From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2B4F6C433EF for ; Thu, 21 Oct 2021 02:20:14 +0000 (UTC) Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 910FD611CC for ; Thu, 21 Oct 2021 02:20:13 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org 910FD611CC Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=huawei.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=redhat.com Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-456-GEHYhSmZOkGNTqdVc1vMTQ-1; Wed, 20 Oct 2021 22:20:09 -0400 X-MC-Unique: GEHYhSmZOkGNTqdVc1vMTQ-1 Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 98076806688; Thu, 21 Oct 2021 02:20:04 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.20]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 29D9E60CA0; Thu, 21 Oct 2021 02:20:04 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id CD32818199EE; Thu, 21 Oct 2021 02:20:03 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx01.intmail.prod.int.rdu2.redhat.com [10.11.54.1]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id 19KFQjrp005634 for ; Wed, 20 Oct 2021 11:26:45 -0400 Received: by smtp.corp.redhat.com (Postfix) id 3EC2540CFD01; Wed, 20 Oct 2021 15:26:45 +0000 (UTC) Received: from mimecast-mx02.redhat.com (mimecast02.extmail.prod.ext.rdu2.redhat.com [10.11.55.18]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 3A0C540CFD11 for ; Wed, 20 Oct 2021 15:26:45 +0000 (UTC) Received: from us-smtp-1.mimecast.com (us-smtp-1.mimecast.com [207.211.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 1688E8027E1 for ; Wed, 20 Oct 2021 15:26:45 +0000 (UTC) Received: from frasgout.his.huawei.com (frasgout.his.huawei.com [185.176.79.56]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-247-VvHXA7CFPLG_Fyweo7Giyg-1; Wed, 20 Oct 2021 11:26:14 -0400 X-MC-Unique: VvHXA7CFPLG_Fyweo7Giyg-1 Received: from fraeml712-chm.china.huawei.com (unknown [172.18.147.226]) by frasgout.his.huawei.com (SkyGuard) with ESMTP id 4HZDRj3tffz67Xsj; Wed, 20 Oct 2021 23:04:49 +0800 (CST) Received: from fraeml714-chm.china.huawei.com (10.206.15.33) by fraeml712-chm.china.huawei.com (10.206.15.61) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2308.15; Wed, 20 Oct 2021 17:08:39 +0200 Received: from fraeml714-chm.china.huawei.com ([10.206.15.33]) by fraeml714-chm.china.huawei.com ([10.206.15.33]) with mapi id 15.01.2308.015; Wed, 20 Oct 2021 17:08:39 +0200 From: Roberto Sassu To: Eric Biggers , Deven Bowers Thread-Topic: [RFC PATCH v7 12/16] fsverity|security: add security hooks to fsverity digest and signature Thread-Index: AQHXwGWUN6BqcPCg3Uma5jdt5usPz6vRLYAAgAMlHYCAAAy0gIAHoD6w Date: Wed, 20 Oct 2021 15:08:39 +0000 Message-ID: <5c1f800ba554485cb3659da689d2079a@huawei.com> References: <1634151995-16266-1-git-send-email-deven.desai@linux.microsoft.com> <1634151995-16266-13-git-send-email-deven.desai@linux.microsoft.com> <9089bdb0-b28a-9fa0-c510-00fa275af621@linux.microsoft.com> In-Reply-To: Accept-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.221.98.153] MIME-Version: 1.0 X-CFilter-Loop: Reflected X-Mimecast-Impersonation-Protect: Policy=CLT - Impersonation Protection Definition; Similar Internal Domain=false; Similar Monitored External Domain=false; Custom External Domain=false; Mimecast External Domain=false; Newly Observed Domain=false; Internal User Name=false; Custom Display Name List=false; Reply-to Address Mismatch=false; Targeted Threat Dictionary=false; Mimecast Threat Dictionary=false; Custom Threat Dictionary=false X-Scanned-By: MIMEDefang 2.84 on 10.11.54.1 X-MIME-Autoconverted: from base64 to 8bit by lists01.pubmisc.prod.ext.phx2.redhat.com id 19KFQjrp005634 X-loop: dm-devel@redhat.com X-Mailman-Approved-At: Wed, 20 Oct 2021 22:18:52 -0400 Cc: "axboe@kernel.dk" , "linux-security-module@vger.kernel.org" , "tytso@mit.edu" , "paul@paul-moore.com" , "snitzer@redhat.com" , "corbet@lwn.net" , "jannh@google.com" , "linux-doc@vger.kernel.org" , "jmorris@namei.org" , "eparis@redhat.com" , "linux-kernel@vger.kernel.org" , "linux-block@vger.kernel.org" , "dm-devel@redhat.com" , "linux-audit@redhat.com" , "linux-fscrypt@vger.kernel.org" , "agk@redhat.com" , "serge@hallyn.com" Subject: Re: [dm-devel] [RFC PATCH v7 12/16] fsverity|security: add security hooks to fsverity digest and signature X-BeenThere: dm-devel@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: device-mapper development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: dm-devel-bounces@redhat.com Errors-To: dm-devel-bounces@redhat.com X-Scanned-By: MIMEDefang 2.79 on 10.5.11.12 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=dm-devel-bounces@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Language: en-US Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 PiBGcm9tOiBFcmljIEJpZ2dlcnMgW21haWx0bzplYmlnZ2Vyc0BrZXJuZWwub3JnXQo+IFNlbnQ6 IEZyaWRheSwgT2N0b2JlciAxNSwgMjAyMSAxMDoxMSBQTQo+IE9uIEZyaSwgT2N0IDE1LCAyMDIx IGF0IDEyOjI1OjUzUE0gLTA3MDAsIERldmVuIEJvd2VycyB3cm90ZToKPiA+Cj4gPiBPbiAxMC8x My8yMDIxIDEyOjI0IFBNLCBFcmljIEJpZ2dlcnMgd3JvdGU6Cj4gPiA+IE9uIFdlZCwgT2N0IDEz LCAyMDIxIGF0IDEyOjA2OjMxUE0gLTA3MDAsCj4gZGV2ZW4uZGVzYWlAbGludXgubWljcm9zb2Z0 LmNvbSB3cm90ZToKPiA+ID4gPiBGcm9tOiBGYW4gV3UgPHd1ZmFuQGxpbnV4Lm1pY3Jvc29mdC5j b20+Cj4gPiA+ID4KPiA+ID4gPiBBZGQgc2VjdXJpdHlfaW5vZGVfc2V0c2VjdXJpdHkgdG8gZnN2 ZXJpdHkgc2lnbmF0dXJlIHZlcmlmaWNhdGlvbi4KPiA+ID4gPiBUaGlzIGNhbiBsZXQgTFNNcyBz YXZlIHRoZSBzaWduYXR1cmUgZGF0YSBhbmQgZGlnZXN0IGhhc2hlcyBwcm92aWRlZAo+ID4gPiA+ IGJ5IGZzdmVyaXR5Lgo+ID4gPiBDYW4geW91IGVsYWJvcmF0ZSBvbiB3aHkgTFNNcyBuZWVkIHRo aXMgaW5mb3JtYXRpb24/Cj4gPgo+ID4gVGhlIHByb3Bvc2VkIExTTSAoSVBFKSBvZiB0aGlzIHNl cmllcyB3aWxsIGJlIHRoZSBvbmx5IG9uZSB0byBuZWVkCj4gPiB0aGlzIGluZm9ybWF0aW9uIGF0 IHRoZcKgIG1vbWVudC4gSVBF4oCZcyBnb2FsIGlzIHRvIGhhdmUgcHJvdmlkZQo+ID4gdHJ1c3Qt YmFzZWQgYWNjZXNzIGNvbnRyb2wuIFRydXN0IGFuZCBJbnRlZ3JpdHkgYXJlIHRpZWQgdG9nZXRo ZXIsCj4gPiBhcyB5b3UgY2Fubm90IHByb3ZlIHRydXN0IHdpdGhvdXQgcHJvdmluZyBpbnRlZ3Jp dHkuCj4gCj4gSSB0aGluayB5b3UgbWVhbiBhdXRoZW50aWNpdHksIG5vdCBpbnRlZ3JpdHk/Cj4g Cj4gQWxzbyBob3cgZG9lcyB0aGlzIGRpZmZlciBmcm9tIElNQT8gIEkga25vdyB0aGF0IElNQSBk b2Vzbid0IHN1cHBvcnQgZnMtdmVyaXR5Cj4gZmlsZSBoYXNoZXMsIGJ1dCB0aGF0IGNvdWxkIGJl IGNoYW5nZWQuICBXaHkgbm90IGV4dGVuZCBJTUEgdG8gY292ZXIgeW91ciB1c2UKPiBjYXNlKHMp Pwo+IAo+ID4gSVBFIG5lZWRzIHRoZSBkaWdlc3QgaW5mb3JtYXRpb24gdG8gYmUgYWJsZSB0byBj b21wYXJlIGEgZGlnZXN0Cj4gPiBwcm92aWRlZCBieSB0aGUgcG9saWN5IGF1dGhvciwgYWdhaW5z dCB0aGUgZGlnZXN0IGNhbGN1bGF0ZWQgYnkKPiA+IGZzdmVyaXR5IHRvIG1ha2UgYSBkZWNpc2lv biBvbiB3aGV0aGVyIHRoYXQgc3BlY2lmaWMgZmlsZSwgcmVwcmVzZW50ZWQKPiA+IGJ5IHRoZSBk aWdlc3QgaXMgYXV0aG9yaXplZCBmb3IgdGhlIGFjdGlvbnMgc3BlY2lmaWVkIGluIHRoZSBwb2xp Y3kuCj4gPgo+ID4gQSBtb3JlIGNvbmNyZXRlIGV4YW1wbGUsIGlmIGFuIElQRSBwb2xpY3kgYXV0 aG9yIHdyaXRlczoKPiA+Cj4gPiDCoMKgwqAgb3A9RVhFQ1VURSBmc3Zlcml0eV9kaWdlc3Q9PEhl eERpZ2VzdCA+IGFjdGlvbj1ERU5ZCj4gPgo+ID4gSVBFIHRha2VzIHRoZSBkaWdlc3QgcHJvdmlk ZWQgYnkgdGhpcyBzZWN1cml0eSBob29rLCBzdG9yZXMgaXQKPiA+IGluIElQRSdzIHNlY3VyaXR5 IGJsb2Igb24gdGhlIGlub2RlLiBJZiB0aGlzIGZpbGUgaXMgbGF0ZXIKPiA+IGV4ZWN1dGVkLCBJ UEUgY29tcGFyZXMgdGhlIGRpZ2VzdCBzdG9yZWQgaW4gdGhlIExTTSBibG9iLAo+ID4gcHJvdmlk ZWQgYnkgdGhpcyBob29rLCBhZ2FpbnN0IDxIZXhEaWdlc3Q+IGluIHRoZSBwb2xpY3ksIGlmCj4g PiBpdCBtYXRjaGVzLCBpdCBkZW5pZXMgdGhlIGFjY2VzcywgcGVyZm9ybWluZyBhIHJldm9jYXRp b24KPiA+IG9mIHRoYXQgZmlsZS4KPiAKPiBEbyB5b3UgaGF2ZSBhIGJldHRlciBleGFtcGxlPyAg VGhpcyBvbmUgaXMgcHJldHR5IHVzZWxlc3Mgc2luY2Ugb25lIGNhbiBnZXQKPiBhcm91bmQgaXQg anVzdCBieSBleGVjdXRpbmcgYSBmaWxlIHRoYXQgZG9lc24ndCBoYXZlIGZzLXZlcml0eSBlbmFi bGVkLgoKSSB3YXMgd29uZGVyaW5nIGlmIHRoZSBmb2xsb3dpbmcgdXNlIGNhc2UgY2FuIGJlIHN1 cHBvcnRlZDoKYWxsb3cgdGhlIGV4ZWN1dGlvbiBvZiBmaWxlcyBwcm90ZWN0ZWQgd2l0aCBmc3Zl cml0eSBpZiB0aGUgcm9vdApkaWdlc3QgaXMgZm91bmQgYW1vbmcgcmVmZXJlbmNlIHZhbHVlcyAo aW5zdGVhZCBvZiBwcm92aWRpbmcKdGhlbSBvbmUgYnkgb25lIGluIHRoZSBwb2xpY3kpLgoKU29t ZXRoaW5nIGxpa2U6CgpvcD1FWEVDVVRFIGZzdmVyaXR5X2RpZ2VzdD1kaWdsaW0gYWN0aW9uPUFM TE9XCgpESUdMSU0gaXMgYSBjb21wb25lbnQgSSdtIHdvcmtpbmcgb24gdGhhdCBnZW5lcmljYWxs eQpzdG9yZXMgZGlnZXN0cy4gVGhlIGN1cnJlbnQgdXNlIGNhc2UgaXMgdG8gc3RvcmUgZmlsZSBk aWdlc3RzCmZyb20gUlBNVEFHX0ZJTEVESUdFU1RTIGFuZCB1c2UgdGhlbSB3aXRoIElNQSwgYnV0 CnRoZSBmc3Zlcml0eSB1c2UgY2FzZSBjb3VsZCBiZSBlYXNpbHkgc3VwcG9ydGVkIChpZiB0aGUg cm9vdApkaWdlc3QgaXMgc3RvcmVkIGluIHRoZSBSUE0gaGVhZGVyKS4KCkRJR0xJTSBhbHNvIHRl bGxzIHdoZXRoZXIgb3Igbm90IHRoZSBzaWduYXR1cmUgb2YgdGhlIHNvdXJjZQpjb250YWluaW5n IGZpbGUgZGlnZXN0cyAob3IgZnN2ZXJpdHkgZGlnZXN0cykgaXMgdmFsaWQgKHRoZSBzaWduYXR1 cmUKb2YgdGhlIFJQTSBoZWFkZXIgaXMgdGFrZW4gZnJvbSBSUE1UQUdfUlNBSEVBREVSKS4KClRo ZSBtZW1vcnkgb2NjdXBhdGlvbiBpcyByZWxhdGl2ZWx5IHNtYWxsIGZvciBleGVjdXRhYmxlcwph bmQgc2hhcmVkIGxpYnJhcmllcy4gSSBwdWJsaXNoZWQgYSBkZW1vIGZvciBGZWRvcmEgYW5kCm9w ZW5TVVNFIHNvbWUgdGltZSBhZ286CgpodHRwczovL2xvcmUua2VybmVsLm9yZy9saW51eC1pbnRl Z3JpdHkvNDhjZDczN2M1MDRkNDUyMDgzNzdkYWEyN2Q2MjU1MzFAaHVhd2VpLmNvbS8KClRoYW5r cwoKUm9iZXJ0bwoKSFVBV0VJIFRFQ0hOT0xPR0lFUyBEdWVzc2VsZG9yZiBHbWJILCBIUkIgNTYw NjMKTWFuYWdpbmcgRGlyZWN0b3I6IExpIFBlbmcsIFpob25nIFJvbmdodWEKCj4gPiBUaGlzIGJy aW5ncyBtZSB0byB5b3VyIG5leHQgY29tbWVudDoKPiA+Cj4gPiA+IFRoZSBkaWdlc3QgaXNuJ3Qg bWVhbmluZ2Z1bCB3aXRob3V0IGtub3dpbmcgdGhlIGhhc2ggYWxnb3JpdGhtIGl0IHVzZXMuCj4g PiBJdCdzIGF2YWlsYWJsZSBoZXJlLCBidXQgeW91IGFyZW4ndCBwYXNzaW5nIGl0IHRvIHRoaXMg ZnVuY3Rpb24uCj4gPgo+ID4gVGhlIGRpZ2VzdCBpcyBtZWFuaW5nZnVsIHdpdGhvdXQgdGhlIGFs Z29yaXRobSBpbiB0aGlzIGNhc2UuCj4gCj4gTm8sIGl0J3Mgbm90Lgo+IAo+IERpZ2VzdHMgYXJl IG1lYW5pbmdsZXNzIHdpdGhvdXQga25vd2luZyB3aGF0IGFsZ29yaXRobSB0aGV5IHdlcmUgY3Jl YXRlZAo+IHdpdGguCj4gCj4gSWYgeW91ciBzZWN1cml0eSBwb2xpY3kgaXMgc29tZXRoaW5nIGxp a2UgIlRydXN0IHRoZSBmaWxlIHdpdGggZGlnZXN0ICRmb28iIGFuZAo+IG11bHRpcGxlIGhhc2gg YWxnb3JpdGhtcyBhcmUgcG9zc2libGUsIHRoZW4gdGhlIGFsb3JpdGhtIGludGVuZGVkIHRvIGJl IHVzZWQKPiBuZWVkcyB0byBiZSBleHBsaWNpdGx5IHNwZWNpZmllZC4gIE90aGVyd2lzZSBhbnkg YWxnb3JpdGhtIHdpdGggdGhlIHNhbWUgbGVuZ3RoCj4gZGlnZXN0IHdpbGwgYmUgYWNjZXB0ZWQu ICBUaGF0J3MgYSBmYXRhbCBmbGF3IGlmIGFueSBvZiB0aGVzZSBhbGdvcml0aG1zIGlzCj4gY3J5 cHRvZ3JhcGhpY2FsbHkgYnJva2VuIG9yIHdhcyBuZXZlciBpbnRlbmRlZCB0byBiZSBhIGNyeXB0 b2dyYXBoaWMgYWxnb3JpdGhtCj4gaW4gdGhlIGZpcnN0IHBsYWNlIChlLmcuLCBhIG5vbi1jcnlw dG9ncmFwaGljIGNoZWNrc3VtKS4KPiAKPiBDcnlwdG9zeXN0ZW1zIGFsd2F5cyBuZWVkIHRvIHNw ZWNpZnkgdGhlIGNyeXB0byBhbGdvcml0aG0ocykgdXNlZDsgdGhlCj4gYWR2ZXJzYXJ5Cj4gbXVz dCBub3QgYmUgYWxsb3dlZCB0byBjaG9vc2UgdGhlIGFsZ29yaXRobXMuCj4gCj4gSSdtIG5vdCBz dXJlIGhvdyB0aGVzZSBwYXRjaGVzIGNhbiBiZSB0YWtlbiBzZXJpb3VzbHkgd2hlbiB0aGV5J3Jl IGdldHRpbmcgdGhpcwo+IHNvcnQgb2YgdGhpbmcgd3JvbmcuCj4gCj4gPiA+ID4gKwkJCQkJRlNf VkVSSVRZX1NJR05BVFVSRV9TRUNfTkFNRSwKPiA+ID4gPiArCQkJCQlzaWduYXR1cmUsIHNpZ19z aXplLCAwKTsKPiA+ID4gVGhpcyBpcyBvbmx5IGZvciBmcy12ZXJpdHkgYnVpbHQtaW4gc2lnbmF0 dXJlcyB3aGljaCBhcmVuJ3QgdGhlIG9ubHkgd2F5IHRvIGRvCj4gPiA+IHNpZ25hdHVyZXMgd2l0 aCBmcy12ZXJpdHkuICBBcmUgeW91IHN1cmUgdGhpcyBpcyB3aGF0IHlvdSdyZSBsb29raW5nIGZv cj8KPiA+Cj4gPiBDb3VsZCB5b3UgZWxhYm9yYXRlIG9uIHRoZSBvdGhlciBzaWduYXR1cmUgdHlw ZXMgdGhhdCBjYW4gYmUgdXNlZAo+ID4gd2l0aCBmcy12ZXJpdHk/IEnigJltIDk5JSBzdXJlIHRo aXMgaXMgd2hhdCBJ4oCZbSBsb29raW5nIGZvciBhcyB0aGlzCj4gPiBpcyBhIHNpZ25hdHVyZSB2 YWxpZGF0ZWQgaW4gdGhlIGtlcm5lbCBhZ2FpbnN0IHRoZSBmcy12ZXJpdHkga2V5cmluZwo+ID4g YXMgcGFydCBvZiB0aGUg4oCcZnN2ZXJpdHkgZW5hYmxl4oCdIHV0aWxpdHkuCj4gPgo+ID4gSXQn cyBpbXBvcnRhbnQgdGhhdCB0aGUgc2lnbmF0dXJlIGlzIHZhbGlkYXRlZCBpbiB0aGUga2VybmVs LCBhcwo+ID4gdXNlcnNwYWNlIGlzIGNvbnNpZGVyZWQgdW50cnVzdGVkIHVudGlsIHRoZSBzaWdu YXR1cmUgaXMgdmFsaWRhdGVkCj4gPiBmb3IgdGhpcyBjYXNlLgo+ID4KPiA+ID4gQ2FuIHlvdSBl bGFib3JhdGUgb24geW91ciB1c2UgY2FzZSBmb3IgZnMtdmVyaXR5IGJ1aWx0LWluIHNpZ25hdHVy ZXMsCj4gPiBTdXJlLCBzaWduYXR1cmVzLCBsaWtlIGRpZ2VzdHMsIGFsc28gcHJvdmlkZSBhIHdh eSB0byBwcm92ZSBpbnRlZ3JpdHksCj4gPiBhbmQgdGhlIHRydXN0IGNvbXBvbmVudCBjb21lcyBm cm9tIHRoZSB2YWxpZGF0aW9uIGFnYWluc3QgdGhlIGtleXJpbmcsCj4gPiBhcyBvcHBvc2VkIHRv IGEgZml4ZWQgdmFsdWUgaW4gSVBF4oCZcyBwb2xpY3kuIFRoZSB1c2UgY2FzZSBmb3IgZnMtdmVy aXR5Cj4gPiBidWlsdC1pbiBzaWduYXR1cmVzIGlzIHRoYXQgd2UgaGF2ZSBhIHJ3IGV4dDQgZmls ZXN5c3RlbSB0aGF0IGhhcyBzb21lCj4gPiBleGVjdXRhYmxlIGZpbGVzLCBhbmQgd2Ugd2FudCB0 byBoYXZlIGEgZXhlY3V0aW9uIHBvbGljeSAodGhyb3VnaCBJUEUpCj4gPiB0aGF0IG9ubHkgX3Ry dXN0ZWRfIGV4ZWN1dGFibGVzIGNhbiBydW4uIFBlcmYgaXMgaW1wb3J0YW50IGhlcmUsIGhlbmNl Cj4gPiBmcy12ZXJpdHkuCj4gCj4gTW9zdCB1c2VycyBvZiBmcy12ZXJpdHkgYnVpbHQtaW4gc2ln bmF0dXJlcyBoYXZlIGFjdHVhbGx5IGJlZW4gZW5mb3JjaW5nIHRoZWlyCj4gc2VjdXJpdHkgcG9s aWN5IGluIHVzZXJzcGFjZSwgYnkgY2hlY2tpbmcgd2hldGhlciBzcGVjaWZpYyBmaWxlcyBoYXZl IHRoZQo+IGZzLXZlcml0eSBiaXQgc2V0IG9yIG5vdC4gIFN1Y2ggdXNlcnMgY291bGQganVzdCBz dG9yZSBhbmQgdmVyaWZ5IHNpZ25hdHVyZXMgaW4KPiB1c2Vyc3BhY2UgaW5zdGVhZCwgd2l0aG91 dCBhbnkga2VybmVsIGludm9sdmVtZW50LiAgU28gdGhhdCdzIHdoYXQgSSd2ZSBiZWVuCj4gcmVj b21tZW5kaW5nICh3aXRoIGxpbWl0ZWQgc3VjY2VzcywgdW5mb3J0dW5hdGVseSkuCj4gCj4gSWYg eW91IHJlYWxseSBkbyBuZWVkIGluLWtlcm5lbCBzaWduYXR1cmUgdmVyaWZpY2F0aW9uLCB0aGVu IHRoYXQgbWF5IGJlIGEKPiBsZWdpdGltYXRlIHVzZSBjYXNlIGZvciB0aGUgZnMtdmVyaXR5IGJ1 aWx0LWluIHNpZ25hdHVyZXMsIGFsdGhvdWdoIEkgZG8gd29uZGVyCj4gd2h5IHlvdSBhcmVuJ3Qg dXNpbmcgSU1BIGFuZCBpdHMgc2lnbmF0dXJlIG1lY2hhbmlzbSBpbnN0ZWFkLgo+IAo+IC0gRXJp YwoKLS0KZG0tZGV2ZWwgbWFpbGluZyBsaXN0CmRtLWRldmVsQHJlZGhhdC5jb20KaHR0cHM6Ly9s aXN0bWFuLnJlZGhhdC5jb20vbWFpbG1hbi9saXN0aW5mby9kbS1kZXZlbA== From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id D92A8C433EF for ; Wed, 20 Oct 2021 15:38:38 +0000 (UTC) Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [216.205.24.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 25FAD6137C for ; Wed, 20 Oct 2021 15:38:38 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org 25FAD6137C Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=huawei.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=redhat.com Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-251-JPnyZ42GM0GxTqlGHc7nYg-1; Wed, 20 Oct 2021 11:38:33 -0400 X-MC-Unique: JPnyZ42GM0GxTqlGHc7nYg-1 Received: from smtp.corp.redhat.com (int-mx08.intmail.prod.int.phx2.redhat.com [10.5.11.23]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 8D2458042D3; Wed, 20 Oct 2021 15:38:29 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.20]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 2D75519D9B; Wed, 20 Oct 2021 15:38:29 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id EAED3180BAD2; Wed, 20 Oct 2021 15:38:27 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx05.intmail.prod.int.rdu2.redhat.com [10.11.54.5]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id 19KFQLV2005569 for ; Wed, 20 Oct 2021 11:26:21 -0400 Received: by smtp.corp.redhat.com (Postfix) id E7D34D016B; Wed, 20 Oct 2021 15:26:20 +0000 (UTC) Received: from mimecast-mx02.redhat.com (mimecast05.extmail.prod.ext.rdu2.redhat.com [10.11.55.21]) by smtp.corp.redhat.com (Postfix) with ESMTPS id E031FD0161 for ; Wed, 20 Oct 2021 15:26:17 +0000 (UTC) Received: from us-smtp-1.mimecast.com (us-smtp-1.mimecast.com [207.211.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 8EB67805F49 for ; Wed, 20 Oct 2021 15:26:17 +0000 (UTC) Received: from frasgout.his.huawei.com (frasgout.his.huawei.com [185.176.79.56]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-247-VvHXA7CFPLG_Fyweo7Giyg-1; Wed, 20 Oct 2021 11:26:14 -0400 X-MC-Unique: VvHXA7CFPLG_Fyweo7Giyg-1 Received: from fraeml712-chm.china.huawei.com (unknown [172.18.147.226]) by frasgout.his.huawei.com (SkyGuard) with ESMTP id 4HZDRj3tffz67Xsj; Wed, 20 Oct 2021 23:04:49 +0800 (CST) Received: from fraeml714-chm.china.huawei.com (10.206.15.33) by fraeml712-chm.china.huawei.com (10.206.15.61) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2308.15; Wed, 20 Oct 2021 17:08:39 +0200 Received: from fraeml714-chm.china.huawei.com ([10.206.15.33]) by fraeml714-chm.china.huawei.com ([10.206.15.33]) with mapi id 15.01.2308.015; Wed, 20 Oct 2021 17:08:39 +0200 From: Roberto Sassu To: Eric Biggers , Deven Bowers Subject: RE: [RFC PATCH v7 12/16] fsverity|security: add security hooks to fsverity digest and signature Thread-Topic: [RFC PATCH v7 12/16] fsverity|security: add security hooks to fsverity digest and signature Thread-Index: AQHXwGWUN6BqcPCg3Uma5jdt5usPz6vRLYAAgAMlHYCAAAy0gIAHoD6w Date: Wed, 20 Oct 2021 15:08:39 +0000 Message-ID: <5c1f800ba554485cb3659da689d2079a@huawei.com> References: <1634151995-16266-1-git-send-email-deven.desai@linux.microsoft.com> <1634151995-16266-13-git-send-email-deven.desai@linux.microsoft.com> <9089bdb0-b28a-9fa0-c510-00fa275af621@linux.microsoft.com> In-Reply-To: Accept-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.221.98.153] MIME-Version: 1.0 X-CFilter-Loop: Reflected X-Mimecast-Impersonation-Protect: Policy=CLT - Impersonation Protection Definition; Similar Internal Domain=false; Similar Monitored External Domain=false; Custom External Domain=false; Mimecast External Domain=false; Newly Observed Domain=false; Internal User Name=false; Custom Display Name List=false; Reply-to Address Mismatch=false; Targeted Threat Dictionary=false; Mimecast Threat Dictionary=false; Custom Threat Dictionary=false X-Scanned-By: MIMEDefang 2.79 on 10.11.54.5 X-MIME-Autoconverted: from base64 to 8bit by lists01.pubmisc.prod.ext.phx2.redhat.com id 19KFQLV2005569 X-loop: linux-audit@redhat.com X-Mailman-Approved-At: Wed, 20 Oct 2021 11:38:25 -0400 Cc: "axboe@kernel.dk" , "linux-security-module@vger.kernel.org" , "tytso@mit.edu" , "snitzer@redhat.com" , "corbet@lwn.net" , "jannh@google.com" , "linux-doc@vger.kernel.org" , "jmorris@namei.org" , "eparis@redhat.com" , "linux-kernel@vger.kernel.org" , "linux-block@vger.kernel.org" , "dm-devel@redhat.com" , "linux-audit@redhat.com" , "linux-fscrypt@vger.kernel.org" , "agk@redhat.com" , "serge@hallyn.com" X-BeenThere: linux-audit@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Linux Audit Discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com X-Scanned-By: MIMEDefang 2.84 on 10.5.11.23 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=linux-audit-bounces@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Language: en-US Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 PiBGcm9tOiBFcmljIEJpZ2dlcnMgW21haWx0bzplYmlnZ2Vyc0BrZXJuZWwub3JnXQo+IFNlbnQ6 IEZyaWRheSwgT2N0b2JlciAxNSwgMjAyMSAxMDoxMSBQTQo+IE9uIEZyaSwgT2N0IDE1LCAyMDIx IGF0IDEyOjI1OjUzUE0gLTA3MDAsIERldmVuIEJvd2VycyB3cm90ZToKPiA+Cj4gPiBPbiAxMC8x My8yMDIxIDEyOjI0IFBNLCBFcmljIEJpZ2dlcnMgd3JvdGU6Cj4gPiA+IE9uIFdlZCwgT2N0IDEz LCAyMDIxIGF0IDEyOjA2OjMxUE0gLTA3MDAsCj4gZGV2ZW4uZGVzYWlAbGludXgubWljcm9zb2Z0 LmNvbSB3cm90ZToKPiA+ID4gPiBGcm9tOiBGYW4gV3UgPHd1ZmFuQGxpbnV4Lm1pY3Jvc29mdC5j b20+Cj4gPiA+ID4KPiA+ID4gPiBBZGQgc2VjdXJpdHlfaW5vZGVfc2V0c2VjdXJpdHkgdG8gZnN2 ZXJpdHkgc2lnbmF0dXJlIHZlcmlmaWNhdGlvbi4KPiA+ID4gPiBUaGlzIGNhbiBsZXQgTFNNcyBz YXZlIHRoZSBzaWduYXR1cmUgZGF0YSBhbmQgZGlnZXN0IGhhc2hlcyBwcm92aWRlZAo+ID4gPiA+ IGJ5IGZzdmVyaXR5Lgo+ID4gPiBDYW4geW91IGVsYWJvcmF0ZSBvbiB3aHkgTFNNcyBuZWVkIHRo aXMgaW5mb3JtYXRpb24/Cj4gPgo+ID4gVGhlIHByb3Bvc2VkIExTTSAoSVBFKSBvZiB0aGlzIHNl cmllcyB3aWxsIGJlIHRoZSBvbmx5IG9uZSB0byBuZWVkCj4gPiB0aGlzIGluZm9ybWF0aW9uIGF0 IHRoZcKgIG1vbWVudC4gSVBF4oCZcyBnb2FsIGlzIHRvIGhhdmUgcHJvdmlkZQo+ID4gdHJ1c3Qt YmFzZWQgYWNjZXNzIGNvbnRyb2wuIFRydXN0IGFuZCBJbnRlZ3JpdHkgYXJlIHRpZWQgdG9nZXRo ZXIsCj4gPiBhcyB5b3UgY2Fubm90IHByb3ZlIHRydXN0IHdpdGhvdXQgcHJvdmluZyBpbnRlZ3Jp dHkuCj4gCj4gSSB0aGluayB5b3UgbWVhbiBhdXRoZW50aWNpdHksIG5vdCBpbnRlZ3JpdHk/Cj4g Cj4gQWxzbyBob3cgZG9lcyB0aGlzIGRpZmZlciBmcm9tIElNQT8gIEkga25vdyB0aGF0IElNQSBk b2Vzbid0IHN1cHBvcnQgZnMtdmVyaXR5Cj4gZmlsZSBoYXNoZXMsIGJ1dCB0aGF0IGNvdWxkIGJl IGNoYW5nZWQuICBXaHkgbm90IGV4dGVuZCBJTUEgdG8gY292ZXIgeW91ciB1c2UKPiBjYXNlKHMp Pwo+IAo+ID4gSVBFIG5lZWRzIHRoZSBkaWdlc3QgaW5mb3JtYXRpb24gdG8gYmUgYWJsZSB0byBj b21wYXJlIGEgZGlnZXN0Cj4gPiBwcm92aWRlZCBieSB0aGUgcG9saWN5IGF1dGhvciwgYWdhaW5z dCB0aGUgZGlnZXN0IGNhbGN1bGF0ZWQgYnkKPiA+IGZzdmVyaXR5IHRvIG1ha2UgYSBkZWNpc2lv biBvbiB3aGV0aGVyIHRoYXQgc3BlY2lmaWMgZmlsZSwgcmVwcmVzZW50ZWQKPiA+IGJ5IHRoZSBk aWdlc3QgaXMgYXV0aG9yaXplZCBmb3IgdGhlIGFjdGlvbnMgc3BlY2lmaWVkIGluIHRoZSBwb2xp Y3kuCj4gPgo+ID4gQSBtb3JlIGNvbmNyZXRlIGV4YW1wbGUsIGlmIGFuIElQRSBwb2xpY3kgYXV0 aG9yIHdyaXRlczoKPiA+Cj4gPiDCoMKgwqAgb3A9RVhFQ1VURSBmc3Zlcml0eV9kaWdlc3Q9PEhl eERpZ2VzdCA+IGFjdGlvbj1ERU5ZCj4gPgo+ID4gSVBFIHRha2VzIHRoZSBkaWdlc3QgcHJvdmlk ZWQgYnkgdGhpcyBzZWN1cml0eSBob29rLCBzdG9yZXMgaXQKPiA+IGluIElQRSdzIHNlY3VyaXR5 IGJsb2Igb24gdGhlIGlub2RlLiBJZiB0aGlzIGZpbGUgaXMgbGF0ZXIKPiA+IGV4ZWN1dGVkLCBJ UEUgY29tcGFyZXMgdGhlIGRpZ2VzdCBzdG9yZWQgaW4gdGhlIExTTSBibG9iLAo+ID4gcHJvdmlk ZWQgYnkgdGhpcyBob29rLCBhZ2FpbnN0IDxIZXhEaWdlc3Q+IGluIHRoZSBwb2xpY3ksIGlmCj4g PiBpdCBtYXRjaGVzLCBpdCBkZW5pZXMgdGhlIGFjY2VzcywgcGVyZm9ybWluZyBhIHJldm9jYXRp b24KPiA+IG9mIHRoYXQgZmlsZS4KPiAKPiBEbyB5b3UgaGF2ZSBhIGJldHRlciBleGFtcGxlPyAg VGhpcyBvbmUgaXMgcHJldHR5IHVzZWxlc3Mgc2luY2Ugb25lIGNhbiBnZXQKPiBhcm91bmQgaXQg anVzdCBieSBleGVjdXRpbmcgYSBmaWxlIHRoYXQgZG9lc24ndCBoYXZlIGZzLXZlcml0eSBlbmFi bGVkLgoKSSB3YXMgd29uZGVyaW5nIGlmIHRoZSBmb2xsb3dpbmcgdXNlIGNhc2UgY2FuIGJlIHN1 cHBvcnRlZDoKYWxsb3cgdGhlIGV4ZWN1dGlvbiBvZiBmaWxlcyBwcm90ZWN0ZWQgd2l0aCBmc3Zl cml0eSBpZiB0aGUgcm9vdApkaWdlc3QgaXMgZm91bmQgYW1vbmcgcmVmZXJlbmNlIHZhbHVlcyAo aW5zdGVhZCBvZiBwcm92aWRpbmcKdGhlbSBvbmUgYnkgb25lIGluIHRoZSBwb2xpY3kpLgoKU29t ZXRoaW5nIGxpa2U6CgpvcD1FWEVDVVRFIGZzdmVyaXR5X2RpZ2VzdD1kaWdsaW0gYWN0aW9uPUFM TE9XCgpESUdMSU0gaXMgYSBjb21wb25lbnQgSSdtIHdvcmtpbmcgb24gdGhhdCBnZW5lcmljYWxs eQpzdG9yZXMgZGlnZXN0cy4gVGhlIGN1cnJlbnQgdXNlIGNhc2UgaXMgdG8gc3RvcmUgZmlsZSBk aWdlc3RzCmZyb20gUlBNVEFHX0ZJTEVESUdFU1RTIGFuZCB1c2UgdGhlbSB3aXRoIElNQSwgYnV0 CnRoZSBmc3Zlcml0eSB1c2UgY2FzZSBjb3VsZCBiZSBlYXNpbHkgc3VwcG9ydGVkIChpZiB0aGUg cm9vdApkaWdlc3QgaXMgc3RvcmVkIGluIHRoZSBSUE0gaGVhZGVyKS4KCkRJR0xJTSBhbHNvIHRl bGxzIHdoZXRoZXIgb3Igbm90IHRoZSBzaWduYXR1cmUgb2YgdGhlIHNvdXJjZQpjb250YWluaW5n IGZpbGUgZGlnZXN0cyAob3IgZnN2ZXJpdHkgZGlnZXN0cykgaXMgdmFsaWQgKHRoZSBzaWduYXR1 cmUKb2YgdGhlIFJQTSBoZWFkZXIgaXMgdGFrZW4gZnJvbSBSUE1UQUdfUlNBSEVBREVSKS4KClRo ZSBtZW1vcnkgb2NjdXBhdGlvbiBpcyByZWxhdGl2ZWx5IHNtYWxsIGZvciBleGVjdXRhYmxlcwph bmQgc2hhcmVkIGxpYnJhcmllcy4gSSBwdWJsaXNoZWQgYSBkZW1vIGZvciBGZWRvcmEgYW5kCm9w ZW5TVVNFIHNvbWUgdGltZSBhZ286CgpodHRwczovL2xvcmUua2VybmVsLm9yZy9saW51eC1pbnRl Z3JpdHkvNDhjZDczN2M1MDRkNDUyMDgzNzdkYWEyN2Q2MjU1MzFAaHVhd2VpLmNvbS8KClRoYW5r cwoKUm9iZXJ0bwoKSFVBV0VJIFRFQ0hOT0xPR0lFUyBEdWVzc2VsZG9yZiBHbWJILCBIUkIgNTYw NjMKTWFuYWdpbmcgRGlyZWN0b3I6IExpIFBlbmcsIFpob25nIFJvbmdodWEKCj4gPiBUaGlzIGJy aW5ncyBtZSB0byB5b3VyIG5leHQgY29tbWVudDoKPiA+Cj4gPiA+IFRoZSBkaWdlc3QgaXNuJ3Qg bWVhbmluZ2Z1bCB3aXRob3V0IGtub3dpbmcgdGhlIGhhc2ggYWxnb3JpdGhtIGl0IHVzZXMuCj4g PiBJdCdzIGF2YWlsYWJsZSBoZXJlLCBidXQgeW91IGFyZW4ndCBwYXNzaW5nIGl0IHRvIHRoaXMg ZnVuY3Rpb24uCj4gPgo+ID4gVGhlIGRpZ2VzdCBpcyBtZWFuaW5nZnVsIHdpdGhvdXQgdGhlIGFs Z29yaXRobSBpbiB0aGlzIGNhc2UuCj4gCj4gTm8sIGl0J3Mgbm90Lgo+IAo+IERpZ2VzdHMgYXJl IG1lYW5pbmdsZXNzIHdpdGhvdXQga25vd2luZyB3aGF0IGFsZ29yaXRobSB0aGV5IHdlcmUgY3Jl YXRlZAo+IHdpdGguCj4gCj4gSWYgeW91ciBzZWN1cml0eSBwb2xpY3kgaXMgc29tZXRoaW5nIGxp a2UgIlRydXN0IHRoZSBmaWxlIHdpdGggZGlnZXN0ICRmb28iIGFuZAo+IG11bHRpcGxlIGhhc2gg YWxnb3JpdGhtcyBhcmUgcG9zc2libGUsIHRoZW4gdGhlIGFsb3JpdGhtIGludGVuZGVkIHRvIGJl IHVzZWQKPiBuZWVkcyB0byBiZSBleHBsaWNpdGx5IHNwZWNpZmllZC4gIE90aGVyd2lzZSBhbnkg YWxnb3JpdGhtIHdpdGggdGhlIHNhbWUgbGVuZ3RoCj4gZGlnZXN0IHdpbGwgYmUgYWNjZXB0ZWQu ICBUaGF0J3MgYSBmYXRhbCBmbGF3IGlmIGFueSBvZiB0aGVzZSBhbGdvcml0aG1zIGlzCj4gY3J5 cHRvZ3JhcGhpY2FsbHkgYnJva2VuIG9yIHdhcyBuZXZlciBpbnRlbmRlZCB0byBiZSBhIGNyeXB0 b2dyYXBoaWMgYWxnb3JpdGhtCj4gaW4gdGhlIGZpcnN0IHBsYWNlIChlLmcuLCBhIG5vbi1jcnlw dG9ncmFwaGljIGNoZWNrc3VtKS4KPiAKPiBDcnlwdG9zeXN0ZW1zIGFsd2F5cyBuZWVkIHRvIHNw ZWNpZnkgdGhlIGNyeXB0byBhbGdvcml0aG0ocykgdXNlZDsgdGhlCj4gYWR2ZXJzYXJ5Cj4gbXVz dCBub3QgYmUgYWxsb3dlZCB0byBjaG9vc2UgdGhlIGFsZ29yaXRobXMuCj4gCj4gSSdtIG5vdCBz dXJlIGhvdyB0aGVzZSBwYXRjaGVzIGNhbiBiZSB0YWtlbiBzZXJpb3VzbHkgd2hlbiB0aGV5J3Jl IGdldHRpbmcgdGhpcwo+IHNvcnQgb2YgdGhpbmcgd3JvbmcuCj4gCj4gPiA+ID4gKwkJCQkJRlNf VkVSSVRZX1NJR05BVFVSRV9TRUNfTkFNRSwKPiA+ID4gPiArCQkJCQlzaWduYXR1cmUsIHNpZ19z aXplLCAwKTsKPiA+ID4gVGhpcyBpcyBvbmx5IGZvciBmcy12ZXJpdHkgYnVpbHQtaW4gc2lnbmF0 dXJlcyB3aGljaCBhcmVuJ3QgdGhlIG9ubHkgd2F5IHRvIGRvCj4gPiA+IHNpZ25hdHVyZXMgd2l0 aCBmcy12ZXJpdHkuICBBcmUgeW91IHN1cmUgdGhpcyBpcyB3aGF0IHlvdSdyZSBsb29raW5nIGZv cj8KPiA+Cj4gPiBDb3VsZCB5b3UgZWxhYm9yYXRlIG9uIHRoZSBvdGhlciBzaWduYXR1cmUgdHlw ZXMgdGhhdCBjYW4gYmUgdXNlZAo+ID4gd2l0aCBmcy12ZXJpdHk/IEnigJltIDk5JSBzdXJlIHRo aXMgaXMgd2hhdCBJ4oCZbSBsb29raW5nIGZvciBhcyB0aGlzCj4gPiBpcyBhIHNpZ25hdHVyZSB2 YWxpZGF0ZWQgaW4gdGhlIGtlcm5lbCBhZ2FpbnN0IHRoZSBmcy12ZXJpdHkga2V5cmluZwo+ID4g YXMgcGFydCBvZiB0aGUg4oCcZnN2ZXJpdHkgZW5hYmxl4oCdIHV0aWxpdHkuCj4gPgo+ID4gSXQn cyBpbXBvcnRhbnQgdGhhdCB0aGUgc2lnbmF0dXJlIGlzIHZhbGlkYXRlZCBpbiB0aGUga2VybmVs LCBhcwo+ID4gdXNlcnNwYWNlIGlzIGNvbnNpZGVyZWQgdW50cnVzdGVkIHVudGlsIHRoZSBzaWdu YXR1cmUgaXMgdmFsaWRhdGVkCj4gPiBmb3IgdGhpcyBjYXNlLgo+ID4KPiA+ID4gQ2FuIHlvdSBl bGFib3JhdGUgb24geW91ciB1c2UgY2FzZSBmb3IgZnMtdmVyaXR5IGJ1aWx0LWluIHNpZ25hdHVy ZXMsCj4gPiBTdXJlLCBzaWduYXR1cmVzLCBsaWtlIGRpZ2VzdHMsIGFsc28gcHJvdmlkZSBhIHdh eSB0byBwcm92ZSBpbnRlZ3JpdHksCj4gPiBhbmQgdGhlIHRydXN0IGNvbXBvbmVudCBjb21lcyBm cm9tIHRoZSB2YWxpZGF0aW9uIGFnYWluc3QgdGhlIGtleXJpbmcsCj4gPiBhcyBvcHBvc2VkIHRv IGEgZml4ZWQgdmFsdWUgaW4gSVBF4oCZcyBwb2xpY3kuIFRoZSB1c2UgY2FzZSBmb3IgZnMtdmVy aXR5Cj4gPiBidWlsdC1pbiBzaWduYXR1cmVzIGlzIHRoYXQgd2UgaGF2ZSBhIHJ3IGV4dDQgZmls ZXN5c3RlbSB0aGF0IGhhcyBzb21lCj4gPiBleGVjdXRhYmxlIGZpbGVzLCBhbmQgd2Ugd2FudCB0 byBoYXZlIGEgZXhlY3V0aW9uIHBvbGljeSAodGhyb3VnaCBJUEUpCj4gPiB0aGF0IG9ubHkgX3Ry dXN0ZWRfIGV4ZWN1dGFibGVzIGNhbiBydW4uIFBlcmYgaXMgaW1wb3J0YW50IGhlcmUsIGhlbmNl Cj4gPiBmcy12ZXJpdHkuCj4gCj4gTW9zdCB1c2VycyBvZiBmcy12ZXJpdHkgYnVpbHQtaW4gc2ln bmF0dXJlcyBoYXZlIGFjdHVhbGx5IGJlZW4gZW5mb3JjaW5nIHRoZWlyCj4gc2VjdXJpdHkgcG9s aWN5IGluIHVzZXJzcGFjZSwgYnkgY2hlY2tpbmcgd2hldGhlciBzcGVjaWZpYyBmaWxlcyBoYXZl IHRoZQo+IGZzLXZlcml0eSBiaXQgc2V0IG9yIG5vdC4gIFN1Y2ggdXNlcnMgY291bGQganVzdCBz dG9yZSBhbmQgdmVyaWZ5IHNpZ25hdHVyZXMgaW4KPiB1c2Vyc3BhY2UgaW5zdGVhZCwgd2l0aG91 dCBhbnkga2VybmVsIGludm9sdmVtZW50LiAgU28gdGhhdCdzIHdoYXQgSSd2ZSBiZWVuCj4gcmVj b21tZW5kaW5nICh3aXRoIGxpbWl0ZWQgc3VjY2VzcywgdW5mb3J0dW5hdGVseSkuCj4gCj4gSWYg eW91IHJlYWxseSBkbyBuZWVkIGluLWtlcm5lbCBzaWduYXR1cmUgdmVyaWZpY2F0aW9uLCB0aGVu IHRoYXQgbWF5IGJlIGEKPiBsZWdpdGltYXRlIHVzZSBjYXNlIGZvciB0aGUgZnMtdmVyaXR5IGJ1 aWx0LWluIHNpZ25hdHVyZXMsIGFsdGhvdWdoIEkgZG8gd29uZGVyCj4gd2h5IHlvdSBhcmVuJ3Qg dXNpbmcgSU1BIGFuZCBpdHMgc2lnbmF0dXJlIG1lY2hhbmlzbSBpbnN0ZWFkLgo+IAo+IC0gRXJp YwoKLS0KTGludXgtYXVkaXQgbWFpbGluZyBsaXN0CkxpbnV4LWF1ZGl0QHJlZGhhdC5jb20KaHR0 cHM6Ly9saXN0bWFuLnJlZGhhdC5jb20vbWFpbG1hbi9saXN0aW5mby9saW51eC1hdWRpdA== From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 54B65C433FE for ; Wed, 20 Oct 2021 15:08:44 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 2FFA06137C for ; Wed, 20 Oct 2021 15:08:44 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230260AbhJTPK5 (ORCPT ); Wed, 20 Oct 2021 11:10:57 -0400 Received: from frasgout.his.huawei.com ([185.176.79.56]:4010 "EHLO frasgout.his.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229570AbhJTPK4 (ORCPT ); Wed, 20 Oct 2021 11:10:56 -0400 Received: from fraeml712-chm.china.huawei.com (unknown [172.18.147.226]) by frasgout.his.huawei.com (SkyGuard) with ESMTP id 4HZDRj3tffz67Xsj; Wed, 20 Oct 2021 23:04:49 +0800 (CST) Received: from fraeml714-chm.china.huawei.com (10.206.15.33) by fraeml712-chm.china.huawei.com (10.206.15.61) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2308.15; Wed, 20 Oct 2021 17:08:39 +0200 Received: from fraeml714-chm.china.huawei.com ([10.206.15.33]) by fraeml714-chm.china.huawei.com ([10.206.15.33]) with mapi id 15.01.2308.015; Wed, 20 Oct 2021 17:08:39 +0200 From: Roberto Sassu To: Eric Biggers , Deven Bowers CC: "corbet@lwn.net" , "axboe@kernel.dk" , "agk@redhat.com" , "snitzer@redhat.com" , "tytso@mit.edu" , "paul@paul-moore.com" , "eparis@redhat.com" , "jmorris@namei.org" , "serge@hallyn.com" , "jannh@google.com" , "dm-devel@redhat.com" , "linux-doc@vger.kernel.org" , "linux-kernel@vger.kernel.org" , "linux-block@vger.kernel.org" , "linux-fscrypt@vger.kernel.org" , "linux-audit@redhat.com" , "linux-security-module@vger.kernel.org" Subject: RE: [RFC PATCH v7 12/16] fsverity|security: add security hooks to fsverity digest and signature Thread-Topic: [RFC PATCH v7 12/16] fsverity|security: add security hooks to fsverity digest and signature Thread-Index: AQHXwGWUN6BqcPCg3Uma5jdt5usPz6vRLYAAgAMlHYCAAAy0gIAHoD6w Date: Wed, 20 Oct 2021 15:08:39 +0000 Message-ID: <5c1f800ba554485cb3659da689d2079a@huawei.com> References: <1634151995-16266-1-git-send-email-deven.desai@linux.microsoft.com> <1634151995-16266-13-git-send-email-deven.desai@linux.microsoft.com> <9089bdb0-b28a-9fa0-c510-00fa275af621@linux.microsoft.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.221.98.153] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-block@vger.kernel.org PiBGcm9tOiBFcmljIEJpZ2dlcnMgW21haWx0bzplYmlnZ2Vyc0BrZXJuZWwub3JnXQ0KPiBTZW50 OiBGcmlkYXksIE9jdG9iZXIgMTUsIDIwMjEgMTA6MTEgUE0NCj4gT24gRnJpLCBPY3QgMTUsIDIw MjEgYXQgMTI6MjU6NTNQTSAtMDcwMCwgRGV2ZW4gQm93ZXJzIHdyb3RlOg0KPiA+DQo+ID4gT24g MTAvMTMvMjAyMSAxMjoyNCBQTSwgRXJpYyBCaWdnZXJzIHdyb3RlOg0KPiA+ID4gT24gV2VkLCBP Y3QgMTMsIDIwMjEgYXQgMTI6MDY6MzFQTSAtMDcwMCwNCj4gZGV2ZW4uZGVzYWlAbGludXgubWlj cm9zb2Z0LmNvbSB3cm90ZToNCj4gPiA+ID4gRnJvbTogRmFuIFd1IDx3dWZhbkBsaW51eC5taWNy b3NvZnQuY29tPg0KPiA+ID4gPg0KPiA+ID4gPiBBZGQgc2VjdXJpdHlfaW5vZGVfc2V0c2VjdXJp dHkgdG8gZnN2ZXJpdHkgc2lnbmF0dXJlIHZlcmlmaWNhdGlvbi4NCj4gPiA+ID4gVGhpcyBjYW4g bGV0IExTTXMgc2F2ZSB0aGUgc2lnbmF0dXJlIGRhdGEgYW5kIGRpZ2VzdCBoYXNoZXMgcHJvdmlk ZWQNCj4gPiA+ID4gYnkgZnN2ZXJpdHkuDQo+ID4gPiBDYW4geW91IGVsYWJvcmF0ZSBvbiB3aHkg TFNNcyBuZWVkIHRoaXMgaW5mb3JtYXRpb24/DQo+ID4NCj4gPiBUaGUgcHJvcG9zZWQgTFNNIChJ UEUpIG9mIHRoaXMgc2VyaWVzIHdpbGwgYmUgdGhlIG9ubHkgb25lIHRvIG5lZWQNCj4gPiB0aGlz IGluZm9ybWF0aW9uIGF0IHRoZcKgIG1vbWVudC4gSVBF4oCZcyBnb2FsIGlzIHRvIGhhdmUgcHJv dmlkZQ0KPiA+IHRydXN0LWJhc2VkIGFjY2VzcyBjb250cm9sLiBUcnVzdCBhbmQgSW50ZWdyaXR5 IGFyZSB0aWVkIHRvZ2V0aGVyLA0KPiA+IGFzIHlvdSBjYW5ub3QgcHJvdmUgdHJ1c3Qgd2l0aG91 dCBwcm92aW5nIGludGVncml0eS4NCj4gDQo+IEkgdGhpbmsgeW91IG1lYW4gYXV0aGVudGljaXR5 LCBub3QgaW50ZWdyaXR5Pw0KPiANCj4gQWxzbyBob3cgZG9lcyB0aGlzIGRpZmZlciBmcm9tIElN QT8gIEkga25vdyB0aGF0IElNQSBkb2Vzbid0IHN1cHBvcnQgZnMtdmVyaXR5DQo+IGZpbGUgaGFz aGVzLCBidXQgdGhhdCBjb3VsZCBiZSBjaGFuZ2VkLiAgV2h5IG5vdCBleHRlbmQgSU1BIHRvIGNv dmVyIHlvdXIgdXNlDQo+IGNhc2Uocyk/DQo+IA0KPiA+IElQRSBuZWVkcyB0aGUgZGlnZXN0IGlu Zm9ybWF0aW9uIHRvIGJlIGFibGUgdG8gY29tcGFyZSBhIGRpZ2VzdA0KPiA+IHByb3ZpZGVkIGJ5 IHRoZSBwb2xpY3kgYXV0aG9yLCBhZ2FpbnN0IHRoZSBkaWdlc3QgY2FsY3VsYXRlZCBieQ0KPiA+ IGZzdmVyaXR5IHRvIG1ha2UgYSBkZWNpc2lvbiBvbiB3aGV0aGVyIHRoYXQgc3BlY2lmaWMgZmls ZSwgcmVwcmVzZW50ZWQNCj4gPiBieSB0aGUgZGlnZXN0IGlzIGF1dGhvcml6ZWQgZm9yIHRoZSBh Y3Rpb25zIHNwZWNpZmllZCBpbiB0aGUgcG9saWN5Lg0KPiA+DQo+ID4gQSBtb3JlIGNvbmNyZXRl IGV4YW1wbGUsIGlmIGFuIElQRSBwb2xpY3kgYXV0aG9yIHdyaXRlczoNCj4gPg0KPiA+IMKgwqDC oCBvcD1FWEVDVVRFIGZzdmVyaXR5X2RpZ2VzdD08SGV4RGlnZXN0ID4gYWN0aW9uPURFTlkNCj4g Pg0KPiA+IElQRSB0YWtlcyB0aGUgZGlnZXN0IHByb3ZpZGVkIGJ5IHRoaXMgc2VjdXJpdHkgaG9v aywgc3RvcmVzIGl0DQo+ID4gaW4gSVBFJ3Mgc2VjdXJpdHkgYmxvYiBvbiB0aGUgaW5vZGUuIElm IHRoaXMgZmlsZSBpcyBsYXRlcg0KPiA+IGV4ZWN1dGVkLCBJUEUgY29tcGFyZXMgdGhlIGRpZ2Vz dCBzdG9yZWQgaW4gdGhlIExTTSBibG9iLA0KPiA+IHByb3ZpZGVkIGJ5IHRoaXMgaG9vaywgYWdh aW5zdCA8SGV4RGlnZXN0PiBpbiB0aGUgcG9saWN5LCBpZg0KPiA+IGl0IG1hdGNoZXMsIGl0IGRl bmllcyB0aGUgYWNjZXNzLCBwZXJmb3JtaW5nIGEgcmV2b2NhdGlvbg0KPiA+IG9mIHRoYXQgZmls ZS4NCj4gDQo+IERvIHlvdSBoYXZlIGEgYmV0dGVyIGV4YW1wbGU/ICBUaGlzIG9uZSBpcyBwcmV0 dHkgdXNlbGVzcyBzaW5jZSBvbmUgY2FuIGdldA0KPiBhcm91bmQgaXQganVzdCBieSBleGVjdXRp bmcgYSBmaWxlIHRoYXQgZG9lc24ndCBoYXZlIGZzLXZlcml0eSBlbmFibGVkLg0KDQpJIHdhcyB3 b25kZXJpbmcgaWYgdGhlIGZvbGxvd2luZyB1c2UgY2FzZSBjYW4gYmUgc3VwcG9ydGVkOg0KYWxs b3cgdGhlIGV4ZWN1dGlvbiBvZiBmaWxlcyBwcm90ZWN0ZWQgd2l0aCBmc3Zlcml0eSBpZiB0aGUg cm9vdA0KZGlnZXN0IGlzIGZvdW5kIGFtb25nIHJlZmVyZW5jZSB2YWx1ZXMgKGluc3RlYWQgb2Yg cHJvdmlkaW5nDQp0aGVtIG9uZSBieSBvbmUgaW4gdGhlIHBvbGljeSkuDQoNClNvbWV0aGluZyBs aWtlOg0KDQpvcD1FWEVDVVRFIGZzdmVyaXR5X2RpZ2VzdD1kaWdsaW0gYWN0aW9uPUFMTE9XDQoN CkRJR0xJTSBpcyBhIGNvbXBvbmVudCBJJ20gd29ya2luZyBvbiB0aGF0IGdlbmVyaWNhbGx5DQpz dG9yZXMgZGlnZXN0cy4gVGhlIGN1cnJlbnQgdXNlIGNhc2UgaXMgdG8gc3RvcmUgZmlsZSBkaWdl c3RzDQpmcm9tIFJQTVRBR19GSUxFRElHRVNUUyBhbmQgdXNlIHRoZW0gd2l0aCBJTUEsIGJ1dA0K dGhlIGZzdmVyaXR5IHVzZSBjYXNlIGNvdWxkIGJlIGVhc2lseSBzdXBwb3J0ZWQgKGlmIHRoZSBy b290DQpkaWdlc3QgaXMgc3RvcmVkIGluIHRoZSBSUE0gaGVhZGVyKS4NCg0KRElHTElNIGFsc28g dGVsbHMgd2hldGhlciBvciBub3QgdGhlIHNpZ25hdHVyZSBvZiB0aGUgc291cmNlDQpjb250YWlu aW5nIGZpbGUgZGlnZXN0cyAob3IgZnN2ZXJpdHkgZGlnZXN0cykgaXMgdmFsaWQgKHRoZSBzaWdu YXR1cmUNCm9mIHRoZSBSUE0gaGVhZGVyIGlzIHRha2VuIGZyb20gUlBNVEFHX1JTQUhFQURFUiku DQoNClRoZSBtZW1vcnkgb2NjdXBhdGlvbiBpcyByZWxhdGl2ZWx5IHNtYWxsIGZvciBleGVjdXRh Ymxlcw0KYW5kIHNoYXJlZCBsaWJyYXJpZXMuIEkgcHVibGlzaGVkIGEgZGVtbyBmb3IgRmVkb3Jh IGFuZA0Kb3BlblNVU0Ugc29tZSB0aW1lIGFnbzoNCg0KaHR0cHM6Ly9sb3JlLmtlcm5lbC5vcmcv bGludXgtaW50ZWdyaXR5LzQ4Y2Q3MzdjNTA0ZDQ1MjA4Mzc3ZGFhMjdkNjI1NTMxQGh1YXdlaS5j b20vDQoNClRoYW5rcw0KDQpSb2JlcnRvDQoNCkhVQVdFSSBURUNITk9MT0dJRVMgRHVlc3NlbGRv cmYgR21iSCwgSFJCIDU2MDYzDQpNYW5hZ2luZyBEaXJlY3RvcjogTGkgUGVuZywgWmhvbmcgUm9u Z2h1YQ0KDQo+ID4gVGhpcyBicmluZ3MgbWUgdG8geW91ciBuZXh0IGNvbW1lbnQ6DQo+ID4NCj4g PiA+IFRoZSBkaWdlc3QgaXNuJ3QgbWVhbmluZ2Z1bCB3aXRob3V0IGtub3dpbmcgdGhlIGhhc2gg YWxnb3JpdGhtIGl0IHVzZXMuDQo+ID4gSXQncyBhdmFpbGFibGUgaGVyZSwgYnV0IHlvdSBhcmVu J3QgcGFzc2luZyBpdCB0byB0aGlzIGZ1bmN0aW9uLg0KPiA+DQo+ID4gVGhlIGRpZ2VzdCBpcyBt ZWFuaW5nZnVsIHdpdGhvdXQgdGhlIGFsZ29yaXRobSBpbiB0aGlzIGNhc2UuDQo+IA0KPiBObywg aXQncyBub3QuDQo+IA0KPiBEaWdlc3RzIGFyZSBtZWFuaW5nbGVzcyB3aXRob3V0IGtub3dpbmcg d2hhdCBhbGdvcml0aG0gdGhleSB3ZXJlIGNyZWF0ZWQNCj4gd2l0aC4NCj4gDQo+IElmIHlvdXIg c2VjdXJpdHkgcG9saWN5IGlzIHNvbWV0aGluZyBsaWtlICJUcnVzdCB0aGUgZmlsZSB3aXRoIGRp Z2VzdCAkZm9vIiBhbmQNCj4gbXVsdGlwbGUgaGFzaCBhbGdvcml0aG1zIGFyZSBwb3NzaWJsZSwg dGhlbiB0aGUgYWxvcml0aG0gaW50ZW5kZWQgdG8gYmUgdXNlZA0KPiBuZWVkcyB0byBiZSBleHBs aWNpdGx5IHNwZWNpZmllZC4gIE90aGVyd2lzZSBhbnkgYWxnb3JpdGhtIHdpdGggdGhlIHNhbWUg bGVuZ3RoDQo+IGRpZ2VzdCB3aWxsIGJlIGFjY2VwdGVkLiAgVGhhdCdzIGEgZmF0YWwgZmxhdyBp ZiBhbnkgb2YgdGhlc2UgYWxnb3JpdGhtcyBpcw0KPiBjcnlwdG9ncmFwaGljYWxseSBicm9rZW4g b3Igd2FzIG5ldmVyIGludGVuZGVkIHRvIGJlIGEgY3J5cHRvZ3JhcGhpYyBhbGdvcml0aG0NCj4g aW4gdGhlIGZpcnN0IHBsYWNlIChlLmcuLCBhIG5vbi1jcnlwdG9ncmFwaGljIGNoZWNrc3VtKS4N Cj4gDQo+IENyeXB0b3N5c3RlbXMgYWx3YXlzIG5lZWQgdG8gc3BlY2lmeSB0aGUgY3J5cHRvIGFs Z29yaXRobShzKSB1c2VkOyB0aGUNCj4gYWR2ZXJzYXJ5DQo+IG11c3Qgbm90IGJlIGFsbG93ZWQg dG8gY2hvb3NlIHRoZSBhbGdvcml0aG1zLg0KPiANCj4gSSdtIG5vdCBzdXJlIGhvdyB0aGVzZSBw YXRjaGVzIGNhbiBiZSB0YWtlbiBzZXJpb3VzbHkgd2hlbiB0aGV5J3JlIGdldHRpbmcgdGhpcw0K PiBzb3J0IG9mIHRoaW5nIHdyb25nLg0KPiANCj4gPiA+ID4gKwkJCQkJRlNfVkVSSVRZX1NJR05B VFVSRV9TRUNfTkFNRSwNCj4gPiA+ID4gKwkJCQkJc2lnbmF0dXJlLCBzaWdfc2l6ZSwgMCk7DQo+ ID4gPiBUaGlzIGlzIG9ubHkgZm9yIGZzLXZlcml0eSBidWlsdC1pbiBzaWduYXR1cmVzIHdoaWNo IGFyZW4ndCB0aGUgb25seSB3YXkgdG8gZG8NCj4gPiA+IHNpZ25hdHVyZXMgd2l0aCBmcy12ZXJp dHkuICBBcmUgeW91IHN1cmUgdGhpcyBpcyB3aGF0IHlvdSdyZSBsb29raW5nIGZvcj8NCj4gPg0K PiA+IENvdWxkIHlvdSBlbGFib3JhdGUgb24gdGhlIG90aGVyIHNpZ25hdHVyZSB0eXBlcyB0aGF0 IGNhbiBiZSB1c2VkDQo+ID4gd2l0aCBmcy12ZXJpdHk/IEnigJltIDk5JSBzdXJlIHRoaXMgaXMg d2hhdCBJ4oCZbSBsb29raW5nIGZvciBhcyB0aGlzDQo+ID4gaXMgYSBzaWduYXR1cmUgdmFsaWRh dGVkIGluIHRoZSBrZXJuZWwgYWdhaW5zdCB0aGUgZnMtdmVyaXR5IGtleXJpbmcNCj4gPiBhcyBw YXJ0IG9mIHRoZSDigJxmc3Zlcml0eSBlbmFibGXigJ0gdXRpbGl0eS4NCj4gPg0KPiA+IEl0J3Mg aW1wb3J0YW50IHRoYXQgdGhlIHNpZ25hdHVyZSBpcyB2YWxpZGF0ZWQgaW4gdGhlIGtlcm5lbCwg YXMNCj4gPiB1c2Vyc3BhY2UgaXMgY29uc2lkZXJlZCB1bnRydXN0ZWQgdW50aWwgdGhlIHNpZ25h dHVyZSBpcyB2YWxpZGF0ZWQNCj4gPiBmb3IgdGhpcyBjYXNlLg0KPiA+DQo+ID4gPiBDYW4geW91 IGVsYWJvcmF0ZSBvbiB5b3VyIHVzZSBjYXNlIGZvciBmcy12ZXJpdHkgYnVpbHQtaW4gc2lnbmF0 dXJlcywNCj4gPiBTdXJlLCBzaWduYXR1cmVzLCBsaWtlIGRpZ2VzdHMsIGFsc28gcHJvdmlkZSBh IHdheSB0byBwcm92ZSBpbnRlZ3JpdHksDQo+ID4gYW5kIHRoZSB0cnVzdCBjb21wb25lbnQgY29t ZXMgZnJvbSB0aGUgdmFsaWRhdGlvbiBhZ2FpbnN0IHRoZSBrZXlyaW5nLA0KPiA+IGFzIG9wcG9z ZWQgdG8gYSBmaXhlZCB2YWx1ZSBpbiBJUEXigJlzIHBvbGljeS4gVGhlIHVzZSBjYXNlIGZvciBm cy12ZXJpdHkNCj4gPiBidWlsdC1pbiBzaWduYXR1cmVzIGlzIHRoYXQgd2UgaGF2ZSBhIHJ3IGV4 dDQgZmlsZXN5c3RlbSB0aGF0IGhhcyBzb21lDQo+ID4gZXhlY3V0YWJsZSBmaWxlcywgYW5kIHdl IHdhbnQgdG8gaGF2ZSBhIGV4ZWN1dGlvbiBwb2xpY3kgKHRocm91Z2ggSVBFKQ0KPiA+IHRoYXQg b25seSBfdHJ1c3RlZF8gZXhlY3V0YWJsZXMgY2FuIHJ1bi4gUGVyZiBpcyBpbXBvcnRhbnQgaGVy ZSwgaGVuY2UNCj4gPiBmcy12ZXJpdHkuDQo+IA0KPiBNb3N0IHVzZXJzIG9mIGZzLXZlcml0eSBi dWlsdC1pbiBzaWduYXR1cmVzIGhhdmUgYWN0dWFsbHkgYmVlbiBlbmZvcmNpbmcgdGhlaXINCj4g c2VjdXJpdHkgcG9saWN5IGluIHVzZXJzcGFjZSwgYnkgY2hlY2tpbmcgd2hldGhlciBzcGVjaWZp YyBmaWxlcyBoYXZlIHRoZQ0KPiBmcy12ZXJpdHkgYml0IHNldCBvciBub3QuICBTdWNoIHVzZXJz IGNvdWxkIGp1c3Qgc3RvcmUgYW5kIHZlcmlmeSBzaWduYXR1cmVzIGluDQo+IHVzZXJzcGFjZSBp bnN0ZWFkLCB3aXRob3V0IGFueSBrZXJuZWwgaW52b2x2ZW1lbnQuICBTbyB0aGF0J3Mgd2hhdCBJ J3ZlIGJlZW4NCj4gcmVjb21tZW5kaW5nICh3aXRoIGxpbWl0ZWQgc3VjY2VzcywgdW5mb3J0dW5h dGVseSkuDQo+IA0KPiBJZiB5b3UgcmVhbGx5IGRvIG5lZWQgaW4ta2VybmVsIHNpZ25hdHVyZSB2 ZXJpZmljYXRpb24sIHRoZW4gdGhhdCBtYXkgYmUgYQ0KPiBsZWdpdGltYXRlIHVzZSBjYXNlIGZv ciB0aGUgZnMtdmVyaXR5IGJ1aWx0LWluIHNpZ25hdHVyZXMsIGFsdGhvdWdoIEkgZG8gd29uZGVy DQo+IHdoeSB5b3UgYXJlbid0IHVzaW5nIElNQSBhbmQgaXRzIHNpZ25hdHVyZSBtZWNoYW5pc20g aW5zdGVhZC4NCj4gDQo+IC0gRXJpYw0K