From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B0ADBEC5 for ; Thu, 23 Jan 2025 17:39:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1737653965; cv=none; b=IXIALDfhTs38hMV9FD4cIt/By8q4Fkhx6SlM4Cr69B8/gNG3mFhdYBqLc4E6RVq8e0Aun5VjE+fLB5jscEOaOn+I4GivlN+3j/95JqqNAnVp2sM9+sxyrtNAtjvXrbomXF5LarBPdC6CA5JQOgXE4JKK8pSnMCFmzmJubpt8ozQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1737653965; c=relaxed/simple; bh=Wsx7NwHtvPc2zkVlBoq/r49b2GvlxZPoOjg9b4CTA1Q=; h=Message-ID:Subject:From:To:Cc:Date:In-Reply-To:References: Content-Type:MIME-Version; b=HLOk7bHOjeslUtoMt2pxogm2mUwrS98SaLsUgaf1M0wO22CK26RYsE27JISox4aJvrJNFBxazH6XWmS2Uxd4xz1j0TodlOC7xzon44K3nV0+ZfXfg4Ky2Gxo9IrzPIgyU5r8Fp685qDcMAbXxI2uyNnwm0RFYRAhZZCP5vlq5JE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=E4sf8v3v; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="E4sf8v3v" Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 50N9d722022534; Thu, 23 Jan 2025 17:39:18 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=pp1; bh=A3uXV8 hu1U2d0DiavA56xbXq20mzfmYKzcGlzqX/vDY=; b=E4sf8v3v/93jHR9VT/iwiR hKeUhSLFa2TN77XxHKMLiHAtha0Xm1VEFr6V9Yt1YXDd0lxQiMc4zuF3AJzKLEV8 VNoNU5xnUw5iTdUhaC1lo4vf52hwd2//GUTMWkSf7q511bUwdjbaovQc+hmWirB5 gl0NR90j/HsiLisQzdI5FTFlMQpDZE7uovCwTDI1bImNwoZvtpnr7UuvwdHqytB6 /eAaX7JEaOq0Tnt+XLoWLGUhf9iXpgmk0VH0Kwmh/H+lrKXNYtEOaQegWsgpTJD+ hrzSp3SwOhOeaMy1XChYE++hdadVmHVdO/YEgOxCims+BGgSCmbCaA6rSBXSYY2w == Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 44bbu9cdm8-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 23 Jan 2025 17:39:17 +0000 (GMT) Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.18.1.2/8.18.1.2) with ESMTP id 50NHZ3dn019223; Thu, 23 Jan 2025 17:39:16 GMT Received: from smtprelay02.dal12v.mail.ibm.com ([172.16.1.4]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 448pmspu00-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 23 Jan 2025 17:39:16 +0000 Received: from smtpav01.wdc07v.mail.ibm.com (smtpav01.wdc07v.mail.ibm.com [10.39.53.228]) by smtprelay02.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 50NHdFFT12124816 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 23 Jan 2025 17:39:16 GMT Received: from smtpav01.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 9A40258055; Thu, 23 Jan 2025 17:39:15 +0000 (GMT) Received: from smtpav01.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 203BE5804B; Thu, 23 Jan 2025 17:39:15 +0000 (GMT) Received: from li-43857255-d5e6-4659-90f1-fc5cee4750ad.ibm.com (unknown [9.61.4.223]) by smtpav01.wdc07v.mail.ibm.com (Postfix) with ESMTP; Thu, 23 Jan 2025 17:39:15 +0000 (GMT) Message-ID: <3c7dee2c281867aa279c9d556e4aa62a7e865d36.camel@linux.ibm.com> Subject: Re: [PATCH v3 05/10] IMA: Read required policy from file From: Mimi Zohar To: Petr Vorel , ltp@lists.linux.it Cc: linux-integrity@vger.kernel.org Date: Thu, 23 Jan 2025 12:39:14 -0500 In-Reply-To: <20250114112915.610297-6-pvorel@suse.cz> References: <20250114112915.610297-1-pvorel@suse.cz> <20250114112915.610297-6-pvorel@suse.cz> Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable User-Agent: Evolution 3.52.4 (3.52.4-2.fc40) Precedence: bulk X-Mailing-List: linux-integrity@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: l5zSDrbCxZOzrgtxnh8jF8a51Woj2qxJ X-Proofpoint-ORIG-GUID: l5zSDrbCxZOzrgtxnh8jF8a51Woj2qxJ X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1057,Hydra:6.0.680,FMLib:17.12.68.34 definitions=2025-01-23_07,2025-01-23_01,2024-11-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 mlxlogscore=999 priorityscore=1501 clxscore=1015 adultscore=0 bulkscore=0 mlxscore=0 suspectscore=0 malwarescore=0 impostorscore=0 lowpriorityscore=0 spamscore=0 phishscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.19.0-2411120000 definitions=main-2501230128 On Tue, 2025-01-14 at 12:29 +0100, Petr Vorel wrote: > Previously snipped of required policy was as a string or regexp. > Loading required policy from file allows to move code to ima_setup.sh. > This is a preparation for loading IMA policy from file. >=20 > Check can be done on one or both: > 1) IMA builtin policy (based on /proc/cmdline) > 2) IMA policy content (actual content of /sys/kernel/security/ima/policy) >=20 > When missing CONFIG_IMA_READ_POLICY=3Dy on required policy convert: test,= but convert > TFAIL =3D> TCONF. >=20 > Signed-off-by: Petr Vorel Thanks, Petr. Really nice patch. Below is an improvement suggestion. Reviewed-by: Mimi Zohar > --- >=20 > diff --git a/testcases/kernel/security/integrity/ima/tests/ima_selinux.sh > b/testcases/kernel/security/integrity/ima/tests/ima_selinux.sh > index 75f9ba84e4..45fd741b5f 100755 > --- a/testcases/kernel/security/integrity/ima/tests/ima_selinux.sh > +++ b/testcases/kernel/security/integrity/ima/tests/ima_selinux.sh > @@ -1,6 +1,7 @@ > =C2=A0#!/bin/sh > =C2=A0# SPDX-License-Identifier: GPL-2.0-or-later > =C2=A0# Copyright (c) 2021 Microsoft Corporation > +# Copyright (c) Linux Test Project, 2021-2025 > =C2=A0# Author: Lakshmi Ramasubramanian > =C2=A0# > =C2=A0# Verify measurement of SELinux policy hash and state. > @@ -14,15 +15,12 @@ TST_CNT=3D2 > =C2=A0TST_SETUP=3D"setup" > =C2=A0TST_MIN_KVER=3D"5.12" > =C2=A0 > -FUNC_CRITICAL_DATA=3D'func=3DCRITICAL_DATA' > -REQUIRED_POLICY=3D"^measure.*$FUNC_CRITICAL_DATA" > +REQUIRED_POLICY_CONTENT=3D'selinux.policy' The selinux.policy contains a specific critical data measurement rule: measure func=3DCRITICAL_DATA label=3Dselinux. However the test would work = with the generic policy rule "measure func=3DCRITICAL_DATA", which can be specified = on the .=20 boot command line via "ima_policy=3Dcritical_data". As long as being able to read the IMA policy is required, in addition to ch= ecking whether the specific critical data rule exists, check whether the generic r= ule exists before loading the specific one. Perhaps all that is needed is defining REQUIRED_BUILTIN_POLICY like: REQUIRED_BUILTIN_POLICY=3D"critical_data" > =C2=A0 > =C2=A0setup() > =C2=A0{ > =C2=A0 SELINUX_DIR=3D$(tst_get_selinux_dir) > =C2=A0 [ "$SELINUX_DIR" ] || tst_brk TCONF "SELinux is not enabled" > - > - require_ima_policy_content "$REQUIRED_POLICY" '-E' > > $TST_TMPDIR/policy.txt > =C2=A0} > =C2=A0 > =C2=A0# Format of the measured SELinux state data. > @@ -45,7 +43,7 @@ validate_policy_capabilities() > =C2=A0 measured_value=3D$(echo $1 | awk -F'[=3D;]' -v inx=3D"$inx" '{pri= nt > $inx}') > =C2=A0 expected_value=3D$(cat > "$SELINUX_DIR/policy_capabilities/$measured_cap") > =C2=A0 if [ "$measured_value" !=3D "$expected_value" ]; then > - tst_res TFAIL "$measured_cap: expected: $expected_value, > got: $digest" > + tst_res $IMA_FAIL "$measured_cap: expected: > $expected_value, got: $digest" > =C2=A0 return > =C2=A0 fi > =C2=A0 > @@ -75,7 +73,7 @@ test1() > =C2=A0 # in kernel memory for SELinux > =C2=A0 line=3D$(grep -E "selinux-policy-hash" $ASCII_MEASUREMENTS | tail = -1) > =C2=A0 if [ -z "$line" ]; then > - tst_res TFAIL "SELinux policy hash not measured" > + tst_res $IMA_FAIL "SELinux policy hash not measured" > =C2=A0 return > =C2=A0 fi > =C2=A0 > @@ -86,7 +84,7 @@ test1() > =C2=A0 tst_brk TCONF "cannot compute digest for $algorithm" > =C2=A0 > =C2=A0 if [ "$policy_digest" !=3D "$expected_policy_digest" ]; then > - tst_res TFAIL "Digest mismatch: expected: $expected_policy_digest, > got: $policy_digest" > + tst_res $IMA_FAIL "Digest mismatch: expected: > $expected_policy_digest, got: $policy_digest" > =C2=A0 return > =C2=A0 fi > =C2=A0 > @@ -116,7 +114,7 @@ test2() > =C2=A0 # state matches that currently set for SELinux > =C2=A0 line=3D$(grep -E "selinux-state" $ASCII_MEASUREMENTS | tail -1) > =C2=A0 if [ -z "$line" ]; then > - tst_res TFAIL "SELinux state not measured" > + tst_res $IMA_FAIL "SELinux state not measured" > =C2=A0 return > =C2=A0 fi > =C2=A0 > @@ -129,7 +127,7 @@ test2() > =C2=A0 tst_brk TCONF "cannot compute digest for $algorithm" > =C2=A0 > =C2=A0 if [ "$digest" !=3D "$expected_digest" ]; then > - tst_res TFAIL "digest mismatch: expected: $expected_digest, got: > $digest" > + tst_res $IMA_FAIL "digest mismatch: expected: $expected_digest, > got: $digest" > =C2=A0 return > =C2=A0 fi > =C2=A0 > @@ -146,20 +144,20 @@ test2() > =C2=A0 enforced_value=3D$(echo $measured_data | awk -F'[=3D;]' '{print $4= }') > =C2=A0 expected_enforced_value=3D$(cat $SELINUX_DIR/enforce) > =C2=A0 if [ "$expected_enforced_value" !=3D "$enforced_value" ]; then > - tst_res TFAIL "enforce: expected: $expected_enforced_value, got: > $enforced_value" > + tst_res $IMA_FAIL "enforce: expected: $expected_enforced_value, > got: $enforced_value" > =C2=A0 return > =C2=A0 fi > =C2=A0 > =C2=A0 checkreqprot_value=3D$(echo $measured_data | awk -F'[=3D;]' '{prin= t $6}') > =C2=A0 expected_checkreqprot_value=3D$(cat $SELINUX_DIR/checkreqprot) > =C2=A0 if [ "$expected_checkreqprot_value" !=3D "$checkreqprot_value" ]; = then > - tst_res TFAIL "checkreqprot: expected: > $expected_checkreqprot_value, got: $checkreqprot_value" > + tst_res $IMA_FAIL "checkreqprot: expected: > $expected_checkreqprot_value, got: $checkreqprot_value" > =C2=A0 return > =C2=A0 fi > =C2=A0 > =C2=A0 initialized_value=3D$(echo $measured_data | awk -F'[=3D;]' '{print= $2}') > =C2=A0 if [ "$initialized_value" !=3D "1" ]; then > - tst_res TFAIL "initialized: expected 1, got: $initialized_value" > + tst_res $IMA_FAIL "initialized: expected 1, got: > $initialized_value" > =C2=A0 return > =C2=A0 fi From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from picard.linux.it (picard.linux.it [213.254.12.146]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id D222AC02182 for ; Thu, 23 Jan 2025 17:39:38 +0000 (UTC) Received: from picard.linux.it (localhost [IPv6:::1]) by picard.linux.it (Postfix) with ESMTP id 6DD763C4DF9 for ; Thu, 23 Jan 2025 18:39:37 +0100 (CET) Received: from in-7.smtp.seeweb.it (in-7.smtp.seeweb.it [217.194.8.7]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1)) (No client certificate requested) by picard.linux.it (Postfix) with ESMTPS id EB3913C2998 for ; Thu, 23 Jan 2025 18:39:20 +0100 (CET) Authentication-Results: in-7.smtp.seeweb.it; spf=pass (sender SPF authorized) smtp.mailfrom=linux.ibm.com (client-ip=148.163.156.1; helo=mx0a-001b2d01.pphosted.com; envelope-from=zohar@linux.ibm.com; receiver=lists.linux.it) Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by in-7.smtp.seeweb.it (Postfix) with ESMTPS id 2CC02207F21 for ; Thu, 23 Jan 2025 18:39:19 +0100 (CET) Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 50N9d722022534; Thu, 23 Jan 2025 17:39:18 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=pp1; bh=A3uXV8 hu1U2d0DiavA56xbXq20mzfmYKzcGlzqX/vDY=; b=E4sf8v3v/93jHR9VT/iwiR hKeUhSLFa2TN77XxHKMLiHAtha0Xm1VEFr6V9Yt1YXDd0lxQiMc4zuF3AJzKLEV8 VNoNU5xnUw5iTdUhaC1lo4vf52hwd2//GUTMWkSf7q511bUwdjbaovQc+hmWirB5 gl0NR90j/HsiLisQzdI5FTFlMQpDZE7uovCwTDI1bImNwoZvtpnr7UuvwdHqytB6 /eAaX7JEaOq0Tnt+XLoWLGUhf9iXpgmk0VH0Kwmh/H+lrKXNYtEOaQegWsgpTJD+ hrzSp3SwOhOeaMy1XChYE++hdadVmHVdO/YEgOxCims+BGgSCmbCaA6rSBXSYY2w == Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 44bbu9cdm8-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 23 Jan 2025 17:39:17 +0000 (GMT) Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.18.1.2/8.18.1.2) with ESMTP id 50NHZ3dn019223; Thu, 23 Jan 2025 17:39:16 GMT Received: from smtprelay02.dal12v.mail.ibm.com ([172.16.1.4]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 448pmspu00-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 23 Jan 2025 17:39:16 +0000 Received: from smtpav01.wdc07v.mail.ibm.com (smtpav01.wdc07v.mail.ibm.com [10.39.53.228]) by smtprelay02.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 50NHdFFT12124816 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 23 Jan 2025 17:39:16 GMT Received: from smtpav01.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 9A40258055; Thu, 23 Jan 2025 17:39:15 +0000 (GMT) Received: from smtpav01.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 203BE5804B; Thu, 23 Jan 2025 17:39:15 +0000 (GMT) Received: from li-43857255-d5e6-4659-90f1-fc5cee4750ad.ibm.com (unknown [9.61.4.223]) by smtpav01.wdc07v.mail.ibm.com (Postfix) with ESMTP; Thu, 23 Jan 2025 17:39:15 +0000 (GMT) Message-ID: <3c7dee2c281867aa279c9d556e4aa62a7e865d36.camel@linux.ibm.com> From: Mimi Zohar To: Petr Vorel , ltp@lists.linux.it Date: Thu, 23 Jan 2025 12:39:14 -0500 In-Reply-To: <20250114112915.610297-6-pvorel@suse.cz> References: <20250114112915.610297-1-pvorel@suse.cz> <20250114112915.610297-6-pvorel@suse.cz> User-Agent: Evolution 3.52.4 (3.52.4-2.fc40) MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: l5zSDrbCxZOzrgtxnh8jF8a51Woj2qxJ X-Proofpoint-ORIG-GUID: l5zSDrbCxZOzrgtxnh8jF8a51Woj2qxJ X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1057,Hydra:6.0.680,FMLib:17.12.68.34 definitions=2025-01-23_07,2025-01-23_01,2024-11-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 mlxlogscore=999 priorityscore=1501 clxscore=1015 adultscore=0 bulkscore=0 mlxscore=0 suspectscore=0 malwarescore=0 impostorscore=0 lowpriorityscore=0 spamscore=0 phishscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.19.0-2411120000 definitions=main-2501230128 X-Virus-Scanned: clamav-milter 1.0.3 at in-7.smtp.seeweb.it X-Virus-Status: Clean Subject: Re: [LTP] [PATCH v3 05/10] IMA: Read required policy from file X-BeenThere: ltp@lists.linux.it X-Mailman-Version: 2.1.29 Precedence: list List-Id: Linux Test Project List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: linux-integrity@vger.kernel.org Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Errors-To: ltp-bounces+ltp=archiver.kernel.org@lists.linux.it Sender: "ltp" T24gVHVlLCAyMDI1LTAxLTE0IGF0IDEyOjI5ICswMTAwLCBQZXRyIFZvcmVsIHdyb3RlOgo+IFBy ZXZpb3VzbHkgc25pcHBlZCBvZiByZXF1aXJlZCBwb2xpY3kgd2FzIGFzIGEgc3RyaW5nIG9yIHJl Z2V4cC4KPiBMb2FkaW5nIHJlcXVpcmVkIHBvbGljeSBmcm9tIGZpbGUgYWxsb3dzIHRvIG1vdmUg Y29kZSB0byBpbWFfc2V0dXAuc2guCj4gVGhpcyBpcyBhIHByZXBhcmF0aW9uIGZvciBsb2FkaW5n IElNQSBwb2xpY3kgZnJvbSBmaWxlLgo+IAo+IENoZWNrIGNhbiBiZSBkb25lIG9uIG9uZSBvciBi b3RoOgo+IDEpIElNQSBidWlsdGluIHBvbGljeSAoYmFzZWQgb24gL3Byb2MvY21kbGluZSkKPiAy KSBJTUEgcG9saWN5IGNvbnRlbnQgKGFjdHVhbCBjb250ZW50IG9mIC9zeXMva2VybmVsL3NlY3Vy aXR5L2ltYS9wb2xpY3kpCj4gCj4gV2hlbiBtaXNzaW5nIENPTkZJR19JTUFfUkVBRF9QT0xJQ1k9 eSBvbiByZXF1aXJlZCBwb2xpY3kgY29udmVydDogdGVzdCwgYnV0IGNvbnZlcnQKPiBURkFJTCA9 PiBUQ09ORi4KPiAKPiBTaWduZWQtb2ZmLWJ5OiBQZXRyIFZvcmVsIDxwdm9yZWxAc3VzZS5jej4K ClRoYW5rcywgUGV0ci4gIFJlYWxseSBuaWNlIHBhdGNoLiAgQmVsb3cgaXMgYW4gaW1wcm92ZW1l bnQgc3VnZ2VzdGlvbi4KClJldmlld2VkLWJ5OiBNaW1pIFpvaGFyIDx6b2hhckBsaW51eC5pYm0u Y29tPgoKPiAtLS0KPiAKPiBkaWZmIC0tZ2l0IGEvdGVzdGNhc2VzL2tlcm5lbC9zZWN1cml0eS9p bnRlZ3JpdHkvaW1hL3Rlc3RzL2ltYV9zZWxpbnV4LnNoCj4gYi90ZXN0Y2FzZXMva2VybmVsL3Nl Y3VyaXR5L2ludGVncml0eS9pbWEvdGVzdHMvaW1hX3NlbGludXguc2gKPiBpbmRleCA3NWY5YmE4 NGU0Li40NWZkNzQxYjVmIDEwMDc1NQo+IC0tLSBhL3Rlc3RjYXNlcy9rZXJuZWwvc2VjdXJpdHkv aW50ZWdyaXR5L2ltYS90ZXN0cy9pbWFfc2VsaW51eC5zaAo+ICsrKyBiL3Rlc3RjYXNlcy9rZXJu ZWwvc2VjdXJpdHkvaW50ZWdyaXR5L2ltYS90ZXN0cy9pbWFfc2VsaW51eC5zaAo+IEBAIC0xLDYg KzEsNyBAQAo+IMKgIyEvYmluL3NoCj4gwqAjIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBHUEwt Mi4wLW9yLWxhdGVyCj4gwqAjIENvcHlyaWdodCAoYykgMjAyMSBNaWNyb3NvZnQgQ29ycG9yYXRp b24KPiArIyBDb3B5cmlnaHQgKGMpIExpbnV4IFRlc3QgUHJvamVjdCwgMjAyMS0yMDI1Cj4gwqAj IEF1dGhvcjogTGFrc2htaSBSYW1hc3VicmFtYW5pYW4gPG5yYW1hc0BsaW51eC5taWNyb3NvZnQu Y29tPgo+IMKgIwo+IMKgIyBWZXJpZnkgbWVhc3VyZW1lbnQgb2YgU0VMaW51eCBwb2xpY3kgaGFz aCBhbmQgc3RhdGUuCj4gQEAgLTE0LDE1ICsxNSwxMiBAQCBUU1RfQ05UPTIKPiDCoFRTVF9TRVRV UD0ic2V0dXAiCj4gwqBUU1RfTUlOX0tWRVI9IjUuMTIiCj4gwqAKPiAtRlVOQ19DUklUSUNBTF9E QVRBPSdmdW5jPUNSSVRJQ0FMX0RBVEEnCj4gLVJFUVVJUkVEX1BPTElDWT0iXm1lYXN1cmUuKiRG VU5DX0NSSVRJQ0FMX0RBVEEiCj4gK1JFUVVJUkVEX1BPTElDWV9DT05URU5UPSdzZWxpbnV4LnBv bGljeScKClRoZSBzZWxpbnV4LnBvbGljeSBjb250YWlucyBhIHNwZWNpZmljIGNyaXRpY2FsIGRh dGEgbWVhc3VyZW1lbnQgcnVsZToKbWVhc3VyZSBmdW5jPUNSSVRJQ0FMX0RBVEEgbGFiZWw9c2Vs aW51eC4gIEhvd2V2ZXIgdGhlIHRlc3Qgd291bGQgd29yayB3aXRoIHRoZQpnZW5lcmljIHBvbGlj eSBydWxlICJtZWFzdXJlIGZ1bmM9Q1JJVElDQUxfREFUQSIsIHdoaWNoIGNhbiBiZSBzcGVjaWZp ZWQgb24gdGhlIC4gCmJvb3QgY29tbWFuZCBsaW5lIHZpYSAiaW1hX3BvbGljeT1jcml0aWNhbF9k YXRhIi4KCkFzIGxvbmcgYXMgYmVpbmcgYWJsZSB0byByZWFkIHRoZSBJTUEgcG9saWN5IGlzIHJl cXVpcmVkLCBpbiBhZGRpdGlvbiB0byBjaGVja2luZwp3aGV0aGVyIHRoZSBzcGVjaWZpYyBjcml0 aWNhbCBkYXRhIHJ1bGUgZXhpc3RzLCBjaGVjayB3aGV0aGVyIHRoZSBnZW5lcmljIHJ1bGUgZXhp c3RzCmJlZm9yZSBsb2FkaW5nIHRoZSBzcGVjaWZpYyBvbmUuCgpQZXJoYXBzIGFsbCB0aGF0IGlz IG5lZWRlZCBpcyBkZWZpbmluZyBSRVFVSVJFRF9CVUlMVElOX1BPTElDWSBsaWtlOgpSRVFVSVJF RF9CVUlMVElOX1BPTElDWT0iY3JpdGljYWxfZGF0YSIKCj4gwqAKPiDCoHNldHVwKCkKPiDCoHsK PiDCoAlTRUxJTlVYX0RJUj0kKHRzdF9nZXRfc2VsaW51eF9kaXIpCj4gwqAJWyAiJFNFTElOVVhf RElSIiBdIHx8IHRzdF9icmsgVENPTkYgIlNFTGludXggaXMgbm90IGVuYWJsZWQiCj4gLQo+IC0J cmVxdWlyZV9pbWFfcG9saWN5X2NvbnRlbnQgIiRSRVFVSVJFRF9QT0xJQ1kiICctRScgPgo+ICRU U1RfVE1QRElSL3BvbGljeS50eHQKPiDCoH0KPiDCoAo+IMKgIyBGb3JtYXQgb2YgdGhlIG1lYXN1 cmVkIFNFTGludXggc3RhdGUgZGF0YS4KPiBAQCAtNDUsNyArNDMsNyBAQCB2YWxpZGF0ZV9wb2xp Y3lfY2FwYWJpbGl0aWVzKCkKPiDCoAkJbWVhc3VyZWRfdmFsdWU9JChlY2hvICQxIHwgYXdrIC1G J1s9O10nIC12IGlueD0iJGlueCIgJ3twcmludAo+ICRpbnh9JykKPiDCoAkJZXhwZWN0ZWRfdmFs dWU9JChjYXQKPiAiJFNFTElOVVhfRElSL3BvbGljeV9jYXBhYmlsaXRpZXMvJG1lYXN1cmVkX2Nh cCIpCj4gwqAJCWlmIFsgIiRtZWFzdXJlZF92YWx1ZSIgIT0gIiRleHBlY3RlZF92YWx1ZSIgXTsg dGhlbgo+IC0JCQl0c3RfcmVzIFRGQUlMICIkbWVhc3VyZWRfY2FwOiBleHBlY3RlZDogJGV4cGVj dGVkX3ZhbHVlLAo+IGdvdDogJGRpZ2VzdCIKPiArCQkJdHN0X3JlcyAkSU1BX0ZBSUwgIiRtZWFz dXJlZF9jYXA6IGV4cGVjdGVkOgo+ICRleHBlY3RlZF92YWx1ZSwgZ290OiAkZGlnZXN0Igo+IMKg CQkJcmV0dXJuCj4gwqAJCWZpCj4gwqAKPiBAQCAtNzUsNyArNzMsNyBAQCB0ZXN0MSgpCj4gwqAJ IyBpbiBrZXJuZWwgbWVtb3J5IGZvciBTRUxpbnV4Cj4gwqAJbGluZT0kKGdyZXAgLUUgInNlbGlu dXgtcG9saWN5LWhhc2giICRBU0NJSV9NRUFTVVJFTUVOVFMgfCB0YWlsIC0xKQo+IMKgCWlmIFsg LXogIiRsaW5lIiBdOyB0aGVuCj4gLQkJdHN0X3JlcyBURkFJTCAiU0VMaW51eCBwb2xpY3kgaGFz aCBub3QgbWVhc3VyZWQiCj4gKwkJdHN0X3JlcyAkSU1BX0ZBSUwgIlNFTGludXggcG9saWN5IGhh c2ggbm90IG1lYXN1cmVkIgo+IMKgCQlyZXR1cm4KPiDCoAlmaQo+IMKgCj4gQEAgLTg2LDcgKzg0 LDcgQEAgdGVzdDEoKQo+IMKgCQl0c3RfYnJrIFRDT05GICJjYW5ub3QgY29tcHV0ZSBkaWdlc3Qg Zm9yICRhbGdvcml0aG0iCj4gwqAKPiDCoAlpZiBbICIkcG9saWN5X2RpZ2VzdCIgIT0gIiRleHBl Y3RlZF9wb2xpY3lfZGlnZXN0IiBdOyB0aGVuCj4gLQkJdHN0X3JlcyBURkFJTCAiRGlnZXN0IG1p c21hdGNoOiBleHBlY3RlZDogJGV4cGVjdGVkX3BvbGljeV9kaWdlc3QsCj4gZ290OiAkcG9saWN5 X2RpZ2VzdCIKPiArCQl0c3RfcmVzICRJTUFfRkFJTCAiRGlnZXN0IG1pc21hdGNoOiBleHBlY3Rl ZDoKPiAkZXhwZWN0ZWRfcG9saWN5X2RpZ2VzdCwgZ290OiAkcG9saWN5X2RpZ2VzdCIKPiDCoAkJ cmV0dXJuCj4gwqAJZmkKPiDCoAo+IEBAIC0xMTYsNyArMTE0LDcgQEAgdGVzdDIoKQo+IMKgCSMg c3RhdGUgbWF0Y2hlcyB0aGF0IGN1cnJlbnRseSBzZXQgZm9yIFNFTGludXgKPiDCoAlsaW5lPSQo Z3JlcCAtRSAic2VsaW51eC1zdGF0ZSIgJEFTQ0lJX01FQVNVUkVNRU5UUyB8IHRhaWwgLTEpCj4g wqAJaWYgWyAteiAiJGxpbmUiIF07IHRoZW4KPiAtCQl0c3RfcmVzIFRGQUlMICJTRUxpbnV4IHN0 YXRlIG5vdCBtZWFzdXJlZCIKPiArCQl0c3RfcmVzICRJTUFfRkFJTCAiU0VMaW51eCBzdGF0ZSBu b3QgbWVhc3VyZWQiCj4gwqAJCXJldHVybgo+IMKgCWZpCj4gwqAKPiBAQCAtMTI5LDcgKzEyNyw3 IEBAIHRlc3QyKCkKPiDCoAl0c3RfYnJrIFRDT05GICJjYW5ub3QgY29tcHV0ZSBkaWdlc3QgZm9y ICRhbGdvcml0aG0iCj4gwqAKPiDCoAlpZiBbICIkZGlnZXN0IiAhPSAiJGV4cGVjdGVkX2RpZ2Vz dCIgXTsgdGhlbgo+IC0JCXRzdF9yZXMgVEZBSUwgImRpZ2VzdCBtaXNtYXRjaDogZXhwZWN0ZWQ6 ICRleHBlY3RlZF9kaWdlc3QsIGdvdDoKPiAkZGlnZXN0Igo+ICsJCXRzdF9yZXMgJElNQV9GQUlM ICJkaWdlc3QgbWlzbWF0Y2g6IGV4cGVjdGVkOiAkZXhwZWN0ZWRfZGlnZXN0LAo+IGdvdDogJGRp Z2VzdCIKPiDCoAkJcmV0dXJuCj4gwqAJZmkKPiDCoAo+IEBAIC0xNDYsMjAgKzE0NCwyMCBAQCB0 ZXN0MigpCj4gwqAJZW5mb3JjZWRfdmFsdWU9JChlY2hvICRtZWFzdXJlZF9kYXRhIHwgYXdrIC1G J1s9O10nICd7cHJpbnQgJDR9JykKPiDCoAlleHBlY3RlZF9lbmZvcmNlZF92YWx1ZT0kKGNhdCAk U0VMSU5VWF9ESVIvZW5mb3JjZSkKPiDCoAlpZiBbICIkZXhwZWN0ZWRfZW5mb3JjZWRfdmFsdWUi ICE9ICIkZW5mb3JjZWRfdmFsdWUiIF07IHRoZW4KPiAtCQl0c3RfcmVzIFRGQUlMICJlbmZvcmNl OiBleHBlY3RlZDogJGV4cGVjdGVkX2VuZm9yY2VkX3ZhbHVlLCBnb3Q6Cj4gJGVuZm9yY2VkX3Zh bHVlIgo+ICsJCXRzdF9yZXMgJElNQV9GQUlMICJlbmZvcmNlOiBleHBlY3RlZDogJGV4cGVjdGVk X2VuZm9yY2VkX3ZhbHVlLAo+IGdvdDogJGVuZm9yY2VkX3ZhbHVlIgo+IMKgCQlyZXR1cm4KPiDC oAlmaQo+IMKgCj4gwqAJY2hlY2tyZXFwcm90X3ZhbHVlPSQoZWNobyAkbWVhc3VyZWRfZGF0YSB8 IGF3ayAtRidbPTtdJyAne3ByaW50ICQ2fScpCj4gwqAJZXhwZWN0ZWRfY2hlY2tyZXFwcm90X3Zh bHVlPSQoY2F0ICRTRUxJTlVYX0RJUi9jaGVja3JlcXByb3QpCj4gwqAJaWYgWyAiJGV4cGVjdGVk X2NoZWNrcmVxcHJvdF92YWx1ZSIgIT0gIiRjaGVja3JlcXByb3RfdmFsdWUiIF07IHRoZW4KPiAt CQl0c3RfcmVzIFRGQUlMICJjaGVja3JlcXByb3Q6IGV4cGVjdGVkOgo+ICRleHBlY3RlZF9jaGVj a3JlcXByb3RfdmFsdWUsIGdvdDogJGNoZWNrcmVxcHJvdF92YWx1ZSIKPiArCQl0c3RfcmVzICRJ TUFfRkFJTCAiY2hlY2tyZXFwcm90OiBleHBlY3RlZDoKPiAkZXhwZWN0ZWRfY2hlY2tyZXFwcm90 X3ZhbHVlLCBnb3Q6ICRjaGVja3JlcXByb3RfdmFsdWUiCj4gwqAJCXJldHVybgo+IMKgCWZpCj4g wqAKPiDCoAlpbml0aWFsaXplZF92YWx1ZT0kKGVjaG8gJG1lYXN1cmVkX2RhdGEgfCBhd2sgLUYn Wz07XScgJ3twcmludCAkMn0nKQo+IMKgCWlmIFsgIiRpbml0aWFsaXplZF92YWx1ZSIgIT0gIjEi IF07IHRoZW4KPiAtCQl0c3RfcmVzIFRGQUlMICJpbml0aWFsaXplZDogZXhwZWN0ZWQgMSwgZ290 OiAkaW5pdGlhbGl6ZWRfdmFsdWUiCj4gKwkJdHN0X3JlcyAkSU1BX0ZBSUwgImluaXRpYWxpemVk OiBleHBlY3RlZCAxLCBnb3Q6Cj4gJGluaXRpYWxpemVkX3ZhbHVlIgo+IMKgCQlyZXR1cm4KPiDC oAlmaQoKCi0tIApNYWlsaW5nIGxpc3QgaW5mbzogaHR0cHM6Ly9saXN0cy5saW51eC5pdC9saXN0 aW5mby9sdHAK