From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp-bc0d.mail.infomaniak.ch (smtp-bc0d.mail.infomaniak.ch [45.157.188.13]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A94F715FA60 for ; Thu, 25 Jul 2024 09:12:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=45.157.188.13 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1721898770; cv=none; b=ffGRFATp2EtQ/raayWWk9pNrqrp3dBjjOgCFx8YTgKwSXSIe43FCMXf+KMFeJ1dmvIr8LcyFaPAoQOsryT4XnTYvgYR31/BtIysFM1vqdj5i0Izh3Acviu4fJOXYg9Lta56+4o/dR5lDy74nxFuIv/txEKWtoApwd1GNJvBp0K0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1721898770; c=relaxed/simple; bh=M1DIfw/8y8TYjl34EtfuPfTvqlwEq7Ssrj/kLCT2bM0=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=nUfihZmassEdwOy6d7O0EfBAPgSGjJRkBomDXzcmWaLEvxvX630/ohNqPSZzHixMvjVzU89HiYoQldgzJyhSGca/VXnJyxjs0eK8xYrQj0kjx6fDiDkj5A7zWMaioM9+n/adtxwk0yWjg4iyPWUfxvq28mZF6m8xc+IT/C8YMEw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=digikod.net; spf=pass smtp.mailfrom=digikod.net; dkim=pass (1024-bit key) header.d=digikod.net header.i=@digikod.net header.b=NFuNHXbh; arc=none smtp.client-ip=45.157.188.13 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=digikod.net Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=digikod.net Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=digikod.net header.i=@digikod.net header.b="NFuNHXbh" Received: from smtp-3-0001.mail.infomaniak.ch (smtp-3-0001.mail.infomaniak.ch [10.4.36.108]) by smtp-4-3000.mail.infomaniak.ch (Postfix) with ESMTPS id 4WV4kw6MLxzfV5; Thu, 25 Jul 2024 11:06:48 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=digikod.net; s=20191114; t=1721898408; bh=3YLAoaGBqf1G92r6BZ71PVCkUapElXjyM/572gLPJxQ=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=NFuNHXbhfmYpdQ5VPjim8Ew0MrSVEl5SWk2o6yxDQBD41dptUaq9BvkbxUnPaa5i5 f3VN1fK1BmzSfk09jT6RK9tCBlSDLqtW+kXG4LWaA50brVhTMm53mO3bQ1Wsl0O0CX KlWxpV25kwTPnytvGTkwCRgyWCECoNVM7v5/EP9M= Received: from unknown by smtp-3-0001.mail.infomaniak.ch (Postfix) with ESMTPA id 4WV4kv6McYz296; Thu, 25 Jul 2024 11:06:47 +0200 (CEST) Date: Thu, 25 Jul 2024 11:06:46 +0200 From: =?utf-8?Q?Micka=C3=ABl_Sala=C3=BCn?= To: Andrea Cervesato Cc: landlock@lists.linux.dev, Petr Vorel , Li Wang , ltp@lists.linux.it, =?utf-8?Q?G=C3=BCnther?= Noack Subject: Re: LTP landlock test is failing for all kernels <= 6.6 Message-ID: <20240725.Sohsez7coh2t@digikod.net> References: <54317d90-ec53-49ff-bbff-15200f09c8d2@suse.com> Precedence: bulk X-Mailing-List: landlock@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <54317d90-ec53-49ff-bbff-15200f09c8d2@suse.com> X-Infomaniak-Routing: alpha Hi Andrea, On Thu, Jul 25, 2024 at 09:50:36AM +0200, Andrea Cervesato wrote: > Hi all, > > we are facing an issue with landlock support in kernels <=6.6. We have a > test that takes in consideration all possible rules set and enable only one > of them, checking that all the others are raising a permission error. > The test can be found here: > https://github.com/acerv/ltp/commit/9b1d6838592cebe3c89282a7339db543be2a00e7 There is definitely an issue in this commit. ALL_RULES contains all access right, mixing filesystem and network ones, which doesn't make sense because they don't have the same "namespace". LANDLOCK_ACCESS_NET_* and LANDLOCK_ACCESS_FS_* bits overlaps. The tester_get_all_rules() function does the ABI checks and removes the LANDLOCK_ACCESS_NET_{BIND,CONNECT}_TCP bits if they are not supported (in the handled_access_net namespace), which is the same as removing LANDLOCK_ACCESS_FS_{EXECUTE,WRITE_FILE} whereas they are supported (in the handled_access_fs namespace). > It work fine for all kernels >= 6.7. LANDLOCK_ACCESS_NET_{BIND,CONNECT}_TCP were introduced with this kernel (Landlock ABI 4), so I guess that's the issue. > > Below you will find the discussion in the LTP mailing list. Can you please > give any help with this? > > Regards, > Andrea > > > > -------- Forwarded Message -------- > Subject: Re: [LTP] [PATCH v3 09/11] Add landlock04 test > Date: Thu, 25 Jul 2024 09:12:39 +0200 > From: Andrea Cervesato > To: Li Wang , Petr Vorel > CC: Andrea Cervesato , ltp@lists.linux.it, > Konstantin Meskhidze > > > > Hi! > > it seems like the landlock() support in kernel 6.6 is different than the one > in 6.7. The reason why we see that error in kernel <=6.6 is related to how > landlock is handling the rules set according to the rule we want to enable. > > Let's suppose we want to enable the execution for a file. What we should be > able to do, is to consider __ALL__ the rules available for landlock, then to > enable EXEC only for a specific file. Then, if we make any other operation > that is not EXEC, we should have a permission error. This translates to: > > - set ruleset_attr->handled_access_fs for all available LANDLOCK_ACCESS_FS_* > rules > - set path_beneath_attr->allowed_access to LANDLOCK_ACCESS_FS_EXEC | > LANDLOCK_ACCESS_FS_READ (we need to read in order to execute) for a binary > - enforce the rules inside a sandbox containing the binary > - execute the binary will work > - do any other operation inside the sandbox and obtain a permissions error > - at this point, any new rule that is added, will update the list of > landlock rules, enabling the sandbox permissions > > For some reasons that I don't know (and this is evident from kselftests as > well), if the initial rules set (ruleset_attr->handled_access_fs) is not > identical to the rules we are going to enable > (path_beneath_attr->allowed_access), landlock_add_rule() will fail with > EINVAL. And this is our case for all kernels <=6.6. path_beneath_attr->allowed_access needs to be a subset of ruleset_attr->handled_access_fs, otherwise it doesn't make sense to allow something which is not handled/denied. > > I really have no idea why this happens and maybe we need to contact the > landlock developers. Feel free to Cc me and Günther for all Landlock-related patches. > > Andrea > > On 7/24/24 15:47, Andrea Cervesato wrote: > > Hi Li, > > > > thanks for checking. Mmmh I don't know if it's because they added > > LANDLOCK_RULE_NET_PORT. It sounds strange to me, since that would break > > all the other features. > > > > Andrea > > > > On 7/24/24 14:12, Li Wang wrote: > > > Hi Petr, Andrea, > > > > > > On Wed, Jul 17, 2024 at 1:27 AM Petr Vorel wrote: > > > > > > Hi Andrea, > > > > > > ... > > > > +static void enable_exec_libs(const int ruleset_fd) > > > > +{ > > > > +     FILE *fp; > > > > +     char line[1024]; > > > > +     char path[PATH_MAX]; > > > > +     char dependency[8][PATH_MAX]; > > > > +     int count = 0; > > > > +     int duplicate = 0; > > > > + > > > > +     fp = SAFE_FOPEN("/proc/self/maps", "r"); > > > > + > > > > +     while (fgets(line, sizeof(line), fp)) { > > > > +             if (strstr(line, ".so") == NULL) > > > > +                     continue; > > > > + > > > > +             SAFE_SSCANF(line, "%*x-%*x %*s %*x %*s %*d %s", > > > path); > > > > + > > > > +             for (int i = 0; i < count; i++) { > > > > +                     if (strcmp(path, dependency[i]) == 0) { > > > > +                             duplicate = 1; > > > > +                             break; > > > > +                     } > > > > +             } > > > > + > > > > +             if (duplicate) { > > > > +                     duplicate = 0; > > > > +                     continue; > > > > +             } > > > > + > > > > +             strncpy(dependency[count], path, PATH_MAX); > > > > +             count++; > > > > + > > > > +             tst_res(TINFO, "Enable read/exec permissions for > > > %s", path); > > > > + > > > > +             path_beneath_attr->allowed_access = > > > > +                     LANDLOCK_ACCESS_FS_READ_FILE | > > > > +                     LANDLOCK_ACCESS_FS_EXECUTE; > > > > +             path_beneath_attr->parent_fd = SAFE_OPEN(path, > > > O_PATH | O_CLOEXEC); > > > > + > > > > +             SAFE_LANDLOCK_ADD_RULE( > > > > +                     ruleset_fd, > > > > +                     LANDLOCK_RULE_PATH_BENEATH, > > > > +                     path_beneath_attr, > > > > +                     0); > > > > > > Unfortunately, on 6.6.15-amd64 kernel (random Debian machine) it > > > fails (after > > > fresh boot) with: > > > > > > ... > > > tst_supported_fs_types.c:97: TINFO: Kernel supports tmpfs > > > tst_supported_fs_types.c:49: TINFO: mkfs is not needed for tmpfs > > > tst_test.c:1746: TINFO: === Testing on ext2 === > > > tst_test.c:1111: TINFO: Formatting /dev/loop1 with ext2 opts='' > > > extra opts='' > > > mke2fs 1.47.0 (5-Feb-2023) > > > tst_test.c:1123: TINFO: Mounting /dev/loop1 to > > > /tmp/LTP_lant6WbKJ/sandbox fstyp=ext2 flags=0 > > > landlock_common.h:30: TINFO: Landlock ABI v3 > > > landlock04.c:151: TINFO: Testing LANDLOCK_ACCESS_FS_EXECUTE > > > landlock04.c:123: TINFO: Enable read/exec permissions for > > > /usr/lib/i386-linux-gnu/libc.so.6 > > > landlock04.c:131: TBROK: landlock_add_rule(3, 1, 0xf7f13ff4, 0): > > > EINVAL (22) > > > > > > > > > Possibly that's because the 'LANDLOCK_RULE_PATH_BENEATH'  was > > > refactored from the v6.7 mainline kernel, so it can't add the rule > > > correctly > > > with older kernels. > > > > > > commit 0e0fc7e8eb4a11bd9f89a9c74bc7c0e144c56203 > > > Author: Konstantin Meskhidze > > > Date:   Thu Oct 26 09:47:46 2023 +0800 > > > > > >     landlock: Refactor landlock_add_rule() syscall > > > > > > But this is my guess (through reading the code), I didn't do more to > > > verify that by installing such a kernel. > > > > > > > > > -- > > > Regards, > > > Li Wang > > > > > > From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from picard.linux.it (picard.linux.it [213.254.12.146]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 7F439C3DA49 for ; Thu, 25 Jul 2024 09:07:07 +0000 (UTC) Received: from picard.linux.it (localhost [IPv6:::1]) by picard.linux.it (Postfix) with ESMTP id 902263D1CB5 for ; Thu, 25 Jul 2024 11:07:05 +0200 (CEST) Received: from in-5.smtp.seeweb.it (in-5.smtp.seeweb.it [IPv6:2001:4b78:1:20::5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1)) (No client certificate requested) by picard.linux.it (Postfix) with ESMTPS id 98C883D0FA8 for ; Thu, 25 Jul 2024 11:06:50 +0200 (CEST) Authentication-Results: in-5.smtp.seeweb.it; spf=pass (sender SPF authorized) smtp.mailfrom=digikod.net (client-ip=84.16.66.175; helo=smtp-42af.mail.infomaniak.ch; envelope-from=mic@digikod.net; receiver=lists.linux.it) Received: from smtp-42af.mail.infomaniak.ch (smtp-42af.mail.infomaniak.ch [84.16.66.175]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by in-5.smtp.seeweb.it (Postfix) with ESMTPS id 8B7D0613377 for ; Thu, 25 Jul 2024 11:06:49 +0200 (CEST) Received: from smtp-3-0001.mail.infomaniak.ch (smtp-3-0001.mail.infomaniak.ch [10.4.36.108]) by smtp-4-3000.mail.infomaniak.ch (Postfix) with ESMTPS id 4WV4kw6MLxzfV5; Thu, 25 Jul 2024 11:06:48 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=digikod.net; s=20191114; t=1721898408; bh=3YLAoaGBqf1G92r6BZ71PVCkUapElXjyM/572gLPJxQ=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=NFuNHXbhfmYpdQ5VPjim8Ew0MrSVEl5SWk2o6yxDQBD41dptUaq9BvkbxUnPaa5i5 f3VN1fK1BmzSfk09jT6RK9tCBlSDLqtW+kXG4LWaA50brVhTMm53mO3bQ1Wsl0O0CX KlWxpV25kwTPnytvGTkwCRgyWCECoNVM7v5/EP9M= Received: from unknown by smtp-3-0001.mail.infomaniak.ch (Postfix) with ESMTPA id 4WV4kv6McYz296; Thu, 25 Jul 2024 11:06:47 +0200 (CEST) Date: Thu, 25 Jul 2024 11:06:46 +0200 From: =?utf-8?Q?Micka=C3=ABl_Sala=C3=BCn?= To: Andrea Cervesato Message-ID: <20240725.Sohsez7coh2t@digikod.net> References: <54317d90-ec53-49ff-bbff-15200f09c8d2@suse.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <54317d90-ec53-49ff-bbff-15200f09c8d2@suse.com> X-Infomaniak-Routing: alpha X-Virus-Scanned: clamav-milter 1.0.3 at in-5.smtp.seeweb.it X-Virus-Status: Clean Subject: Re: [LTP] LTP landlock test is failing for all kernels <= 6.6 X-BeenThere: ltp@lists.linux.it X-Mailman-Version: 2.1.29 Precedence: list List-Id: Linux Test Project List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: =?utf-8?Q?G=C3=BCnther?= Noack , ltp@lists.linux.it, landlock@lists.linux.dev Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Errors-To: ltp-bounces+ltp=archiver.kernel.org@lists.linux.it Sender: "ltp" SGkgQW5kcmVhLAoKT24gVGh1LCBKdWwgMjUsIDIwMjQgYXQgMDk6NTA6MzZBTSArMDIwMCwgQW5k cmVhIENlcnZlc2F0byB3cm90ZToKPiBIaSBhbGwsCj4gCj4gd2UgYXJlIGZhY2luZyBhbiBpc3N1 ZSB3aXRoIGxhbmRsb2NrIHN1cHBvcnQgaW4ga2VybmVscyA8PTYuNi4gV2UgaGF2ZSBhCj4gdGVz dCB0aGF0IHRha2VzIGluIGNvbnNpZGVyYXRpb24gYWxsIHBvc3NpYmxlIHJ1bGVzIHNldCBhbmQg ZW5hYmxlIG9ubHkgb25lCj4gb2YgdGhlbSwgY2hlY2tpbmcgdGhhdCBhbGwgdGhlIG90aGVycyBh cmUgcmFpc2luZyBhIHBlcm1pc3Npb24gZXJyb3IuCj4gVGhlIHRlc3QgY2FuIGJlIGZvdW5kIGhl cmU6Cj4gaHR0cHM6Ly9naXRodWIuY29tL2FjZXJ2L2x0cC9jb21taXQvOWIxZDY4Mzg1OTJjZWJl M2M4OTI4MmE3MzM5ZGI1NDNiZTJhMDBlNwoKVGhlcmUgaXMgZGVmaW5pdGVseSBhbiBpc3N1ZSBp biB0aGlzIGNvbW1pdC4gIEFMTF9SVUxFUyBjb250YWlucyBhbGwKYWNjZXNzIHJpZ2h0LCBtaXhp bmcgZmlsZXN5c3RlbSBhbmQgbmV0d29yayBvbmVzLCB3aGljaCBkb2Vzbid0IG1ha2UKc2Vuc2Ug YmVjYXVzZSB0aGV5IGRvbid0IGhhdmUgdGhlIHNhbWUgIm5hbWVzcGFjZSIuCkxBTkRMT0NLX0FD Q0VTU19ORVRfKiBhbmQgTEFORExPQ0tfQUNDRVNTX0ZTXyogYml0cyBvdmVybGFwcy4KVGhlIHRl c3Rlcl9nZXRfYWxsX3J1bGVzKCkgZnVuY3Rpb24gZG9lcyB0aGUgQUJJIGNoZWNrcyBhbmQgcmVt b3ZlcyB0aGUKTEFORExPQ0tfQUNDRVNTX05FVF97QklORCxDT05ORUNUfV9UQ1AgYml0cyBpZiB0 aGV5IGFyZSBub3Qgc3VwcG9ydGVkCihpbiB0aGUgaGFuZGxlZF9hY2Nlc3NfbmV0IG5hbWVzcGFj ZSksIHdoaWNoIGlzIHRoZSBzYW1lIGFzIHJlbW92aW5nCkxBTkRMT0NLX0FDQ0VTU19GU197RVhF Q1VURSxXUklURV9GSUxFfSB3aGVyZWFzIHRoZXkgYXJlIHN1cHBvcnRlZCAoaW4KdGhlIGhhbmRs ZWRfYWNjZXNzX2ZzIG5hbWVzcGFjZSkuCgo+IEl0IHdvcmsgZmluZSBmb3IgYWxsIGtlcm5lbHMg Pj0gNi43LgoKTEFORExPQ0tfQUNDRVNTX05FVF97QklORCxDT05ORUNUfV9UQ1Agd2VyZSBpbnRy b2R1Y2VkIHdpdGggdGhpcyBrZXJuZWwKKExhbmRsb2NrIEFCSSA0KSwgc28gSSBndWVzcyB0aGF0 J3MgdGhlIGlzc3VlLgoKPiAKPiBCZWxvdyB5b3Ugd2lsbCBmaW5kIHRoZSBkaXNjdXNzaW9uIGlu IHRoZSBMVFAgbWFpbGluZyBsaXN0LiBDYW4geW91IHBsZWFzZQo+IGdpdmUgYW55IGhlbHAgd2l0 aCB0aGlzPwo+IAo+IFJlZ2FyZHMsCj4gQW5kcmVhCj4gCj4gCj4gCj4gLS0tLS0tLS0gRm9yd2Fy ZGVkIE1lc3NhZ2UgLS0tLS0tLS0KPiBTdWJqZWN0OiAJUmU6IFtMVFBdIFtQQVRDSCB2MyAwOS8x MV0gQWRkIGxhbmRsb2NrMDQgdGVzdAo+IERhdGU6IAlUaHUsIDI1IEp1bCAyMDI0IDA5OjEyOjM5 ICswMjAwCj4gRnJvbTogCUFuZHJlYSBDZXJ2ZXNhdG8gPGFuZHJlYS5jZXJ2ZXNhdG9Ac3VzZS5j b20+Cj4gVG86IAlMaSBXYW5nIDxsaXdhbmdAcmVkaGF0LmNvbT4sIFBldHIgVm9yZWwgPHB2b3Jl bEBzdXNlLmN6Pgo+IENDOiAJQW5kcmVhIENlcnZlc2F0byA8YW5kcmVhLmNlcnZlc2F0b0BzdXNl LmRlPiwgbHRwQGxpc3RzLmxpbnV4Lml0LAo+IEtvbnN0YW50aW4gTWVza2hpZHplIDxrb25zdGFu dGluLm1lc2toaWR6ZUBodWF3ZWkuY29tPgo+IAo+IAo+IAo+IEhpIQo+IAo+IGl0IHNlZW1zIGxp a2UgdGhlIGxhbmRsb2NrKCkgc3VwcG9ydCBpbiBrZXJuZWwgNi42IGlzIGRpZmZlcmVudCB0aGFu IHRoZSBvbmUKPiBpbiA2LjcuIFRoZSByZWFzb24gd2h5IHdlIHNlZSB0aGF0IGVycm9yIGluIGtl cm5lbCA8PTYuNiBpcyByZWxhdGVkIHRvIGhvdwo+IGxhbmRsb2NrIGlzIGhhbmRsaW5nIHRoZSBy dWxlcyBzZXQgYWNjb3JkaW5nIHRvIHRoZSBydWxlIHdlIHdhbnQgdG8gZW5hYmxlLgo+IAo+IExl dCdzIHN1cHBvc2Ugd2Ugd2FudCB0byBlbmFibGUgdGhlIGV4ZWN1dGlvbiBmb3IgYSBmaWxlLiBX aGF0IHdlIHNob3VsZCBiZQo+IGFibGUgdG8gZG8sIGlzIHRvIGNvbnNpZGVyIF9fQUxMX18gdGhl IHJ1bGVzIGF2YWlsYWJsZSBmb3IgbGFuZGxvY2ssIHRoZW4gdG8KPiBlbmFibGUgRVhFQyBvbmx5 IGZvciBhIHNwZWNpZmljIGZpbGUuIFRoZW4sIGlmIHdlIG1ha2UgYW55IG90aGVyIG9wZXJhdGlv bgo+IHRoYXQgaXMgbm90IEVYRUMsIHdlIHNob3VsZCBoYXZlIGEgcGVybWlzc2lvbiBlcnJvci4g VGhpcyB0cmFuc2xhdGVzIHRvOgo+IAo+IC0gc2V0IHJ1bGVzZXRfYXR0ci0+aGFuZGxlZF9hY2Nl c3NfZnMgZm9yIGFsbCBhdmFpbGFibGUgTEFORExPQ0tfQUNDRVNTX0ZTXyoKPiBydWxlcwo+IC0g c2V0IHBhdGhfYmVuZWF0aF9hdHRyLT5hbGxvd2VkX2FjY2VzcyB0byBMQU5ETE9DS19BQ0NFU1Nf RlNfRVhFQyB8Cj4gTEFORExPQ0tfQUNDRVNTX0ZTX1JFQUQgKHdlIG5lZWQgdG8gcmVhZCBpbiBv cmRlciB0byBleGVjdXRlKSBmb3IgYSBiaW5hcnkKPiAtIGVuZm9yY2UgdGhlIHJ1bGVzIGluc2lk ZSBhIHNhbmRib3ggY29udGFpbmluZyB0aGUgYmluYXJ5Cj4gLSBleGVjdXRlIHRoZSBiaW5hcnkg d2lsbCB3b3JrCj4gLSBkbyBhbnkgb3RoZXIgb3BlcmF0aW9uIGluc2lkZSB0aGUgc2FuZGJveCBh bmQgb2J0YWluIGEgcGVybWlzc2lvbnMgZXJyb3IKPiAtIGF0IHRoaXMgcG9pbnQsIGFueSBuZXcg cnVsZSB0aGF0IGlzIGFkZGVkLCB3aWxsIHVwZGF0ZSB0aGUgbGlzdCBvZgo+IGxhbmRsb2NrIHJ1 bGVzLCBlbmFibGluZyB0aGUgc2FuZGJveCBwZXJtaXNzaW9ucwo+IAo+IEZvciBzb21lIHJlYXNv bnMgdGhhdCBJIGRvbid0IGtub3cgKGFuZCB0aGlzIGlzIGV2aWRlbnQgZnJvbSBrc2VsZnRlc3Rz IGFzCj4gd2VsbCksIGlmIHRoZSBpbml0aWFsIHJ1bGVzIHNldCAocnVsZXNldF9hdHRyLT5oYW5k bGVkX2FjY2Vzc19mcykgaXMgbm90Cj4gaWRlbnRpY2FsIHRvIHRoZSBydWxlcyB3ZSBhcmUgZ29p bmcgdG8gZW5hYmxlCj4gKHBhdGhfYmVuZWF0aF9hdHRyLT5hbGxvd2VkX2FjY2VzcyksIGxhbmRs b2NrX2FkZF9ydWxlKCkgd2lsbCBmYWlsIHdpdGgKPiBFSU5WQUwuIEFuZCB0aGlzIGlzIG91ciBj YXNlIGZvciBhbGwga2VybmVscyA8PTYuNi4KCnBhdGhfYmVuZWF0aF9hdHRyLT5hbGxvd2VkX2Fj Y2VzcyBuZWVkcyB0byBiZSBhIHN1YnNldCBvZgpydWxlc2V0X2F0dHItPmhhbmRsZWRfYWNjZXNz X2ZzLCBvdGhlcndpc2UgaXQgZG9lc24ndCBtYWtlIHNlbnNlIHRvCmFsbG93IHNvbWV0aGluZyB3 aGljaCBpcyBub3QgaGFuZGxlZC9kZW5pZWQuCgo+IAo+IEkgcmVhbGx5IGhhdmUgbm8gaWRlYSB3 aHkgdGhpcyBoYXBwZW5zIGFuZCBtYXliZSB3ZSBuZWVkIHRvIGNvbnRhY3QgdGhlCj4gbGFuZGxv Y2sgZGV2ZWxvcGVycy4KCkZlZWwgZnJlZSB0byBDYyBtZSBhbmQgR8O8bnRoZXIgZm9yIGFsbCBM YW5kbG9jay1yZWxhdGVkIHBhdGNoZXMuCgo+IAo+IEFuZHJlYQo+IAo+IE9uIDcvMjQvMjQgMTU6 NDcsIEFuZHJlYSBDZXJ2ZXNhdG8gd3JvdGU6Cj4gPiBIaSBMaSwKPiA+IAo+ID4gdGhhbmtzIGZv ciBjaGVja2luZy4gTW1taCBJIGRvbid0IGtub3cgaWYgaXQncyBiZWNhdXNlIHRoZXkgYWRkZWQK PiA+IExBTkRMT0NLX1JVTEVfTkVUX1BPUlQuIEl0IHNvdW5kcyBzdHJhbmdlIHRvIG1lLCBzaW5j ZSB0aGF0IHdvdWxkIGJyZWFrCj4gPiBhbGwgdGhlIG90aGVyIGZlYXR1cmVzLgo+ID4gCj4gPiBB bmRyZWEKPiA+IAo+ID4gT24gNy8yNC8yNCAxNDoxMiwgTGkgV2FuZyB3cm90ZToKPiA+ID4gSGkg UGV0ciwgQW5kcmVhLAo+ID4gPiAKPiA+ID4gT24gV2VkLCBKdWwgMTcsIDIwMjQgYXQgMToyN+KA r0FNIFBldHIgVm9yZWwgPHB2b3JlbEBzdXNlLmN6PiB3cm90ZToKPiA+ID4gCj4gPiA+ICAgICBI aSBBbmRyZWEsCj4gPiA+IAo+ID4gPiAgICAgLi4uCj4gPiA+ICAgICA+ICtzdGF0aWMgdm9pZCBl bmFibGVfZXhlY19saWJzKGNvbnN0IGludCBydWxlc2V0X2ZkKQo+ID4gPiAgICAgPiArewo+ID4g PiAgICAgPiArwqAgwqAgwqBGSUxFICpmcDsKPiA+ID4gICAgID4gK8KgIMKgIMKgY2hhciBsaW5l WzEwMjRdOwo+ID4gPiAgICAgPiArwqAgwqAgwqBjaGFyIHBhdGhbUEFUSF9NQVhdOwo+ID4gPiAg ICAgPiArwqAgwqAgwqBjaGFyIGRlcGVuZGVuY3lbOF1bUEFUSF9NQVhdOwo+ID4gPiAgICAgPiAr wqAgwqAgwqBpbnQgY291bnQgPSAwOwo+ID4gPiAgICAgPiArwqAgwqAgwqBpbnQgZHVwbGljYXRl ID0gMDsKPiA+ID4gICAgID4gKwo+ID4gPiAgICAgPiArwqAgwqAgwqBmcCA9IFNBRkVfRk9QRU4o Ii9wcm9jL3NlbGYvbWFwcyIsICJyIik7Cj4gPiA+ICAgICA+ICsKPiA+ID4gICAgID4gK8KgIMKg IMKgd2hpbGUgKGZnZXRzKGxpbmUsIHNpemVvZihsaW5lKSwgZnApKSB7Cj4gPiA+ICAgICA+ICvC oCDCoCDCoCDCoCDCoCDCoCDCoGlmIChzdHJzdHIobGluZSwgIi5zbyIpID09IE5VTEwpCj4gPiA+ ICAgICA+ICvCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoGNvbnRpbnVlOwo+ID4gPiAg ICAgPiArCj4gPiA+ICAgICA+ICvCoCDCoCDCoCDCoCDCoCDCoCDCoFNBRkVfU1NDQU5GKGxpbmUs ICIlKngtJSp4ICUqcyAlKnggJSpzICUqZCAlcyIsCj4gPiA+ICAgICBwYXRoKTsKPiA+ID4gICAg ID4gKwo+ID4gPiAgICAgPiArwqAgwqAgwqAgwqAgwqAgwqAgwqBmb3IgKGludCBpID0gMDsgaSA8 IGNvdW50OyBpKyspIHsKPiA+ID4gICAgID4gK8KgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKg IMKgaWYgKHN0cmNtcChwYXRoLCBkZXBlbmRlbmN5W2ldKSA9PSAwKSB7Cj4gPiA+ICAgICA+ICvC oCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoGR1cGxpY2F0ZSA9IDE7 Cj4gPiA+ICAgICA+ICvCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDC oGJyZWFrOwo+ID4gPiAgICAgPiArwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqB9Cj4g PiA+ICAgICA+ICvCoCDCoCDCoCDCoCDCoCDCoCDCoH0KPiA+ID4gICAgID4gKwo+ID4gPiAgICAg PiArwqAgwqAgwqAgwqAgwqAgwqAgwqBpZiAoZHVwbGljYXRlKSB7Cj4gPiA+ICAgICA+ICvCoCDC oCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoGR1cGxpY2F0ZSA9IDA7Cj4gPiA+ICAgICA+ICvC oCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoGNvbnRpbnVlOwo+ID4gPiAgICAgPiArwqAg wqAgwqAgwqAgwqAgwqAgwqB9Cj4gPiA+ICAgICA+ICsKPiA+ID4gICAgID4gK8KgIMKgIMKgIMKg IMKgIMKgIMKgc3RybmNweShkZXBlbmRlbmN5W2NvdW50XSwgcGF0aCwgUEFUSF9NQVgpOwo+ID4g PiAgICAgPiArwqAgwqAgwqAgwqAgwqAgwqAgwqBjb3VudCsrOwo+ID4gPiAgICAgPiArCj4gPiA+ ICAgICA+ICvCoCDCoCDCoCDCoCDCoCDCoCDCoHRzdF9yZXMoVElORk8sICJFbmFibGUgcmVhZC9l eGVjIHBlcm1pc3Npb25zIGZvcgo+ID4gPiAgICAgJXMiLCBwYXRoKTsKPiA+ID4gICAgID4gKwo+ ID4gPiAgICAgPiArwqAgwqAgwqAgwqAgwqAgwqAgwqBwYXRoX2JlbmVhdGhfYXR0ci0+YWxsb3dl ZF9hY2Nlc3MgPQo+ID4gPiAgICAgPiArwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqBM QU5ETE9DS19BQ0NFU1NfRlNfUkVBRF9GSUxFIHwKPiA+ID4gICAgID4gK8KgIMKgIMKgIMKgIMKg IMKgIMKgIMKgIMKgIMKgIMKgTEFORExPQ0tfQUNDRVNTX0ZTX0VYRUNVVEU7Cj4gPiA+ICAgICA+ ICvCoCDCoCDCoCDCoCDCoCDCoCDCoHBhdGhfYmVuZWF0aF9hdHRyLT5wYXJlbnRfZmQgPSBTQUZF X09QRU4ocGF0aCwKPiA+ID4gICAgIE9fUEFUSCB8IE9fQ0xPRVhFQyk7Cj4gPiA+ICAgICA+ICsK PiA+ID4gICAgID4gK8KgIMKgIMKgIMKgIMKgIMKgIMKgU0FGRV9MQU5ETE9DS19BRERfUlVMRSgK PiA+ID4gICAgID4gK8KgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgcnVsZXNldF9mZCwK PiA+ID4gICAgID4gK8KgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgTEFORExPQ0tfUlVM RV9QQVRIX0JFTkVBVEgsCj4gPiA+ICAgICA+ICvCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDC oCDCoHBhdGhfYmVuZWF0aF9hdHRyLAo+ID4gPiAgICAgPiArwqAgwqAgwqAgwqAgwqAgwqAgwqAg wqAgwqAgwqAgwqAwKTsKPiA+ID4gCj4gPiA+ICAgICBVbmZvcnR1bmF0ZWx5LCBvbiA2LjYuMTUt YW1kNjQga2VybmVsIChyYW5kb20gRGViaWFuIG1hY2hpbmUpIGl0Cj4gPiA+ICAgICBmYWlscyAo YWZ0ZXIKPiA+ID4gICAgIGZyZXNoIGJvb3QpIHdpdGg6Cj4gPiA+IAo+ID4gPiAgICAgLi4uCj4g PiA+ICAgICB0c3Rfc3VwcG9ydGVkX2ZzX3R5cGVzLmM6OTc6IFRJTkZPOiBLZXJuZWwgc3VwcG9y dHMgdG1wZnMKPiA+ID4gICAgIHRzdF9zdXBwb3J0ZWRfZnNfdHlwZXMuYzo0OTogVElORk86IG1r ZnMgaXMgbm90IG5lZWRlZCBmb3IgdG1wZnMKPiA+ID4gICAgIHRzdF90ZXN0LmM6MTc0NjogVElO Rk86ID09PSBUZXN0aW5nIG9uIGV4dDIgPT09Cj4gPiA+ICAgICB0c3RfdGVzdC5jOjExMTE6IFRJ TkZPOiBGb3JtYXR0aW5nIC9kZXYvbG9vcDEgd2l0aCBleHQyIG9wdHM9JycKPiA+ID4gICAgIGV4 dHJhIG9wdHM9JycKPiA+ID4gICAgIG1rZTJmcyAxLjQ3LjAgKDUtRmViLTIwMjMpCj4gPiA+ICAg ICB0c3RfdGVzdC5jOjExMjM6IFRJTkZPOiBNb3VudGluZyAvZGV2L2xvb3AxIHRvCj4gPiA+ICAg ICAvdG1wL0xUUF9sYW50NldiS0ovc2FuZGJveCBmc3R5cD1leHQyIGZsYWdzPTAKPiA+ID4gICAg IGxhbmRsb2NrX2NvbW1vbi5oOjMwOiBUSU5GTzogTGFuZGxvY2sgQUJJIHYzCj4gPiA+ICAgICBs YW5kbG9jazA0LmM6MTUxOiBUSU5GTzogVGVzdGluZyBMQU5ETE9DS19BQ0NFU1NfRlNfRVhFQ1VU RQo+ID4gPiAgICAgbGFuZGxvY2swNC5jOjEyMzogVElORk86IEVuYWJsZSByZWFkL2V4ZWMgcGVy bWlzc2lvbnMgZm9yCj4gPiA+ICAgICAvdXNyL2xpYi9pMzg2LWxpbnV4LWdudS9saWJjLnNvLjYK PiA+ID4gICAgIGxhbmRsb2NrMDQuYzoxMzE6IFRCUk9LOiBsYW5kbG9ja19hZGRfcnVsZSgzLCAx LCAweGY3ZjEzZmY0LCAwKToKPiA+ID4gICAgIEVJTlZBTCAoMjIpCj4gPiA+IAo+ID4gPiAKPiA+ ID4gUG9zc2libHkgdGhhdCdzIGJlY2F1c2UgdGhlICdMQU5ETE9DS19SVUxFX1BBVEhfQkVORUFU SCfCoCB3YXMKPiA+ID4gcmVmYWN0b3JlZCBmcm9tIHRoZSB2Ni43IG1haW5saW5lIGtlcm5lbCwg c28gaXQgY2FuJ3QgYWRkIHRoZSBydWxlCj4gPiA+IGNvcnJlY3RseQo+ID4gPiB3aXRoIG9sZGVy IGtlcm5lbHMuCj4gPiA+IAo+ID4gPiBjb21taXQgMGUwZmM3ZThlYjRhMTFiZDlmODlhOWM3NGJj N2MwZTE0NGM1NjIwMwo+ID4gPiBBdXRob3I6IEtvbnN0YW50aW4gTWVza2hpZHplIDxrb25zdGFu dGluLm1lc2toaWR6ZUBodWF3ZWkuY29tPgo+ID4gPiBEYXRlOiDCoCBUaHUgT2N0IDI2IDA5OjQ3 OjQ2IDIwMjMgKzA4MDAKPiA+ID4gCj4gPiA+IMKgIMKgIGxhbmRsb2NrOiBSZWZhY3RvciBsYW5k bG9ja19hZGRfcnVsZSgpIHN5c2NhbGwKPiA+ID4gCj4gPiA+IEJ1dCB0aGlzIGlzIG15IGd1ZXNz ICh0aHJvdWdoIHJlYWRpbmcgdGhlIGNvZGUpLCBJIGRpZG4ndCBkbyBtb3JlIHRvCj4gPiA+IHZl cmlmeSB0aGF0IGJ5IGluc3RhbGxpbmcgc3VjaCBhIGtlcm5lbC4KPiA+ID4gCj4gPiA+IAo+ID4g PiAtLSAKPiA+ID4gUmVnYXJkcywKPiA+ID4gTGkgV2FuZwo+ID4gCj4gPiAKPiAKPiAKCi0tIApN YWlsaW5nIGxpc3QgaW5mbzogaHR0cHM6Ly9saXN0cy5saW51eC5pdC9saXN0aW5mby9sdHAK