From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4B2F6C77B7C for ; Fri, 5 May 2023 22:12:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230352AbjEEWM2 (ORCPT ); Fri, 5 May 2023 18:12:28 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39328 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229877AbjEEWM1 (ORCPT ); Fri, 5 May 2023 18:12:27 -0400 Received: from mail-lf1-x12b.google.com (mail-lf1-x12b.google.com [IPv6:2a00:1450:4864:20::12b]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 01CC546A6 for ; Fri, 5 May 2023 15:12:25 -0700 (PDT) Received: by mail-lf1-x12b.google.com with SMTP id 2adb3069b0e04-4f13c577e36so2597040e87.1 for ; Fri, 05 May 2023 15:12:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20221208; t=1683324744; x=1685916744; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=zvwH/om6riyO67KuORkjhn7D8bd2EIUB1tcKOP2bv8w=; b=P/jX61iU4sj1X3+G0O1I2VdoZiOVuGsFhc9t/gb9NTLOMV2BaT5lfBJURCujYGVLJr Ivl1xAOTrPk44dcFgM6Sj56Q6Wir6dIP9LVHey3s5FEH4HaHzeai/fJmuYIfkb2XOl0i jU4JNiGeAuejVpIdz8KVd06GjAaTxBLhChBU8REWp3e5/SuROosaSgs5xJDfJth/yvL1 ByfhIPe2sdohOXX15dhkeUpEoCMvZyBj9OIThbbuHI/qUjkqH6QLD/R3t7x3jaWm9rgj 2rpjaVSKjDjjEpReOAw80efRzgykmbuIdprTp0VBLIGXBC2wSKxByiwB6SCCIKOckt14 B9RQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1683324744; x=1685916744; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=zvwH/om6riyO67KuORkjhn7D8bd2EIUB1tcKOP2bv8w=; b=cZuZ5C+g5rDS5RTWsxOweX0lHBQ377CqomM9VxdTzK/GBu8XYujTj6QCcnMOLg4aUQ 4v5WnrRjoipyjVzBWd+2rE1ZgbewrP8BzNkqYtSu5RNoNuxVhfqlcBwI3OLnrsAG2K46 uij0I9P/AG7bjo4lCa314cpwn3byEcoVQ/Ln5KSJ1QUj1wlEFba+R/yFU9XA3pXRENFR FDm0K7DoE8+7e5kLJLzU/ZkASnOGeWHf9iSnWndIOt5QNVQysTzMaPVsDkNo1MgmEEiE /uFn66coQJGn1eGZTAARoGBYsDw22MGkYAcWjt7oe8SrjunOGb+Mtn/Z+vYYsdgY7ZGa M+7A== X-Gm-Message-State: AC+VfDyGFxrf+MAEIMokCACEOUXJk7TfreSmwDzzBESdVlTHtwvL7z90 2t02OcLJWeGYV/JUbuNKjZs= X-Google-Smtp-Source: ACHHUZ4dPDxP/8+k+DX0YtlzfqnFMES5FF+Vr0TwXxTT/asT8GQ0seC0pv55tjxY7JZVO+zcLj7O2g== X-Received: by 2002:ac2:5213:0:b0:4d8:4f46:f0b9 with SMTP id a19-20020ac25213000000b004d84f46f0b9mr872406lfl.23.1683324743929; Fri, 05 May 2023 15:12:23 -0700 (PDT) Received: from [192.168.0.31] ([94.242.171.165]) by smtp.gmail.com with ESMTPSA id x22-20020ac24896000000b004db297957e8sm426674lfc.305.2023.05.05.15.12.23 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Fri, 05 May 2023 15:12:23 -0700 (PDT) Message-ID: <7c4caf66-a0ae-4999-172e-437d6cfc8ff3@gmail.com> Date: Sat, 6 May 2023 01:12:23 +0300 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Thunderbird/102.10.0 Subject: Re: Can AUDIT_LIST_RULES causes kthreadd-spam? To: Tetsuo Handa , Paul Moore Cc: audit@vger.kernel.org, linux-audit@redhat.com References: <9ae2c1df-1f20-a40b-35ed-1dc76b122a4f@I-love.SAKURA.ne.jp> <415a4871-4d84-a31f-5417-e850a98bbffd@I-love.SAKURA.ne.jp> Content-Language: en-US, ru-RU From: Rinat Gadelshin In-Reply-To: <415a4871-4d84-a31f-5417-e850a98bbffd@I-love.SAKURA.ne.jp> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: audit@vger.kernel.org On 05.05.2023 01:53, Tetsuo Handa wrote: > On 2023/05/05 3:40, Paul Moore wrote: >> On Wed, May 3, 2023 at 10:50 PM Tetsuo Handa >> wrote: >>> On 2023/05/04 7:12, Rinat Gadelshin wrote: >>>> On 04.05.2023 00:27, Paul Moore wrote: >>>>> Can you be more specific about the kernel threads you are seeing, are >>>>> you seeing multiple "kauditd" threads? >>>>> >>>>> % ps -fC kauditd >>>>> UID PID PPID C STIME TTY TIME CMD >>>>> root 89 2 0 Apr28 ? 00:00:00 [kauditd] >>> I don't think so. >>> >>> kernel audit subsystem uses kthread_run() in order to run short-lived kernel threads. >> Thanks Tetsuo, I agree that's far more likely. Ever since I took over >> shepherding the audit code, all of the thread issues have been around >> the main audit queue thread so it's a bit reflexive to assume that is >> the case :) >> > Since kthread_run(audit_send_list_thread) is called by audit_receive_msg(AUDIT_LIST_RULES) > via audit_list_rules_send(), trying to audit fork request via AUDIT_LIST_RULES will cause > spams. Maybe something is going wrong with "And such events occurred 1208 times when > AUDIT_LIST_RULES is sending." part; let's wait for what printk() says. > > By the way, why do we need to use kthread_run() for short-lived tasks? Can't we use > a dedicated workqueue which would significantly reduce frequency of fork request for > AUDIT_LIST_RULES request? > Hello there =) Sorry for my long absence. I've managed to build and install the custom kernel (from Linus' branch with Tetsuo's patch for logging). The following rules were dictated by my netlink (with disabled poll rule's logic: -a always,exit -F arch=b32 -S fork,execve,clone,vfork,execveat -a always,exit -F arch=b64 -S clone,fork,vfork,execve,execveat -a never,exit -F pid=4641 -a never,exit -F ppid=4641 -a never,exit -F pid=1 -a never,exit -F ppid=1 -a always,exit -F arch=b64 -S kill,ptrace -a always,exit -F arch=b32 -S ptrace,kill -a always,exit -F arch=b64 -S exit,exit_group -a always,exit -F arch=b32 -S exit,exit_group -a always,exit -F arch=b64 -S connect,accept,accept4 -a always,exit -F arch=b32 -S connect,accept4 -a always,exit -F arch=b64 -S open,creat,openat,437 -a always,exit -F arch=b64 -S rename,renameat,renameat2 -a always,exit -F arch=b32 -S rename,renameat,renameat2 -a always,exit -F arch=b64 -S chown,fchown,lchown,fchownat -a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -a always,exit -F arch=b32 -S chmod,fchmod,fchmodat -a always,exit -F arch=b64 -S link,symlink,linkat,symlinkat -a always,exit -F arch=b32 -S link,symlink,linkat,symlinkat -a always,exit -F arch=b64 -S mount,umount2 -a always,exit -F arch=b32 -S mount,umount,umount2 -a always,exit -F arch=b64 -S setuid,setgid,setreuid,setregid,setresuid,setresgid -a always,exit -F arch=b32 -S setuid,setgid,setreuid,setregid,setresuid,setresgid -a always,exit -F arch=b64 -S mmap,mprotect -F a2=0x7 -a always,exit -F arch=b32 -S mmap,mprotect -F a2=0x7 -a always,exit -F arch=b64 -S unlink,unlinkat -a always,exit -F arch=b32 -S unlink,unlinkat -a always,exit -F arch=b64 -S ioctl -F a2=0x40086602 -a always,exit -F arch=b32 -S ioctl -F a2=0x40086602 The only one `auditctl -l` request was performed. I see the following response in syslog for the request: May  6 01:01:19 gadelshin-ri-nb kernel: [  110.474111] audit: Started audit_send_reply_thread May  6 01:01:19 gadelshin-ri-nb kernel: [  110.474123] audit: Finished audit_send_reply_thread May  6 01:01:20 gadelshin-ri-nb kernel: [  111.972014] audit: Started audit_send_list_thread May  6 01:01:20 gadelshin-ri-nb kernel: [  111.972020] audit: Calling netlink unicast May  6 01:01:20 gadelshin-ri-nb kernel: [  111.972023] audit: Calling netlink unicast May  6 01:01:20 gadelshin-ri-nb kernel: [  111.972023] audit: Calling netlink unicast May  6 01:01:20 gadelshin-ri-nb kernel: [  111.972024] audit: Calling netlink unicast May  6 01:01:20 gadelshin-ri-nb kernel: [  111.972025] audit: Calling netlink unicast May  6 01:01:20 gadelshin-ri-nb kernel: [  111.972026] audit: Calling netlink unicast May  6 01:01:20 gadelshin-ri-nb kernel: [  111.972026] audit: Calling netlink unicast May  6 01:01:20 gadelshin-ri-nb kernel: [  111.972027] audit: Calling netlink unicast May  6 01:01:20 gadelshin-ri-nb kernel: [  111.972028] audit: Calling netlink unicast May  6 01:01:20 gadelshin-ri-nb kernel: [  111.972029] audit: Calling netlink unicast May  6 01:01:20 gadelshin-ri-nb kernel: [  111.972029] audit: Calling netlink unicast May  6 01:01:20 gadelshin-ri-nb kernel: [  111.972030] audit: Calling netlink unicast May  6 01:01:20 gadelshin-ri-nb kernel: [  111.972030] audit: Calling netlink unicast May  6 01:01:20 gadelshin-ri-nb kernel: [  111.972031] audit: Calling netlink unicast May  6 01:01:20 gadelshin-ri-nb kernel: [  111.972032] audit: Calling netlink unicast May  6 01:01:20 gadelshin-ri-nb kernel: [  111.972032] audit: Calling netlink unicast May  6 01:01:20 gadelshin-ri-nb kernel: [  111.972033] audit: Calling netlink unicast May  6 01:01:20 gadelshin-ri-nb kernel: [  111.972034] audit: Calling netlink unicast May  6 01:01:20 gadelshin-ri-nb kernel: [  111.972034] audit: Calling netlink unicast May  6 01:01:20 gadelshin-ri-nb kernel: [  111.972035] audit: Calling netlink unicast May  6 01:01:20 gadelshin-ri-nb kernel: [  111.972035] audit: Calling netlink unicast May  6 01:01:20 gadelshin-ri-nb kernel: [  111.972036] audit: Calling netlink unicast May  6 01:01:20 gadelshin-ri-nb kernel: [  111.972037] audit: Calling netlink unicast May  6 01:01:20 gadelshin-ri-nb kernel: [  111.972038] audit: Calling netlink unicast May  6 01:01:20 gadelshin-ri-nb kernel: [  111.972038] audit: Calling netlink unicast May  6 01:01:20 gadelshin-ri-nb kernel: [  111.972039] audit: Calling netlink unicast May  6 01:01:20 gadelshin-ri-nb kernel: [  111.972039] audit: Calling netlink unicast May  6 01:01:20 gadelshin-ri-nb kernel: [  111.972040] audit: Calling netlink unicast May  6 01:01:20 gadelshin-ri-nb kernel: [  111.972040] audit: Calling netlink unicast May  6 01:01:20 gadelshin-ri-nb kernel: [  111.972041] audit: Calling netlink unicast May  6 01:01:20 gadelshin-ri-nb kernel: [  111.972042] audit: Calling netlink unicast May  6 01:01:20 gadelshin-ri-nb kernel: [  111.972043] audit: Calling netlink unicast May  6 01:01:20 gadelshin-ri-nb kernel: [  111.972044] audit: Calling netlink unicast May  6 01:01:20 gadelshin-ri-nb kernel: [  111.972045] audit: Finished audit_send_list_thread May  6 01:01:21 gadelshin-ri-nb kernel: [  112.485659] audit: Started audit_send_reply_thread May  6 01:01:21 gadelshin-ri-nb kernel: [  112.485689] audit: Finished audit_send_reply_thread May  6 01:01:23 gadelshin-ri-nb kernel: [  114.501072] audit: Started audit_send_reply_thread May  6 01:01:23 gadelshin-ri-nb kernel: [  114.501076] audit: Finished audit_send_reply_thread May  6 01:01:24 gadelshin-ri-nb auditd[1210]: Audit daemon rotating log files May  6 01:01:25 gadelshin-ri-nb kernel: [  116.506645] audit: Started audit_send_reply_thread May  6 01:01:25 gadelshin-ri-nb kernel: [  116.506656] audit: Finished audit_send_reply_thread May  6 01:01:27 gadelshin-ri-nb kernel: [  118.512282] audit: Started audit_send_reply_thread May  6 01:01:27 gadelshin-ri-nb kernel: [  118.512306] audit: Finished audit_send_reply_thread `git describes` shows: v6.3-13027-g1a5304fecee5 Distributive is  Ubuntu 20.04 (x64) From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id AA615C77B7C for ; Fri, 5 May 2023 22:12:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1683324765; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:list-id:list-help: list-unsubscribe:list-subscribe:list-post; bh=5zaeWh0OnLmDSdMFuIt/AAajGZo1wyjL7l+Zvsb7Zgg=; b=Khcu0FgNxv+vcv0hzBJp+/ofMPrLZf++5eQiGJ1ryFq1z9ncbQ1GmGX60HnnAGw0t1ywEI cXW3n4sG4O1e1bKKcBLG8T/MBaoCVE9hreCJdAf2yHdo057Zz2r4kyWWjtrF5xxZNAOfeB d8rKtl1B4UJF8LdCb8sMc+86Vqa6ud0= Received: from mimecast-mx02.redhat.com (mx3-rdu2.redhat.com [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-611-ViUX8VjTOJ20_x-PlWZeaw-1; Fri, 05 May 2023 18:12:42 -0400 X-MC-Unique: ViUX8VjTOJ20_x-PlWZeaw-1 Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.rdu2.redhat.com [10.11.54.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 15B063C0F1B2; Fri, 5 May 2023 22:12:41 +0000 (UTC) Received: from mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (unknown [10.30.29.100]) by smtp.corp.redhat.com (Postfix) with ESMTP id 1805A2166B32; Fri, 5 May 2023 22:12:39 +0000 (UTC) Received: from mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (localhost [IPv6:::1]) by mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (Postfix) with ESMTP id B14951946A48; Fri, 5 May 2023 22:12:38 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx09.intmail.prod.int.rdu2.redhat.com [10.11.54.9]) by mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (Postfix) with ESMTP id BCC2A1946A43 for ; Fri, 5 May 2023 22:12:37 +0000 (UTC) Received: by smtp.corp.redhat.com (Postfix) id 645D0492B01; Fri, 5 May 2023 22:12:37 +0000 (UTC) Received: from mimecast-mx02.redhat.com (mimecast05.extmail.prod.ext.rdu2.redhat.com [10.11.55.21]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 5BD19492B00 for ; Fri, 5 May 2023 22:12:31 +0000 (UTC) Received: from us-smtp-1.mimecast.com (us-smtp-delivery-1.mimecast.com [205.139.110.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 3C3B2886460 for ; Fri, 5 May 2023 22:12:31 +0000 (UTC) Received: from mail-lf1-f50.google.com (mail-lf1-f50.google.com [209.85.167.50]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-304-qxA6JWcDNfiTXgzlwVWnpw-1; Fri, 05 May 2023 18:12:28 -0400 X-MC-Unique: qxA6JWcDNfiTXgzlwVWnpw-1 Received: by mail-lf1-f50.google.com with SMTP id 2adb3069b0e04-4eed764a10cso2602887e87.0 for ; Fri, 05 May 2023 15:12:26 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1683324744; x=1685916744; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=zvwH/om6riyO67KuORkjhn7D8bd2EIUB1tcKOP2bv8w=; b=NaqrS7V7D8MX2F87dI5zqIVSpPUBJtAYPHpsxyUZ8tnGUfIpq/5+UWhAJy3z/QpDtq 9gsizskh3bBP2Hw9+/gplyUrRyVfa8wyYEFn8dIO2dPw4dzk9tWoJFZn50H5pZ0UAuw/ lcyKaj/6bKSMRtZCWWWC7BKwbcptJ8YLbMlbm94Tqf7s81zvaH8EAZfvGYBezjfEzy79 fMybz17MSjoVktdtx5FTr/HLauQUQYGq7gfJRW/rQ44l+L4N+iyuTsczhGkNZyuFXOVk v9yv+xbXMKe3KQLmBGxnVMkdfqXcLgDrJybaxPTkL9l/Pa10xq2kjrh9eDDZhyOToEgl 7YFA== X-Gm-Message-State: AC+VfDyVYdZBOD7Yp4jTsLRm4vRFCf2QHKBdZjOZdHItlc3ciPSCgrYK Z8Q5TeG2SXMrzeF9deZpPmHK8XvXeNVYQh7X X-Google-Smtp-Source: ACHHUZ4dPDxP/8+k+DX0YtlzfqnFMES5FF+Vr0TwXxTT/asT8GQ0seC0pv55tjxY7JZVO+zcLj7O2g== X-Received: by 2002:ac2:5213:0:b0:4d8:4f46:f0b9 with SMTP id a19-20020ac25213000000b004d84f46f0b9mr872406lfl.23.1683324743929; Fri, 05 May 2023 15:12:23 -0700 (PDT) Received: from [192.168.0.31] ([94.242.171.165]) by smtp.gmail.com with ESMTPSA id x22-20020ac24896000000b004db297957e8sm426674lfc.305.2023.05.05.15.12.23 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Fri, 05 May 2023 15:12:23 -0700 (PDT) Message-ID: <7c4caf66-a0ae-4999-172e-437d6cfc8ff3@gmail.com> Date: Sat, 6 May 2023 01:12:23 +0300 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Thunderbird/102.10.0 Subject: Re: Can AUDIT_LIST_RULES causes kthreadd-spam? To: Tetsuo Handa , Paul Moore References: <9ae2c1df-1f20-a40b-35ed-1dc76b122a4f@I-love.SAKURA.ne.jp> <415a4871-4d84-a31f-5417-e850a98bbffd@I-love.SAKURA.ne.jp> From: Rinat Gadelshin In-Reply-To: <415a4871-4d84-a31f-5417-e850a98bbffd@I-love.SAKURA.ne.jp> X-Mimecast-Impersonation-Protect: Policy=CLT - Impersonation Protection Definition; Similar Internal Domain=false; Similar Monitored External Domain=false; Custom External Domain=false; Mimecast External Domain=false; Newly Observed Domain=false; Internal User Name=false; Custom Display Name List=false; Reply-to Address Mismatch=false; Targeted Threat Dictionary=false; Mimecast Threat Dictionary=false; Custom Threat Dictionary=false X-Scanned-By: MIMEDefang 3.1 on 10.11.54.9 X-BeenThere: linux-audit@redhat.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Linux Audit Discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: audit@vger.kernel.org, linux-audit@redhat.com Errors-To: linux-audit-bounces@redhat.com Sender: "Linux-audit" X-Scanned-By: MIMEDefang 3.1 on 10.11.54.6 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: gmail.com Content-Language: en-US, ru-RU Content-Transfer-Encoding: base64 Content-Type: text/plain; charset="utf-8"; Format="flowed" T24gMDUuMDUuMjAyMyAwMTo1MywgVGV0c3VvIEhhbmRhIHdyb3RlOgo+IE9uIDIwMjMvMDUvMDUg Mzo0MCwgUGF1bCBNb29yZSB3cm90ZToKPj4gT24gV2VkLCBNYXkgMywgMjAyMyBhdCAxMDo1MOKA r1BNIFRldHN1byBIYW5kYQo+PiA8cGVuZ3Vpbi1rZXJuZWxAaS1sb3ZlLnNha3VyYS5uZS5qcD4g d3JvdGU6Cj4+PiBPbiAyMDIzLzA1LzA0IDc6MTIsIFJpbmF0IEdhZGVsc2hpbiB3cm90ZToKPj4+ PiBPbiAwNC4wNS4yMDIzIDAwOjI3LCBQYXVsIE1vb3JlIHdyb3RlOgo+Pj4+PiBDYW4geW91IGJl IG1vcmUgc3BlY2lmaWMgYWJvdXQgdGhlIGtlcm5lbCB0aHJlYWRzIHlvdSBhcmUgc2VlaW5nLCBh cmUKPj4+Pj4geW91IHNlZWluZyBtdWx0aXBsZSAia2F1ZGl0ZCIgdGhyZWFkcz8KPj4+Pj4KPj4+ Pj4gJSBwcyAtZkMga2F1ZGl0ZAo+Pj4+PiBVSUQgICAgICAgICAgUElEICAgIFBQSUQgIEMgU1RJ TUUgVFRZICAgICAgICAgIFRJTUUgQ01ECj4+Pj4+IHJvb3QgICAgICAgICAgODkgICAgICAgMiAg MCBBcHIyOCA/ICAgICAgICAwMDowMDowMCBba2F1ZGl0ZF0KPj4+IEkgZG9uJ3QgdGhpbmsgc28u Cj4+Pgo+Pj4ga2VybmVsIGF1ZGl0IHN1YnN5c3RlbSB1c2VzIGt0aHJlYWRfcnVuKCkgaW4gb3Jk ZXIgdG8gcnVuIHNob3J0LWxpdmVkIGtlcm5lbCB0aHJlYWRzLgo+PiBUaGFua3MgVGV0c3VvLCBJ IGFncmVlIHRoYXQncyBmYXIgbW9yZSBsaWtlbHkuICBFdmVyIHNpbmNlIEkgdG9vayBvdmVyCj4+ IHNoZXBoZXJkaW5nIHRoZSBhdWRpdCBjb2RlLCBhbGwgb2YgdGhlIHRocmVhZCBpc3N1ZXMgaGF2 ZSBiZWVuIGFyb3VuZAo+PiB0aGUgbWFpbiBhdWRpdCBxdWV1ZSB0aHJlYWQgc28gaXQncyBhIGJp dCByZWZsZXhpdmUgdG8gYXNzdW1lIHRoYXQgaXMKPj4gdGhlIGNhc2UgOikKPj4KPiBTaW5jZSBr dGhyZWFkX3J1bihhdWRpdF9zZW5kX2xpc3RfdGhyZWFkKSBpcyBjYWxsZWQgYnkgYXVkaXRfcmVj ZWl2ZV9tc2coQVVESVRfTElTVF9SVUxFUykKPiB2aWEgYXVkaXRfbGlzdF9ydWxlc19zZW5kKCks IHRyeWluZyB0byBhdWRpdCBmb3JrIHJlcXVlc3QgdmlhIEFVRElUX0xJU1RfUlVMRVMgd2lsbCBj YXVzZQo+IHNwYW1zLiBNYXliZSBzb21ldGhpbmcgaXMgZ29pbmcgd3Jvbmcgd2l0aCAiQW5kIHN1 Y2ggZXZlbnRzIG9jY3VycmVkIDEyMDggdGltZXMgd2hlbgo+IEFVRElUX0xJU1RfUlVMRVMgaXMg c2VuZGluZy4iIHBhcnQ7IGxldCdzIHdhaXQgZm9yIHdoYXQgcHJpbnRrKCkgc2F5cy4KPgo+IEJ5 IHRoZSB3YXksIHdoeSBkbyB3ZSBuZWVkIHRvIHVzZSBrdGhyZWFkX3J1bigpIGZvciBzaG9ydC1s aXZlZCB0YXNrcz8gQ2FuJ3Qgd2UgdXNlCj4gYSBkZWRpY2F0ZWQgd29ya3F1ZXVlIHdoaWNoIHdv dWxkIHNpZ25pZmljYW50bHkgcmVkdWNlIGZyZXF1ZW5jeSBvZiBmb3JrIHJlcXVlc3QgZm9yCj4g QVVESVRfTElTVF9SVUxFUyByZXF1ZXN0Pwo+CkhlbGxvIHRoZXJlID0pClNvcnJ5IGZvciBteSBs b25nIGFic2VuY2UuCgpJJ3ZlIG1hbmFnZWQgdG8gYnVpbGQgYW5kIGluc3RhbGwgdGhlIGN1c3Rv bSBrZXJuZWwgKGZyb20gTGludXMnIGJyYW5jaCAKd2l0aCBUZXRzdW8ncyBwYXRjaCBmb3IgbG9n Z2luZykuCgpUaGUgZm9sbG93aW5nIHJ1bGVzIHdlcmUgZGljdGF0ZWQgYnkgbXkgbmV0bGluayAo d2l0aCBkaXNhYmxlZCBwb2xsIApydWxlJ3MgbG9naWM6CgotYSBhbHdheXMsZXhpdCAtRiBhcmNo PWIzMiAtUyBmb3JrLGV4ZWN2ZSxjbG9uZSx2Zm9yayxleGVjdmVhdAotYSBhbHdheXMsZXhpdCAt RiBhcmNoPWI2NCAtUyBjbG9uZSxmb3JrLHZmb3JrLGV4ZWN2ZSxleGVjdmVhdAotYSBuZXZlcixl eGl0IC1GIHBpZD00NjQxCi1hIG5ldmVyLGV4aXQgLUYgcHBpZD00NjQxCi1hIG5ldmVyLGV4aXQg LUYgcGlkPTEKLWEgbmV2ZXIsZXhpdCAtRiBwcGlkPTEKLWEgYWx3YXlzLGV4aXQgLUYgYXJjaD1i NjQgLVMga2lsbCxwdHJhY2UKLWEgYWx3YXlzLGV4aXQgLUYgYXJjaD1iMzIgLVMgcHRyYWNlLGtp bGwKLWEgYWx3YXlzLGV4aXQgLUYgYXJjaD1iNjQgLVMgZXhpdCxleGl0X2dyb3VwCi1hIGFsd2F5 cyxleGl0IC1GIGFyY2g9YjMyIC1TIGV4aXQsZXhpdF9ncm91cAotYSBhbHdheXMsZXhpdCAtRiBh cmNoPWI2NCAtUyBjb25uZWN0LGFjY2VwdCxhY2NlcHQ0Ci1hIGFsd2F5cyxleGl0IC1GIGFyY2g9 YjMyIC1TIGNvbm5lY3QsYWNjZXB0NAotYSBhbHdheXMsZXhpdCAtRiBhcmNoPWI2NCAtUyBvcGVu LGNyZWF0LG9wZW5hdCw0MzcKLWEgYWx3YXlzLGV4aXQgLUYgYXJjaD1iNjQgLVMgcmVuYW1lLHJl bmFtZWF0LHJlbmFtZWF0MgotYSBhbHdheXMsZXhpdCAtRiBhcmNoPWIzMiAtUyByZW5hbWUscmVu YW1lYXQscmVuYW1lYXQyCi1hIGFsd2F5cyxleGl0IC1GIGFyY2g9YjY0IC1TIGNob3duLGZjaG93 bixsY2hvd24sZmNob3duYXQKLWEgYWx3YXlzLGV4aXQgLUYgYXJjaD1iMzIgLVMgbGNob3duLGZj aG93bixjaG93bixmY2hvd25hdAotYSBhbHdheXMsZXhpdCAtRiBhcmNoPWI2NCAtUyBjaG1vZCxm Y2htb2QsZmNobW9kYXQKLWEgYWx3YXlzLGV4aXQgLUYgYXJjaD1iMzIgLVMgY2htb2QsZmNobW9k LGZjaG1vZGF0Ci1hIGFsd2F5cyxleGl0IC1GIGFyY2g9YjY0IC1TIGxpbmssc3ltbGluayxsaW5r YXQsc3ltbGlua2F0Ci1hIGFsd2F5cyxleGl0IC1GIGFyY2g9YjMyIC1TIGxpbmssc3ltbGluayxs aW5rYXQsc3ltbGlua2F0Ci1hIGFsd2F5cyxleGl0IC1GIGFyY2g9YjY0IC1TIG1vdW50LHVtb3Vu dDIKLWEgYWx3YXlzLGV4aXQgLUYgYXJjaD1iMzIgLVMgbW91bnQsdW1vdW50LHVtb3VudDIKLWEg YWx3YXlzLGV4aXQgLUYgYXJjaD1iNjQgLVMgCnNldHVpZCxzZXRnaWQsc2V0cmV1aWQsc2V0cmVn aWQsc2V0cmVzdWlkLHNldHJlc2dpZAotYSBhbHdheXMsZXhpdCAtRiBhcmNoPWIzMiAtUyAKc2V0 dWlkLHNldGdpZCxzZXRyZXVpZCxzZXRyZWdpZCxzZXRyZXN1aWQsc2V0cmVzZ2lkCi1hIGFsd2F5 cyxleGl0IC1GIGFyY2g9YjY0IC1TIG1tYXAsbXByb3RlY3QgLUYgYTI9MHg3Ci1hIGFsd2F5cyxl eGl0IC1GIGFyY2g9YjMyIC1TIG1tYXAsbXByb3RlY3QgLUYgYTI9MHg3Ci1hIGFsd2F5cyxleGl0 IC1GIGFyY2g9YjY0IC1TIHVubGluayx1bmxpbmthdAotYSBhbHdheXMsZXhpdCAtRiBhcmNoPWIz MiAtUyB1bmxpbmssdW5saW5rYXQKLWEgYWx3YXlzLGV4aXQgLUYgYXJjaD1iNjQgLVMgaW9jdGwg LUYgYTI9MHg0MDA4NjYwMgotYSBhbHdheXMsZXhpdCAtRiBhcmNoPWIzMiAtUyBpb2N0bCAtRiBh Mj0weDQwMDg2NjAyCgpUaGUgb25seSBvbmUgYGF1ZGl0Y3RsIC1sYCByZXF1ZXN0IHdhcyBwZXJm b3JtZWQuCkkgc2VlIHRoZSBmb2xsb3dpbmcgcmVzcG9uc2UgaW4gc3lzbG9nIGZvciB0aGUgcmVx dWVzdDoKCk1hecKgIDYgMDE6MDE6MTkgZ2FkZWxzaGluLXJpLW5iIGtlcm5lbDogW8KgIDExMC40 NzQxMTFdIGF1ZGl0OiBTdGFydGVkIAphdWRpdF9zZW5kX3JlcGx5X3RocmVhZApNYXnCoCA2IDAx OjAxOjE5IGdhZGVsc2hpbi1yaS1uYiBrZXJuZWw6IFvCoCAxMTAuNDc0MTIzXSBhdWRpdDogRmlu aXNoZWQgCmF1ZGl0X3NlbmRfcmVwbHlfdGhyZWFkCk1hecKgIDYgMDE6MDE6MjAgZ2FkZWxzaGlu LXJpLW5iIGtlcm5lbDogW8KgIDExMS45NzIwMTRdIGF1ZGl0OiBTdGFydGVkIAphdWRpdF9zZW5k X2xpc3RfdGhyZWFkCk1hecKgIDYgMDE6MDE6MjAgZ2FkZWxzaGluLXJpLW5iIGtlcm5lbDogW8Kg IDExMS45NzIwMjBdIGF1ZGl0OiBDYWxsaW5nIApuZXRsaW5rIHVuaWNhc3QKTWF5wqAgNiAwMTow MToyMCBnYWRlbHNoaW4tcmktbmIga2VybmVsOiBbwqAgMTExLjk3MjAyM10gYXVkaXQ6IENhbGxp bmcgCm5ldGxpbmsgdW5pY2FzdApNYXnCoCA2IDAxOjAxOjIwIGdhZGVsc2hpbi1yaS1uYiBrZXJu ZWw6IFvCoCAxMTEuOTcyMDIzXSBhdWRpdDogQ2FsbGluZyAKbmV0bGluayB1bmljYXN0Ck1hecKg IDYgMDE6MDE6MjAgZ2FkZWxzaGluLXJpLW5iIGtlcm5lbDogW8KgIDExMS45NzIwMjRdIGF1ZGl0 OiBDYWxsaW5nIApuZXRsaW5rIHVuaWNhc3QKTWF5wqAgNiAwMTowMToyMCBnYWRlbHNoaW4tcmkt bmIga2VybmVsOiBbwqAgMTExLjk3MjAyNV0gYXVkaXQ6IENhbGxpbmcgCm5ldGxpbmsgdW5pY2Fz dApNYXnCoCA2IDAxOjAxOjIwIGdhZGVsc2hpbi1yaS1uYiBrZXJuZWw6IFvCoCAxMTEuOTcyMDI2 XSBhdWRpdDogQ2FsbGluZyAKbmV0bGluayB1bmljYXN0Ck1hecKgIDYgMDE6MDE6MjAgZ2FkZWxz aGluLXJpLW5iIGtlcm5lbDogW8KgIDExMS45NzIwMjZdIGF1ZGl0OiBDYWxsaW5nIApuZXRsaW5r IHVuaWNhc3QKTWF5wqAgNiAwMTowMToyMCBnYWRlbHNoaW4tcmktbmIga2VybmVsOiBbwqAgMTEx Ljk3MjAyN10gYXVkaXQ6IENhbGxpbmcgCm5ldGxpbmsgdW5pY2FzdApNYXnCoCA2IDAxOjAxOjIw IGdhZGVsc2hpbi1yaS1uYiBrZXJuZWw6IFvCoCAxMTEuOTcyMDI4XSBhdWRpdDogQ2FsbGluZyAK bmV0bGluayB1bmljYXN0Ck1hecKgIDYgMDE6MDE6MjAgZ2FkZWxzaGluLXJpLW5iIGtlcm5lbDog W8KgIDExMS45NzIwMjldIGF1ZGl0OiBDYWxsaW5nIApuZXRsaW5rIHVuaWNhc3QKTWF5wqAgNiAw MTowMToyMCBnYWRlbHNoaW4tcmktbmIga2VybmVsOiBbwqAgMTExLjk3MjAyOV0gYXVkaXQ6IENh bGxpbmcgCm5ldGxpbmsgdW5pY2FzdApNYXnCoCA2IDAxOjAxOjIwIGdhZGVsc2hpbi1yaS1uYiBr ZXJuZWw6IFvCoCAxMTEuOTcyMDMwXSBhdWRpdDogQ2FsbGluZyAKbmV0bGluayB1bmljYXN0Ck1h ecKgIDYgMDE6MDE6MjAgZ2FkZWxzaGluLXJpLW5iIGtlcm5lbDogW8KgIDExMS45NzIwMzBdIGF1 ZGl0OiBDYWxsaW5nIApuZXRsaW5rIHVuaWNhc3QKTWF5wqAgNiAwMTowMToyMCBnYWRlbHNoaW4t cmktbmIga2VybmVsOiBbwqAgMTExLjk3MjAzMV0gYXVkaXQ6IENhbGxpbmcgCm5ldGxpbmsgdW5p Y2FzdApNYXnCoCA2IDAxOjAxOjIwIGdhZGVsc2hpbi1yaS1uYiBrZXJuZWw6IFvCoCAxMTEuOTcy MDMyXSBhdWRpdDogQ2FsbGluZyAKbmV0bGluayB1bmljYXN0Ck1hecKgIDYgMDE6MDE6MjAgZ2Fk ZWxzaGluLXJpLW5iIGtlcm5lbDogW8KgIDExMS45NzIwMzJdIGF1ZGl0OiBDYWxsaW5nIApuZXRs aW5rIHVuaWNhc3QKTWF5wqAgNiAwMTowMToyMCBnYWRlbHNoaW4tcmktbmIga2VybmVsOiBbwqAg MTExLjk3MjAzM10gYXVkaXQ6IENhbGxpbmcgCm5ldGxpbmsgdW5pY2FzdApNYXnCoCA2IDAxOjAx OjIwIGdhZGVsc2hpbi1yaS1uYiBrZXJuZWw6IFvCoCAxMTEuOTcyMDM0XSBhdWRpdDogQ2FsbGlu ZyAKbmV0bGluayB1bmljYXN0Ck1hecKgIDYgMDE6MDE6MjAgZ2FkZWxzaGluLXJpLW5iIGtlcm5l bDogW8KgIDExMS45NzIwMzRdIGF1ZGl0OiBDYWxsaW5nIApuZXRsaW5rIHVuaWNhc3QKTWF5wqAg NiAwMTowMToyMCBnYWRlbHNoaW4tcmktbmIga2VybmVsOiBbwqAgMTExLjk3MjAzNV0gYXVkaXQ6 IENhbGxpbmcgCm5ldGxpbmsgdW5pY2FzdApNYXnCoCA2IDAxOjAxOjIwIGdhZGVsc2hpbi1yaS1u YiBrZXJuZWw6IFvCoCAxMTEuOTcyMDM1XSBhdWRpdDogQ2FsbGluZyAKbmV0bGluayB1bmljYXN0 Ck1hecKgIDYgMDE6MDE6MjAgZ2FkZWxzaGluLXJpLW5iIGtlcm5lbDogW8KgIDExMS45NzIwMzZd IGF1ZGl0OiBDYWxsaW5nIApuZXRsaW5rIHVuaWNhc3QKTWF5wqAgNiAwMTowMToyMCBnYWRlbHNo aW4tcmktbmIga2VybmVsOiBbwqAgMTExLjk3MjAzN10gYXVkaXQ6IENhbGxpbmcgCm5ldGxpbmsg dW5pY2FzdApNYXnCoCA2IDAxOjAxOjIwIGdhZGVsc2hpbi1yaS1uYiBrZXJuZWw6IFvCoCAxMTEu OTcyMDM4XSBhdWRpdDogQ2FsbGluZyAKbmV0bGluayB1bmljYXN0Ck1hecKgIDYgMDE6MDE6MjAg Z2FkZWxzaGluLXJpLW5iIGtlcm5lbDogW8KgIDExMS45NzIwMzhdIGF1ZGl0OiBDYWxsaW5nIApu ZXRsaW5rIHVuaWNhc3QKTWF5wqAgNiAwMTowMToyMCBnYWRlbHNoaW4tcmktbmIga2VybmVsOiBb wqAgMTExLjk3MjAzOV0gYXVkaXQ6IENhbGxpbmcgCm5ldGxpbmsgdW5pY2FzdApNYXnCoCA2IDAx OjAxOjIwIGdhZGVsc2hpbi1yaS1uYiBrZXJuZWw6IFvCoCAxMTEuOTcyMDM5XSBhdWRpdDogQ2Fs bGluZyAKbmV0bGluayB1bmljYXN0Ck1hecKgIDYgMDE6MDE6MjAgZ2FkZWxzaGluLXJpLW5iIGtl cm5lbDogW8KgIDExMS45NzIwNDBdIGF1ZGl0OiBDYWxsaW5nIApuZXRsaW5rIHVuaWNhc3QKTWF5 wqAgNiAwMTowMToyMCBnYWRlbHNoaW4tcmktbmIga2VybmVsOiBbwqAgMTExLjk3MjA0MF0gYXVk aXQ6IENhbGxpbmcgCm5ldGxpbmsgdW5pY2FzdApNYXnCoCA2IDAxOjAxOjIwIGdhZGVsc2hpbi1y aS1uYiBrZXJuZWw6IFvCoCAxMTEuOTcyMDQxXSBhdWRpdDogQ2FsbGluZyAKbmV0bGluayB1bmlj YXN0Ck1hecKgIDYgMDE6MDE6MjAgZ2FkZWxzaGluLXJpLW5iIGtlcm5lbDogW8KgIDExMS45NzIw NDJdIGF1ZGl0OiBDYWxsaW5nIApuZXRsaW5rIHVuaWNhc3QKTWF5wqAgNiAwMTowMToyMCBnYWRl bHNoaW4tcmktbmIga2VybmVsOiBbwqAgMTExLjk3MjA0M10gYXVkaXQ6IENhbGxpbmcgCm5ldGxp bmsgdW5pY2FzdApNYXnCoCA2IDAxOjAxOjIwIGdhZGVsc2hpbi1yaS1uYiBrZXJuZWw6IFvCoCAx MTEuOTcyMDQ0XSBhdWRpdDogQ2FsbGluZyAKbmV0bGluayB1bmljYXN0Ck1hecKgIDYgMDE6MDE6 MjAgZ2FkZWxzaGluLXJpLW5iIGtlcm5lbDogW8KgIDExMS45NzIwNDVdIGF1ZGl0OiBGaW5pc2hl ZCAKYXVkaXRfc2VuZF9saXN0X3RocmVhZApNYXnCoCA2IDAxOjAxOjIxIGdhZGVsc2hpbi1yaS1u YiBrZXJuZWw6IFvCoCAxMTIuNDg1NjU5XSBhdWRpdDogU3RhcnRlZCAKYXVkaXRfc2VuZF9yZXBs eV90aHJlYWQKTWF5wqAgNiAwMTowMToyMSBnYWRlbHNoaW4tcmktbmIga2VybmVsOiBbwqAgMTEy LjQ4NTY4OV0gYXVkaXQ6IEZpbmlzaGVkIAphdWRpdF9zZW5kX3JlcGx5X3RocmVhZApNYXnCoCA2 IDAxOjAxOjIzIGdhZGVsc2hpbi1yaS1uYiBrZXJuZWw6IFvCoCAxMTQuNTAxMDcyXSBhdWRpdDog U3RhcnRlZCAKYXVkaXRfc2VuZF9yZXBseV90aHJlYWQKTWF5wqAgNiAwMTowMToyMyBnYWRlbHNo aW4tcmktbmIga2VybmVsOiBbwqAgMTE0LjUwMTA3Nl0gYXVkaXQ6IEZpbmlzaGVkIAphdWRpdF9z ZW5kX3JlcGx5X3RocmVhZApNYXnCoCA2IDAxOjAxOjI0IGdhZGVsc2hpbi1yaS1uYiBhdWRpdGRb MTIxMF06IEF1ZGl0IGRhZW1vbiByb3RhdGluZyBsb2cgCmZpbGVzCk1hecKgIDYgMDE6MDE6MjUg Z2FkZWxzaGluLXJpLW5iIGtlcm5lbDogW8KgIDExNi41MDY2NDVdIGF1ZGl0OiBTdGFydGVkIAph dWRpdF9zZW5kX3JlcGx5X3RocmVhZApNYXnCoCA2IDAxOjAxOjI1IGdhZGVsc2hpbi1yaS1uYiBr ZXJuZWw6IFvCoCAxMTYuNTA2NjU2XSBhdWRpdDogRmluaXNoZWQgCmF1ZGl0X3NlbmRfcmVwbHlf dGhyZWFkCk1hecKgIDYgMDE6MDE6MjcgZ2FkZWxzaGluLXJpLW5iIGtlcm5lbDogW8KgIDExOC41 MTIyODJdIGF1ZGl0OiBTdGFydGVkIAphdWRpdF9zZW5kX3JlcGx5X3RocmVhZApNYXnCoCA2IDAx OjAxOjI3IGdhZGVsc2hpbi1yaS1uYiBrZXJuZWw6IFvCoCAxMTguNTEyMzA2XSBhdWRpdDogRmlu aXNoZWQgCmF1ZGl0X3NlbmRfcmVwbHlfdGhyZWFkCgpgZ2l0IGRlc2NyaWJlc2Agc2hvd3M6IHY2 LjMtMTMwMjctZzFhNTMwNGZlY2VlNQpEaXN0cmlidXRpdmUgaXPCoCBVYnVudHUgMjAuMDQgKHg2 NCkKCi0tCkxpbnV4LWF1ZGl0IG1haWxpbmcgbGlzdApMaW51eC1hdWRpdEByZWRoYXQuY29tCmh0 dHBzOi8vbGlzdG1hbi5yZWRoYXQuY29tL21haWxtYW4vbGlzdGluZm8vbGludXgtYXVkaXQK