From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.1 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,NICE_REPLY_A, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_SANE_1 autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E3A7BC433E7 for ; Wed, 14 Oct 2020 09:30:21 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 7876C206F4 for ; Wed, 14 Oct 2020 09:30:21 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="AYQcWHx4" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728030AbgJNJZ0 (ORCPT ); Wed, 14 Oct 2020 05:25:26 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39966 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730014AbgJNJTj (ORCPT ); Wed, 14 Oct 2020 05:19:39 -0400 Received: from mail-wr1-x442.google.com (mail-wr1-x442.google.com [IPv6:2a00:1450:4864:20::442]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8F636C045860; Tue, 13 Oct 2020 22:41:12 -0700 (PDT) Received: by mail-wr1-x442.google.com with SMTP id i1so2234678wro.1; Tue, 13 Oct 2020 22:41:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=cc:subject:to:references:from:message-id:date:user-agent :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=5ZD1Q1ycqo0UA6f9xY0VJ9HAjkT2BLtIOvzScJIKi9M=; b=AYQcWHx49JTyiIvfHAlkFzIhR6WG3kcBicmvcevU3yWLq5+Gspl272RNPtjAzKPT9e n8SPo6JiEuTivW7zt0Gvu0lQKKnMzaX2SoP+QqmO6/9+pmcVyteTPXEjvVqBivl/Dm9k KLjGCU2OSfbEzJu+cJYYSphQFyuZSpnjPFN3h04e3kvtET6Zlr5szW61p5MrMJBIZvUh sKlCvlwIGsAKwj+XW+EMLvl9CKPFmPNIPgXDKx4Ay4xO+le7aeQKP/jkkmP8U2y5LlXu lV3W0sQgBYtWgD5WpYetbxeCzmwkK42RQJsq8opSJfQhtFmZ0hh8FD6j5VjTZbUJt4rS LWPA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:cc:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=5ZD1Q1ycqo0UA6f9xY0VJ9HAjkT2BLtIOvzScJIKi9M=; b=GZQNMeY46xXpxQMF2xrESgd3u6HFx4wn6Y9jv8MQVuUCVJ+JB9rCMMvy29rzkxGotD IuRGaxXAEgFHt4rEnqEjKH7wKGSf6h/5rKKn3WDoZSFyYKemb5VaLBJFU7HUTCaspSl9 iqKx8uOLi6TXUhzKP9GICV7FrqYAdIAv6ii4ehA7fge5zuRNAbFAeNxS2ApZkhocQNxF WP+TCue4NFm9P7eGnb9+gqM1Hxzl5JU3yEa26e/E6Nzp+umgPUg0YvUHqgt6w5IWbQkj TtmDoGV6KRapLv2+8t1OZ9W6VU7mmIwftrGysYo2J3l+ArWbflcCHGpqN7reuDObxirS N5Lg== X-Gm-Message-State: AOAM532NI//i3C8O8277RQ5/iBGBNJAINBcJITbJ1cm7GzmSO7hRRu6Q HMt+LQx9oTOLhqZ7ZqfhaNQ= X-Google-Smtp-Source: ABdhPJz5XyrZLGamBlvAuoMrkkPcgWPQMbcczbspT9zKCtHmVhGjFjSIuktq+RJkYJSEg3ti156pOw== X-Received: by 2002:adf:fa05:: with SMTP id m5mr3595047wrr.57.1602654071185; Tue, 13 Oct 2020 22:41:11 -0700 (PDT) Received: from [192.168.1.10] (static-176-175-73-29.ftth.abo.bbox.fr. [176.175.73.29]) by smtp.gmail.com with ESMTPSA id f189sm1977581wmf.16.2020.10.13.22.41.09 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 13 Oct 2020 22:41:10 -0700 (PDT) Cc: mtk.manpages@gmail.com, Jann Horn , linux-man , Song Liu , Will Drewry , Kees Cook , Daniel Borkmann , Giuseppe Scrivano , Robert Sesek , Linux Containers , lkml , Alexei Starovoitov , bpf , Andy Lutomirski , Christian Brauner Subject: Re: For review: seccomp_user_notif(2) manual page To: Christian Brauner , Tycho Andersen References: <45f07f17-18b6-d187-0914-6f341fe90857@gmail.com> <20201001125043.dj6taeieatpw3a4w@gmail.com> <20201001165850.GC1260245@cisco> <20201001171206.jvkdx4htqux5agdv@gmail.com> From: "Michael Kerrisk (man-pages)" Message-ID: <3a417df2-6346-601d-568e-29307347e6aa@gmail.com> Date: Wed, 14 Oct 2020 07:41:07 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.11.0 MIME-Version: 1.0 In-Reply-To: <20201001171206.jvkdx4htqux5agdv@gmail.com> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: bpf@vger.kernel.org On 10/1/20 7:12 PM, Christian Brauner wrote: > On Thu, Oct 01, 2020 at 10:58:50AM -0600, Tycho Andersen wrote: >> On Thu, Oct 01, 2020 at 05:47:54PM +0200, Jann Horn via Containers wrote: >>> On Thu, Oct 1, 2020 at 2:54 PM Christian Brauner >>> wrote: >>>> On Wed, Sep 30, 2020 at 05:53:46PM +0200, Jann Horn via Containers wrote: >>>>> On Wed, Sep 30, 2020 at 1:07 PM Michael Kerrisk (man-pages) >>>>> wrote: >>>>>> NOTES >>>>>> The file descriptor returned when seccomp(2) is employed with the >>>>>> SECCOMP_FILTER_FLAG_NEW_LISTENER flag can be monitored using >>>>>> poll(2), epoll(7), and select(2). When a notification is pend‐ >>>>>> ing, these interfaces indicate that the file descriptor is read‐ >>>>>> able. >>>>> >>>>> We should probably also point out somewhere that, as >>>>> include/uapi/linux/seccomp.h says: >>>>> >>>>> * Similar precautions should be applied when stacking SECCOMP_RET_USER_NOTIF >>>>> * or SECCOMP_RET_TRACE. For SECCOMP_RET_USER_NOTIF filters acting on the >>>>> * same syscall, the most recently added filter takes precedence. This means >>>>> * that the new SECCOMP_RET_USER_NOTIF filter can override any >>>>> * SECCOMP_IOCTL_NOTIF_SEND from earlier filters, essentially allowing all >>>>> * such filtered syscalls to be executed by sending the response >>>>> * SECCOMP_USER_NOTIF_FLAG_CONTINUE. Note that SECCOMP_RET_TRACE can equally >>>>> * be overriden by SECCOMP_USER_NOTIF_FLAG_CONTINUE. >>>>> >>>>> In other words, from a security perspective, you must assume that the >>>>> target process can bypass any SECCOMP_RET_USER_NOTIF (or >>>>> SECCOMP_RET_TRACE) filters unless it is completely prohibited from >>>>> calling seccomp(). This should also be noted over in the main >>>>> seccomp(2) manpage, especially the SECCOMP_RET_TRACE part. >>>> >>>> So I was actually wondering about this when I skimmed this and a while >>>> ago but forgot about this again... Afaict, you can only ever load a >>>> single filter with SECCOMP_FILTER_FLAG_NEW_LISTENER set. If there >>>> already is a filter with the SECCOMP_FILTER_FLAG_NEW_LISTENER property >>>> in the tasks filter hierarchy then the kernel will refuse to load a new >>>> one? >>>> >>>> static struct file *init_listener(struct seccomp_filter *filter) >>>> { >>>> struct file *ret = ERR_PTR(-EBUSY); >>>> struct seccomp_filter *cur; >>>> >>>> for (cur = current->seccomp.filter; cur; cur = cur->prev) { >>>> if (cur->notif) >>>> goto out; >>>> } >>>> >>>> shouldn't that be sufficient to guarantee that USER_NOTIF filters can't >>>> override each other for the same task simply because there can only ever >>>> be a single one? >>> >>> Good point. Exceeeept that that check seems ineffective because this >>> happens before we take the locks that guard against TSYNC, and also >>> before we decide to which existing filter we want to chain the new >>> filter. So if two threads race with TSYNC, I think they'll be able to >>> chain two filters with listeners together. >> >> Yep, seems the check needs to also be in seccomp_can_sync_threads() to >> be totally effective, >> >>> I don't know whether we want to eternalize this "only one listener >>> across all the filters" restriction in the manpage though, or whether >>> the man page should just say that the kernel currently doesn't support >>> it but that security-wise you should assume that it might at some >>> point. >> >> This requirement originally came from Andy, arguing that the semantics >> of this were/are confusing, which still makes sense to me. Perhaps we >> should do something like the below? > > I think we should either keep up this restriction and then cement it in > the manpage or add a flag to indicate that the notifier is > non-overridable. > I don't care about the default too much, i.e. whether it's overridable > by default and exclusive if opting in or the other way around doesn't > matter too much. But from a supervisor's perspective it'd be quite nice > to be able to be sure that a notifier can't be overriden by another > notifier. > > I think having a flag would provide the greatest flexibility but I agree > that the semantics of multiple listeners are kinda odd. So, for now, I have applied the patch at the foot of this mail to the pages. Does this seem correct? > Below looks sane to me though again, I'm not sitting in fron of source > code. [...] Thanks, Michael PS Jann, if you see this, I'm still working through your (extensive and very helpful) review comments. I will be sending a response. ====== diff --git a/man2/seccomp.2 b/man2/seccomp.2 index 9ab07f4ab..45a6984df 100644 --- a/man2/seccomp.2 +++ b/man2/seccomp.2 @@ -221,6 +221,11 @@ return a new user-space notification file descriptor. When the filter returns .BR SECCOMP_RET_USER_NOTIF a notification will be sent to this file descriptor. +.IP +At most one seccomp filter using the +.BR SECCOMP_FILTER_FLAG_NEW_LISTENER +flag can be installed for a thread. +.IP See .BR seccomp_user_notif (2) for further details. @@ -789,6 +794,12 @@ capability in its user namespace, or had not set before using .BR SECCOMP_SET_MODE_FILTER . .TP +.BR EBUSY +While installing a new filter, the +.BR SECCOMP_FILTER_FLAG_NEW_LISTENER +flag was specified, +but a previous filter had already been installed with that flag. +.TP .BR EFAULT .IR args was not a valid address. diff --git a/man2/seccomp_user_notif.2 b/man2/seccomp_user_notif.2 index a6025e4d4..d1a406f46 100644 --- a/man2/seccomp_user_notif.2 +++ b/man2/seccomp_user_notif.2 @@ -92,6 +92,7 @@ Consequently, the return value of the (successful) .BR seccomp (2) call is a new "listening" file descriptor that can be used to receive notifications. +Only one such "listener" can be established. .IP \(bu In cases where it is appropriate, the seccomp filter returns the action value .BR SECCOMP_RET_USER_NOTIF . -- Michael Kerrisk Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/ Linux/UNIX System Programming Training: http://man7.org/training/ From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.8 required=3.0 tests=BAYES_00,DKIM_ADSP_CUSTOM_MED, DKIM_INVALID,DKIM_SIGNED,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,NICE_REPLY_A, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_SANE_1 autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8C45FC433DF for ; Wed, 14 Oct 2020 05:41:19 +0000 (UTC) Received: from fraxinus.osuosl.org (smtp4.osuosl.org [140.211.166.137]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id CD4FA2177B for ; Wed, 14 Oct 2020 05:41:18 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="AYQcWHx4" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org CD4FA2177B Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=containers-bounces@lists.linux-foundation.org Received: from localhost (localhost [127.0.0.1]) by fraxinus.osuosl.org (Postfix) with ESMTP id 6AE1F87985; Wed, 14 Oct 2020 05:41:18 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from fraxinus.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eeuJv9W22YeM; Wed, 14 Oct 2020 05:41:17 +0000 (UTC) Received: from lists.linuxfoundation.org (lf-lists.osuosl.org [140.211.9.56]) by fraxinus.osuosl.org (Postfix) with ESMTP id 49AB48797C; Wed, 14 Oct 2020 05:41:17 +0000 (UTC) Received: from lf-lists.osuosl.org (localhost [127.0.0.1]) by lists.linuxfoundation.org (Postfix) with ESMTP id 28301C07FF; Wed, 14 Oct 2020 05:41:17 +0000 (UTC) Received: from silver.osuosl.org (smtp3.osuosl.org [140.211.166.136]) by lists.linuxfoundation.org (Postfix) with ESMTP id 5B4BBC0051 for ; Wed, 14 Oct 2020 05:41:15 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by silver.osuosl.org (Postfix) with ESMTP id 3DF9C2E190 for ; Wed, 14 Oct 2020 05:41:15 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from silver.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id crf3WEGcA4oa for ; Wed, 14 Oct 2020 05:41:13 +0000 (UTC) X-Greylist: domain auto-whitelisted by SQLgrey-1.7.6 Received: from mail-wr1-f66.google.com (mail-wr1-f66.google.com [209.85.221.66]) by silver.osuosl.org (Postfix) with ESMTPS id DF7EC20445 for ; Wed, 14 Oct 2020 05:41:12 +0000 (UTC) Received: by mail-wr1-f66.google.com with SMTP id h5so2190581wrv.7 for ; Tue, 13 Oct 2020 22:41:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=cc:subject:to:references:from:message-id:date:user-agent :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=5ZD1Q1ycqo0UA6f9xY0VJ9HAjkT2BLtIOvzScJIKi9M=; b=AYQcWHx49JTyiIvfHAlkFzIhR6WG3kcBicmvcevU3yWLq5+Gspl272RNPtjAzKPT9e n8SPo6JiEuTivW7zt0Gvu0lQKKnMzaX2SoP+QqmO6/9+pmcVyteTPXEjvVqBivl/Dm9k KLjGCU2OSfbEzJu+cJYYSphQFyuZSpnjPFN3h04e3kvtET6Zlr5szW61p5MrMJBIZvUh sKlCvlwIGsAKwj+XW+EMLvl9CKPFmPNIPgXDKx4Ay4xO+le7aeQKP/jkkmP8U2y5LlXu lV3W0sQgBYtWgD5WpYetbxeCzmwkK42RQJsq8opSJfQhtFmZ0hh8FD6j5VjTZbUJt4rS LWPA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:cc:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=5ZD1Q1ycqo0UA6f9xY0VJ9HAjkT2BLtIOvzScJIKi9M=; b=p4fuK/f1cRyjWZ9p0nFGVZyxp8GTkbHzOekzn8GBSrSkrohBRvU1kLkx4lE/6HtS2S v714oFdY8ZMDstMDAGk+Nz717LlffBQcyIPWM761p2NcwdvaJ3pPwjVOIcRBngzSuezL 5ocmwTxfz14k5LCGD42WNRpPu/DANLYvkvUGOA7XjhTeBXb/USOw3phHKb1rw4WdOd8a +1tU6iW6TVXzLZEVSzDPIEu4mTfArIZu9a61WRxAM+g2WMV4g/hBFW8xFXOOBF4c8jgm Uvu/OHVSlwtt1L4ZU2TWBJ+ywuQCygJPCCctKCHQ5cwZb1KftBfxZ1JyZnnvPqQ1+zHk wnxQ== X-Gm-Message-State: AOAM533OQGodP+sQetSu3VaCnwI+kG93oooWcYZHEBla9UAQel1UVnB2 Qph/ECAni+q3bLVJ5IjFRXo= X-Google-Smtp-Source: ABdhPJz5XyrZLGamBlvAuoMrkkPcgWPQMbcczbspT9zKCtHmVhGjFjSIuktq+RJkYJSEg3ti156pOw== X-Received: by 2002:adf:fa05:: with SMTP id m5mr3595047wrr.57.1602654071185; Tue, 13 Oct 2020 22:41:11 -0700 (PDT) Received: from [192.168.1.10] (static-176-175-73-29.ftth.abo.bbox.fr. [176.175.73.29]) by smtp.gmail.com with ESMTPSA id f189sm1977581wmf.16.2020.10.13.22.41.09 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 13 Oct 2020 22:41:10 -0700 (PDT) Subject: Re: For review: seccomp_user_notif(2) manual page To: Christian Brauner , Tycho Andersen References: <45f07f17-18b6-d187-0914-6f341fe90857@gmail.com> <20201001125043.dj6taeieatpw3a4w@gmail.com> <20201001165850.GC1260245@cisco> <20201001171206.jvkdx4htqux5agdv@gmail.com> From: "Michael Kerrisk (man-pages)" Message-ID: <3a417df2-6346-601d-568e-29307347e6aa@gmail.com> Date: Wed, 14 Oct 2020 07:41:07 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.11.0 MIME-Version: 1.0 In-Reply-To: <20201001171206.jvkdx4htqux5agdv@gmail.com> Content-Language: en-US Cc: linux-man , Song Liu , Will Drewry , Kees Cook , Daniel Borkmann , Jann Horn , Robert Sesek , Linux Containers , lkml , Alexei Starovoitov , mtk.manpages@gmail.com, Giuseppe Scrivano , bpf , Andy Lutomirski , Christian Brauner X-BeenThere: containers@lists.linux-foundation.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Linux Containers List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Errors-To: containers-bounces@lists.linux-foundation.org Sender: "Containers" T24gMTAvMS8yMCA3OjEyIFBNLCBDaHJpc3RpYW4gQnJhdW5lciB3cm90ZToKPiBPbiBUaHUsIE9j dCAwMSwgMjAyMCBhdCAxMDo1ODo1MEFNIC0wNjAwLCBUeWNobyBBbmRlcnNlbiB3cm90ZToKPj4g T24gVGh1LCBPY3QgMDEsIDIwMjAgYXQgMDU6NDc6NTRQTSArMDIwMCwgSmFubiBIb3JuIHZpYSBD b250YWluZXJzIHdyb3RlOgo+Pj4gT24gVGh1LCBPY3QgMSwgMjAyMCBhdCAyOjU0IFBNIENocmlz dGlhbiBCcmF1bmVyCj4+PiA8Y2hyaXN0aWFuLmJyYXVuZXJAY2Fub25pY2FsLmNvbT4gd3JvdGU6 Cj4+Pj4gT24gV2VkLCBTZXAgMzAsIDIwMjAgYXQgMDU6NTM6NDZQTSArMDIwMCwgSmFubiBIb3Ju IHZpYSBDb250YWluZXJzIHdyb3RlOgo+Pj4+PiBPbiBXZWQsIFNlcCAzMCwgMjAyMCBhdCAxOjA3 IFBNIE1pY2hhZWwgS2VycmlzayAobWFuLXBhZ2VzKQo+Pj4+PiA8bXRrLm1hbnBhZ2VzQGdtYWls LmNvbT4gd3JvdGU6Cj4+Pj4+PiBOT1RFUwo+Pj4+Pj4gICAgICAgIFRoZSBmaWxlIGRlc2NyaXB0 b3IgcmV0dXJuZWQgd2hlbiBzZWNjb21wKDIpIGlzIGVtcGxveWVkIHdpdGggdGhlCj4+Pj4+PiAg ICAgICAgU0VDQ09NUF9GSUxURVJfRkxBR19ORVdfTElTVEVORVIgIGZsYWcgIGNhbiAgYmUgIG1v bml0b3JlZCAgdXNpbmcKPj4+Pj4+ICAgICAgICBwb2xsKDIpLCBlcG9sbCg3KSwgYW5kIHNlbGVj dCgyKS4gIFdoZW4gYSBub3RpZmljYXRpb24gIGlzICBwZW5k4oCQCj4+Pj4+PiAgICAgICAgaW5n LCAgdGhlc2UgaW50ZXJmYWNlcyBpbmRpY2F0ZSB0aGF0IHRoZSBmaWxlIGRlc2NyaXB0b3IgaXMg cmVhZOKAkAo+Pj4+Pj4gICAgICAgIGFibGUuCj4+Pj4+Cj4+Pj4+IFdlIHNob3VsZCBwcm9iYWJs eSBhbHNvIHBvaW50IG91dCBzb21ld2hlcmUgdGhhdCwgYXMKPj4+Pj4gaW5jbHVkZS91YXBpL2xp bnV4L3NlY2NvbXAuaCBzYXlzOgo+Pj4+Pgo+Pj4+PiAgKiBTaW1pbGFyIHByZWNhdXRpb25zIHNo b3VsZCBiZSBhcHBsaWVkIHdoZW4gc3RhY2tpbmcgU0VDQ09NUF9SRVRfVVNFUl9OT1RJRgo+Pj4+ PiAgKiBvciBTRUNDT01QX1JFVF9UUkFDRS4gRm9yIFNFQ0NPTVBfUkVUX1VTRVJfTk9USUYgZmls dGVycyBhY3Rpbmcgb24gdGhlCj4+Pj4+ICAqIHNhbWUgc3lzY2FsbCwgdGhlIG1vc3QgcmVjZW50 bHkgYWRkZWQgZmlsdGVyIHRha2VzIHByZWNlZGVuY2UuIFRoaXMgbWVhbnMKPj4+Pj4gICogdGhh dCB0aGUgbmV3IFNFQ0NPTVBfUkVUX1VTRVJfTk9USUYgZmlsdGVyIGNhbiBvdmVycmlkZSBhbnkK Pj4+Pj4gICogU0VDQ09NUF9JT0NUTF9OT1RJRl9TRU5EIGZyb20gZWFybGllciBmaWx0ZXJzLCBl c3NlbnRpYWxseSBhbGxvd2luZyBhbGwKPj4+Pj4gICogc3VjaCBmaWx0ZXJlZCBzeXNjYWxscyB0 byBiZSBleGVjdXRlZCBieSBzZW5kaW5nIHRoZSByZXNwb25zZQo+Pj4+PiAgKiBTRUNDT01QX1VT RVJfTk9USUZfRkxBR19DT05USU5VRS4gTm90ZSB0aGF0IFNFQ0NPTVBfUkVUX1RSQUNFIGNhbiBl cXVhbGx5Cj4+Pj4+ICAqIGJlIG92ZXJyaWRlbiBieSBTRUNDT01QX1VTRVJfTk9USUZfRkxBR19D T05USU5VRS4KPj4+Pj4KPj4+Pj4gSW4gb3RoZXIgd29yZHMsIGZyb20gYSBzZWN1cml0eSBwZXJz cGVjdGl2ZSwgeW91IG11c3QgYXNzdW1lIHRoYXQgdGhlCj4+Pj4+IHRhcmdldCBwcm9jZXNzIGNh biBieXBhc3MgYW55IFNFQ0NPTVBfUkVUX1VTRVJfTk9USUYgKG9yCj4+Pj4+IFNFQ0NPTVBfUkVU X1RSQUNFKSBmaWx0ZXJzIHVubGVzcyBpdCBpcyBjb21wbGV0ZWx5IHByb2hpYml0ZWQgZnJvbQo+ Pj4+PiBjYWxsaW5nIHNlY2NvbXAoKS4gVGhpcyBzaG91bGQgYWxzbyBiZSBub3RlZCBvdmVyIGlu IHRoZSBtYWluCj4+Pj4+IHNlY2NvbXAoMikgbWFucGFnZSwgZXNwZWNpYWxseSB0aGUgU0VDQ09N UF9SRVRfVFJBQ0UgcGFydC4KPj4+Pgo+Pj4+IFNvIEkgd2FzIGFjdHVhbGx5IHdvbmRlcmluZyBh Ym91dCB0aGlzIHdoZW4gSSBza2ltbWVkIHRoaXMgYW5kIGEgd2hpbGUKPj4+PiBhZ28gYnV0IGZv cmdvdCBhYm91dCB0aGlzIGFnYWluLi4uIEFmYWljdCwgeW91IGNhbiBvbmx5IGV2ZXIgbG9hZCBh Cj4+Pj4gc2luZ2xlIGZpbHRlciB3aXRoIFNFQ0NPTVBfRklMVEVSX0ZMQUdfTkVXX0xJU1RFTkVS IHNldC4gSWYgdGhlcmUKPj4+PiBhbHJlYWR5IGlzIGEgZmlsdGVyIHdpdGggdGhlIFNFQ0NPTVBf RklMVEVSX0ZMQUdfTkVXX0xJU1RFTkVSIHByb3BlcnR5Cj4+Pj4gaW4gdGhlIHRhc2tzIGZpbHRl ciBoaWVyYXJjaHkgdGhlbiB0aGUga2VybmVsIHdpbGwgcmVmdXNlIHRvIGxvYWQgYSBuZXcKPj4+ PiBvbmU/Cj4+Pj4KPj4+PiBzdGF0aWMgc3RydWN0IGZpbGUgKmluaXRfbGlzdGVuZXIoc3RydWN0 IHNlY2NvbXBfZmlsdGVyICpmaWx0ZXIpCj4+Pj4gewo+Pj4+ICAgICAgICAgc3RydWN0IGZpbGUg KnJldCA9IEVSUl9QVFIoLUVCVVNZKTsKPj4+PiAgICAgICAgIHN0cnVjdCBzZWNjb21wX2ZpbHRl ciAqY3VyOwo+Pj4+Cj4+Pj4gICAgICAgICBmb3IgKGN1ciA9IGN1cnJlbnQtPnNlY2NvbXAuZmls dGVyOyBjdXI7IGN1ciA9IGN1ci0+cHJldikgewo+Pj4+ICAgICAgICAgICAgICAgICBpZiAoY3Vy LT5ub3RpZikKPj4+PiAgICAgICAgICAgICAgICAgICAgICAgICBnb3RvIG91dDsKPj4+PiAgICAg ICAgIH0KPj4+Pgo+Pj4+IHNob3VsZG4ndCB0aGF0IGJlIHN1ZmZpY2llbnQgdG8gZ3VhcmFudGVl IHRoYXQgVVNFUl9OT1RJRiBmaWx0ZXJzIGNhbid0Cj4+Pj4gb3ZlcnJpZGUgZWFjaCBvdGhlciBm b3IgdGhlIHNhbWUgdGFzayBzaW1wbHkgYmVjYXVzZSB0aGVyZSBjYW4gb25seSBldmVyCj4+Pj4g YmUgYSBzaW5nbGUgb25lPwo+Pj4KPj4+IEdvb2QgcG9pbnQuIEV4Y2VlZWVwdCB0aGF0IHRoYXQg Y2hlY2sgc2VlbXMgaW5lZmZlY3RpdmUgYmVjYXVzZSB0aGlzCj4+PiBoYXBwZW5zIGJlZm9yZSB3 ZSB0YWtlIHRoZSBsb2NrcyB0aGF0IGd1YXJkIGFnYWluc3QgVFNZTkMsIGFuZCBhbHNvCj4+PiBi ZWZvcmUgd2UgZGVjaWRlIHRvIHdoaWNoIGV4aXN0aW5nIGZpbHRlciB3ZSB3YW50IHRvIGNoYWlu IHRoZSBuZXcKPj4+IGZpbHRlci4gU28gaWYgdHdvIHRocmVhZHMgcmFjZSB3aXRoIFRTWU5DLCBJ IHRoaW5rIHRoZXknbGwgYmUgYWJsZSB0bwo+Pj4gY2hhaW4gdHdvIGZpbHRlcnMgd2l0aCBsaXN0 ZW5lcnMgdG9nZXRoZXIuCj4+Cj4+IFllcCwgc2VlbXMgdGhlIGNoZWNrIG5lZWRzIHRvIGFsc28g YmUgaW4gc2VjY29tcF9jYW5fc3luY190aHJlYWRzKCkgdG8KPj4gYmUgdG90YWxseSBlZmZlY3Rp dmUsCj4+Cj4+PiBJIGRvbid0IGtub3cgd2hldGhlciB3ZSB3YW50IHRvIGV0ZXJuYWxpemUgdGhp cyAib25seSBvbmUgbGlzdGVuZXIKPj4+IGFjcm9zcyBhbGwgdGhlIGZpbHRlcnMiIHJlc3RyaWN0 aW9uIGluIHRoZSBtYW5wYWdlIHRob3VnaCwgb3Igd2hldGhlcgo+Pj4gdGhlIG1hbiBwYWdlIHNo b3VsZCBqdXN0IHNheSB0aGF0IHRoZSBrZXJuZWwgY3VycmVudGx5IGRvZXNuJ3Qgc3VwcG9ydAo+ Pj4gaXQgYnV0IHRoYXQgc2VjdXJpdHktd2lzZSB5b3Ugc2hvdWxkIGFzc3VtZSB0aGF0IGl0IG1p Z2h0IGF0IHNvbWUKPj4+IHBvaW50Lgo+Pgo+PiBUaGlzIHJlcXVpcmVtZW50IG9yaWdpbmFsbHkg Y2FtZSBmcm9tIEFuZHksIGFyZ3VpbmcgdGhhdCB0aGUgc2VtYW50aWNzCj4+IG9mIHRoaXMgd2Vy ZS9hcmUgY29uZnVzaW5nLCB3aGljaCBzdGlsbCBtYWtlcyBzZW5zZSB0byBtZS4gUGVyaGFwcyB3 ZQo+PiBzaG91bGQgZG8gc29tZXRoaW5nIGxpa2UgdGhlIGJlbG93Pwo+IAo+IEkgdGhpbmsgd2Ug c2hvdWxkIGVpdGhlciBrZWVwIHVwIHRoaXMgcmVzdHJpY3Rpb24gYW5kIHRoZW4gY2VtZW50IGl0 IGluCj4gdGhlIG1hbnBhZ2Ugb3IgYWRkIGEgZmxhZyB0byBpbmRpY2F0ZSB0aGF0IHRoZSBub3Rp ZmllciBpcwo+IG5vbi1vdmVycmlkYWJsZS4KPiBJIGRvbid0IGNhcmUgYWJvdXQgdGhlIGRlZmF1 bHQgdG9vIG11Y2gsIGkuZS4gd2hldGhlciBpdCdzIG92ZXJyaWRhYmxlCj4gYnkgZGVmYXVsdCBh bmQgZXhjbHVzaXZlIGlmIG9wdGluZyBpbiBvciB0aGUgb3RoZXIgd2F5IGFyb3VuZCBkb2Vzbid0 Cj4gbWF0dGVyIHRvbyBtdWNoLiBCdXQgZnJvbSBhIHN1cGVydmlzb3IncyBwZXJzcGVjdGl2ZSBp dCdkIGJlIHF1aXRlIG5pY2UKPiB0byBiZSBhYmxlIHRvIGJlIHN1cmUgdGhhdCBhIG5vdGlmaWVy IGNhbid0IGJlIG92ZXJyaWRlbiBieSBhbm90aGVyCj4gbm90aWZpZXIuCj4gCj4gSSB0aGluayBo YXZpbmcgYSBmbGFnIHdvdWxkIHByb3ZpZGUgdGhlIGdyZWF0ZXN0IGZsZXhpYmlsaXR5IGJ1dCBJ IGFncmVlCj4gdGhhdCB0aGUgc2VtYW50aWNzIG9mIG11bHRpcGxlIGxpc3RlbmVycyBhcmUga2lu ZGEgb2RkLgoKU28sIGZvciBub3csIEkgaGF2ZSBhcHBsaWVkIHRoZSBwYXRjaCBhdCB0aGUgZm9v dCBvZiB0aGlzIG1haWwKdG8gdGhlIHBhZ2VzLiBEb2VzIHRoaXMgc2VlbSBjb3JyZWN0PwoKPiBC ZWxvdyBsb29rcyBzYW5lIHRvIG1lIHRob3VnaCBhZ2FpbiwgSSdtIG5vdCBzaXR0aW5nIGluIGZy b24gb2Ygc291cmNlCj4gY29kZS4KWy4uLl0KClRoYW5rcywKCk1pY2hhZWwKClBTIEphbm4sIGlm IHlvdSBzZWUgdGhpcywgSSdtIHN0aWxsIHdvcmtpbmcgdGhyb3VnaCB5b3VyIChleHRlbnNpdmUK YW5kIHZlcnkgaGVscGZ1bCkgcmV2aWV3IGNvbW1lbnRzLiBJIHdpbGwgYmUgc2VuZGluZyBhIHJl c3BvbnNlLgoKPT09PT09CgpkaWZmIC0tZ2l0IGEvbWFuMi9zZWNjb21wLjIgYi9tYW4yL3NlY2Nv bXAuMgppbmRleCA5YWIwN2Y0YWIuLjQ1YTY5ODRkZiAxMDA2NDQKLS0tIGEvbWFuMi9zZWNjb21w LjIKKysrIGIvbWFuMi9zZWNjb21wLjIKQEAgLTIyMSw2ICsyMjEsMTEgQEAgcmV0dXJuIGEgbmV3 IHVzZXItc3BhY2Ugbm90aWZpY2F0aW9uIGZpbGUgZGVzY3JpcHRvci4KIFdoZW4gdGhlIGZpbHRl ciByZXR1cm5zCiAuQlIgU0VDQ09NUF9SRVRfVVNFUl9OT1RJRgogYSBub3RpZmljYXRpb24gd2ls bCBiZSBzZW50IHRvIHRoaXMgZmlsZSBkZXNjcmlwdG9yLgorLklQCitBdCBtb3N0IG9uZSBzZWNj b21wIGZpbHRlciB1c2luZyB0aGUKKy5CUiBTRUNDT01QX0ZJTFRFUl9GTEFHX05FV19MSVNURU5F UgorZmxhZyBjYW4gYmUgaW5zdGFsbGVkIGZvciBhIHRocmVhZC4KKy5JUAogU2VlCiAuQlIgc2Vj Y29tcF91c2VyX25vdGlmICgyKQogZm9yIGZ1cnRoZXIgZGV0YWlscy4KQEAgLTc4OSw2ICs3OTQs MTIgQEAgY2FwYWJpbGl0eSBpbiBpdHMgdXNlciBuYW1lc3BhY2UsIG9yIGhhZCBub3Qgc2V0CiBi ZWZvcmUgdXNpbmcKIC5CUiBTRUNDT01QX1NFVF9NT0RFX0ZJTFRFUiAuCiAuVFAKKy5CUiBFQlVT WQorV2hpbGUgaW5zdGFsbGluZyBhIG5ldyBmaWx0ZXIsIHRoZQorLkJSIFNFQ0NPTVBfRklMVEVS X0ZMQUdfTkVXX0xJU1RFTkVSCitmbGFnIHdhcyBzcGVjaWZpZWQsCitidXQgYSBwcmV2aW91cyBm aWx0ZXIgaGFkIGFscmVhZHkgYmVlbiBpbnN0YWxsZWQgd2l0aCB0aGF0IGZsYWcuCisuVFAKIC5C UiBFRkFVTFQKIC5JUiBhcmdzCiB3YXMgbm90IGEgdmFsaWQgYWRkcmVzcy4KZGlmZiAtLWdpdCBh L21hbjIvc2VjY29tcF91c2VyX25vdGlmLjIgYi9tYW4yL3NlY2NvbXBfdXNlcl9ub3RpZi4yCmlu ZGV4IGE2MDI1ZTRkNC4uZDFhNDA2ZjQ2IDEwMDY0NAotLS0gYS9tYW4yL3NlY2NvbXBfdXNlcl9u b3RpZi4yCisrKyBiL21hbjIvc2VjY29tcF91c2VyX25vdGlmLjIKQEAgLTkyLDYgKzkyLDcgQEAg Q29uc2VxdWVudGx5LCB0aGUgcmV0dXJuIHZhbHVlICBvZiB0aGUgKHN1Y2Nlc3NmdWwpCiAuQlIg c2VjY29tcCAoMikKIGNhbGwgaXMgYSBuZXcgImxpc3RlbmluZyIKIGZpbGUgZGVzY3JpcHRvciB0 aGF0IGNhbiBiZSB1c2VkIHRvIHJlY2VpdmUgbm90aWZpY2F0aW9ucy4KK09ubHkgb25lIHN1Y2gg Imxpc3RlbmVyIiBjYW4gYmUgZXN0YWJsaXNoZWQuCiAuSVAgXChidQogSW4gY2FzZXMgd2hlcmUg aXQgaXMgYXBwcm9wcmlhdGUsIHRoZSBzZWNjb21wIGZpbHRlciByZXR1cm5zIHRoZSBhY3Rpb24g dmFsdWUKIC5CUiBTRUNDT01QX1JFVF9VU0VSX05PVElGIC4KCi0tIApNaWNoYWVsIEtlcnJpc2sK TGludXggbWFuLXBhZ2VzIG1haW50YWluZXI7IGh0dHA6Ly93d3cua2VybmVsLm9yZy9kb2MvbWFu LXBhZ2VzLwpMaW51eC9VTklYIFN5c3RlbSBQcm9ncmFtbWluZyBUcmFpbmluZzogaHR0cDovL21h bjcub3JnL3RyYWluaW5nLwpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fXwpDb250YWluZXJzIG1haWxpbmcgbGlzdApDb250YWluZXJzQGxpc3RzLmxpbnV4LWZv dW5kYXRpb24ub3JnCmh0dHBzOi8vbGlzdHMubGludXhmb3VuZGF0aW9uLm9yZy9tYWlsbWFuL2xp c3RpbmZvL2NvbnRhaW5lcnM=