postfix) with ESMTP id 889DF40C1073; Tue, 31 Jan 2023 07:49:12 +0000 (UTC) Received: from mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (localhost [IPv6:::1]) by mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (Postfix) with ESMTP id 576041946589; Tue, 31 Jan 2023 07:49:12 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx08.intmail.prod.int.rdu2.redhat.com [10.11.54.8]) by mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (Postfix) with ESMTP id 3D8561946589 for ; Mon, 30 Jan 2023 23:06:40 +0000 (UTC) Received: by smtp.corp.redhat.com (Postfix) id 319C4C16021; Mon, 30 Jan 2023 23:06:40 +0000 (UTC) Received: from mimecast-mx02.redhat.com (mimecast02.extmail.prod.ext.rdu2.redhat.com [10.11.55.18]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 2867BC16020 for ; Mon, 30 Jan 2023 23:06:40 +0000 (UTC) Received: from us-smtp-1.mimecast.com (us-smtp-2.mimecast.com [207.211.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 03B92800B23 for ; Mon, 30 Jan 2023 23:06:40 +0000 (UTC) Received: from linux.microsoft.com (linux.microsoft.com [13.77.154.182]) by relay.mimecast.com with ESMTP id us-mta-207-H4n9BtZwN_GFPdukbDyI6w-1; Mon, 30 Jan 2023 18:06:38 -0500 X-MC-Unique: H4n9BtZwN_GFPdukbDyI6w-1 Received: by linux.microsoft.com (Postfix, from userid 1052) id E04B220E9FB1; Mon, 30 Jan 2023 14:58:41 -0800 (PST) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com E04B220E9FB1 From: Fan Wu To: corbet@lwn.net, zohar@linux.ibm.com, jmorris@namei.org, serge@hallyn.com, tytso@mit.edu, ebiggers@kernel.org, axboe@kernel.dk, agk@redhat.com, snitzer@kernel.org, eparis@redhat.com, paul@paul-moore.com Date: Mon, 30 Jan 2023 14:57:15 -0800 Message-Id: <1675119451-23180-1-git-send-email-wufan@linux.microsoft.com> MIME-Version: 1.0 X-Mimecast-Impersonation-Protect: Policy=CLT - Impersonation Protection Definition; Similar Internal Domain=false; Similar Monitored External Domain=false; Custom External Domain=false; Mimecast External Domain=false; Newly Observed Domain=false; Internal User Name=false; Custom Display Name List=false; Reply-to Address Mismatch=false; Targeted Threat Dictionary=false; Mimecast Threat Dictionary=false; Custom Threat Dictionary=false X-Scanned-By: MIMEDefang 3.1 on 10.11.54.8 X-Mailman-Approved-At: Tue, 31 Jan 2023 07:47:16 +0000 Subject: [dm-devel] [RFC PATCH v9 00/16] Integrity Policy Enforcement LSM (IPE) X-BeenThere: dm-devel@redhat.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: device-mapper development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Fan Wu , dm-devel@redhat.com, linux-doc@vger.kernel.org, roberto.sassu@huawei.com, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, linux-block@vger.kernel.org, linux-fscrypt@vger.kernel.org, linux-audit@redhat.com, linux-integrity@vger.kernel.org Errors-To: dm-devel-bounces@redhat.com Sender: "dm-devel" X-Scanned-By: MIMEDefang 3.1 on 10.11.54.2 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 T3ZlcnZpZXc6Ci0tLS0tLS0tLQoKSVBFIGlzIGEgTGludXggU2VjdXJpdHkgTW9kdWxlIHdoaWNo IHRha2VzIGEgY29tcGxpbWVudGFyeSBhcHByb2FjaCB0bwphY2Nlc3MgY29udHJvbC4gV2hlcmVh cyBleGlzdGluZyBtYW5kYXRvcnkgYWNjZXNzIGNvbnRyb2wgbWVjaGFuaXNtcwpiYXNlIHRoZWly IGRlY2lzaW9ucyBvbiBsYWJlbHMgYW5kIHBhdGhzLCBJUEUgaW5zdGVhZCBkZXRlcm1pbmVzCndo ZXRoZXIgb3Igbm90IGFuIG9wZXJhdGlvbiBzaG91bGQgYmUgYWxsb3dlZCBiYXNlZCBvbiBpbW11 dGFibGUKc2VjdXJpdHkgcHJvcGVydGllcyBvZiB0aGUgc3lzdGVtIGNvbXBvbmVudCB0aGUgb3Bl cmF0aW9uIGlzIGJlaW5nCnBlcmZvcm1lZCBvbi4KCklQRSBpdHNlbGYgZG9lcyBub3QgbWFuZGF0 ZSBob3cgdGhlIHNlY3VyaXR5IHByb3BlcnR5IHNob3VsZCBiZQpldmFsdWF0ZWQsIGJ1dCByZWxp ZXMgb24gYW4gZXh0ZW5zaWJsZSBzZXQgb2YgZXh0ZXJuYWwgcHJvcGVydHkgcHJvdmlkZXJzCnRv IGV2YWx1YXRlIHRoZSBjb21wb25lbnQuIElQRSBtYWtlcyBpdHMgZGVjaXNpb24gYmFzZWQgb24g cmVmZXJlbmNlCnZhbHVlcyBmb3IgdGhlIHNlbGVjdGVkIHByb3BlcnRpZXMsIHNwZWNpZmllZCBp biB0aGUgSVBFIHBvbGljeS4KClRoZSByZWZlcmVuY2UgdmFsdWVzIHJlcHJlc2VudCB0aGUgdmFs dWUgdGhhdCB0aGUgcG9saWN5IHdyaXRlciBhbmQgdGhlCmxvY2FsIHN5c3RlbSBhZG1pbmlzdHJh dG9yIChiYXNlZCBvbiB0aGUgcG9saWN5IHNpZ25hdHVyZSkgdHJ1c3QgZm9yIHRoZQpzeXN0ZW0g dG8gYWNjb21wbGlzaCB0aGUgZGVzaXJlZCB0YXNrcy4KCk9uZSBzdWNoIHByb3ZpZGVyIGlzIGZv ciBleGFtcGxlIGRtLXZlcml0eSwgd2hpY2ggaXMgYWJsZSB0byByZXByZXNlbnQKdGhlIGludGVn cml0eSBwcm9wZXJ0eSBvZiBhIHBhcnRpdGlvbiAoaXRzIGltbXV0YWJsZSBzdGF0ZSkgd2l0aCBh IGRpZ2VzdC4KCklQRSBpcyBjb21waWxlZCB1bmRlciBDT05GSUdfU0VDVVJJVFlfSVBFLgoKVXNl IENhc2VzCi0tLS0tLS0tLQoKSVBFIHdvcmtzIGJlc3QgaW4gZml4ZWQtZnVuY3Rpb24gZGV2aWNl czogRGV2aWNlcyBpbiB3aGljaCB0aGVpciBwdXJwb3NlCmlzIGNsZWFybHkgZGVmaW5lZCBhbmQg bm90IHN1cHBvc2VkIHRvIGJlIGNoYW5nZWQgKGUuZy4gbmV0d29yayBmaXJld2FsbApkZXZpY2Ug aW4gYSBkYXRhIGNlbnRlciwgYW4gSW9UIGRldmljZSwgZXRjZXRlcmEpLCB3aGVyZSBhbGwgc29m dHdhcmUgYW5kCmNvbmZpZ3VyYXRpb24gaXMgYnVpbHQgYW5kIHByb3Zpc2lvbmVkIGJ5IHRoZSBz eXN0ZW0gb3duZXIuCgpJUEUgaXMgYSBsb25nLXdheSBvZmYgZm9yIHVzZSBpbiBnZW5lcmFsLXB1 cnBvc2UgY29tcHV0aW5nOiB0aGUgTGludXgKY29tbXVuaXR5IGFzIGEgd2hvbGUgdGVuZHMgdG8g Zm9sbG93IGEgZGVjZW50cmFsaXplZCB0cnVzdCBtb2RlbCwKa25vd24gYXMgdGhlIHdlYiBvZiB0 cnVzdCwgd2hpY2ggSVBFIGhhcyBubyBzdXBwb3J0IGZvciBhcyBvZiAgeWV0LgpUaGVyZSBhcmUg ZXhjZXB0aW9ucywgc3VjaCBhcyB0aGUgY2FzZSB3aGVyZSBhIExpbnV4IGRpc3RyaWJ1dGlvbgp2 ZW5kb3IgdHJ1c3RzIG9ubHkgdGhlaXIgb3duIGtleXMsIHdoZXJlIElQRSBjYW4gc3VjY2Vzc2Z1 bGx5IGJlIHVzZWQKdG8gZW5mb3JjZSB0aGUgdHJ1c3QgcmVxdWlyZW1lbnQuCgpBZGRpdGlvbmFs bHksIHdoaWxlIG1vc3QgcGFja2FnZXMgYXJlIHNpZ25lZCB0b2RheSwgdGhlIGZpbGVzIGluc2lk ZQp0aGUgcGFja2FnZXMgKGZvciBpbnN0YW5jZSwgdGhlIGV4ZWN1dGFibGVzKSwgdGVuZCB0byBi ZSB1bnNpZ25lZC4gVGhpcwptYWtlcyBpdCBkaWZmaWN1bHQgdG8gdXRpbGl6ZSBJUEUgaW4gc3lz dGVtcyB3aGVyZSBhIHBhY2thZ2UgbWFuYWdlciBpcwpleHBlY3RlZCB0byBiZSBmdW5jdGlvbmFs LCB3aXRob3V0IG1ham9yIGNoYW5nZXMgdG8gdGhlIHBhY2thZ2UgbWFuYWdlcgphbmQgZWNvc3lz dGVtIGJlaGluZCBpdC4KCkRJR0xJTVsxXSBpcyBhIHN5c3RlbSB0aGF0IHdoZW4gY29tYmluZWQg d2l0aCBJUEUsIGNvdWxkIGJlIHVzZWQgdG8KZW5hYmxlIGdlbmVyYWwgcHVycG9zZSBjb21wdXRp bmcgc2NlbmFyaW9zLgoKUG9saWN5OgotLS0tLS0tCgpJUEUgcG9saWN5IGlzIGEgcGxhaW4tdGV4 dCBwb2xpY3kgY29tcG9zZWQgb2YgbXVsdGlwbGUgc3RhdGVtZW50cwpvdmVyIHNldmVyYWwgbGlu ZXMuIFRoZXJlIGlzIG9uZSByZXF1aXJlZCBsaW5lLCBhdCB0aGUgdG9wIG9mIHRoZQpwb2xpY3ks IGluZGljYXRpbmcgdGhlIHBvbGljeSBuYW1lLCBhbmQgdGhlIHBvbGljeSB2ZXJzaW9uLCBmb3IK aW5zdGFuY2U6CgogIHBvbGljeV9uYW1lPUV4X1BvbGljeSBwb2xpY3lfdmVyc2lvbj0wLjAuMAoK VGhlIHBvbGljeSB2ZXJzaW9uIGluZGljYXRlcyB0aGUgY3VycmVudCB2ZXJzaW9uIG9mIHRoZSBw b2xpY3kuIFRoaXMgaXMKdXNlZCB0byBwcmV2ZW50IHJvbGwtYmFjayBvZiBwb2xpY3kgdG8gcG90 ZW50aWFsbHkgaW5zZWN1cmUgcHJldmlvdXMKdmVyc2lvbnMgb2YgdGhlIHBvbGljeS4KClRoZSBu ZXh0IHBvcnRpb24gb2YgSVBFIHBvbGljeSwgYXJlIHJ1bGVzLiBSdWxlcyBhcmUgZm9ybWVkIGJ5 IGtleT12YWx1ZQpwYWlycywga25vd24gYXMgcHJvcGVydGllcy4gSVBFIHJ1bGVzIHJlcXVpcmUg dHdvIGtleXM6ICJhY3Rpb24iLCB3aGljaApkZXRlcm1pbmVzIHdoYXQgSVBFIGRvZXMgd2hlbiBp dCBlbmNvdW50ZXJzIGEgbWF0Y2ggYWdhaW5zdCB0aGUgcG9saWN5CmFuZCAib3AiLCB3aGljaCBk ZXRlcm1pbmVzIHdoZW4gdGhhdCBydWxlIHNob3VsZCBiZSBldmFsdWF0ZWQuCgpUaHVzLCBhIG1p bmltYWwgcnVsZSBpczoKCiAgb3A9RVhFQ1VURSBhY3Rpb249QUxMT1cKClRoaXMgZXhhbXBsZSBy dWxlIHdpbGwgYWxsb3cgYW55IGV4ZWN1dGlvbi4gQSBydWxlIGlzIHJlcXVpcmVkIHRvIGhhdmUg dGhlCiJvcCIgcHJvcGVydHkgYXMgdGhlIGZpcnN0IHRva2VuIG9mIGEgcnVsZSwgYW5kIHRoZSAi YWN0aW9uIiBhcyB0aGUgbGFzdAp0b2tlbiBvZiB0aGUgcnVsZS4gCgpBZGRpdGlvbmFsIHByb3Bl cnRpZXMgYXJlIHVzZWQgdG8gcmVzdHJpY3QgYXR0cmlidXRlcyBhYm91dCB0aGUgZmlsZXMgYmVp bmcKZXZhbHVhdGVkLiBUaGVzZSBwcm9wZXJ0aWVzIGFyZSBpbnRlbmRlZCB0byBiZSBkZXRlcm1p bmlzdGljIGF0dHJpYnV0ZXMKdGhhdCBhcmUgcmVzaWRlbnQgaW4gdGhlIGtlcm5lbC4gCgpGb3Ig ZXhhbXBsZToKCiAgb3A9RVhFQ1VURSBkbXZlcml0eV9zaWduYXR1cmU9RkFMU0UgYWN0aW9uPURF TlkKClRoaXMgcnVsZSB3aXRoIHByb3BlcnR5IGRtdmVyaXR5X3NpZ25hdHVyZSB3aWxsIGRlbnkg YW55IGZpbGUgbm90IGZyb20KYSBzaWduZWQgZG12ZXJpdHkgdm9sdW1lIHRvIGJlIGV4ZWN1dGVk LiAKCkFsbCBhdmFpbGFibGUgcHJvcGVydGllcyBmb3IgSVBFIGRlc2NyaWJlZCBpbiB0aGUgZG9j dW1lbnRhdGlvbiBwYXRjaCBvZgp0aGlzIHNlcmllcy4KClJ1bGVzIGFyZSBldmFsdWF0ZWQgdG9w LXRvLWJvdHRvbS4gQXMgYSByZXN1bHQsIGFueSByZXZvY2F0aW9uIHJ1bGVzLApvciBkZW5pZXMg c2hvdWxkIGJlIHBsYWNlZCBlYXJseSBpbiB0aGUgZmlsZSB0byBlbnN1cmUgdGhhdCB0aGVzZSBy dWxlcwphcmUgZXZhbHVhdGVkIGJlZm9yZSBhIHJ1bGUgd2l0aCAiYWN0aW9uPUFMTE9XIiBpcyBo aXQuCgpBbnkgdW5rbm93biBzeW50YXggaW4gSVBFIHBvbGljeSB3aWxsIHJlc3VsdCBpbiBhIGZh dGFsIGVycm9yIHRvIHBhcnNlCnRoZSBwb2xpY3kuIAoKQWRkaXRpb25hbGx5LCBhIERFRkFVTFQg b3BlcmF0aW9uIG11c3QgYmUgc2V0IGZvciBhbGwgdW5kZXJzdG9vZApvcGVyYXRpb25zIHdpdGhp biBJUEUuIEZvciBwb2xpY2llcyB0byByZW1haW4gY29tcGxldGVseSBmb3J3YXJkcwpjb21wYXRp YmxlLCBpdCBpcyByZWNvbW1lbmRlZCB0aGF0IHVzZXJzIGFkZCBhICJERUZBVUxUIGFjdGlvbj1B TExPVyIKYW5kIG92ZXJyaWRlIHRoZSBkZWZhdWx0cyBvbiBhIHBlci1vcGVyYXRpb24gYmFzaXMu CgpGb3IgbW9yZSBpbmZvcm1hdGlvbiBhYm91dCB0aGUgcG9saWN5IHN5bnRheCwgc2VlIHRoZSBr ZXJuZWwKZG9jdW1lbnRhdGlvbiBwYWdlLgoKRWFybHkgVXNlcm1vZGUgUHJvdGVjdGlvbjoKLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0KCklQRSBjYW4gYmUgcHJvdmlkZWQgd2l0aCBhIHBvbGlj eSBhdCBzdGFydHVwIHRvIGxvYWQgYW5kIGVuZm9yY2UuClRoaXMgaXMgaW50ZW5kZWQgdG8gYmUg YSBtaW5pbWFsIHBvbGljeSB0byBnZXQgdGhlIHN5c3RlbSB0byBhIHN0YXRlCndoZXJlIHVzZXJz cGFjZSBpcyBzZXR1cCBhbmQgcmVhZHkgdG8gcmVjZWl2ZSBjb21tYW5kcywgYXQgd2hpY2gKcG9p bnQgYSBwb2xpY3kgY2FuIGJlIGRlcGxveWVkIHZpYSBzZWN1cml0eWZzLiBUaGlzICJib290IHBv bGljeSIgY2FuIGJlCnNwZWNpZmllZCB2aWEgdGhlIGNvbmZpZywgU0VDVVJJVFlfSVBFX0JPT1Rf UE9MSUNZLCB3aGljaCBhY2NlcHRzIGEgcGF0aAp0byBhIHBsYWluLXRleHQgdmVyc2lvbiBvZiB0 aGUgSVBFIHBvbGljeSB0byBhcHBseS4gVGhpcyBwb2xpY3kgd2lsbCBiZQpjb21waWxlZCBpbnRv IHRoZSBrZXJuZWwuIElmIG5vdCBzcGVjaWZpZWQsIElQRSB3aWxsIGJlIGRpc2FibGVkIHVudGls IGEKcG9saWN5IGlzIGRlcGxveWVkIGFuZCBhY3RpdmF0ZWQgdGhyb3VnaCB0aGUgbWV0aG9kIGFi b3ZlLgoKUG9saWN5IEV4YW1wbGVzOgotLS0tLS0tLS0tLS0tLS0tCgpBbGxvdyBhbGw6CgogIHBv bGljeV9uYW1lPUFsbG93X0FsbCBwb2xpY3lfdmVyc2lvbj0wLjAuMAogIERFRkFVTFQgYWN0aW9u PUFMTE9XCgpBbGxvdyBvbmx5IGluaXRpYWwgc3VwZXJibG9jazoKCiAgcG9saWN5X25hbWU9QWxs b3dfQWxsX0luaXRpYWxfU0IgcG9saWN5X3ZlcnNpb249MC4wLjAKICBERUZBVUxUIGFjdGlvbj1E RU5ZCgogIG9wPUVYRUNVVEUgYm9vdF92ZXJpZmllZD1UUlVFIGFjdGlvbj1BTExPVwoKQWxsb3cg YW55IHNpZ25lZCBkbS12ZXJpdHkgdm9sdW1lIGFuZCB0aGUgaW5pdGlhbCBzdXBlcmJsb2NrOgoK ICBwb2xpY3lfbmFtZT1BbGxvd1NpZ25lZEFuZEluaXRpYWwgcG9saWN5X3ZlcnNpb249MC4wLjAK ICBERUZBVUxUIGFjdGlvbj1ERU5ZCgogIG9wPUVYRUNVVEUgYm9vdF92ZXJpZmllZD1UUlVFIGFj dGlvbj1BTExPVwogIG9wPUVYRUNVVEUgZG12ZXJpdHlfc2lnbmF0dXJlPVRSVUUgYWN0aW9uPUFM TE9XCgpQcm9oaWJpdCBleGVjdXRpb24gZnJvbSBhIHNwZWNpZmljIGRtLXZlcml0eSB2b2x1bWUs IHdoaWxlIGFsbG93aW5nCmFsbCBzaWduZWQgdm9sdW1lcyBhbmQgdGhlIGluaXRpYWwgc3VwZXJi bG9jazoKCiAgcG9saWN5X25hbWU9UHJvaGliaXRTaW5nbGVWb2x1bWUgcG9saWN5X3ZlcnNpb249 MC4wLjAKICBERUZBVUxUIGFjdGlvbj1ERU5ZCgogIG9wPUVYRUNVVEUgZG12ZXJpdHlfcm9vdGhh c2g9c2hhMjU2OjQwMWZjZWM1OTQ0ODIzYWUxMmY2MjcyNmU4MTg0NDA3YTVmYTk1OTk3ODNmMDMw ZGVjMTQ2OTM4IGFjdGlvbj1ERU5ZCiAgb3A9RVhFQ1VURSBib290X3ZlcmlmaWVkPVRSVUUgYWN0 aW9uPUFMTE9XCiAgb3A9RVhFQ1VURSBkbXZlcml0eV9zaWduYXR1cmU9VFJVRSBhY3Rpb249QUxM T1cKCkFsbG93IG9ubHkgYSBzcGVjaWZpYyBkbS12ZXJpdHkgdm9sdW1lOgoKICBwb2xpY3lfbmFt ZT1BbGxvd1NwZWNpZmljIHBvbGljeV92ZXJzaW9uPTAuMC4wCiAgREVGQVVMVCBhY3Rpb249REVO WQoKICBvcD1FWEVDVVRFIGRtdmVyaXR5X3Jvb3RoYXNoPXNoYTI1Njo0MDFmY2VjNTk0NDgyM2Fl MTJmNjI3MjZlODE4NDQwN2E1ZmE5NTk5NzgzZjAzMGRlYzE0NjkzOCBhY3Rpb249QUxMT1cKCkFs bG93IGFueSBzaWduZWQgZnMtdmVyaXR5IGZpbGUKCiAgcG9saWN5X25hbWU9IkFsbG93U2lnbmVk RlNWZXJpdHkiIHBvbGljeV92ZXJzaW9uPTAuMC4wCiAgREVGQVVMVCBhY3Rpb249REVOWQoKICBv cD1FWEVDVVRFIGZzdmVyaXR5X3NpZ25hdHVyZT1UUlVFIGFjdGlvbj1BTExPVwoKRGVueSBhIHNw ZWNpZmljIGZzLXZlcml0eSBmaWxlOgoKICBwb2xpY3lfbmFtZT0iUHJvaGliaXRTcGVjaWZpY0ZT VkYiIHBvbGljeV92ZXJzaW9uPTAuMC4wCiAgREVGQVVMVCBhY3Rpb249REVOWQoKICBvcD1FWEVD VVRFIGZzdmVyaXR5X2RpZ2VzdD1zaGEyNTY6ZmQ4OGYyYjg4MjRlMTk3Zjg1MGJmNGM1MTA5YmVh NWNmMGVlMzgxMDRmNzEwODQzYmI3MmRhNzk2YmE1YWY5ZSBhY3Rpb249REVOWQogIG9wPUVYRUNV VEUgYm9vdF92ZXJpZmllZD1UUlVFIGFjdGlvbj1BTExPVwogIG9wPUVYRUNVVEUgZG12ZXJpdHlf c2lnbmF0dXJlPVRSVUUgYWN0aW9uPUFMTE9XCgpEZXBsb3lpbmcgUG9saWNpZXM6Ci0tLS0tLS0t LS0tLS0tLS0tLS0KCkZpcnN0IHNpZ24gYSBwbGFpbiB0ZXh0IHBvbGljeSwgd2l0aCBhIGNlcnRp ZmljYXRlIHRoYXQgaXMgcHJlc2VudCBpbgp0aGUgU1lTVEVNX1RSVVNURURfS0VZUklORyBvZiB5 b3VyIHRlc3QgbWFjaGluZS4gVGhyb3VnaCBvcGVuc3NsLCB0aGUKc2lnbmluZyBjYW4gYmUgZG9u ZSB2aWE6CgogIG9wZW5zc2wgc21pbWUgLXNpZ24gLWluICIkTVlfUE9MSUNZIiAtc2lnbmVyICIk TVlfQ0VSVElGSUNBVEUiIFwKICAgIC1pbmtleSAiJE1ZX1BSSVZBVEVfS0VZIiAtb3V0Zm9ybSBk ZXIgLW5vYXR0ciAtbm9kZXRhY2ggXAogICAgLW91dCAiJE1ZX1BPTElDWS5wN3MiCgpUaGVuLCBz aW1wbHkgY2F0IHRoZSBmaWxlIGludG8gdGhlIElQRSdzICJuZXdfcG9saWN5IiBzZWN1cml0eWZz IG5vZGU6CgogIGNhdCAiJE1ZX1BPTElDWS5wN3MiID4gL3N5cy9rZXJuZWwvc2VjdXJpdHkvaXBl L25ld19wb2xpY3kKClRoZSBwb2xpY3kgc2hvdWxkIG5vdyBiZSBwcmVzZW50IHVuZGVyIHRoZSBw b2xpY2llcy8gc3ViZGlyZWN0b3J5LCB1bmRlcgppdHMgInBvbGljeV9uYW1lIiBhdHRyaWJ1dGUu CgpUaGUgcG9saWN5IGlzIG5vdyBwcmVzZW50IGluIHRoZSBrZXJuZWwgYW5kIGNhbiBiZSBtYXJr ZWQgYXMgYWN0aXZlLAp2aWEgdGhlIHNlY3VyaXR5ZnMgbm9kZToKCiAgZWNobyAxID4gIi9zeXMv a2VybmVsL3NlY3VyaXR5L2lwZS8kTVlfUE9MSUNZX05BTUUvYWN0aXZlIgoKVGhpcyB3aWxsIG5v dyBtYXJrIHRoZSBwb2xpY3kgYXMgYWN0aXZlIGFuZCB0aGUgc3lzdGVtIHdpbGwgYmUgZW5mb3Jj aW5nCiRNWV9QT0xJQ1lfTkFNRS4KClRoZXJlIGlzIG9uZSByZXF1aXJlbWVudCB3aGVuIG1hcmtp bmcgYSBwb2xpY3kgYXMgYWN0aXZlLCB0aGUgcG9saWN5X3ZlcnNpb24KYXR0cmlidXRlIG11c3Qg ZWl0aGVyIGluY3JlYXNlLCBvciByZW1haW4gdGhlIHNhbWUgYXMgdGhlIGN1cnJlbnRseSBydW5u aW5nCnBvbGljeS4KClBvbGljaWVzIGNhbiBiZSB1cGRhdGVkIHZpYToKCiAgY2F0ICIkTVlfVVBE QVRFRF9QT0xJQ1kucDdzIiA+IFwKICAgICIvc3lzL2tlcm5lbC9zZWN1cml0eS9pcGUvcG9saWNp ZXMvJE1ZX1BPTElDWV9OQU1FL3VwZGF0ZSIKCkFkZGl0aW9uYWxseSwgcG9saWNpZXMgY2FuIGJl IGRlbGV0ZWQgdmlhIHRoZSAiZGVsZXRlIiBzZWN1cml0eWZzCm5vZGUuIFNpbXBseSB3cml0ZSAi MSIgdG8gdGhlIGNvcnJlc3BvbmRpbmcgbm9kZSBpbiB0aGUgcG9saWN5IGZvbGRlcjoKCiAgZWNo byAxID4gIi9zeXMva2VybmVsL3NlY3VyaXR5L2lwZS9wb2xpY2llcy8kTVlfUE9MSUNZX05BTUUv ZGVsZXRlIgoKVGhlcmUgaXMgb25seSBvbmUgcmVxdWlyZW1lbnQgdG8gZGVsZXRlIHBvbGljaWVz LCB0aGUgcG9saWN5IGJlaW5nCmRlbGV0ZWQgbXVzdCBub3QgYmUgdGhlIGFjdGl2ZSBwb2xpY3ku CgpOT1RFOiBBbnkgc2VjdXJpdHlmcyB3cml0ZSB0byBJUEUncyBub2RlcyB3aWxsIHJlcXVpcmUg Q0FQX01BQ19BRE1JTi4KCkludGVncmF0aW9uczoKLS0tLS0tLS0tLS0tLQoKVGhpcyBwYXRjaCBz ZXJpZXMgYWRkcyBzdXBwb3J0IGZvciBmc3Zlcml0eSB2aWEgZGlnZXN0IGFuZCBzaWduYXR1cmUK KGZzdmVyaXR5X3NpZ25hdHVyZSBhbmQgZnN2ZXJpdHlfZGlnZXN0KSwgZG0tdmVyaXR5IGJ5IGRp Z2VzdCBhbmQKc2lnbmF0dXJlIChkbXZlcml0eV9zaWduYXR1cmUgYW5kIGRtdmVyaXR5X3Jvb3Ro YXNoKSwgYW5kIHRydXN0IGZvcgp0aGUgaW5pdHJhbWZzIChib290X3ZlcmlmaWVkKS4KClBsZWFz ZSBzZWUgdGhlIGRvY3VtZW50YXRpb24gcGF0Y2ggZm9yIG1vcmUgaW5mb3JtYXRpb24gYWJvdXQg dGhlCmludGVncmF0aW9ucyBhdmFpbGFibGUuCgpUZXN0aW5nOgotLS0tLS0tLQoKS1VuaXQgVGVz dHMgYXJlIGF2YWlsYWJsZS4gUmVjb21tZW5kZWQga3VuaXRjb25maWc6CgogICAgQ09ORklHX0tV TklUPXkKICAgIENPTkZJR19TRUNVUklUWT15CiAgICBDT05GSUdfU0VDVVJJVFlGUz15CiAgICBD T05GSUdfUEtDUzdfTUVTU0FHRV9QQVJTRVI9eQogICAgQ09ORklHX1NZU1RFTV9EQVRBX1ZFUklG SUNBVElPTj15CiAgICBDT05GSUdfRlNfVkVSSVRZPXkKICAgIENPTkZJR19GU19WRVJJVFlfQlVJ TFRJTl9TSUdOQVRVUkVTPXkKICAgIENPTkZJR19CTE9DSz15CiAgICBDT05GSUdfTUQ9eQogICAg Q09ORklHX0JMS19ERVZfRE09eQogICAgQ09ORklHX0RNX1ZFUklUWT15CiAgICBDT05GSUdfRE1f VkVSSVRZX1ZFUklGWV9ST09USEFTSF9TSUc9eQogICAgQ09ORklHX05FVD15CiAgICBDT05GSUdf QVVESVQ9eQogICAgQ09ORklHX0FVRElUU1lTQ0FMTD15CgogICAgQ09ORklHX1NFQ1VSSVRZX0lQ RT15CiAgICBDT05GSUdfSVBFX1BST1BfRE1fVkVSSVRZPXkKICAgIENPTkZJR19JUEVfUFJPUF9G U19WRVJJVFk9eQogICAgQ09ORklHX1NFQ1VSSVRZX0lQRV9LVU5JVF9URVNUPXkKClNpbXBseSBy dW46CgogICAgbWFrZSBBUkNIPXVtIG1ycHJvcGVyCiAgICAuL3Rvb2xzL3Rlc3Rpbmcva3VuaXQv a3VuaXQucHkgcnVuIC0ta3VuaXRjb25maWcgPHBhdGgvdG8vY29uZmlnPgoKQW5kIHRoZSB0ZXN0 cyB3aWxsIGV4ZWN1dGUgYW5kIHJlcG9ydCB0aGUgcmVzdWx0LiBGb3IgbW9yZSBpbmRlcHRoIHRl c3RpbmcsCml0IHdpbGwgcmVxdWlyZSB5b3UgdG8gY3JlYXRlIGFuZCBtb3VudCBhIGRtLXZlcml0 eSB2b2x1bWUgb3IgZnMtdmVyaXR5CmVuYWJsZWQgZmlsZS4KCkRvY3VtZW50YXRpb246Ci0tLS0t LS0tLS0tLS0tCgpUaGVyZSBpcyBib3RoIGRvY3VtZW50YXRpb24gYXZhaWxhYmxlIG9uIGdpdGh1 YiBhdApodHRwczovL21pY3Jvc29mdC5naXRodWIuaW8vaXBlLCBhbmQgRG9jdW1lbnRhdGlvbiBp biB0aGlzIHBhdGNoIHNlcmllcywKdG8gYmUgYWRkZWQgaW4tdHJlZS4KCktub3duIEdhcHM6Ci0t LS0tLS0tLS0tCgpJUEUgaGFzIHR3byBrbm93biBnYXBzOgoKMS4gSVBFIGNhbm5vdCB2ZXJpZnkg dGhlIGludGVncml0eSBvZiBhbm9ueW1vdXMgZXhlY3V0YWJsZSBtZW1vcnksIHN1Y2ggYXMKICB0 aGUgdHJhbXBvbGluZXMgY3JlYXRlZCBieSBnY2MgY2xvc3VyZXMgYW5kIGxpYmZmaSAoPDMuNC4y KSwgb3IgSklUJ2QgY29kZS4KICBVbmZvcnR1bmF0ZWx5LCBhcyB0aGlzIGlzIGR5bmFtaWNhbGx5 IGdlbmVyYXRlZCBjb2RlLCB0aGVyZSBpcyBubyB3YXkKICBmb3IgSVBFIHRvIGVuc3VyZSB0aGUg aW50ZWdyaXR5IG9mIHRoaXMgY29kZSB0byBmb3JtIGEgdHJ1c3QgYmFzaXMuIEluIGFsbAogIGNh c2VzLCB0aGUgcmV0dXJuIHJlc3VsdCBmb3IgdGhlc2Ugb3BlcmF0aW9ucyB3aWxsIGJlIHdoYXRl dmVyIHRoZSBhZG1pbgogIGNvbmZpZ3VyZXMgdGhlIERFRkFVTFQgYWN0aW9uIGZvciAiRVhFQ1VU RSIuCgoyLiBJUEUgY2Fubm90IHZlcmlmeSB0aGUgaW50ZWdyaXR5IG9mIGludGVycHJldGVkIGxh bmd1YWdlcycgcHJvZ3JhbXMgd2hlbgogIHRoZXNlIHNjcmlwdHMgaW52b2tlZCB2aWEgYGA8aW50 ZXJwcmV0ZXI+IDxmaWxlPmBgLiBUaGlzIGlzIGJlY2F1c2UgdGhlCiAgd2F5IGludGVycHJldGVy cyBleGVjdXRlIHRoZXNlIGZpbGVzLCB0aGUgc2NyaXB0cyB0aGVtc2VsdmVzIGFyZSBub3QKICBl dmFsdWF0ZWQgYXMgZXhlY3V0YWJsZSBjb2RlIHRocm91Z2ggb25lIG9mIElQRSdzIGhvb2tzLiBJ bnRlcnByZXRlcnMKICBjYW4gYmUgZW5saWdodGVuZWQgdG8gdGhlIHVzYWdlIG9mIElQRSBieSB0 cnlpbmcgdG8gbW1hcCBhIGZpbGUgaW50bwogIGV4ZWN1dGFibGUgbWVtb3J5ICgrWCksIGFmdGVy IG9wZW5pbmcgdGhlIGZpbGUgYW5kIHJlc3BvbmRpbmcgdG8gdGhlCiAgZXJyb3IgY29kZSBhcHBy b3ByaWF0ZWx5LiBUaGlzIGFsc28gYXBwbGllcyB0byBpbmNsdWRlZCBmaWxlcywgb3IgaGlnaAog IHZhbHVlIGZpbGVzLCBzdWNoIGFzIGNvbmZpZ3VyYXRpb24gZmlsZXMgb2YgY3JpdGljYWwgc3lz dGVtIGNvbXBvbmVudHMuCgpBcHBlbmRpeDoKLS0tLS0tLS0tCgpBLiBJUEUgR2l0aHViIFJlcG9z aXRvcnk6IGh0dHBzOi8vZ2l0aHViLmNvbS9taWNyb3NvZnQvaXBlCkIuIElQRSBVc2VycycgR3Vp ZGU6IERvY3VtZW50YXRpb24vYWRtaW4tZ3VpZGUvTFNNL2lwZS5yc3QKClJlZmVyZW5jZXM6Ci0t LS0tLS0tLS0tCgoxOiBodHRwczovL2xvcmUua2VybmVsLm9yZy9icGYvNGQ2OTMyZTk2ZDc3NDIy N2I0MjcyMWQ5ZjY0NWJhNTFAaHVhd2VpLmNvbS9ULwoKRkFROgotLS0tCgpROiBXaGF0IGlzIHRo ZSBkaWZmZXJlbmNlIGJldHdlZW4gSU1BIGFuZCBJUEU/CgpBOiBTZWUgdGhlIGRvY3VtZW50YXRp b24gcGF0Y2ggZm9yIG1vcmUgb24gdGhpcyB0b3BpYy4KClByZXZpb3VzIFBvc3RpbmdzCi0tLS0t LS0tLS0tLS0tLS0tCgp2MTogaHR0cHM6Ly9sb3JlLmtlcm5lbC5vcmcvYWxsLzIwMjAwNDA2MTgx MDQ1LjEwMjQxNjQtMS1kZXZlbi5kZXNhaUBsaW51eC5taWNyb3NvZnQuY29tLwp2MjogaHR0cHM6 Ly9sb3JlLmtlcm5lbC5vcmcvYWxsLzIwMjAwNDA2MjIxNDM5LjE0Njk4NjItMS1kZXZlbi5kZXNh aUBsaW51eC5taWNyb3NvZnQuY29tLwp2MzogaHR0cHM6Ly9sb3JlLmtlcm5lbC5vcmcvYWxsLzIw MjAwNDE1MTYyNTUwLjIzMjQtMS1kZXZlbi5kZXNhaUBsaW51eC5taWNyb3NvZnQuY29tLwp2NDog aHR0cHM6Ly9sb3JlLmtlcm5lbC5vcmcvYWxsLzIwMjAwNzE3MjMwOTQxLjExOTA3NDQtMS1kZXZl bi5kZXNhaUBsaW51eC5taWNyb3NvZnQuY29tLwp2NTogaHR0cHM6Ly9sb3JlLmtlcm5lbC5vcmcv YWxsLzIwMjAwNzI4MjEzNjE0LjU4NjMxMi0xLWRldmVuLmRlc2FpQGxpbnV4Lm1pY3Jvc29mdC5j b20vCnY2OiBodHRwczovL2xvcmUua2VybmVsLm9yZy9hbGwvMjAyMDA3MzAwMDMxMTMuMjU2MTY0 NC0xLWRldmVuLmRlc2FpQGxpbnV4Lm1pY3Jvc29mdC5jb20vCnY3OiBodHRwczovL2xvcmUua2Vy bmVsLm9yZy9hbGwvMTYzNDE1MTk5NS0xNjI2Ni0xLWdpdC1zZW5kLWVtYWlsLWRldmVuLmRlc2Fp QGxpbnV4Lm1pY3Jvc29mdC5jb20vCnY4OiBodHRwczovL2xvcmUua2VybmVsLm9yZy9hbGwvMTY1 NDcxNDg4OS0yNjcyOC0xLWdpdC1zZW5kLWVtYWlsLWRldmVuLmRlc2FpQGxpbnV4Lm1pY3Jvc29m dC5jb20vCgpDaGFuZ2Vsb2c6Ci0tLS0tLS0tLS0KCnYyOgogIFNwbGl0IHRoZSBzZWNvbmQgcGF0 Y2ggb2YgdGhlIHByZXZpb3VzIHNlcmllcyBpbnRvIHR3by4KICBNaW5vciBjb3JyZWN0aW9ucyBp biB0aGUgY292ZXItbGV0dGVyIGFuZCBkb2N1bWVudGF0aW9uCiAgY29tbWVudHMgcmVnYXJkaW5n IENBUF9NQUNfQURNSU4gY2hlY2tzIGluIElQRS4KCnYzOgogIEFkZHJlc3MgdmFyaW91cyBjb21t ZW50cyBieSBKYW5uIEhvcm4uIEhpZ2hsaWdodHM6CiAgICBTd2l0Y2ggdmFyaW91cyBhdWRpdCBh bGxvY2F0b3JzIHRvIEdGUF9LRVJORUwuCiAgICBVdGlsaXplIHJjdV9hY2Nlc3NfcG9pbnRlcigp IGluIHZhcmlvdXMgbG9jYXRpb25zLgogICAgU3RyaXAgb3V0IHRoZSBjYWNoaW5nIHN5c3RlbSBm b3IgcHJvcGVydGllcwogICAgU3RyaXAgY29tbWVudHMgZnJvbSBoZWFkZXJzCiAgICBNb3ZlIGZ1 bmN0aW9ucyBhcm91bmQgaW4gcGF0Y2hlcwogICAgUmVtb3ZlIGtlcm5lbCBjb21tYW5kIGxpbmUg cGFyYW1ldGVycwogICAgUmVjb25jaWxlIHRoZSByYWNlIGNvbmRpdGlvbiBvbiB0aGUgZGVsZXRl IG5vZGUgZm9yIHBvbGljeSBieQogICAgICBleHBhbmRpbmcgdGhlIHBvbGljeSBjcml0aWNhbCBz ZWN0aW9uLgoKICBBZGRyZXNzIGEgZmV3IGNvbW1lbnRzIGJ5IEpvbmF0aGFuIENvcmJldCBhcm91 bmQgdGhlIGRvY3VtZW50YXRpb24KICAgIHBhZ2VzIGZvciBJUEUuCgogIEZpeCBhbiBpc3N1ZSB3 aXRoIHRoZSBpbml0aWFsaXphdGlvbiBvZiBJUEUgcG9saWN5IHdpdGggYSAiLTAiCiAgICB2ZXJz aW9uLCBjYXVzZWQgYnkgbm90IGluaXRpYWxpemluZyB0aGUgaGxpc3QgZW50cmllcyBiZWZvcmUK ICAgIGZyZWVpbmcuCgp2NDoKICBBZGRyZXNzIGEgY29uY2VybiBhcm91bmQgSVBFJ3MgYmVoYXZp b3Igd2l0aCB1bmtub3duIHN5bnRheC4KICAgIFNwZWNpZmljYWxseSwgbWFrZSBhbnkgdW5rbm93 biBzeW50YXggYSBmYXRhbCBlcnJvciBpbnN0ZWFkIG9mIGEKICAgIHdhcm5pbmcsIGFzIHN1Z2dl c3RlZCBieSBNaWNrYcOrbCBTYWxhw7xuLgogIEludHJvZHVjZSBhIG5ldyBzZWN1cml0eWZzIG5v ZGUsICRzZWN1cml0eWZzL2lwZS9wcm9wZXJ0eV9jb25maWcsCiAgICB3aGljaCBwcm92aWRlcyBh IGxpc3Rpbmcgb2Ygd2hhdCBwcm9wZXJ0aWVzIGFyZSBlbmFibGVkIGJ5IHRoZQogICAga2VybmVs IGFuZCB0aGVpciB2ZXJzaW9ucy4gVGhpcyBhbGxvd3MgdXNlcm1vZGUgdG8gcHJlZGljdCB3aGF0 CiAgICBwb2xpY2llcyBzaG91bGQgYmUgYWxsb3dlZC4KICBTdHJpcCBzb21lIGNvbW1lbnRzIGZy b20gYyBmaWxlcyB0aGF0IEkgbWlzc2VkLgogIENsYXJpZnkgc29tZSBkb2N1bWVudGF0aW9uIGNv bW1lbnRzIGFyb3VuZCAnYm9vdF92ZXJpZmllZCcuCiAgICBXaGlsZSB0aGlzIGN1cnJlbnRseSBk b2VzIG5vdCBmdW5jdGlvbmFsbHkgY2hhbmdlIHRoZSBwcm9wZXJ0eQogICAgaXRzZWxmLCB0aGUg ZGlzdGluY3Rpb24gaXMgaW1wb3J0YW50IHdoZW4gSVBFIGNhbiBlbmZvcmNlIHZlcmlmaWVkCiAg ICByZWFkcy4gQWRkaXRpb25hbGx5LCAnS0VSTkVMX1JFQUQnIHdhcyBvbWl0dGVkIGZyb20gdGhl IGRvY3VtZW50YXRpb24uCiAgICBUaGlzIGhhcyBiZWVuIGNvcnJlY3RlZC4KICBDaGFuZ2UgU2Vj dXJpdHlGUyBhbmQgU0hBMSB0byBhIHJldmVyc2UgZGVwZW5kZW5jeS4KICBVcGRhdGUgdGhlIGNv dmVyLWxldHRlciB3aXRoIHRoZSB1cGRhdGVkIGJlaGF2aW9yIG9mIHVua25vd24gc3ludGF4Lgog IFJlbW92ZSBhbGwgc3lzY3RscywgbWFraW5nIGFuIGVxdWl2YWxlbnQgZnVuY3Rpb24gaW4gc2Vj dXJpdHlmcy4KICBSZXdvcmsgdGhlIGFjdGl2ZS9kZWxldGUgbWVjaGFuaXNtIHRvIGJlIGEgbm9k ZSB1bmRlciB0aGUgcG9saWN5IGluCiAgICAkc2VjdXJpdHlmcy9pcGUvcG9saWNpZXMuCiAgVGhl IGtlcm5lbCBjb21tYW5kIGxpbmUgcGFyYW1ldGVycyBpcGUuZW5mb3JjZSBhbmQgaXBlLnN1Y2Nl c3NfYXVkaXQKICAgIGhhdmUgcmV0dXJuZWQgYXMgdGhpcyBmdW5jdGlvbmFsaXR5IGlzIG5vIGxv bmdlciBleHBvc2VkIHRocm91Z2gKICAgIHN5c2ZzLgoKdjU6CiAgQ29ycmVjdCBzb21lIGdyYW1t YXRpY2FsIGVycm9ycyByZXBvcnRlZCBieSBSYW5keSBEdW5sYXAuCiAgRml4IHNvbWUgd2Fybmlu Z3MgcmVwb3J0ZWQgYnkga2VybmVsIHRlc3QgYm90LgogIENoYW5nZSBjb252ZW50aW9uIGFyb3Vu ZCBzZWN1cml0eV9iZGV2X3NldHNlY3VyaXR5LiAtRU5PU1lTCiAgICBpcyBub3cgZXhwZWN0ZWQg aWYgYW4gTFNNIGRvZXMgbm90IGltcGxlbWVudCBhIHBhcnRpY3VsYXIgQG5hbWUsCiAgICBhcyBz dWdnZXN0ZWQgYnkgQ2FzZXkgU2NoYXVmbGVyLgogIE1pbm9yIHN0cmluZyBjb3JyZWN0aW9ucyBy ZWxhdGVkIHRvIHRoZSBtb3ZlIGZyb20gc3lzZnMgdG8gc2VjdXJpdHlmcwogIENvcnJlY3QgYSBz cGVsbGluZyBvZiBhbiAjaWZkZWYgZm9yIHRoZSBwZXJtaXNzaXZlIGFyZ3VtZW50LgogIEFkZCB0 aGUga2VybmVsIHBhcmFtZXRlcnMgcmUtYWRkZWQgdG8gdGhlIGRvY3VtZW50YXRpb24uCiAgRml4 IGEgbWlub3IgYnVnIHdoZXJlIHRoZSBtb2RlIGJlaW5nIGF1ZGl0ZWQgb24gcGVybWlzc2l2ZSBz d2l0Y2gKICAgIHdhcyB0aGUgb3JpZ2luYWwgbW9kZSwgbm90IHRoZSBtb2RlIGJlaW5nIHN3YXBw ZWQgdG8uCiAgQ2xlYW51cCBkb2MgY29tbWVudHMsIGZpeCBzb21lIHdoaXRlc3BhY2UgYWxpZ25t ZW50IGlzc3Vlcy4KCnY2OgogIENoYW5nZSBpZiBzdGF0ZW1lbnQgY29uZGl0aW9uIGluIHNlY3Vy aXR5X2JkZXZfc2V0c2VjdXJpdHkgdG8gYmUKICAgIG1vcmUgY29uY2lzZSwgYXMgc3VnZ2VzdGVk IGJ5IENhc2V5IFNjaGF1ZmxlciBhbmQgQWwgVmlybwogIERyb3AgdGhlIDZ0aCBwYXRjaCBpbiB0 aGUgc2VyaWVzLCAiZG0tdmVyaXR5IG1vdmUgc2lnbmF0dXJlIGNoZWNrLi4uIgogICAgZHVlIHRv IG51bWVyb3VzIGlzc3VlcywgYW5kIGl0IHVsdGltYXRlbHkgcHJvdmlkaW5nIG5vIHJlYWwgdmFs dWUuCiAgRml4IHRoZSBwYXRjaCB0cmVlIC0gdGhlIHByZXZpb3VzIGl0ZXJhdGlvbiBhcHBlYXJz IHRvIGhhdmUgYmVlbiBpbiBhCiAgICB0b3JuIHN0YXRlIChwYXRjaGVzIDgrOSB3ZXJlIG1lcmdl ZCkuIFRoaXMgaGFzIHNpbmNlIGJlZW4gY29ycmVjdGVkLgoKdjc6CiAgKiBSZXdvcmQgY292ZXIg bGV0dGVyIHRvIG1vcmUgYWNjdXJhdGUgY29udmV5IElQRSdzIHB1cnBvc2UKICAgIGFuZCBsYXRl c3QgdXBkYXRlcy4KICAqIFJlZmFjdG9yIHNlcmllcyB0bzoKICAgICAgMS4gU3VwcG9ydCBhIGNv bnRleHQgc3RydWN0dXJlLCBlbmFibGluZzoKICAgICAgICAgIDEuIEVhc2llciBUZXN0aW5nIHZp YSBLVU5JVAogICAgICAgICAgMi4gQSBiZXR0ZXIgYXJjaGl0ZWN0dXJlIGZvciBmdXR1cmUgZGVz aWducwogICAgICAyLiBNYWtlIHBhcnNlciBjb2RlIGNsZWFuZXIKICAqIE1vdmUgcGF0Y2ggMDEv MTIgdG8gWzE0LzE2XSBvZiB0aGUgc2VyaWVzCiAgKiBTcGxpdCB1cCBwYXRjaCAwMi8xMiBpbnRv IGZvdXIgcGFydHM6CiAgICAgIDEuIGNvbnRleHQgY3JlYXRpb24gWzAxLzE2XQogICAgICAyLiBh dWRpdCBbMDcvMTZdCiAgICAgIDMuIGV2YWx1YXRpb24gbG9vcCBbMDMvMTZdCiAgICAgIDQuIGFj Y2VzcyBjb250cm9sIGhvb2tzIFswNS8xNl0KICAgICAgNS4gcGVybWlzc2l2ZSBtb2RlIFswOC8x Nl0KICAqIFNwbGl0IHVwIHBhdGNoIDAzLzEyIGludG8gdHdvIHBhcnRzOgogICAgICAxLiBwYXJz ZXIgWzAyLzE2XQogICAgICAyLiB1c2Vyc3BhY2UgaW50ZXJmYWNlIFswNC8xNl0KICAqIFJld29y ZCBhbmQgcmVmYWN0b3IgcGF0Y2ggMDQvMTIgdG8gWzA5LzE2XQogICogU3F1YXNoIHBhdGNoIDA1 LzEyLCAwNy8xMiwgMDkvMTIgdG8gWzEwLzE2XQogICogU3F1YXNoIHBhdGNoIDA4LzEyLCAxMC8x MiB0byBbMTEvMTZdCiAgKiBDaGFuZ2UgYXVkaXQgcmVjb3JkcyB0byBNQUMgcmVnaW9uICgxNFhY KSBmcm9tIEludGVncml0eSByZWdpb24gKDE4WFgpCiAgKiBBZGQgRlNWZXJpdHkgU3VwcG9ydAog ICogSW50ZXJmYWNlIGNoYW5nZXM6CiAgICAgIDEuICJyYXciIHdhcyByZW5hbWVkIHRvICJwa2Nz NyIgYW5kIG1hZGUgcmVhZCBvbmx5CiAgICAgIDIuICJyYXciJ3Mgd3JpdGUgZnVuY3Rpb25hbGl0 eSAodXBkYXRlIGEgcG9saWN5KSBtb3ZlZCB0byAidXBkYXRlIgogICAgICAzLiBpbnRyb2R1Y2Vk ICJ2ZXJzaW9uIiwgInBvbGljeV9uYW1lIiBub2Rlcy4KICAgICAgNC4gImNvbnRlbnQiIHJlbmFt ZWQgdG8gInBvbGljeSIKICAgICAgNS4gVGhlIGJvb3QgcG9saWN5IGNhbiBub3cgYmUgdXBkYXRl ZCBsaWtlIGFueSBvdGhlciBwb2xpY3kuCiAgKiBBZGQgYWRkaXRpb25hbCBkZXZlbG9wZXItbGV2 ZWwgZG9jdW1lbnRhdGlvbgogICogVXBkYXRlIGFkbWluLWd1aWRlIGRvY3MgdG8gcmVmbGVjdCBj aGFuZ2VzLgogICogS3VuaXQgdGVzdHMKICAqIERyb3BwZWQgQ09ORklHX1NFQ1VSSVRZX0lQRV9Q RVJNSVNTSVZFX1NXSVRDSCAtIGZ1bmN0aW9uYWxpdHkgY2FuCiAgICBlYXNpbHkgY29tZSBsYXRl ciB3aXRoIGEgc21hbGwgcGF0Y2guCiAgKiBVc2UgcGFydGl0aW9uMCBmb3IgYmxvY2tfZGV2aWNl IGZvciBkbS12ZXJpdHkgcGF0Y2gKCnY4OgogICogQWRkIGNoYW5nZWxvZyBpbmZvcm1hdGlvbiB0 byBpbmRpdmlkdWFsIGNvbW1pdHMKICAqIEEgbGFyZ2UgbnVtYmVyIG9mIGNoYW5nZXMgdG8gdGhl IGF1ZGl0IHBhdGNoLgogICogc3BsaXQgZnMvICYgc2VjdXJpdHkvIGNoYW5nZXMgdG8gdHdvIHNl cGFyYXRlIHBhdGNoZXMuCiAgKiBzcGxpdCBibG9jay8sIHNlY3VyaXR5LyAmIGRyaXZlcnMvbWQv IGNoYW5nZXMgdG8gc2VwYXJhdGUgcGF0Y2hlcy4KICAqIEFkZCBzb21lIGhpc3RvcmljYWwgY29u dGV4dCB0byB3aGF0IGxlYWQgdG8gdGhlIGNyZWF0aW9uIG9mIElQRQogICAgaW4gdGhlIGRvY3Vt ZW50YXRpb24gcGF0Y2guCiAgKiBDb3Zlci1sZXR0ZXIgY2hhbmdlcyBzdWdnZXN0ZWQgYnkgUm9i ZXJ0byBTYXNzdS4KCnY5OgogICogUmV3cml0ZSBJUEUgcGFyc2VyIHRvIHVzZSBrZXJuZWwgbWF0 Y2hfdGFibGUgcGFyc2VyLgogICogQWRhcHQgZXhpc3RpbmcgSVBFIHByb3BlcnRpZXMgdG8gdGhl IG5ldyBwYXJzZXIuCiAgKiBSZW1vdmUgaXBlX2NvbnRleHQsIHF1b3RlIHBvbGljeSBzeW50YXgs IGtlcm5lbF9yZWFkIGZvciBzaW1wbGljaXR5LgogICogQWRkIG5ldyBmdW5jdGlvbiBpbiB0aGUg c2VjdXJpdHkgZmlsZSBzeXN0ZW0gdG8gZGVsZXRlIElQRSBwb2xpY3kuCiAgKiBNYWtlIElQRSBh dWRpdCBidWlsdGluIGFuZCBjaGFuZ2Ugc2V2ZXJhbCBhdWRpdCBmb3JtYXRzLgogICogTWFrZSBi b290X3ZlcmlmaWVkIHByb3BlcnR5IGJ1aWx0aW4KCkRldmVuIEJvd2VycyAoMTMpOgogIHNlY3Vy aXR5OiBhZGQgaXBlIGxzbQogIGlwZTogYWRkIHBvbGljeSBwYXJzZXIKICBpcGU6IGFkZCBldmFs dWF0aW9uIGxvb3AgYW5kIGludHJvZHVjZSAnYm9vdF92ZXJpZmllZCcgYXMgYSB0cnVzdAogICAg cHJvdmlkZXIKICBpcGU6IGFkZCB1c2Vyc3BhY2UgaW50ZXJmYWNlCiAgaXBlOiBhZGQgTFNNIGhv b2tzIG9uIGV4ZWN1dGlvbiBhbmQga2VybmVsIHJlYWQKICB1YXBpfGF1ZGl0fGlwZTogYWRkIGlw ZSBhdWRpdGluZyBzdXBwb3J0CiAgaXBlOiBhZGQgcGVybWlzc2l2ZSB0b2dnbGUKICBibG9ja3xz ZWN1cml0eTogYWRkIExTTSBibG9iIHRvIGJsb2NrX2RldmljZQogIGRtLXZlcml0eTogY29uc3Vt ZSByb290IGhhc2ggZGlnZXN0IGFuZCBzaWduYXR1cmUgZGF0YSB2aWEgTFNNIGhvb2sKICBpcGU6 IGFkZCBzdXBwb3J0IGZvciBkbS12ZXJpdHkgYXMgYSB0cnVzdCBwcm92aWRlcgogIHNjcmlwdHM6 IGFkZCBib290IHBvbGljeSBnZW5lcmF0aW9uIHByb2dyYW0KICBpcGU6IGt1bml0IHRlc3QgZm9y IHBhcnNlcgogIGRvY3VtZW50YXRpb246IGFkZCBpcGUgZG9jdW1lbnRhdGlvbgoKRmFuIFd1ICgz KToKICBzZWN1cml0eTogYWRkIG5ldyBzZWN1cml0eWZzIGRlbGV0ZSBmdW5jdGlvbgogIGZzdmVy aXR5OiBjb25zdW1lIGJ1aWx0aW4gc2lnbmF0dXJlIHZpYSBMU00gaG9vawogIGlwZTogZW5hYmxl IHN1cHBvcnQgZm9yIGZzLXZlcml0eSBhcyBhIHRydXN0IHByb3ZpZGVyCgogRG9jdW1lbnRhdGlv bi9hZG1pbi1ndWlkZS9MU00vaW5kZXgucnN0ICAgICAgIHwgICAxICsKIERvY3VtZW50YXRpb24v YWRtaW4tZ3VpZGUvTFNNL2lwZS5yc3QgICAgICAgICB8IDcyOSArKysrKysrKysrKysrKysrKysK IC4uLi9hZG1pbi1ndWlkZS9rZXJuZWwtcGFyYW1ldGVycy50eHQgICAgICAgICB8ICAxMiArCiBE b2N1bWVudGF0aW9uL3NlY3VyaXR5L2luZGV4LnJzdCAgICAgICAgICAgICAgfCAgIDEgKwogRG9j dW1lbnRhdGlvbi9zZWN1cml0eS9pcGUucnN0ICAgICAgICAgICAgICAgIHwgNDM2ICsrKysrKysr KysrCiBNQUlOVEFJTkVSUyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfCAgIDgg KwogYmxvY2svYmRldi5jICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHwgICA3ICsK IGRyaXZlcnMvbWQvZG0tdmVyaXR5LXRhcmdldC5jICAgICAgICAgICAgICAgICB8ICAyNSArLQog ZHJpdmVycy9tZC9kbS12ZXJpdHktdmVyaWZ5LXNpZy5jICAgICAgICAgICAgIHwgIDE2ICstCiBk cml2ZXJzL21kL2RtLXZlcml0eS12ZXJpZnktc2lnLmggICAgICAgICAgICAgfCAgMTAgKy0KIGZz L3Zlcml0eS9mc3Zlcml0eV9wcml2YXRlLmggICAgICAgICAgICAgICAgICB8ICAgMiArLQogZnMv dmVyaXR5L29wZW4uYyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHwgIDEzICstCiBmcy92 ZXJpdHkvc2lnbmF0dXJlLmMgICAgICAgICAgICAgICAgICAgICAgICAgfCAgIDEgKwogaW5jbHVk ZS9saW51eC9ibGtfdHlwZXMuaCAgICAgICAgICAgICAgICAgICAgIHwgICAzICsKIGluY2x1ZGUv bGludXgvZG0tdmVyaXR5LmggICAgICAgICAgICAgICAgICAgICB8ICAxOSArCiBpbmNsdWRlL2xp bnV4L2ZzdmVyaXR5LmggICAgICAgICAgICAgICAgICAgICAgfCAgIDIgKwogaW5jbHVkZS9saW51 eC9sc21faG9va19kZWZzLmggICAgICAgICAgICAgICAgIHwgICA1ICsKIGluY2x1ZGUvbGludXgv bHNtX2hvb2tzLmggICAgICAgICAgICAgICAgICAgICB8ICAxMiArCiBpbmNsdWRlL2xpbnV4L3Nl Y3VyaXR5LmggICAgICAgICAgICAgICAgICAgICAgfCAgMjMgKwogaW5jbHVkZS91YXBpL2xpbnV4 L2F1ZGl0LmggICAgICAgICAgICAgICAgICAgIHwgICAxICsKIHNjcmlwdHMvTWFrZWZpbGUgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICB8ICAgMSArCiBzY3JpcHRzL2lwZS9NYWtlZmlsZSAg ICAgICAgICAgICAgICAgICAgICAgICAgfCAgIDIgKwogc2NyaXB0cy9pcGUvcG9sZ2VuLy5naXRp Z25vcmUgICAgICAgICAgICAgICAgIHwgICAxICsKIHNjcmlwdHMvaXBlL3BvbGdlbi9NYWtlZmls ZSAgICAgICAgICAgICAgICAgICB8ICAgNiArCiBzY3JpcHRzL2lwZS9wb2xnZW4vcG9sZ2VuLmMg ICAgICAgICAgICAgICAgICAgfCAxNDUgKysrKwogc2VjdXJpdHkvS2NvbmZpZyAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIHwgIDExICstCiBzZWN1cml0eS9NYWtlZmlsZSAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgfCAgIDEgKwogc2VjdXJpdHkvaW5vZGUuYyAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIHwgIDI1ICsKIHNlY3VyaXR5L2lwZS8uZ2l0aWdub3JlICAgICAgICAg ICAgICAgICAgICAgICB8ICAgMSArCiBzZWN1cml0eS9pcGUvS2NvbmZpZyAgICAgICAgICAgICAg ICAgICAgICAgICAgfCAgNzUgKysKIHNlY3VyaXR5L2lwZS9NYWtlZmlsZSAgICAgICAgICAgICAg ICAgICAgICAgICB8ICAzMiArCiBzZWN1cml0eS9pcGUvYXVkaXQuYyAgICAgICAgICAgICAgICAg ICAgICAgICAgfCAyNzkgKysrKysrKwogc2VjdXJpdHkvaXBlL2F1ZGl0LmggICAgICAgICAgICAg ICAgICAgICAgICAgIHwgIDE5ICsKIHNlY3VyaXR5L2lwZS9kaWdlc3QuYyAgICAgICAgICAgICAg ICAgICAgICAgICB8IDE0NCArKysrCiBzZWN1cml0eS9pcGUvZGlnZXN0LmggICAgICAgICAgICAg ICAgICAgICAgICAgfCAgMjYgKwogc2VjdXJpdHkvaXBlL2V2YWwuYyAgICAgICAgICAgICAgICAg ICAgICAgICAgIHwgNDI0ICsrKysrKysrKysKIHNlY3VyaXR5L2lwZS9ldmFsLmggICAgICAgICAg ICAgICAgICAgICAgICAgICB8ICA2MCArKwogc2VjdXJpdHkvaXBlL2ZzLmMgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIHwgMjQyICsrKysrKwogc2VjdXJpdHkvaXBlL2ZzLmggICAgICAgICAg ICAgICAgICAgICAgICAgICAgIHwgIDE3ICsKIHNlY3VyaXR5L2lwZS9ob29rcy5jICAgICAgICAg ICAgICAgICAgICAgICAgICB8IDI3NSArKysrKysrCiBzZWN1cml0eS9pcGUvaG9va3MuaCAgICAg ICAgICAgICAgICAgICAgICAgICAgfCAgNDIgKwogc2VjdXJpdHkvaXBlL2lwZS5jICAgICAgICAg ICAgICAgICAgICAgICAgICAgIHwgIDk3ICsrKwogc2VjdXJpdHkvaXBlL2lwZS5oICAgICAgICAg ICAgICAgICAgICAgICAgICAgIHwgIDIyICsKIHNlY3VyaXR5L2lwZS9wb2xpY3kuYyAgICAgICAg ICAgICAgICAgICAgICAgICB8IDI1OSArKysrKysrCiBzZWN1cml0eS9pcGUvcG9saWN5LmggICAg ICAgICAgICAgICAgICAgICAgICAgfCAgOTMgKysrCiBzZWN1cml0eS9pcGUvcG9saWN5X2ZzLmMg ICAgICAgICAgICAgICAgICAgICAgfCA0NTkgKysrKysrKysrKysKIHNlY3VyaXR5L2lwZS9wb2xp Y3lfcGFyc2VyLmMgICAgICAgICAgICAgICAgICB8IDU0NSArKysrKysrKysrKysrCiBzZWN1cml0 eS9pcGUvcG9saWN5X3BhcnNlci5oICAgICAgICAgICAgICAgICAgfCAgMTEgKwogc2VjdXJpdHkv aXBlL3BvbGljeV90ZXN0cy5jICAgICAgICAgICAgICAgICAgIHwgMjk0ICsrKysrKysKIHNlY3Vy aXR5L3NlY3VyaXR5LmMgICAgICAgICAgICAgICAgICAgICAgICAgICB8ICA3MCArKwogNTAgZmls ZXMgY2hhbmdlZCwgNDk4OCBpbnNlcnRpb25zKCspLCAxNiBkZWxldGlvbnMoLSkKIGNyZWF0ZSBt b2RlIDEwMDY0NCBEb2N1bWVudGF0aW9uL2FkbWluLWd1aWRlL0xTTS9pcGUucnN0CiBjcmVhdGUg bW9kZSAxMDA2NDQgRG9jdW1lbnRhdGlvbi9zZWN1cml0eS9pcGUucnN0CiBjcmVhdGUgbW9kZSAx MDA2NDQgaW5jbHVkZS9saW51eC9kbS12ZXJpdHkuaAogY3JlYXRlIG1vZGUgMTAwNjQ0IHNjcmlw dHMvaXBlL01ha2VmaWxlCiBjcmVhdGUgbW9kZSAxMDA2NDQgc2NyaXB0cy9pcGUvcG9sZ2VuLy5n aXRpZ25vcmUKIGNyZWF0ZSBtb2RlIDEwMDY0NCBzY3JpcHRzL2lwZS9wb2xnZW4vTWFrZWZpbGUK IGNyZWF0ZSBtb2RlIDEwMDY0NCBzY3JpcHRzL2lwZS9wb2xnZW4vcG9sZ2VuLmMKIGNyZWF0ZSBt b2RlIDEwMDY0NCBzZWN1cml0eS9pcGUvLmdpdGlnbm9yZQogY3JlYXRlIG1vZGUgMTAwNjQ0IHNl Y3VyaXR5L2lwZS9LY29uZmlnCiBjcmVhdGUgbW9kZSAxMDA2NDQgc2VjdXJpdHkvaXBlL01ha2Vm aWxlCiBjcmVhdGUgbW9kZSAxMDA2NDQgc2VjdXJpdHkvaXBlL2F1ZGl0LmMKIGNyZWF0ZSBtb2Rl IDEwMDY0NCBzZWN1cml0eS9pcGUvYXVkaXQuaAogY3JlYXRlIG1vZGUgMTAwNjQ0IHNlY3VyaXR5 L2lwZS9kaWdlc3QuYwogY3JlYXRlIG1vZGUgMTAwNjQ0IHNlY3VyaXR5L2lwZS9kaWdlc3QuaAog Y3JlYXRlIG1vZGUgMTAwNjQ0IHNlY3VyaXR5L2lwZS9ldmFsLmMKIGNyZWF0ZSBtb2RlIDEwMDY0 NCBzZWN1cml0eS9pcGUvZXZhbC5oCiBjcmVhdGUgbW9kZSAxMDA2NDQgc2VjdXJpdHkvaXBlL2Zz LmMKIGNyZWF0ZSBtb2RlIDEwMDY0NCBzZWN1cml0eS9pcGUvZnMuaAogY3JlYXRlIG1vZGUgMTAw NjQ0IHNlY3VyaXR5L2lwZS9ob29rcy5jCiBjcmVhdGUgbW9kZSAxMDA2NDQgc2VjdXJpdHkvaXBl L2hvb2tzLmgKIGNyZWF0ZSBtb2RlIDEwMDY0NCBzZWN1cml0eS9pcGUvaXBlLmMKIGNyZWF0ZSBt b2RlIDEwMDY0NCBzZWN1cml0eS9pcGUvaXBlLmgKIGNyZWF0ZSBtb2RlIDEwMDY0NCBzZWN1cml0 eS9pcGUvcG9saWN5LmMKIGNyZWF0ZSBtb2RlIDEwMDY0NCBzZWN1cml0eS9pcGUvcG9saWN5LmgK IGNyZWF0ZSBtb2RlIDEwMDY0NCBzZWN1cml0eS9pcGUvcG9saWN5X2ZzLmMKIGNyZWF0ZSBtb2Rl IDEwMDY0NCBzZWN1cml0eS9pcGUvcG9saWN5X3BhcnNlci5jCiBjcmVhdGUgbW9kZSAxMDA2NDQg c2VjdXJpdHkvaXBlL3BvbGljeV9wYXJzZXIuaAogY3JlYXRlIG1vZGUgMTAwNjQ0IHNlY3VyaXR5 L2lwZS9wb2xpY3lfdGVzdHMuYwoKLS0gCjIuMzkuMAoKLS0KZG0tZGV2ZWwgbWFpbGluZyBsaXN0 CmRtLWRldmVsQHJlZGhhdC5jb20KaHR0cHM6Ly9saXN0bWFuLnJlZGhhdC5jb20vbWFpbG1hbi9s aXN0aW5mby9kbS1kZXZlbAo= From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 5B7D2C64ED9 for ; Tue, 31 Jan 2023 13:51:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1675173107; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding:list-id:list-help: list-unsubscribe:list-subscribe:list-post; bh=uJ93WurHdUoxZERz61q45dTA/ijC/ohnsJ58W8VZ4dU=; b=fXt6KZ2Tm+dKgaNv92FWecu0WJCDzd8Ow2ovrI3hYsvFTVCjSEaIv/kY2+7WSX0wT8O0/1 4S6E/rW3OhMeI3gkmBM5M+wFRlvCwDDyKt5iOKND7uDqZ5vVsHb2ud9NM5Fb86ScPURGTX Gqfoppprl9UjpdJlN24h3I/+NswFBJk= Received: from mimecast-mx02.redhat.com (mx3-rdu2.redhat.com [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-395-_O_1H74KM2yNa-LEwJPu7A-1; Tue, 31 Jan 2023 08:51:42 -0500 X-MC-Unique: _O_1H74KM2yNa-LEwJPu7A-1 Received: from smtp.corp.redhat.com (int-mx05.intmail.prod.int.rdu2.redhat.com [10.11.54.5]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 055D7382B08C; Tue, 31 Jan 2023 13:51:33 +0000 (UTC) Received: from mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (unknown [10.30.29.100]) by smtp.corp.redhat.com (Postfix) with ESMTP id E5F04175A2; Tue, 31 Jan 2023 13:51:32 +0000 (UTC) Received: from mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (localhost [IPv6:::1]) by mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (Postfix) with ESMTP id D5C171946589; Tue, 31 Jan 2023 13:51:32 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx09.intmail.prod.int.rdu2.redhat.com [10.11.54.9]) by mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (Postfix) with ESMTP id 4AACC194658F for ; Mon, 30 Jan 2023 23:06:40 +0000 (UTC) Received: by smtp.corp.redhat.com (Postfix) id 31239492B06; Mon, 30 Jan 2023 23:06:40 +0000 (UTC) Received: from mimecast-mx02.redhat.com (mimecast03.extmail.prod.ext.rdu2.redhat.com [10.11.55.19]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 29A1B492B05 for ; Mon, 30 Jan 2023 23:06:40 +0000 (UTC) Received: from us-smtp-1.mimecast.com (us-smtp-2.mimecast.com [207.211.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 05969811E9C for ; Mon, 30 Jan 2023 23:06:40 +0000 (UTC) Received: from linux.microsoft.com (linux.microsoft.com [13.77.154.182]) by relay.mimecast.com with ESMTP id us-mta-207-H4n9BtZwN_GFPdukbDyI6w-1; Mon, 30 Jan 2023 18:06:38 -0500 X-MC-Unique: H4n9BtZwN_GFPdukbDyI6w-1 Received: by linux.microsoft.com (Postfix, from userid 1052) id E04B220E9FB1; Mon, 30 Jan 2023 14:58:41 -0800 (PST) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com E04B220E9FB1 From: Fan Wu To: corbet@lwn.net, zohar@linux.ibm.com, jmorris@namei.org, serge@hallyn.com, tytso@mit.edu, ebiggers@kernel.org, axboe@kernel.dk, agk@redhat.com, snitzer@kernel.org, eparis@redhat.com, paul@paul-moore.com Subject: [RFC PATCH v9 00/16] Integrity Policy Enforcement LSM (IPE) Date: Mon, 30 Jan 2023 14:57:15 -0800 Message-Id: <1675119451-23180-1-git-send-email-wufan@linux.microsoft.com> MIME-Version: 1.0 X-Mimecast-Impersonation-Protect: Policy=CLT - Impersonation Protection Definition; Similar Internal Domain=false; Similar Monitored External Domain=false; Custom External Domain=false; Mimecast External Domain=false; Newly Observed Domain=false; Internal User Name=false; Custom Display Name List=false; Reply-to Address Mismatch=false; Targeted Threat Dictionary=false; Mimecast Threat Dictionary=false; Custom Threat Dictionary=false X-Scanned-By: MIMEDefang 3.1 on 10.11.54.9 X-Mailman-Approved-At: Tue, 31 Jan 2023 13:51:24 +0000 X-BeenThere: linux-audit@redhat.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Linux Audit Discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Fan Wu , dm-devel@redhat.com, linux-doc@vger.kernel.org, roberto.sassu@huawei.com, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, linux-block@vger.kernel.org, linux-fscrypt@vger.kernel.org, linux-audit@redhat.com, linux-integrity@vger.kernel.org Errors-To: linux-audit-bounces@redhat.com Sender: "Linux-audit" X-Scanned-By: MIMEDefang 3.1 on 10.11.54.5 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 T3ZlcnZpZXc6Ci0tLS0tLS0tLQoKSVBFIGlzIGEgTGludXggU2VjdXJpdHkgTW9kdWxlIHdoaWNo IHRha2VzIGEgY29tcGxpbWVudGFyeSBhcHByb2FjaCB0bwphY2Nlc3MgY29udHJvbC4gV2hlcmVh cyBleGlzdGluZyBtYW5kYXRvcnkgYWNjZXNzIGNvbnRyb2wgbWVjaGFuaXNtcwpiYXNlIHRoZWly IGRlY2lzaW9ucyBvbiBsYWJlbHMgYW5kIHBhdGhzLCBJUEUgaW5zdGVhZCBkZXRlcm1pbmVzCndo ZXRoZXIgb3Igbm90IGFuIG9wZXJhdGlvbiBzaG91bGQgYmUgYWxsb3dlZCBiYXNlZCBvbiBpbW11 dGFibGUKc2VjdXJpdHkgcHJvcGVydGllcyBvZiB0aGUgc3lzdGVtIGNvbXBvbmVudCB0aGUgb3Bl cmF0aW9uIGlzIGJlaW5nCnBlcmZvcm1lZCBvbi4KCklQRSBpdHNlbGYgZG9lcyBub3QgbWFuZGF0 ZSBob3cgdGhlIHNlY3VyaXR5IHByb3BlcnR5IHNob3VsZCBiZQpldmFsdWF0ZWQsIGJ1dCByZWxp ZXMgb24gYW4gZXh0ZW5zaWJsZSBzZXQgb2YgZXh0ZXJuYWwgcHJvcGVydHkgcHJvdmlkZXJzCnRv IGV2YWx1YXRlIHRoZSBjb21wb25lbnQuIElQRSBtYWtlcyBpdHMgZGVjaXNpb24gYmFzZWQgb24g cmVmZXJlbmNlCnZhbHVlcyBmb3IgdGhlIHNlbGVjdGVkIHByb3BlcnRpZXMsIHNwZWNpZmllZCBp biB0aGUgSVBFIHBvbGljeS4KClRoZSByZWZlcmVuY2UgdmFsdWVzIHJlcHJlc2VudCB0aGUgdmFs dWUgdGhhdCB0aGUgcG9saWN5IHdyaXRlciBhbmQgdGhlCmxvY2FsIHN5c3RlbSBhZG1pbmlzdHJh dG9yIChiYXNlZCBvbiB0aGUgcG9saWN5IHNpZ25hdHVyZSkgdHJ1c3QgZm9yIHRoZQpzeXN0ZW0g dG8gYWNjb21wbGlzaCB0aGUgZGVzaXJlZCB0YXNrcy4KCk9uZSBzdWNoIHByb3ZpZGVyIGlzIGZv ciBleGFtcGxlIGRtLXZlcml0eSwgd2hpY2ggaXMgYWJsZSB0byByZXByZXNlbnQKdGhlIGludGVn cml0eSBwcm9wZXJ0eSBvZiBhIHBhcnRpdGlvbiAoaXRzIGltbXV0YWJsZSBzdGF0ZSkgd2l0aCBh IGRpZ2VzdC4KCklQRSBpcyBjb21waWxlZCB1bmRlciBDT05GSUdfU0VDVVJJVFlfSVBFLgoKVXNl IENhc2VzCi0tLS0tLS0tLQoKSVBFIHdvcmtzIGJlc3QgaW4gZml4ZWQtZnVuY3Rpb24gZGV2aWNl czogRGV2aWNlcyBpbiB3aGljaCB0aGVpciBwdXJwb3NlCmlzIGNsZWFybHkgZGVmaW5lZCBhbmQg bm90IHN1cHBvc2VkIHRvIGJlIGNoYW5nZWQgKGUuZy4gbmV0d29yayBmaXJld2FsbApkZXZpY2Ug aW4gYSBkYXRhIGNlbnRlciwgYW4gSW9UIGRldmljZSwgZXRjZXRlcmEpLCB3aGVyZSBhbGwgc29m dHdhcmUgYW5kCmNvbmZpZ3VyYXRpb24gaXMgYnVpbHQgYW5kIHByb3Zpc2lvbmVkIGJ5IHRoZSBz eXN0ZW0gb3duZXIuCgpJUEUgaXMgYSBsb25nLXdheSBvZmYgZm9yIHVzZSBpbiBnZW5lcmFsLXB1 cnBvc2UgY29tcHV0aW5nOiB0aGUgTGludXgKY29tbXVuaXR5IGFzIGEgd2hvbGUgdGVuZHMgdG8g Zm9sbG93IGEgZGVjZW50cmFsaXplZCB0cnVzdCBtb2RlbCwKa25vd24gYXMgdGhlIHdlYiBvZiB0 cnVzdCwgd2hpY2ggSVBFIGhhcyBubyBzdXBwb3J0IGZvciBhcyBvZiAgeWV0LgpUaGVyZSBhcmUg ZXhjZXB0aW9ucywgc3VjaCBhcyB0aGUgY2FzZSB3aGVyZSBhIExpbnV4IGRpc3RyaWJ1dGlvbgp2 ZW5kb3IgdHJ1c3RzIG9ubHkgdGhlaXIgb3duIGtleXMsIHdoZXJlIElQRSBjYW4gc3VjY2Vzc2Z1 bGx5IGJlIHVzZWQKdG8gZW5mb3JjZSB0aGUgdHJ1c3QgcmVxdWlyZW1lbnQuCgpBZGRpdGlvbmFs bHksIHdoaWxlIG1vc3QgcGFja2FnZXMgYXJlIHNpZ25lZCB0b2RheSwgdGhlIGZpbGVzIGluc2lk ZQp0aGUgcGFja2FnZXMgKGZvciBpbnN0YW5jZSwgdGhlIGV4ZWN1dGFibGVzKSwgdGVuZCB0byBi ZSB1bnNpZ25lZC4gVGhpcwptYWtlcyBpdCBkaWZmaWN1bHQgdG8gdXRpbGl6ZSBJUEUgaW4gc3lz dGVtcyB3aGVyZSBhIHBhY2thZ2UgbWFuYWdlciBpcwpleHBlY3RlZCB0byBiZSBmdW5jdGlvbmFs LCB3aXRob3V0IG1ham9yIGNoYW5nZXMgdG8gdGhlIHBhY2thZ2UgbWFuYWdlcgphbmQgZWNvc3lz dGVtIGJlaGluZCBpdC4KCkRJR0xJTVsxXSBpcyBhIHN5c3RlbSB0aGF0IHdoZW4gY29tYmluZWQg d2l0aCBJUEUsIGNvdWxkIGJlIHVzZWQgdG8KZW5hYmxlIGdlbmVyYWwgcHVycG9zZSBjb21wdXRp bmcgc2NlbmFyaW9zLgoKUG9saWN5OgotLS0tLS0tCgpJUEUgcG9saWN5IGlzIGEgcGxhaW4tdGV4 dCBwb2xpY3kgY29tcG9zZWQgb2YgbXVsdGlwbGUgc3RhdGVtZW50cwpvdmVyIHNldmVyYWwgbGlu ZXMuIFRoZXJlIGlzIG9uZSByZXF1aXJlZCBsaW5lLCBhdCB0aGUgdG9wIG9mIHRoZQpwb2xpY3ks IGluZGljYXRpbmcgdGhlIHBvbGljeSBuYW1lLCBhbmQgdGhlIHBvbGljeSB2ZXJzaW9uLCBmb3IK aW5zdGFuY2U6CgogIHBvbGljeV9uYW1lPUV4X1BvbGljeSBwb2xpY3lfdmVyc2lvbj0wLjAuMAoK VGhlIHBvbGljeSB2ZXJzaW9uIGluZGljYXRlcyB0aGUgY3VycmVudCB2ZXJzaW9uIG9mIHRoZSBw b2xpY3kuIFRoaXMgaXMKdXNlZCB0byBwcmV2ZW50IHJvbGwtYmFjayBvZiBwb2xpY3kgdG8gcG90 ZW50aWFsbHkgaW5zZWN1cmUgcHJldmlvdXMKdmVyc2lvbnMgb2YgdGhlIHBvbGljeS4KClRoZSBu ZXh0IHBvcnRpb24gb2YgSVBFIHBvbGljeSwgYXJlIHJ1bGVzLiBSdWxlcyBhcmUgZm9ybWVkIGJ5 IGtleT12YWx1ZQpwYWlycywga25vd24gYXMgcHJvcGVydGllcy4gSVBFIHJ1bGVzIHJlcXVpcmUg dHdvIGtleXM6ICJhY3Rpb24iLCB3aGljaApkZXRlcm1pbmVzIHdoYXQgSVBFIGRvZXMgd2hlbiBp dCBlbmNvdW50ZXJzIGEgbWF0Y2ggYWdhaW5zdCB0aGUgcG9saWN5CmFuZCAib3AiLCB3aGljaCBk ZXRlcm1pbmVzIHdoZW4gdGhhdCBydWxlIHNob3VsZCBiZSBldmFsdWF0ZWQuCgpUaHVzLCBhIG1p bmltYWwgcnVsZSBpczoKCiAgb3A9RVhFQ1VURSBhY3Rpb249QUxMT1cKClRoaXMgZXhhbXBsZSBy dWxlIHdpbGwgYWxsb3cgYW55IGV4ZWN1dGlvbi4gQSBydWxlIGlzIHJlcXVpcmVkIHRvIGhhdmUg dGhlCiJvcCIgcHJvcGVydHkgYXMgdGhlIGZpcnN0IHRva2VuIG9mIGEgcnVsZSwgYW5kIHRoZSAi YWN0aW9uIiBhcyB0aGUgbGFzdAp0b2tlbiBvZiB0aGUgcnVsZS4gCgpBZGRpdGlvbmFsIHByb3Bl cnRpZXMgYXJlIHVzZWQgdG8gcmVzdHJpY3QgYXR0cmlidXRlcyBhYm91dCB0aGUgZmlsZXMgYmVp bmcKZXZhbHVhdGVkLiBUaGVzZSBwcm9wZXJ0aWVzIGFyZSBpbnRlbmRlZCB0byBiZSBkZXRlcm1p bmlzdGljIGF0dHJpYnV0ZXMKdGhhdCBhcmUgcmVzaWRlbnQgaW4gdGhlIGtlcm5lbC4gCgpGb3Ig ZXhhbXBsZToKCiAgb3A9RVhFQ1VURSBkbXZlcml0eV9zaWduYXR1cmU9RkFMU0UgYWN0aW9uPURF TlkKClRoaXMgcnVsZSB3aXRoIHByb3BlcnR5IGRtdmVyaXR5X3NpZ25hdHVyZSB3aWxsIGRlbnkg YW55IGZpbGUgbm90IGZyb20KYSBzaWduZWQgZG12ZXJpdHkgdm9sdW1lIHRvIGJlIGV4ZWN1dGVk LiAKCkFsbCBhdmFpbGFibGUgcHJvcGVydGllcyBmb3IgSVBFIGRlc2NyaWJlZCBpbiB0aGUgZG9j dW1lbnRhdGlvbiBwYXRjaCBvZgp0aGlzIHNlcmllcy4KClJ1bGVzIGFyZSBldmFsdWF0ZWQgdG9w LXRvLWJvdHRvbS4gQXMgYSByZXN1bHQsIGFueSByZXZvY2F0aW9uIHJ1bGVzLApvciBkZW5pZXMg c2hvdWxkIGJlIHBsYWNlZCBlYXJseSBpbiB0aGUgZmlsZSB0byBlbnN1cmUgdGhhdCB0aGVzZSBy dWxlcwphcmUgZXZhbHVhdGVkIGJlZm9yZSBhIHJ1bGUgd2l0aCAiYWN0aW9uPUFMTE9XIiBpcyBo aXQuCgpBbnkgdW5rbm93biBzeW50YXggaW4gSVBFIHBvbGljeSB3aWxsIHJlc3VsdCBpbiBhIGZh dGFsIGVycm9yIHRvIHBhcnNlCnRoZSBwb2xpY3kuIAoKQWRkaXRpb25hbGx5LCBhIERFRkFVTFQg b3BlcmF0aW9uIG11c3QgYmUgc2V0IGZvciBhbGwgdW5kZXJzdG9vZApvcGVyYXRpb25zIHdpdGhp biBJUEUuIEZvciBwb2xpY2llcyB0byByZW1haW4gY29tcGxldGVseSBmb3J3YXJkcwpjb21wYXRp YmxlLCBpdCBpcyByZWNvbW1lbmRlZCB0aGF0IHVzZXJzIGFkZCBhICJERUZBVUxUIGFjdGlvbj1B TExPVyIKYW5kIG92ZXJyaWRlIHRoZSBkZWZhdWx0cyBvbiBhIHBlci1vcGVyYXRpb24gYmFzaXMu CgpGb3IgbW9yZSBpbmZvcm1hdGlvbiBhYm91dCB0aGUgcG9saWN5IHN5bnRheCwgc2VlIHRoZSBr ZXJuZWwKZG9jdW1lbnRhdGlvbiBwYWdlLgoKRWFybHkgVXNlcm1vZGUgUHJvdGVjdGlvbjoKLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0KCklQRSBjYW4gYmUgcHJvdmlkZWQgd2l0aCBhIHBvbGlj eSBhdCBzdGFydHVwIHRvIGxvYWQgYW5kIGVuZm9yY2UuClRoaXMgaXMgaW50ZW5kZWQgdG8gYmUg YSBtaW5pbWFsIHBvbGljeSB0byBnZXQgdGhlIHN5c3RlbSB0byBhIHN0YXRlCndoZXJlIHVzZXJz cGFjZSBpcyBzZXR1cCBhbmQgcmVhZHkgdG8gcmVjZWl2ZSBjb21tYW5kcywgYXQgd2hpY2gKcG9p bnQgYSBwb2xpY3kgY2FuIGJlIGRlcGxveWVkIHZpYSBzZWN1cml0eWZzLiBUaGlzICJib290IHBv bGljeSIgY2FuIGJlCnNwZWNpZmllZCB2aWEgdGhlIGNvbmZpZywgU0VDVVJJVFlfSVBFX0JPT1Rf UE9MSUNZLCB3aGljaCBhY2NlcHRzIGEgcGF0aAp0byBhIHBsYWluLXRleHQgdmVyc2lvbiBvZiB0 aGUgSVBFIHBvbGljeSB0byBhcHBseS4gVGhpcyBwb2xpY3kgd2lsbCBiZQpjb21waWxlZCBpbnRv IHRoZSBrZXJuZWwuIElmIG5vdCBzcGVjaWZpZWQsIElQRSB3aWxsIGJlIGRpc2FibGVkIHVudGls IGEKcG9saWN5IGlzIGRlcGxveWVkIGFuZCBhY3RpdmF0ZWQgdGhyb3VnaCB0aGUgbWV0aG9kIGFi b3ZlLgoKUG9saWN5IEV4YW1wbGVzOgotLS0tLS0tLS0tLS0tLS0tCgpBbGxvdyBhbGw6CgogIHBv bGljeV9uYW1lPUFsbG93X0FsbCBwb2xpY3lfdmVyc2lvbj0wLjAuMAogIERFRkFVTFQgYWN0aW9u PUFMTE9XCgpBbGxvdyBvbmx5IGluaXRpYWwgc3VwZXJibG9jazoKCiAgcG9saWN5X25hbWU9QWxs b3dfQWxsX0luaXRpYWxfU0IgcG9saWN5X3ZlcnNpb249MC4wLjAKICBERUZBVUxUIGFjdGlvbj1E RU5ZCgogIG9wPUVYRUNVVEUgYm9vdF92ZXJpZmllZD1UUlVFIGFjdGlvbj1BTExPVwoKQWxsb3cg YW55IHNpZ25lZCBkbS12ZXJpdHkgdm9sdW1lIGFuZCB0aGUgaW5pdGlhbCBzdXBlcmJsb2NrOgoK ICBwb2xpY3lfbmFtZT1BbGxvd1NpZ25lZEFuZEluaXRpYWwgcG9saWN5X3ZlcnNpb249MC4wLjAK ICBERUZBVUxUIGFjdGlvbj1ERU5ZCgogIG9wPUVYRUNVVEUgYm9vdF92ZXJpZmllZD1UUlVFIGFj dGlvbj1BTExPVwogIG9wPUVYRUNVVEUgZG12ZXJpdHlfc2lnbmF0dXJlPVRSVUUgYWN0aW9uPUFM TE9XCgpQcm9oaWJpdCBleGVjdXRpb24gZnJvbSBhIHNwZWNpZmljIGRtLXZlcml0eSB2b2x1bWUs IHdoaWxlIGFsbG93aW5nCmFsbCBzaWduZWQgdm9sdW1lcyBhbmQgdGhlIGluaXRpYWwgc3VwZXJi bG9jazoKCiAgcG9saWN5X25hbWU9UHJvaGliaXRTaW5nbGVWb2x1bWUgcG9saWN5X3ZlcnNpb249 MC4wLjAKICBERUZBVUxUIGFjdGlvbj1ERU5ZCgogIG9wPUVYRUNVVEUgZG12ZXJpdHlfcm9vdGhh c2g9c2hhMjU2OjQwMWZjZWM1OTQ0ODIzYWUxMmY2MjcyNmU4MTg0NDA3YTVmYTk1OTk3ODNmMDMw ZGVjMTQ2OTM4IGFjdGlvbj1ERU5ZCiAgb3A9RVhFQ1VURSBib290X3ZlcmlmaWVkPVRSVUUgYWN0 aW9uPUFMTE9XCiAgb3A9RVhFQ1VURSBkbXZlcml0eV9zaWduYXR1cmU9VFJVRSBhY3Rpb249QUxM T1cKCkFsbG93IG9ubHkgYSBzcGVjaWZpYyBkbS12ZXJpdHkgdm9sdW1lOgoKICBwb2xpY3lfbmFt ZT1BbGxvd1NwZWNpZmljIHBvbGljeV92ZXJzaW9uPTAuMC4wCiAgREVGQVVMVCBhY3Rpb249REVO WQoKICBvcD1FWEVDVVRFIGRtdmVyaXR5X3Jvb3RoYXNoPXNoYTI1Njo0MDFmY2VjNTk0NDgyM2Fl MTJmNjI3MjZlODE4NDQwN2E1ZmE5NTk5NzgzZjAzMGRlYzE0NjkzOCBhY3Rpb249QUxMT1cKCkFs bG93IGFueSBzaWduZWQgZnMtdmVyaXR5IGZpbGUKCiAgcG9saWN5X25hbWU9IkFsbG93U2lnbmVk RlNWZXJpdHkiIHBvbGljeV92ZXJzaW9uPTAuMC4wCiAgREVGQVVMVCBhY3Rpb249REVOWQoKICBv cD1FWEVDVVRFIGZzdmVyaXR5X3NpZ25hdHVyZT1UUlVFIGFjdGlvbj1BTExPVwoKRGVueSBhIHNw ZWNpZmljIGZzLXZlcml0eSBmaWxlOgoKICBwb2xpY3lfbmFtZT0iUHJvaGliaXRTcGVjaWZpY0ZT VkYiIHBvbGljeV92ZXJzaW9uPTAuMC4wCiAgREVGQVVMVCBhY3Rpb249REVOWQoKICBvcD1FWEVD VVRFIGZzdmVyaXR5X2RpZ2VzdD1zaGEyNTY6ZmQ4OGYyYjg4MjRlMTk3Zjg1MGJmNGM1MTA5YmVh NWNmMGVlMzgxMDRmNzEwODQzYmI3MmRhNzk2YmE1YWY5ZSBhY3Rpb249REVOWQogIG9wPUVYRUNV VEUgYm9vdF92ZXJpZmllZD1UUlVFIGFjdGlvbj1BTExPVwogIG9wPUVYRUNVVEUgZG12ZXJpdHlf c2lnbmF0dXJlPVRSVUUgYWN0aW9uPUFMTE9XCgpEZXBsb3lpbmcgUG9saWNpZXM6Ci0tLS0tLS0t LS0tLS0tLS0tLS0KCkZpcnN0IHNpZ24gYSBwbGFpbiB0ZXh0IHBvbGljeSwgd2l0aCBhIGNlcnRp ZmljYXRlIHRoYXQgaXMgcHJlc2VudCBpbgp0aGUgU1lTVEVNX1RSVVNURURfS0VZUklORyBvZiB5 b3VyIHRlc3QgbWFjaGluZS4gVGhyb3VnaCBvcGVuc3NsLCB0aGUKc2lnbmluZyBjYW4gYmUgZG9u ZSB2aWE6CgogIG9wZW5zc2wgc21pbWUgLXNpZ24gLWluICIkTVlfUE9MSUNZIiAtc2lnbmVyICIk TVlfQ0VSVElGSUNBVEUiIFwKICAgIC1pbmtleSAiJE1ZX1BSSVZBVEVfS0VZIiAtb3V0Zm9ybSBk ZXIgLW5vYXR0ciAtbm9kZXRhY2ggXAogICAgLW91dCAiJE1ZX1BPTElDWS5wN3MiCgpUaGVuLCBz aW1wbHkgY2F0IHRoZSBmaWxlIGludG8gdGhlIElQRSdzICJuZXdfcG9saWN5IiBzZWN1cml0eWZz IG5vZGU6CgogIGNhdCAiJE1ZX1BPTElDWS5wN3MiID4gL3N5cy9rZXJuZWwvc2VjdXJpdHkvaXBl L25ld19wb2xpY3kKClRoZSBwb2xpY3kgc2hvdWxkIG5vdyBiZSBwcmVzZW50IHVuZGVyIHRoZSBw b2xpY2llcy8gc3ViZGlyZWN0b3J5LCB1bmRlcgppdHMgInBvbGljeV9uYW1lIiBhdHRyaWJ1dGUu CgpUaGUgcG9saWN5IGlzIG5vdyBwcmVzZW50IGluIHRoZSBrZXJuZWwgYW5kIGNhbiBiZSBtYXJr ZWQgYXMgYWN0aXZlLAp2aWEgdGhlIHNlY3VyaXR5ZnMgbm9kZToKCiAgZWNobyAxID4gIi9zeXMv a2VybmVsL3NlY3VyaXR5L2lwZS8kTVlfUE9MSUNZX05BTUUvYWN0aXZlIgoKVGhpcyB3aWxsIG5v dyBtYXJrIHRoZSBwb2xpY3kgYXMgYWN0aXZlIGFuZCB0aGUgc3lzdGVtIHdpbGwgYmUgZW5mb3Jj aW5nCiRNWV9QT0xJQ1lfTkFNRS4KClRoZXJlIGlzIG9uZSByZXF1aXJlbWVudCB3aGVuIG1hcmtp bmcgYSBwb2xpY3kgYXMgYWN0aXZlLCB0aGUgcG9saWN5X3ZlcnNpb24KYXR0cmlidXRlIG11c3Qg ZWl0aGVyIGluY3JlYXNlLCBvciByZW1haW4gdGhlIHNhbWUgYXMgdGhlIGN1cnJlbnRseSBydW5u aW5nCnBvbGljeS4KClBvbGljaWVzIGNhbiBiZSB1cGRhdGVkIHZpYToKCiAgY2F0ICIkTVlfVVBE QVRFRF9QT0xJQ1kucDdzIiA+IFwKICAgICIvc3lzL2tlcm5lbC9zZWN1cml0eS9pcGUvcG9saWNp ZXMvJE1ZX1BPTElDWV9OQU1FL3VwZGF0ZSIKCkFkZGl0aW9uYWxseSwgcG9saWNpZXMgY2FuIGJl IGRlbGV0ZWQgdmlhIHRoZSAiZGVsZXRlIiBzZWN1cml0eWZzCm5vZGUuIFNpbXBseSB3cml0ZSAi MSIgdG8gdGhlIGNvcnJlc3BvbmRpbmcgbm9kZSBpbiB0aGUgcG9saWN5IGZvbGRlcjoKCiAgZWNo byAxID4gIi9zeXMva2VybmVsL3NlY3VyaXR5L2lwZS9wb2xpY2llcy8kTVlfUE9MSUNZX05BTUUv ZGVsZXRlIgoKVGhlcmUgaXMgb25seSBvbmUgcmVxdWlyZW1lbnQgdG8gZGVsZXRlIHBvbGljaWVz LCB0aGUgcG9saWN5IGJlaW5nCmRlbGV0ZWQgbXVzdCBub3QgYmUgdGhlIGFjdGl2ZSBwb2xpY3ku CgpOT1RFOiBBbnkgc2VjdXJpdHlmcyB3cml0ZSB0byBJUEUncyBub2RlcyB3aWxsIHJlcXVpcmUg Q0FQX01BQ19BRE1JTi4KCkludGVncmF0aW9uczoKLS0tLS0tLS0tLS0tLQoKVGhpcyBwYXRjaCBz ZXJpZXMgYWRkcyBzdXBwb3J0IGZvciBmc3Zlcml0eSB2aWEgZGlnZXN0IGFuZCBzaWduYXR1cmUK KGZzdmVyaXR5X3NpZ25hdHVyZSBhbmQgZnN2ZXJpdHlfZGlnZXN0KSwgZG0tdmVyaXR5IGJ5IGRp Z2VzdCBhbmQKc2lnbmF0dXJlIChkbXZlcml0eV9zaWduYXR1cmUgYW5kIGRtdmVyaXR5X3Jvb3Ro YXNoKSwgYW5kIHRydXN0IGZvcgp0aGUgaW5pdHJhbWZzIChib290X3ZlcmlmaWVkKS4KClBsZWFz ZSBzZWUgdGhlIGRvY3VtZW50YXRpb24gcGF0Y2ggZm9yIG1vcmUgaW5mb3JtYXRpb24gYWJvdXQg dGhlCmludGVncmF0aW9ucyBhdmFpbGFibGUuCgpUZXN0aW5nOgotLS0tLS0tLQoKS1VuaXQgVGVz dHMgYXJlIGF2YWlsYWJsZS4gUmVjb21tZW5kZWQga3VuaXRjb25maWc6CgogICAgQ09ORklHX0tV TklUPXkKICAgIENPTkZJR19TRUNVUklUWT15CiAgICBDT05GSUdfU0VDVVJJVFlGUz15CiAgICBD T05GSUdfUEtDUzdfTUVTU0FHRV9QQVJTRVI9eQogICAgQ09ORklHX1NZU1RFTV9EQVRBX1ZFUklG SUNBVElPTj15CiAgICBDT05GSUdfRlNfVkVSSVRZPXkKICAgIENPTkZJR19GU19WRVJJVFlfQlVJ TFRJTl9TSUdOQVRVUkVTPXkKICAgIENPTkZJR19CTE9DSz15CiAgICBDT05GSUdfTUQ9eQogICAg Q09ORklHX0JMS19ERVZfRE09eQogICAgQ09ORklHX0RNX1ZFUklUWT15CiAgICBDT05GSUdfRE1f VkVSSVRZX1ZFUklGWV9ST09USEFTSF9TSUc9eQogICAgQ09ORklHX05FVD15CiAgICBDT05GSUdf QVVESVQ9eQogICAgQ09ORklHX0FVRElUU1lTQ0FMTD15CgogICAgQ09ORklHX1NFQ1VSSVRZX0lQ RT15CiAgICBDT05GSUdfSVBFX1BST1BfRE1fVkVSSVRZPXkKICAgIENPTkZJR19JUEVfUFJPUF9G U19WRVJJVFk9eQogICAgQ09ORklHX1NFQ1VSSVRZX0lQRV9LVU5JVF9URVNUPXkKClNpbXBseSBy dW46CgogICAgbWFrZSBBUkNIPXVtIG1ycHJvcGVyCiAgICAuL3Rvb2xzL3Rlc3Rpbmcva3VuaXQv a3VuaXQucHkgcnVuIC0ta3VuaXRjb25maWcgPHBhdGgvdG8vY29uZmlnPgoKQW5kIHRoZSB0ZXN0 cyB3aWxsIGV4ZWN1dGUgYW5kIHJlcG9ydCB0aGUgcmVzdWx0LiBGb3IgbW9yZSBpbmRlcHRoIHRl c3RpbmcsCml0IHdpbGwgcmVxdWlyZSB5b3UgdG8gY3JlYXRlIGFuZCBtb3VudCBhIGRtLXZlcml0 eSB2b2x1bWUgb3IgZnMtdmVyaXR5CmVuYWJsZWQgZmlsZS4KCkRvY3VtZW50YXRpb246Ci0tLS0t LS0tLS0tLS0tCgpUaGVyZSBpcyBib3RoIGRvY3VtZW50YXRpb24gYXZhaWxhYmxlIG9uIGdpdGh1 YiBhdApodHRwczovL21pY3Jvc29mdC5naXRodWIuaW8vaXBlLCBhbmQgRG9jdW1lbnRhdGlvbiBp biB0aGlzIHBhdGNoIHNlcmllcywKdG8gYmUgYWRkZWQgaW4tdHJlZS4KCktub3duIEdhcHM6Ci0t LS0tLS0tLS0tCgpJUEUgaGFzIHR3byBrbm93biBnYXBzOgoKMS4gSVBFIGNhbm5vdCB2ZXJpZnkg dGhlIGludGVncml0eSBvZiBhbm9ueW1vdXMgZXhlY3V0YWJsZSBtZW1vcnksIHN1Y2ggYXMKICB0 aGUgdHJhbXBvbGluZXMgY3JlYXRlZCBieSBnY2MgY2xvc3VyZXMgYW5kIGxpYmZmaSAoPDMuNC4y KSwgb3IgSklUJ2QgY29kZS4KICBVbmZvcnR1bmF0ZWx5LCBhcyB0aGlzIGlzIGR5bmFtaWNhbGx5 IGdlbmVyYXRlZCBjb2RlLCB0aGVyZSBpcyBubyB3YXkKICBmb3IgSVBFIHRvIGVuc3VyZSB0aGUg aW50ZWdyaXR5IG9mIHRoaXMgY29kZSB0byBmb3JtIGEgdHJ1c3QgYmFzaXMuIEluIGFsbAogIGNh c2VzLCB0aGUgcmV0dXJuIHJlc3VsdCBmb3IgdGhlc2Ugb3BlcmF0aW9ucyB3aWxsIGJlIHdoYXRl dmVyIHRoZSBhZG1pbgogIGNvbmZpZ3VyZXMgdGhlIERFRkFVTFQgYWN0aW9uIGZvciAiRVhFQ1VU RSIuCgoyLiBJUEUgY2Fubm90IHZlcmlmeSB0aGUgaW50ZWdyaXR5IG9mIGludGVycHJldGVkIGxh bmd1YWdlcycgcHJvZ3JhbXMgd2hlbgogIHRoZXNlIHNjcmlwdHMgaW52b2tlZCB2aWEgYGA8aW50 ZXJwcmV0ZXI+IDxmaWxlPmBgLiBUaGlzIGlzIGJlY2F1c2UgdGhlCiAgd2F5IGludGVycHJldGVy cyBleGVjdXRlIHRoZXNlIGZpbGVzLCB0aGUgc2NyaXB0cyB0aGVtc2VsdmVzIGFyZSBub3QKICBl dmFsdWF0ZWQgYXMgZXhlY3V0YWJsZSBjb2RlIHRocm91Z2ggb25lIG9mIElQRSdzIGhvb2tzLiBJ bnRlcnByZXRlcnMKICBjYW4gYmUgZW5saWdodGVuZWQgdG8gdGhlIHVzYWdlIG9mIElQRSBieSB0 cnlpbmcgdG8gbW1hcCBhIGZpbGUgaW50bwogIGV4ZWN1dGFibGUgbWVtb3J5ICgrWCksIGFmdGVy IG9wZW5pbmcgdGhlIGZpbGUgYW5kIHJlc3BvbmRpbmcgdG8gdGhlCiAgZXJyb3IgY29kZSBhcHBy b3ByaWF0ZWx5LiBUaGlzIGFsc28gYXBwbGllcyB0byBpbmNsdWRlZCBmaWxlcywgb3IgaGlnaAog IHZhbHVlIGZpbGVzLCBzdWNoIGFzIGNvbmZpZ3VyYXRpb24gZmlsZXMgb2YgY3JpdGljYWwgc3lz dGVtIGNvbXBvbmVudHMuCgpBcHBlbmRpeDoKLS0tLS0tLS0tCgpBLiBJUEUgR2l0aHViIFJlcG9z aXRvcnk6IGh0dHBzOi8vZ2l0aHViLmNvbS9taWNyb3NvZnQvaXBlCkIuIElQRSBVc2VycycgR3Vp ZGU6IERvY3VtZW50YXRpb24vYWRtaW4tZ3VpZGUvTFNNL2lwZS5yc3QKClJlZmVyZW5jZXM6Ci0t LS0tLS0tLS0tCgoxOiBodHRwczovL2xvcmUua2VybmVsLm9yZy9icGYvNGQ2OTMyZTk2ZDc3NDIy N2I0MjcyMWQ5ZjY0NWJhNTFAaHVhd2VpLmNvbS9ULwoKRkFROgotLS0tCgpROiBXaGF0IGlzIHRo ZSBkaWZmZXJlbmNlIGJldHdlZW4gSU1BIGFuZCBJUEU/CgpBOiBTZWUgdGhlIGRvY3VtZW50YXRp b24gcGF0Y2ggZm9yIG1vcmUgb24gdGhpcyB0b3BpYy4KClByZXZpb3VzIFBvc3RpbmdzCi0tLS0t LS0tLS0tLS0tLS0tCgp2MTogaHR0cHM6Ly9sb3JlLmtlcm5lbC5vcmcvYWxsLzIwMjAwNDA2MTgx MDQ1LjEwMjQxNjQtMS1kZXZlbi5kZXNhaUBsaW51eC5taWNyb3NvZnQuY29tLwp2MjogaHR0cHM6 Ly9sb3JlLmtlcm5lbC5vcmcvYWxsLzIwMjAwNDA2MjIxNDM5LjE0Njk4NjItMS1kZXZlbi5kZXNh aUBsaW51eC5taWNyb3NvZnQuY29tLwp2MzogaHR0cHM6Ly9sb3JlLmtlcm5lbC5vcmcvYWxsLzIw MjAwNDE1MTYyNTUwLjIzMjQtMS1kZXZlbi5kZXNhaUBsaW51eC5taWNyb3NvZnQuY29tLwp2NDog aHR0cHM6Ly9sb3JlLmtlcm5lbC5vcmcvYWxsLzIwMjAwNzE3MjMwOTQxLjExOTA3NDQtMS1kZXZl bi5kZXNhaUBsaW51eC5taWNyb3NvZnQuY29tLwp2NTogaHR0cHM6Ly9sb3JlLmtlcm5lbC5vcmcv YWxsLzIwMjAwNzI4MjEzNjE0LjU4NjMxMi0xLWRldmVuLmRlc2FpQGxpbnV4Lm1pY3Jvc29mdC5j b20vCnY2OiBodHRwczovL2xvcmUua2VybmVsLm9yZy9hbGwvMjAyMDA3MzAwMDMxMTMuMjU2MTY0 NC0xLWRldmVuLmRlc2FpQGxpbnV4Lm1pY3Jvc29mdC5jb20vCnY3OiBodHRwczovL2xvcmUua2Vy bmVsLm9yZy9hbGwvMTYzNDE1MTk5NS0xNjI2Ni0xLWdpdC1zZW5kLWVtYWlsLWRldmVuLmRlc2Fp QGxpbnV4Lm1pY3Jvc29mdC5jb20vCnY4OiBodHRwczovL2xvcmUua2VybmVsLm9yZy9hbGwvMTY1 NDcxNDg4OS0yNjcyOC0xLWdpdC1zZW5kLWVtYWlsLWRldmVuLmRlc2FpQGxpbnV4Lm1pY3Jvc29m dC5jb20vCgpDaGFuZ2Vsb2c6Ci0tLS0tLS0tLS0KCnYyOgogIFNwbGl0IHRoZSBzZWNvbmQgcGF0 Y2ggb2YgdGhlIHByZXZpb3VzIHNlcmllcyBpbnRvIHR3by4KICBNaW5vciBjb3JyZWN0aW9ucyBp biB0aGUgY292ZXItbGV0dGVyIGFuZCBkb2N1bWVudGF0aW9uCiAgY29tbWVudHMgcmVnYXJkaW5n IENBUF9NQUNfQURNSU4gY2hlY2tzIGluIElQRS4KCnYzOgogIEFkZHJlc3MgdmFyaW91cyBjb21t ZW50cyBieSBKYW5uIEhvcm4uIEhpZ2hsaWdodHM6CiAgICBTd2l0Y2ggdmFyaW91cyBhdWRpdCBh bGxvY2F0b3JzIHRvIEdGUF9LRVJORUwuCiAgICBVdGlsaXplIHJjdV9hY2Nlc3NfcG9pbnRlcigp IGluIHZhcmlvdXMgbG9jYXRpb25zLgogICAgU3RyaXAgb3V0IHRoZSBjYWNoaW5nIHN5c3RlbSBm b3IgcHJvcGVydGllcwogICAgU3RyaXAgY29tbWVudHMgZnJvbSBoZWFkZXJzCiAgICBNb3ZlIGZ1 bmN0aW9ucyBhcm91bmQgaW4gcGF0Y2hlcwogICAgUmVtb3ZlIGtlcm5lbCBjb21tYW5kIGxpbmUg cGFyYW1ldGVycwogICAgUmVjb25jaWxlIHRoZSByYWNlIGNvbmRpdGlvbiBvbiB0aGUgZGVsZXRl IG5vZGUgZm9yIHBvbGljeSBieQogICAgICBleHBhbmRpbmcgdGhlIHBvbGljeSBjcml0aWNhbCBz ZWN0aW9uLgoKICBBZGRyZXNzIGEgZmV3IGNvbW1lbnRzIGJ5IEpvbmF0aGFuIENvcmJldCBhcm91 bmQgdGhlIGRvY3VtZW50YXRpb24KICAgIHBhZ2VzIGZvciBJUEUuCgogIEZpeCBhbiBpc3N1ZSB3 aXRoIHRoZSBpbml0aWFsaXphdGlvbiBvZiBJUEUgcG9saWN5IHdpdGggYSAiLTAiCiAgICB2ZXJz aW9uLCBjYXVzZWQgYnkgbm90IGluaXRpYWxpemluZyB0aGUgaGxpc3QgZW50cmllcyBiZWZvcmUK ICAgIGZyZWVpbmcuCgp2NDoKICBBZGRyZXNzIGEgY29uY2VybiBhcm91bmQgSVBFJ3MgYmVoYXZp b3Igd2l0aCB1bmtub3duIHN5bnRheC4KICAgIFNwZWNpZmljYWxseSwgbWFrZSBhbnkgdW5rbm93 biBzeW50YXggYSBmYXRhbCBlcnJvciBpbnN0ZWFkIG9mIGEKICAgIHdhcm5pbmcsIGFzIHN1Z2dl c3RlZCBieSBNaWNrYcOrbCBTYWxhw7xuLgogIEludHJvZHVjZSBhIG5ldyBzZWN1cml0eWZzIG5v ZGUsICRzZWN1cml0eWZzL2lwZS9wcm9wZXJ0eV9jb25maWcsCiAgICB3aGljaCBwcm92aWRlcyBh IGxpc3Rpbmcgb2Ygd2hhdCBwcm9wZXJ0aWVzIGFyZSBlbmFibGVkIGJ5IHRoZQogICAga2VybmVs IGFuZCB0aGVpciB2ZXJzaW9ucy4gVGhpcyBhbGxvd3MgdXNlcm1vZGUgdG8gcHJlZGljdCB3aGF0 CiAgICBwb2xpY2llcyBzaG91bGQgYmUgYWxsb3dlZC4KICBTdHJpcCBzb21lIGNvbW1lbnRzIGZy b20gYyBmaWxlcyB0aGF0IEkgbWlzc2VkLgogIENsYXJpZnkgc29tZSBkb2N1bWVudGF0aW9uIGNv bW1lbnRzIGFyb3VuZCAnYm9vdF92ZXJpZmllZCcuCiAgICBXaGlsZSB0aGlzIGN1cnJlbnRseSBk b2VzIG5vdCBmdW5jdGlvbmFsbHkgY2hhbmdlIHRoZSBwcm9wZXJ0eQogICAgaXRzZWxmLCB0aGUg ZGlzdGluY3Rpb24gaXMgaW1wb3J0YW50IHdoZW4gSVBFIGNhbiBlbmZvcmNlIHZlcmlmaWVkCiAg ICByZWFkcy4gQWRkaXRpb25hbGx5LCAnS0VSTkVMX1JFQUQnIHdhcyBvbWl0dGVkIGZyb20gdGhl IGRvY3VtZW50YXRpb24uCiAgICBUaGlzIGhhcyBiZWVuIGNvcnJlY3RlZC4KICBDaGFuZ2UgU2Vj dXJpdHlGUyBhbmQgU0hBMSB0byBhIHJldmVyc2UgZGVwZW5kZW5jeS4KICBVcGRhdGUgdGhlIGNv dmVyLWxldHRlciB3aXRoIHRoZSB1cGRhdGVkIGJlaGF2aW9yIG9mIHVua25vd24gc3ludGF4Lgog IFJlbW92ZSBhbGwgc3lzY3RscywgbWFraW5nIGFuIGVxdWl2YWxlbnQgZnVuY3Rpb24gaW4gc2Vj dXJpdHlmcy4KICBSZXdvcmsgdGhlIGFjdGl2ZS9kZWxldGUgbWVjaGFuaXNtIHRvIGJlIGEgbm9k ZSB1bmRlciB0aGUgcG9saWN5IGluCiAgICAkc2VjdXJpdHlmcy9pcGUvcG9saWNpZXMuCiAgVGhl IGtlcm5lbCBjb21tYW5kIGxpbmUgcGFyYW1ldGVycyBpcGUuZW5mb3JjZSBhbmQgaXBlLnN1Y2Nl c3NfYXVkaXQKICAgIGhhdmUgcmV0dXJuZWQgYXMgdGhpcyBmdW5jdGlvbmFsaXR5IGlzIG5vIGxv bmdlciBleHBvc2VkIHRocm91Z2gKICAgIHN5c2ZzLgoKdjU6CiAgQ29ycmVjdCBzb21lIGdyYW1t YXRpY2FsIGVycm9ycyByZXBvcnRlZCBieSBSYW5keSBEdW5sYXAuCiAgRml4IHNvbWUgd2Fybmlu Z3MgcmVwb3J0ZWQgYnkga2VybmVsIHRlc3QgYm90LgogIENoYW5nZSBjb252ZW50aW9uIGFyb3Vu ZCBzZWN1cml0eV9iZGV2X3NldHNlY3VyaXR5LiAtRU5PU1lTCiAgICBpcyBub3cgZXhwZWN0ZWQg aWYgYW4gTFNNIGRvZXMgbm90IGltcGxlbWVudCBhIHBhcnRpY3VsYXIgQG5hbWUsCiAgICBhcyBz dWdnZXN0ZWQgYnkgQ2FzZXkgU2NoYXVmbGVyLgogIE1pbm9yIHN0cmluZyBjb3JyZWN0aW9ucyBy ZWxhdGVkIHRvIHRoZSBtb3ZlIGZyb20gc3lzZnMgdG8gc2VjdXJpdHlmcwogIENvcnJlY3QgYSBz cGVsbGluZyBvZiBhbiAjaWZkZWYgZm9yIHRoZSBwZXJtaXNzaXZlIGFyZ3VtZW50LgogIEFkZCB0 aGUga2VybmVsIHBhcmFtZXRlcnMgcmUtYWRkZWQgdG8gdGhlIGRvY3VtZW50YXRpb24uCiAgRml4 IGEgbWlub3IgYnVnIHdoZXJlIHRoZSBtb2RlIGJlaW5nIGF1ZGl0ZWQgb24gcGVybWlzc2l2ZSBz d2l0Y2gKICAgIHdhcyB0aGUgb3JpZ2luYWwgbW9kZSwgbm90IHRoZSBtb2RlIGJlaW5nIHN3YXBw ZWQgdG8uCiAgQ2xlYW51cCBkb2MgY29tbWVudHMsIGZpeCBzb21lIHdoaXRlc3BhY2UgYWxpZ25t ZW50IGlzc3Vlcy4KCnY2OgogIENoYW5nZSBpZiBzdGF0ZW1lbnQgY29uZGl0aW9uIGluIHNlY3Vy aXR5X2JkZXZfc2V0c2VjdXJpdHkgdG8gYmUKICAgIG1vcmUgY29uY2lzZSwgYXMgc3VnZ2VzdGVk IGJ5IENhc2V5IFNjaGF1ZmxlciBhbmQgQWwgVmlybwogIERyb3AgdGhlIDZ0aCBwYXRjaCBpbiB0 aGUgc2VyaWVzLCAiZG0tdmVyaXR5IG1vdmUgc2lnbmF0dXJlIGNoZWNrLi4uIgogICAgZHVlIHRv IG51bWVyb3VzIGlzc3VlcywgYW5kIGl0IHVsdGltYXRlbHkgcHJvdmlkaW5nIG5vIHJlYWwgdmFs dWUuCiAgRml4IHRoZSBwYXRjaCB0cmVlIC0gdGhlIHByZXZpb3VzIGl0ZXJhdGlvbiBhcHBlYXJz IHRvIGhhdmUgYmVlbiBpbiBhCiAgICB0b3JuIHN0YXRlIChwYXRjaGVzIDgrOSB3ZXJlIG1lcmdl ZCkuIFRoaXMgaGFzIHNpbmNlIGJlZW4gY29ycmVjdGVkLgoKdjc6CiAgKiBSZXdvcmQgY292ZXIg bGV0dGVyIHRvIG1vcmUgYWNjdXJhdGUgY29udmV5IElQRSdzIHB1cnBvc2UKICAgIGFuZCBsYXRl c3QgdXBkYXRlcy4KICAqIFJlZmFjdG9yIHNlcmllcyB0bzoKICAgICAgMS4gU3VwcG9ydCBhIGNv bnRleHQgc3RydWN0dXJlLCBlbmFibGluZzoKICAgICAgICAgIDEuIEVhc2llciBUZXN0aW5nIHZp YSBLVU5JVAogICAgICAgICAgMi4gQSBiZXR0ZXIgYXJjaGl0ZWN0dXJlIGZvciBmdXR1cmUgZGVz aWducwogICAgICAyLiBNYWtlIHBhcnNlciBjb2RlIGNsZWFuZXIKICAqIE1vdmUgcGF0Y2ggMDEv MTIgdG8gWzE0LzE2XSBvZiB0aGUgc2VyaWVzCiAgKiBTcGxpdCB1cCBwYXRjaCAwMi8xMiBpbnRv IGZvdXIgcGFydHM6CiAgICAgIDEuIGNvbnRleHQgY3JlYXRpb24gWzAxLzE2XQogICAgICAyLiBh dWRpdCBbMDcvMTZdCiAgICAgIDMuIGV2YWx1YXRpb24gbG9vcCBbMDMvMTZdCiAgICAgIDQuIGFj Y2VzcyBjb250cm9sIGhvb2tzIFswNS8xNl0KICAgICAgNS4gcGVybWlzc2l2ZSBtb2RlIFswOC8x Nl0KICAqIFNwbGl0IHVwIHBhdGNoIDAzLzEyIGludG8gdHdvIHBhcnRzOgogICAgICAxLiBwYXJz ZXIgWzAyLzE2XQogICAgICAyLiB1c2Vyc3BhY2UgaW50ZXJmYWNlIFswNC8xNl0KICAqIFJld29y ZCBhbmQgcmVmYWN0b3IgcGF0Y2ggMDQvMTIgdG8gWzA5LzE2XQogICogU3F1YXNoIHBhdGNoIDA1 LzEyLCAwNy8xMiwgMDkvMTIgdG8gWzEwLzE2XQogICogU3F1YXNoIHBhdGNoIDA4LzEyLCAxMC8x MiB0byBbMTEvMTZdCiAgKiBDaGFuZ2UgYXVkaXQgcmVjb3JkcyB0byBNQUMgcmVnaW9uICgxNFhY KSBmcm9tIEludGVncml0eSByZWdpb24gKDE4WFgpCiAgKiBBZGQgRlNWZXJpdHkgU3VwcG9ydAog ICogSW50ZXJmYWNlIGNoYW5nZXM6CiAgICAgIDEuICJyYXciIHdhcyByZW5hbWVkIHRvICJwa2Nz NyIgYW5kIG1hZGUgcmVhZCBvbmx5CiAgICAgIDIuICJyYXciJ3Mgd3JpdGUgZnVuY3Rpb25hbGl0 eSAodXBkYXRlIGEgcG9saWN5KSBtb3ZlZCB0byAidXBkYXRlIgogICAgICAzLiBpbnRyb2R1Y2Vk ICJ2ZXJzaW9uIiwgInBvbGljeV9uYW1lIiBub2Rlcy4KICAgICAgNC4gImNvbnRlbnQiIHJlbmFt ZWQgdG8gInBvbGljeSIKICAgICAgNS4gVGhlIGJvb3QgcG9saWN5IGNhbiBub3cgYmUgdXBkYXRl ZCBsaWtlIGFueSBvdGhlciBwb2xpY3kuCiAgKiBBZGQgYWRkaXRpb25hbCBkZXZlbG9wZXItbGV2 ZWwgZG9jdW1lbnRhdGlvbgogICogVXBkYXRlIGFkbWluLWd1aWRlIGRvY3MgdG8gcmVmbGVjdCBj aGFuZ2VzLgogICogS3VuaXQgdGVzdHMKICAqIERyb3BwZWQgQ09ORklHX1NFQ1VSSVRZX0lQRV9Q RVJNSVNTSVZFX1NXSVRDSCAtIGZ1bmN0aW9uYWxpdHkgY2FuCiAgICBlYXNpbHkgY29tZSBsYXRl ciB3aXRoIGEgc21hbGwgcGF0Y2guCiAgKiBVc2UgcGFydGl0aW9uMCBmb3IgYmxvY2tfZGV2aWNl IGZvciBkbS12ZXJpdHkgcGF0Y2gKCnY4OgogICogQWRkIGNoYW5nZWxvZyBpbmZvcm1hdGlvbiB0 byBpbmRpdmlkdWFsIGNvbW1pdHMKICAqIEEgbGFyZ2UgbnVtYmVyIG9mIGNoYW5nZXMgdG8gdGhl IGF1ZGl0IHBhdGNoLgogICogc3BsaXQgZnMvICYgc2VjdXJpdHkvIGNoYW5nZXMgdG8gdHdvIHNl cGFyYXRlIHBhdGNoZXMuCiAgKiBzcGxpdCBibG9jay8sIHNlY3VyaXR5LyAmIGRyaXZlcnMvbWQv IGNoYW5nZXMgdG8gc2VwYXJhdGUgcGF0Y2hlcy4KICAqIEFkZCBzb21lIGhpc3RvcmljYWwgY29u dGV4dCB0byB3aGF0IGxlYWQgdG8gdGhlIGNyZWF0aW9uIG9mIElQRQogICAgaW4gdGhlIGRvY3Vt ZW50YXRpb24gcGF0Y2guCiAgKiBDb3Zlci1sZXR0ZXIgY2hhbmdlcyBzdWdnZXN0ZWQgYnkgUm9i ZXJ0byBTYXNzdS4KCnY5OgogICogUmV3cml0ZSBJUEUgcGFyc2VyIHRvIHVzZSBrZXJuZWwgbWF0 Y2hfdGFibGUgcGFyc2VyLgogICogQWRhcHQgZXhpc3RpbmcgSVBFIHByb3BlcnRpZXMgdG8gdGhl IG5ldyBwYXJzZXIuCiAgKiBSZW1vdmUgaXBlX2NvbnRleHQsIHF1b3RlIHBvbGljeSBzeW50YXgs IGtlcm5lbF9yZWFkIGZvciBzaW1wbGljaXR5LgogICogQWRkIG5ldyBmdW5jdGlvbiBpbiB0aGUg c2VjdXJpdHkgZmlsZSBzeXN0ZW0gdG8gZGVsZXRlIElQRSBwb2xpY3kuCiAgKiBNYWtlIElQRSBh dWRpdCBidWlsdGluIGFuZCBjaGFuZ2Ugc2V2ZXJhbCBhdWRpdCBmb3JtYXRzLgogICogTWFrZSBi b290X3ZlcmlmaWVkIHByb3BlcnR5IGJ1aWx0aW4KCkRldmVuIEJvd2VycyAoMTMpOgogIHNlY3Vy aXR5OiBhZGQgaXBlIGxzbQogIGlwZTogYWRkIHBvbGljeSBwYXJzZXIKICBpcGU6IGFkZCBldmFs dWF0aW9uIGxvb3AgYW5kIGludHJvZHVjZSAnYm9vdF92ZXJpZmllZCcgYXMgYSB0cnVzdAogICAg cHJvdmlkZXIKICBpcGU6IGFkZCB1c2Vyc3BhY2UgaW50ZXJmYWNlCiAgaXBlOiBhZGQgTFNNIGhv b2tzIG9uIGV4ZWN1dGlvbiBhbmQga2VybmVsIHJlYWQKICB1YXBpfGF1ZGl0fGlwZTogYWRkIGlw ZSBhdWRpdGluZyBzdXBwb3J0CiAgaXBlOiBhZGQgcGVybWlzc2l2ZSB0b2dnbGUKICBibG9ja3xz ZWN1cml0eTogYWRkIExTTSBibG9iIHRvIGJsb2NrX2RldmljZQogIGRtLXZlcml0eTogY29uc3Vt ZSByb290IGhhc2ggZGlnZXN0IGFuZCBzaWduYXR1cmUgZGF0YSB2aWEgTFNNIGhvb2sKICBpcGU6 IGFkZCBzdXBwb3J0IGZvciBkbS12ZXJpdHkgYXMgYSB0cnVzdCBwcm92aWRlcgogIHNjcmlwdHM6 IGFkZCBib290IHBvbGljeSBnZW5lcmF0aW9uIHByb2dyYW0KICBpcGU6IGt1bml0IHRlc3QgZm9y IHBhcnNlcgogIGRvY3VtZW50YXRpb246IGFkZCBpcGUgZG9jdW1lbnRhdGlvbgoKRmFuIFd1ICgz KToKICBzZWN1cml0eTogYWRkIG5ldyBzZWN1cml0eWZzIGRlbGV0ZSBmdW5jdGlvbgogIGZzdmVy aXR5OiBjb25zdW1lIGJ1aWx0aW4gc2lnbmF0dXJlIHZpYSBMU00gaG9vawogIGlwZTogZW5hYmxl IHN1cHBvcnQgZm9yIGZzLXZlcml0eSBhcyBhIHRydXN0IHByb3ZpZGVyCgogRG9jdW1lbnRhdGlv bi9hZG1pbi1ndWlkZS9MU00vaW5kZXgucnN0ICAgICAgIHwgICAxICsKIERvY3VtZW50YXRpb24v YWRtaW4tZ3VpZGUvTFNNL2lwZS5yc3QgICAgICAgICB8IDcyOSArKysrKysrKysrKysrKysrKysK IC4uLi9hZG1pbi1ndWlkZS9rZXJuZWwtcGFyYW1ldGVycy50eHQgICAgICAgICB8ICAxMiArCiBE b2N1bWVudGF0aW9uL3NlY3VyaXR5L2luZGV4LnJzdCAgICAgICAgICAgICAgfCAgIDEgKwogRG9j dW1lbnRhdGlvbi9zZWN1cml0eS9pcGUucnN0ICAgICAgICAgICAgICAgIHwgNDM2ICsrKysrKysr KysrCiBNQUlOVEFJTkVSUyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfCAgIDgg KwogYmxvY2svYmRldi5jICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHwgICA3ICsK IGRyaXZlcnMvbWQvZG0tdmVyaXR5LXRhcmdldC5jICAgICAgICAgICAgICAgICB8ICAyNSArLQog ZHJpdmVycy9tZC9kbS12ZXJpdHktdmVyaWZ5LXNpZy5jICAgICAgICAgICAgIHwgIDE2ICstCiBk cml2ZXJzL21kL2RtLXZlcml0eS12ZXJpZnktc2lnLmggICAgICAgICAgICAgfCAgMTAgKy0KIGZz L3Zlcml0eS9mc3Zlcml0eV9wcml2YXRlLmggICAgICAgICAgICAgICAgICB8ICAgMiArLQogZnMv dmVyaXR5L29wZW4uYyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHwgIDEzICstCiBmcy92 ZXJpdHkvc2lnbmF0dXJlLmMgICAgICAgICAgICAgICAgICAgICAgICAgfCAgIDEgKwogaW5jbHVk ZS9saW51eC9ibGtfdHlwZXMuaCAgICAgICAgICAgICAgICAgICAgIHwgICAzICsKIGluY2x1ZGUv bGludXgvZG0tdmVyaXR5LmggICAgICAgICAgICAgICAgICAgICB8ICAxOSArCiBpbmNsdWRlL2xp bnV4L2ZzdmVyaXR5LmggICAgICAgICAgICAgICAgICAgICAgfCAgIDIgKwogaW5jbHVkZS9saW51 eC9sc21faG9va19kZWZzLmggICAgICAgICAgICAgICAgIHwgICA1ICsKIGluY2x1ZGUvbGludXgv bHNtX2hvb2tzLmggICAgICAgICAgICAgICAgICAgICB8ICAxMiArCiBpbmNsdWRlL2xpbnV4L3Nl Y3VyaXR5LmggICAgICAgICAgICAgICAgICAgICAgfCAgMjMgKwogaW5jbHVkZS91YXBpL2xpbnV4 L2F1ZGl0LmggICAgICAgICAgICAgICAgICAgIHwgICAxICsKIHNjcmlwdHMvTWFrZWZpbGUgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICB8ICAgMSArCiBzY3JpcHRzL2lwZS9NYWtlZmlsZSAg ICAgICAgICAgICAgICAgICAgICAgICAgfCAgIDIgKwogc2NyaXB0cy9pcGUvcG9sZ2VuLy5naXRp Z25vcmUgICAgICAgICAgICAgICAgIHwgICAxICsKIHNjcmlwdHMvaXBlL3BvbGdlbi9NYWtlZmls ZSAgICAgICAgICAgICAgICAgICB8ICAgNiArCiBzY3JpcHRzL2lwZS9wb2xnZW4vcG9sZ2VuLmMg ICAgICAgICAgICAgICAgICAgfCAxNDUgKysrKwogc2VjdXJpdHkvS2NvbmZpZyAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIHwgIDExICstCiBzZWN1cml0eS9NYWtlZmlsZSAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgfCAgIDEgKwogc2VjdXJpdHkvaW5vZGUuYyAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIHwgIDI1ICsKIHNlY3VyaXR5L2lwZS8uZ2l0aWdub3JlICAgICAgICAg ICAgICAgICAgICAgICB8ICAgMSArCiBzZWN1cml0eS9pcGUvS2NvbmZpZyAgICAgICAgICAgICAg ICAgICAgICAgICAgfCAgNzUgKysKIHNlY3VyaXR5L2lwZS9NYWtlZmlsZSAgICAgICAgICAgICAg ICAgICAgICAgICB8ICAzMiArCiBzZWN1cml0eS9pcGUvYXVkaXQuYyAgICAgICAgICAgICAgICAg ICAgICAgICAgfCAyNzkgKysrKysrKwogc2VjdXJpdHkvaXBlL2F1ZGl0LmggICAgICAgICAgICAg ICAgICAgICAgICAgIHwgIDE5ICsKIHNlY3VyaXR5L2lwZS9kaWdlc3QuYyAgICAgICAgICAgICAg ICAgICAgICAgICB8IDE0NCArKysrCiBzZWN1cml0eS9pcGUvZGlnZXN0LmggICAgICAgICAgICAg ICAgICAgICAgICAgfCAgMjYgKwogc2VjdXJpdHkvaXBlL2V2YWwuYyAgICAgICAgICAgICAgICAg ICAgICAgICAgIHwgNDI0ICsrKysrKysrKysKIHNlY3VyaXR5L2lwZS9ldmFsLmggICAgICAgICAg ICAgICAgICAgICAgICAgICB8ICA2MCArKwogc2VjdXJpdHkvaXBlL2ZzLmMgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIHwgMjQyICsrKysrKwogc2VjdXJpdHkvaXBlL2ZzLmggICAgICAgICAg ICAgICAgICAgICAgICAgICAgIHwgIDE3ICsKIHNlY3VyaXR5L2lwZS9ob29rcy5jICAgICAgICAg ICAgICAgICAgICAgICAgICB8IDI3NSArKysrKysrCiBzZWN1cml0eS9pcGUvaG9va3MuaCAgICAg ICAgICAgICAgICAgICAgICAgICAgfCAgNDIgKwogc2VjdXJpdHkvaXBlL2lwZS5jICAgICAgICAg ICAgICAgICAgICAgICAgICAgIHwgIDk3ICsrKwogc2VjdXJpdHkvaXBlL2lwZS5oICAgICAgICAg ICAgICAgICAgICAgICAgICAgIHwgIDIyICsKIHNlY3VyaXR5L2lwZS9wb2xpY3kuYyAgICAgICAg ICAgICAgICAgICAgICAgICB8IDI1OSArKysrKysrCiBzZWN1cml0eS9pcGUvcG9saWN5LmggICAg ICAgICAgICAgICAgICAgICAgICAgfCAgOTMgKysrCiBzZWN1cml0eS9pcGUvcG9saWN5X2ZzLmMg ICAgICAgICAgICAgICAgICAgICAgfCA0NTkgKysrKysrKysrKysKIHNlY3VyaXR5L2lwZS9wb2xp Y3lfcGFyc2VyLmMgICAgICAgICAgICAgICAgICB8IDU0NSArKysrKysrKysrKysrCiBzZWN1cml0 eS9pcGUvcG9saWN5X3BhcnNlci5oICAgICAgICAgICAgICAgICAgfCAgMTEgKwogc2VjdXJpdHkv aXBlL3BvbGljeV90ZXN0cy5jICAgICAgICAgICAgICAgICAgIHwgMjk0ICsrKysrKysKIHNlY3Vy aXR5L3NlY3VyaXR5LmMgICAgICAgICAgICAgICAgICAgICAgICAgICB8ICA3MCArKwogNTAgZmls ZXMgY2hhbmdlZCwgNDk4OCBpbnNlcnRpb25zKCspLCAxNiBkZWxldGlvbnMoLSkKIGNyZWF0ZSBt b2RlIDEwMDY0NCBEb2N1bWVudGF0aW9uL2FkbWluLWd1aWRlL0xTTS9pcGUucnN0CiBjcmVhdGUg bW9kZSAxMDA2NDQgRG9jdW1lbnRhdGlvbi9zZWN1cml0eS9pcGUucnN0CiBjcmVhdGUgbW9kZSAx MDA2NDQgaW5jbHVkZS9saW51eC9kbS12ZXJpdHkuaAogY3JlYXRlIG1vZGUgMTAwNjQ0IHNjcmlw dHMvaXBlL01ha2VmaWxlCiBjcmVhdGUgbW9kZSAxMDA2NDQgc2NyaXB0cy9pcGUvcG9sZ2VuLy5n aXRpZ25vcmUKIGNyZWF0ZSBtb2RlIDEwMDY0NCBzY3JpcHRzL2lwZS9wb2xnZW4vTWFrZWZpbGUK IGNyZWF0ZSBtb2RlIDEwMDY0NCBzY3JpcHRzL2lwZS9wb2xnZW4vcG9sZ2VuLmMKIGNyZWF0ZSBt b2RlIDEwMDY0NCBzZWN1cml0eS9pcGUvLmdpdGlnbm9yZQogY3JlYXRlIG1vZGUgMTAwNjQ0IHNl Y3VyaXR5L2lwZS9LY29uZmlnCiBjcmVhdGUgbW9kZSAxMDA2NDQgc2VjdXJpdHkvaXBlL01ha2Vm aWxlCiBjcmVhdGUgbW9kZSAxMDA2NDQgc2VjdXJpdHkvaXBlL2F1ZGl0LmMKIGNyZWF0ZSBtb2Rl IDEwMDY0NCBzZWN1cml0eS9pcGUvYXVkaXQuaAogY3JlYXRlIG1vZGUgMTAwNjQ0IHNlY3VyaXR5 L2lwZS9kaWdlc3QuYwogY3JlYXRlIG1vZGUgMTAwNjQ0IHNlY3VyaXR5L2lwZS9kaWdlc3QuaAog Y3JlYXRlIG1vZGUgMTAwNjQ0IHNlY3VyaXR5L2lwZS9ldmFsLmMKIGNyZWF0ZSBtb2RlIDEwMDY0 NCBzZWN1cml0eS9pcGUvZXZhbC5oCiBjcmVhdGUgbW9kZSAxMDA2NDQgc2VjdXJpdHkvaXBlL2Zz LmMKIGNyZWF0ZSBtb2RlIDEwMDY0NCBzZWN1cml0eS9pcGUvZnMuaAogY3JlYXRlIG1vZGUgMTAw NjQ0IHNlY3VyaXR5L2lwZS9ob29rcy5jCiBjcmVhdGUgbW9kZSAxMDA2NDQgc2VjdXJpdHkvaXBl L2hvb2tzLmgKIGNyZWF0ZSBtb2RlIDEwMDY0NCBzZWN1cml0eS9pcGUvaXBlLmMKIGNyZWF0ZSBt b2RlIDEwMDY0NCBzZWN1cml0eS9pcGUvaXBlLmgKIGNyZWF0ZSBtb2RlIDEwMDY0NCBzZWN1cml0 eS9pcGUvcG9saWN5LmMKIGNyZWF0ZSBtb2RlIDEwMDY0NCBzZWN1cml0eS9pcGUvcG9saWN5LmgK IGNyZWF0ZSBtb2RlIDEwMDY0NCBzZWN1cml0eS9pcGUvcG9saWN5X2ZzLmMKIGNyZWF0ZSBtb2Rl IDEwMDY0NCBzZWN1cml0eS9pcGUvcG9saWN5X3BhcnNlci5jCiBjcmVhdGUgbW9kZSAxMDA2NDQg c2VjdXJpdHkvaXBlL3BvbGljeV9wYXJzZXIuaAogY3JlYXRlIG1vZGUgMTAwNjQ0IHNlY3VyaXR5 L2lwZS9wb2xpY3lfdGVzdHMuYwoKLS0gCjIuMzkuMAoKLS0KTGludXgtYXVkaXQgbWFpbGluZyBs aXN0CkxpbnV4LWF1ZGl0QHJlZGhhdC5jb20KaHR0cHM6Ly9saXN0bWFuLnJlZGhhdC5jb20vbWFp bG1hbi9saXN0aW5mby9saW51eC1hdWRpdAo= From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DC6E0C64EC6 for ; Mon, 30 Jan 2023 22:58:52 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230202AbjA3W6u (ORCPT ); Mon, 30 Jan 2023 17:58:50 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55240 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229501AbjA3W6o (ORCPT ); Mon, 30 Jan 2023 17:58:44 -0500 Received: from linux.microsoft.com (linux.microsoft.com [13.77.154.182]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 35E8B17CFF; Mon, 30 Jan 2023 14:58:42 -0800 (PST) Received: by linux.microsoft.com (Postfix, from userid 1052) id E04B220E9FB1; Mon, 30 Jan 2023 14:58:41 -0800 (PST) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com E04B220E9FB1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.microsoft.com; s=default; t=1675119521; bh=5qiayccWWeIprZftNcexwMPx/3TPh3cnTMySbicNepo=; h=From:To:Cc:Subject:Date:From; b=WYHER4iAN1x9X5AlLg6KY8c9gz9YX3ZWe3KwhVjHt0qFYOw4gJK0eRoPk9hqADkeS eo2PES9sSV6nD8T5JMylRuWud4oHiedmT6jivfW8Kci0h9i1ILhz/18Zt1SWWB9hPE n+EavpG6dCHIWQ46rBhYrpyIdI6vOchBueSL65jE= From: Fan Wu To: corbet@lwn.net, zohar@linux.ibm.com, jmorris@namei.org, serge@hallyn.com, tytso@mit.edu, ebiggers@kernel.org, axboe@kernel.dk, agk@redhat.com, snitzer@kernel.org, eparis@redhat.com, paul@paul-moore.com Cc: linux-doc@vger.kernel.org, linux-integrity@vger.kernel.org, linux-security-module@vger.kernel.org, linux-fscrypt@vger.kernel.org, linux-block@vger.kernel.org, dm-devel@redhat.com, linux-audit@redhat.com, roberto.sassu@huawei.com, linux-kernel@vger.kernel.org, Fan Wu Subject: [RFC PATCH v9 00/16] Integrity Policy Enforcement LSM (IPE) Date: Mon, 30 Jan 2023 14:57:15 -0800 Message-Id: <1675119451-23180-1-git-send-email-wufan@linux.microsoft.com> X-Mailer: git-send-email 1.8.3.1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-block@vger.kernel.org Overview: --------- IPE is a Linux Security Module which takes a complimentary approach to access control. Whereas existing mandatory access control mechanisms base their decisions on labels and paths, IPE instead determines whether or not an operation should be allowed based on immutable security properties of the system component the operation is being performed on. IPE itself does not mandate how the security property should be evaluated, but relies on an extensible set of external property providers to evaluate the component. IPE makes its decision based on reference values for the selected properties, specified in the IPE policy. The reference values represent the value that the policy writer and the local system administrator (based on the policy signature) trust for the system to accomplish the desired tasks. One such provider is for example dm-verity, which is able to represent the integrity property of a partition (its immutable state) with a digest. IPE is compiled under CONFIG_SECURITY_IPE. Use Cases --------- IPE works best in fixed-function devices: Devices in which their purpose is clearly defined and not supposed to be changed (e.g. network firewall device in a data center, an IoT device, etcetera), where all software and configuration is built and provisioned by the system owner. IPE is a long-way off for use in general-purpose computing: the Linux community as a whole tends to follow a decentralized trust model, known as the web of trust, which IPE has no support for as of yet. There are exceptions, such as the case where a Linux distribution vendor trusts only their own keys, where IPE can successfully be used to enforce the trust requirement. Additionally, while most packages are signed today, the files inside the packages (for instance, the executables), tend to be unsigned. This makes it difficult to utilize IPE in systems where a package manager is expected to be functional, without major changes to the package manager and ecosystem behind it. DIGLIM[1] is a system that when combined with IPE, could be used to enable general purpose computing scenarios. Policy: ------- IPE policy is a plain-text policy composed of multiple statements over several lines. There is one required line, at the top of the policy, indicating the policy name, and the policy version, for instance: policy_name=Ex_Policy policy_version=0.0.0 The policy version indicates the current version of the policy. This is used to prevent roll-back of policy to potentially insecure previous versions of the policy. The next portion of IPE policy, are rules. Rules are formed by key=value pairs, known as properties. IPE rules require two keys: "action", which determines what IPE does when it encounters a match against the policy and "op", which determines when that rule should be evaluated. Thus, a minimal rule is: op=EXECUTE action=ALLOW This example rule will allow any execution. A rule is required to have the "op" property as the first token of a rule, and the "action" as the last token of the rule. Additional properties are used to restrict attributes about the files being evaluated. These properties are intended to be deterministic attributes that are resident in the kernel. For example: op=EXECUTE dmverity_signature=FALSE action=DENY This rule with property dmverity_signature will deny any file not from a signed dmverity volume to be executed. All available properties for IPE described in the documentation patch of this series. Rules are evaluated top-to-bottom. As a result, any revocation rules, or denies should be placed early in the file to ensure that these rules are evaluated before a rule with "action=ALLOW" is hit. Any unknown syntax in IPE policy will result in a fatal error to parse the policy. Additionally, a DEFAULT operation must be set for all understood operations within IPE. For policies to remain completely forwards compatible, it is recommended that users add a "DEFAULT action=ALLOW" and override the defaults on a per-operation basis. For more information about the policy syntax, see the kernel documentation page. Early Usermode Protection: -------------------------- IPE can be provided with a policy at startup to load and enforce. This is intended to be a minimal policy to get the system to a state where userspace is setup and ready to receive commands, at which point a policy can be deployed via securityfs. This "boot policy" can be specified via the config, SECURITY_IPE_BOOT_POLICY, which accepts a path to a plain-text version of the IPE policy to apply. This policy will be compiled into the kernel. If not specified, IPE will be disabled until a policy is deployed and activated through the method above. Policy Examples: ---------------- Allow all: policy_name=Allow_All policy_version=0.0.0 DEFAULT action=ALLOW Allow only initial superblock: policy_name=Allow_All_Initial_SB policy_version=0.0.0 DEFAULT action=DENY op=EXECUTE boot_verified=TRUE action=ALLOW Allow any signed dm-verity volume and the initial superblock: policy_name=AllowSignedAndInitial policy_version=0.0.0 DEFAULT action=DENY op=EXECUTE boot_verified=TRUE action=ALLOW op=EXECUTE dmverity_signature=TRUE action=ALLOW Prohibit execution from a specific dm-verity volume, while allowing all signed volumes and the initial superblock: policy_name=ProhibitSingleVolume policy_version=0.0.0 DEFAULT action=DENY op=EXECUTE dmverity_roothash=sha256:401fcec5944823ae12f62726e8184407a5fa9599783f030dec146938 action=DENY op=EXECUTE boot_verified=TRUE action=ALLOW op=EXECUTE dmverity_signature=TRUE action=ALLOW Allow only a specific dm-verity volume: policy_name=AllowSpecific policy_version=0.0.0 DEFAULT action=DENY op=EXECUTE dmverity_roothash=sha256:401fcec5944823ae12f62726e8184407a5fa9599783f030dec146938 action=ALLOW Allow any signed fs-verity file policy_name="AllowSignedFSVerity" policy_version=0.0.0 DEFAULT action=DENY op=EXECUTE fsverity_signature=TRUE action=ALLOW Deny a specific fs-verity file: policy_name="ProhibitSpecificFSVF" policy_version=0.0.0 DEFAULT action=DENY op=EXECUTE fsverity_digest=sha256:fd88f2b8824e197f850bf4c5109bea5cf0ee38104f710843bb72da796ba5af9e action=DENY op=EXECUTE boot_verified=TRUE action=ALLOW op=EXECUTE dmverity_signature=TRUE action=ALLOW Deploying Policies: ------------------- First sign a plain text policy, with a certificate that is present in the SYSTEM_TRUSTED_KEYRING of your test machine. Through openssl, the signing can be done via: openssl smime -sign -in "$MY_POLICY" -signer "$MY_CERTIFICATE" \ -inkey "$MY_PRIVATE_KEY" -outform der -noattr -nodetach \ -out "$MY_POLICY.p7s" Then, simply cat the file into the IPE's "new_policy" securityfs node: cat "$MY_POLICY.p7s" > /sys/kernel/security/ipe/new_policy The policy should now be present under the policies/ subdirectory, under its "policy_name" attribute. The policy is now present in the kernel and can be marked as active, via the securityfs node: echo 1 > "/sys/kernel/security/ipe/$MY_POLICY_NAME/active" This will now mark the policy as active and the system will be enforcing $MY_POLICY_NAME. There is one requirement when marking a policy as active, the policy_version attribute must either increase, or remain the same as the currently running policy. Policies can be updated via: cat "$MY_UPDATED_POLICY.p7s" > \ "/sys/kernel/security/ipe/policies/$MY_POLICY_NAME/update" Additionally, policies can be deleted via the "delete" securityfs node. Simply write "1" to the corresponding node in the policy folder: echo 1 > "/sys/kernel/security/ipe/policies/$MY_POLICY_NAME/delete" There is only one requirement to delete policies, the policy being deleted must not be the active policy. NOTE: Any securityfs write to IPE's nodes will require CAP_MAC_ADMIN. Integrations: ------------- This patch series adds support for fsverity via digest and signature (fsverity_signature and fsverity_digest), dm-verity by digest and signature (dmverity_signature and dmverity_roothash), and trust for the initramfs (boot_verified). Please see the documentation patch for more information about the integrations available. Testing: -------- KUnit Tests are available. Recommended kunitconfig: CONFIG_KUNIT=y CONFIG_SECURITY=y CONFIG_SECURITYFS=y CONFIG_PKCS7_MESSAGE_PARSER=y CONFIG_SYSTEM_DATA_VERIFICATION=y CONFIG_FS_VERITY=y CONFIG_FS_VERITY_BUILTIN_SIGNATURES=y CONFIG_BLOCK=y CONFIG_MD=y CONFIG_BLK_DEV_DM=y CONFIG_DM_VERITY=y CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG=y CONFIG_NET=y CONFIG_AUDIT=y CONFIG_AUDITSYSCALL=y CONFIG_SECURITY_IPE=y CONFIG_IPE_PROP_DM_VERITY=y CONFIG_IPE_PROP_FS_VERITY=y CONFIG_SECURITY_IPE_KUNIT_TEST=y Simply run: make ARCH=um mrproper ./tools/testing/kunit/kunit.py run --kunitconfig And the tests will execute and report the result. For more indepth testing, it will require you to create and mount a dm-verity volume or fs-verity enabled file. Documentation: -------------- There is both documentation available on github at https://microsoft.github.io/ipe, and Documentation in this patch series, to be added in-tree. Known Gaps: ----------- IPE has two known gaps: 1. IPE cannot verify the integrity of anonymous executable memory, such as the trampolines created by gcc closures and libffi (<3.4.2), or JIT'd code. Unfortunately, as this is dynamically generated code, there is no way for IPE to ensure the integrity of this code to form a trust basis. In all cases, the return result for these operations will be whatever the admin configures the DEFAULT action for "EXECUTE". 2. IPE cannot verify the integrity of interpreted languages' programs when these scripts invoked via `` ``. This is because the way interpreters execute these files, the scripts themselves are not evaluated as executable code through one of IPE's hooks. Interpreters can be enlightened to the usage of IPE by trying to mmap a file into executable memory (+X), after opening the file and responding to the error code appropriately. This also applies to included files, or high value files, such as configuration files of critical system components. Appendix: --------- A. IPE Github Repository: https://github.com/microsoft/ipe B. IPE Users' Guide: Documentation/admin-guide/LSM/ipe.rst References: ----------- 1: https://lore.kernel.org/bpf/4d6932e96d774227b42721d9f645ba51@huawei.com/T/ FAQ: ---- Q: What is the difference between IMA and IPE? A: See the documentation patch for more on this topic. Previous Postings ----------------- v1: https://lore.kernel.org/all/20200406181045.1024164-1-deven.desai@linux.microsoft.com/ v2: https://lore.kernel.org/all/20200406221439.1469862-1-deven.desai@linux.microsoft.com/ v3: https://lore.kernel.org/all/20200415162550.2324-1-deven.desai@linux.microsoft.com/ v4: https://lore.kernel.org/all/20200717230941.1190744-1-deven.desai@linux.microsoft.com/ v5: https://lore.kernel.org/all/20200728213614.586312-1-deven.desai@linux.microsoft.com/ v6: https://lore.kernel.org/all/20200730003113.2561644-1-deven.desai@linux.microsoft.com/ v7: https://lore.kernel.org/all/1634151995-16266-1-git-send-email-deven.desai@linux.microsoft.com/ v8: https://lore.kernel.org/all/1654714889-26728-1-git-send-email-deven.desai@linux.microsoft.com/ Changelog: ---------- v2: Split the second patch of the previous series into two. Minor corrections in the cover-letter and documentation comments regarding CAP_MAC_ADMIN checks in IPE. v3: Address various comments by Jann Horn. Highlights: Switch various audit allocators to GFP_KERNEL. Utilize rcu_access_pointer() in various locations. Strip out the caching system for properties Strip comments from headers Move functions around in patches Remove kernel command line parameters Reconcile the race condition on the delete node for policy by expanding the policy critical section. Address a few comments by Jonathan Corbet around the documentation pages for IPE. Fix an issue with the initialization of IPE policy with a "-0" version, caused by not initializing the hlist entries before freeing. v4: Address a concern around IPE's behavior with unknown syntax. Specifically, make any unknown syntax a fatal error instead of a warning, as suggested by Mickaël Salaün. Introduce a new securityfs node, $securityfs/ipe/property_config, which provides a listing of what properties are enabled by the kernel and their versions. This allows usermode to predict what policies should be allowed. Strip some comments from c files that I missed. Clarify some documentation comments around 'boot_verified'. While this currently does not functionally change the property itself, the distinction is important when IPE can enforce verified reads. Additionally, 'KERNEL_READ' was omitted from the documentation. This has been corrected. Change SecurityFS and SHA1 to a reverse dependency. Update the cover-letter with the updated behavior of unknown syntax. Remove all sysctls, making an equivalent function in securityfs. Rework the active/delete mechanism to be a node under the policy in $securityfs/ipe/policies. The kernel command line parameters ipe.enforce and ipe.success_audit have returned as this functionality is no longer exposed through sysfs. v5: Correct some grammatical errors reported by Randy Dunlap. Fix some warnings reported by kernel test bot. Change convention around security_bdev_setsecurity. -ENOSYS is now expected if an LSM does not implement a particular @name, as suggested by Casey Schaufler. Minor string corrections related to the move from sysfs to securityfs Correct a spelling of an #ifdef for the permissive argument. Add the kernel parameters re-added to the documentation. Fix a minor bug where the mode being audited on permissive switch was the original mode, not the mode being swapped to. Cleanup doc comments, fix some whitespace alignment issues. v6: Change if statement condition in security_bdev_setsecurity to be more concise, as suggested by Casey Schaufler and Al Viro Drop the 6th patch in the series, "dm-verity move signature check..." due to numerous issues, and it ultimately providing no real value. Fix the patch tree - the previous iteration appears to have been in a torn state (patches 8+9 were merged). This has since been corrected. v7: * Reword cover letter to more accurate convey IPE's purpose and latest updates. * Refactor series to: 1. Support a context structure, enabling: 1. Easier Testing via KUNIT 2. A better architecture for future designs 2. Make parser code cleaner * Move patch 01/12 to [14/16] of the series * Split up patch 02/12 into four parts: 1. context creation [01/16] 2. audit [07/16] 3. evaluation loop [03/16] 4. access control hooks [05/16] 5. permissive mode [08/16] * Split up patch 03/12 into two parts: 1. parser [02/16] 2. userspace interface [04/16] * Reword and refactor patch 04/12 to [09/16] * Squash patch 05/12, 07/12, 09/12 to [10/16] * Squash patch 08/12, 10/12 to [11/16] * Change audit records to MAC region (14XX) from Integrity region (18XX) * Add FSVerity Support * Interface changes: 1. "raw" was renamed to "pkcs7" and made read only 2. "raw"'s write functionality (update a policy) moved to "update" 3. introduced "version", "policy_name" nodes. 4. "content" renamed to "policy" 5. The boot policy can now be updated like any other policy. * Add additional developer-level documentation * Update admin-guide docs to reflect changes. * Kunit tests * Dropped CONFIG_SECURITY_IPE_PERMISSIVE_SWITCH - functionality can easily come later with a small patch. * Use partition0 for block_device for dm-verity patch v8: * Add changelog information to individual commits * A large number of changes to the audit patch. * split fs/ & security/ changes to two separate patches. * split block/, security/ & drivers/md/ changes to separate patches. * Add some historical context to what lead to the creation of IPE in the documentation patch. * Cover-letter changes suggested by Roberto Sassu. v9: * Rewrite IPE parser to use kernel match_table parser. * Adapt existing IPE properties to the new parser. * Remove ipe_context, quote policy syntax, kernel_read for simplicity. * Add new function in the security file system to delete IPE policy. * Make IPE audit builtin and change several audit formats. * Make boot_verified property builtin Deven Bowers (13): security: add ipe lsm ipe: add policy parser ipe: add evaluation loop and introduce 'boot_verified' as a trust provider ipe: add userspace interface ipe: add LSM hooks on execution and kernel read uapi|audit|ipe: add ipe auditing support ipe: add permissive toggle block|security: add LSM blob to block_device dm-verity: consume root hash digest and signature data via LSM hook ipe: add support for dm-verity as a trust provider scripts: add boot policy generation program ipe: kunit test for parser documentation: add ipe documentation Fan Wu (3): security: add new securityfs delete function fsverity: consume builtin signature via LSM hook ipe: enable support for fs-verity as a trust provider Documentation/admin-guide/LSM/index.rst | 1 + Documentation/admin-guide/LSM/ipe.rst | 729 ++++++++++++++++++ .../admin-guide/kernel-parameters.txt | 12 + Documentation/security/index.rst | 1 + Documentation/security/ipe.rst | 436 +++++++++++ MAINTAINERS | 8 + block/bdev.c | 7 + drivers/md/dm-verity-target.c | 25 +- drivers/md/dm-verity-verify-sig.c | 16 +- drivers/md/dm-verity-verify-sig.h | 10 +- fs/verity/fsverity_private.h | 2 +- fs/verity/open.c | 13 +- fs/verity/signature.c | 1 + include/linux/blk_types.h | 3 + include/linux/dm-verity.h | 19 + include/linux/fsverity.h | 2 + include/linux/lsm_hook_defs.h | 5 + include/linux/lsm_hooks.h | 12 + include/linux/security.h | 23 + include/uapi/linux/audit.h | 1 + scripts/Makefile | 1 + scripts/ipe/Makefile | 2 + scripts/ipe/polgen/.gitignore | 1 + scripts/ipe/polgen/Makefile | 6 + scripts/ipe/polgen/polgen.c | 145 ++++ security/Kconfig | 11 +- security/Makefile | 1 + security/inode.c | 25 + security/ipe/.gitignore | 1 + security/ipe/Kconfig | 75 ++ security/ipe/Makefile | 32 + security/ipe/audit.c | 279 +++++++ security/ipe/audit.h | 19 + security/ipe/digest.c | 144 ++++ security/ipe/digest.h | 26 + security/ipe/eval.c | 424 ++++++++++ security/ipe/eval.h | 60 ++ security/ipe/fs.c | 242 ++++++ security/ipe/fs.h | 17 + security/ipe/hooks.c | 275 +++++++ security/ipe/hooks.h | 42 + security/ipe/ipe.c | 97 +++ security/ipe/ipe.h | 22 + security/ipe/policy.c | 259 +++++++ security/ipe/policy.h | 93 +++ security/ipe/policy_fs.c | 459 +++++++++++ security/ipe/policy_parser.c | 545 +++++++++++++ security/ipe/policy_parser.h | 11 + security/ipe/policy_tests.c | 294 +++++++ security/security.c | 70 ++ 50 files changed, 4988 insertions(+), 16 deletions(-) create mode 100644 Documentation/admin-guide/LSM/ipe.rst create mode 100644 Documentation/security/ipe.rst create mode 100644 include/linux/dm-verity.h create mode 100644 scripts/ipe/Makefile create mode 100644 scripts/ipe/polgen/.gitignore create mode 100644 scripts/ipe/polgen/Makefile create mode 100644 scripts/ipe/polgen/polgen.c create mode 100644 security/ipe/.gitignore create mode 100644 security/ipe/Kconfig create mode 100644 security/ipe/Makefile create mode 100644 security/ipe/audit.c create mode 100644 security/ipe/audit.h create mode 100644 security/ipe/digest.c create mode 100644 security/ipe/digest.h create mode 100644 security/ipe/eval.c create mode 100644 security/ipe/eval.h create mode 100644 security/ipe/fs.c create mode 100644 security/ipe/fs.h create mode 100644 security/ipe/hooks.c create mode 100644 security/ipe/hooks.h create mode 100644 security/ipe/ipe.c create mode 100644 security/ipe/ipe.h create mode 100644 security/ipe/policy.c create mode 100644 security/ipe/policy.h create mode 100644 security/ipe/policy_fs.c create mode 100644 security/ipe/policy_parser.c create mode 100644 security/ipe/policy_parser.h create mode 100644 security/ipe/policy_tests.c -- 2.39.0