From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.3 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,NICE_REPLY_A,SPF_HELO_NONE, SPF_PASS,URIBL_BLOCKED,USER_AGENT_SANE_1 autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4FEEEC4727C for ; Wed, 30 Sep 2020 20:35:12 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 0CAA72074B for ; Wed, 30 Sep 2020 20:35:12 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="b4EbsNm9" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1725814AbgI3Ue4 (ORCPT ); Wed, 30 Sep 2020 16:34:56 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33192 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725355AbgI3Ue4 (ORCPT ); Wed, 30 Sep 2020 16:34:56 -0400 Received: from mail-wr1-x444.google.com (mail-wr1-x444.google.com [IPv6:2a00:1450:4864:20::444]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CCC34C061755; Wed, 30 Sep 2020 13:34:55 -0700 (PDT) Received: by mail-wr1-x444.google.com with SMTP id o5so3216386wrn.13; Wed, 30 Sep 2020 13:34:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=cc:subject:to:references:from:message-id:date:user-agent :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=IspiLrnT2imZY/Ib+JxzPK1rgkTFQ0uem4Utb6KnzxY=; b=b4EbsNm9L32a8sJpoFaT4hyWH+ptKyoaxgjye0AYiOlxBeFrPKNJgYR+UakNy2STga yX9kSFsWwTymYX4CZrw2rug3yhHP+zATsXh+ObeaDw2GqxuIWfH5i9unDwq2sP/eV9GG mFlLS9h8p/vBExDznmT3C3D/MFbTlhF43vcyU64J8Prg+WnylxB64USH0ZW4pPdtAJZj XnAXqN9tamWT92flreZMHVpUBUO0RV1QOJ6slsXRzHpZcv18mLma5Lt7h1V1g1uQNnJl N2CYCPRa4pujcs/uvk7T7/wRD/rqvsKNS4ijTrQ+Rfrjph957/qgQ+t/aX58IKUnl+iV NFCA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:cc:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=IspiLrnT2imZY/Ib+JxzPK1rgkTFQ0uem4Utb6KnzxY=; b=H40ynTxaxbX2UMwVl3uapGlPoWv2BZyX42TvyuTVU1C1kCHqjcke/6qcsbI5A55jWe LP910hyHLl/IqDJRZ8acIhDp9sN333rnx93RPrpr35MxtIMrUMvxfCUSuqeQc/vSutBW iQHCdob70UnAwmYw0CuvjQYlJCf6QXgkRyBYo9EpHqqxYhmGUYqBnOl020i5HPbfT2FI uN/syW2zP+PTL4K9XM/LaiVIMXJHUNJVpWcDyJqZGnT4SnFJd7VRfBb20UbvGeyCzxPK 7uj1ouyW23IcI9Lw936QEWsODbT0fxpT3dLhzYluMIQN/LNYOQYDXL6LcGslCCwFTJz9 lYtA== X-Gm-Message-State: AOAM531vNz43VT9Z6P33Xrt7mOUHt6LLQKEjXaoHpr+D4JUlEDsawIAE w0Bwlea+2TybI3vbZhGnJRU= X-Google-Smtp-Source: ABdhPJxu7WCzwNxAHegKNtrhoSoK3B3wGOn21tufT7z08EpALYEeln9Ii4oycORRXrlIkIl2co1tog== X-Received: by 2002:a5d:570b:: with SMTP id a11mr5099611wrv.139.1601498094353; Wed, 30 Sep 2020 13:34:54 -0700 (PDT) Received: from ?IPv6:2001:a61:2479:6801:d8fe:4132:9f23:7e8f? ([2001:a61:2479:6801:d8fe:4132:9f23:7e8f]) by smtp.gmail.com with ESMTPSA id d83sm4993890wmf.23.2020.09.30.13.34.52 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Wed, 30 Sep 2020 13:34:53 -0700 (PDT) Cc: mtk.manpages@gmail.com, Sargun Dhillon , Kees Cook , Christian Brauner , linux-man , lkml , Aleksa Sarai , Jann Horn , Alexei Starovoitov , wad@chromium.org, bpf@vger.kernel.org, Song Liu , Daniel Borkmann , Andy Lutomirski , Linux Containers , Giuseppe Scrivano , Robert Sesek Subject: Re: For review: seccomp_user_notif(2) manual page To: Tycho Andersen References: <45f07f17-18b6-d187-0914-6f341fe90857@gmail.com> <20200930150330.GC284424@cisco> From: "Michael Kerrisk (man-pages)" Message-ID: <8bcd956f-58d2-d2f0-ca7c-0a30f3fcd5b8@gmail.com> Date: Wed, 30 Sep 2020 22:34:51 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 MIME-Version: 1.0 In-Reply-To: <20200930150330.GC284424@cisco> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: bpf@vger.kernel.org Hi Tycho, Thanks for taking time to look at the page! On 9/30/20 5:03 PM, Tycho Andersen wrote: > On Wed, Sep 30, 2020 at 01:07:38PM +0200, Michael Kerrisk (man-pages) wrote: >> 2. In order that the supervisor process can obtain notifications >> using the listening file descriptor, (a duplicate of) that >> file descriptor must be passed from the target process to the >> supervisor process. One way in which this could be done is by >> passing the file descriptor over a UNIX domain socket connec‐ >> tion between the two processes (using the SCM_RIGHTS ancillary >> message type described in unix(7)). Another possibility is >> that the supervisor might inherit the file descriptor via >> fork(2). > > It is technically possible to inherit the fd via fork, but is it > really that useful? The child process wouldn't be able to actually do > the syscall in question, since it would have the same filter. D'oh! Yes, of course. I think I was reaching because in an earlier conversation you replied: [[ > 3. The "target process" passes the "listening file descriptor" > to the "monitoring process" via the UNIX domain socket. or some other means, it doesn't have to be with SCM_RIGHTS. ]] So, what other means? Anyway, I removed the sentence mentioning fork(). >> The information in the notification can be used to discover >> the values of pointer arguments for the target process's sys‐ >> tem call. (This is something that can't be done from within a >> seccomp filter.) To do this (and assuming it has suitable > > s/To do this/One way to accomplish this/ perhaps, since there are > others. Yes, thanks, done. >> permissions), the supervisor opens the corresponding >> /proc/[pid]/mem file, seeks to the memory location that corre‐ >> sponds to one of the pointer arguments whose value is supplied >> in the notification event, and reads bytes from that location. >> (The supervisor must be careful to avoid a race condition that >> can occur when doing this; see the description of the SEC‐ >> COMP_IOCTL_NOTIF_ID_VALID ioctl(2) operation below.) In addi‐ >> tion, the supervisor can access other system information that >> is visible in user space but which is not accessible from a >> seccomp filter. >> >> ┌─────────────────────────────────────────────────────┐ >> │FIXME │ >> ├─────────────────────────────────────────────────────┤ >> │Suppose we are reading a pathname from /proc/PID/mem │ >> │for a system call such as mkdir(). The pathname can │ >> │be an arbitrary length. How do we know how much (how │ >> │many pages) to read from /proc/PID/mem? │ >> └─────────────────────────────────────────────────────┘ > > PATH_MAX, I suppose. Yes, I misunderstood a fundamental detail here, as Jann also confirmed. >> ┌─────────────────────────────────────────────────────┐ >> │FIXME │ >> ├─────────────────────────────────────────────────────┤ >> │From my experiments, it appears that if a SEC‐ │ >> │COMP_IOCTL_NOTIF_RECV is done after the target │ >> │process terminates, then the ioctl() simply blocks │ >> │(rather than returning an error to indicate that the │ >> │target process no longer exists). │ > > Yeah, I think Christian wanted to fix this at some point, Do you have a pointer that discussion? I could not find it with a quick search. > but it's a > bit sticky to do. Can you say a few words about the nature of the problem? In the meantime. I think this merits a note under BUGS, and I've added one. > Note that if you e.g. rely on fork() above, the > filter is shared with your current process, and this notification > would never be possible. Perhaps another reason to omit that from the > man page. (Yes, as noted above, I removed that sentence.) >> SECCOMP_IOCTL_NOTIF_ID_VALID >> This operation can be used to check that a notification ID >> returned by an earlier SECCOMP_IOCTL_NOTIF_RECV operation >> is still valid (i.e., that the target process still >> exists). >> >> The third ioctl(2) argument is a pointer to the cookie >> (id) returned by the SECCOMP_IOCTL_NOTIF_RECV operation. >> >> This operation is necessary to avoid race conditions that >> can occur when the pid returned by the SEC‐ >> COMP_IOCTL_NOTIF_RECV operation terminates, and that >> process ID is reused by another process. An example of >> this kind of race is the following >> >> 1. A notification is generated on the listening file >> descriptor. The returned seccomp_notif contains the >> PID of the target process. >> >> 2. The target process terminates. >> >> 3. Another process is created on the system that by chance >> reuses the PID that was freed when the target process >> terminates. >> >> 4. The supervisor open(2)s the /proc/[pid]/mem file for >> the PID obtained in step 1, with the intention of (say) >> inspecting the memory locations that contains the argu‐ >> ments of the system call that triggered the notifica‐ >> tion in step 1. >> >> In the above scenario, the risk is that the supervisor may >> try to access the memory of a process other than the tar‐ >> get. This race can be avoided by following the call to >> open with a SECCOMP_IOCTL_NOTIF_ID_VALID operation to ver‐ >> ify that the process that generated the notification is >> still alive. (Note that if the target process subse‐ >> quently terminates, its PID won't be reused because there >> remains an open reference to the /proc[pid]/mem file; in >> this case, a subsequent read(2) from the file will return >> 0, indicating end of file.) >> >> On success (i.e., the notification ID is still valid), >> this operation returns 0 On failure (i.e., the notifica‐ > ^ need a period? > >> ┌─────────────────────────────────────────────────────┐ >> │FIXME │ >> ├─────────────────────────────────────────────────────┤ >> │Interestingly, after the event had been received, │ >> │the file descriptor indicates as writable (verified │ >> │from the source code and by experiment). How is this │ >> │useful? │ > > You're saying it should just do EPOLLOUT and not EPOLLWRNORM? Seems > reasonable. No, I'm saying something more fundamental: why is the FD indicating as writable? Can you write something to it? If yes, what? If not, then why do these APIs want to say that the FD is writable? >> EXAMPLES >> The (somewhat contrived) program shown below demonstrates the use > > May also be worth mentioning the example in > samples/seccomp/user-trap.c as well. Oh -- I meant to do that! Thanks for the reminding me. Thanks, Michael -- Michael Kerrisk Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/ Linux/UNIX System Programming Training: http://man7.org/training/ From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.0 required=3.0 tests=BAYES_00,DKIM_ADSP_CUSTOM_MED, DKIM_INVALID,DKIM_SIGNED,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,NICE_REPLY_A,SPF_HELO_NONE, SPF_PASS,URIBL_BLOCKED,USER_AGENT_SANE_1 autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8DD0DC4727C for ; Wed, 30 Sep 2020 20:35:06 +0000 (UTC) Received: from silver.osuosl.org (smtp3.osuosl.org [140.211.166.136]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 0BB212074B for ; Wed, 30 Sep 2020 20:35:05 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="b4EbsNm9" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 0BB212074B Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=containers-bounces@lists.linux-foundation.org Received: from localhost (localhost [127.0.0.1]) by silver.osuosl.org (Postfix) with ESMTP id 6C913204D8; Wed, 30 Sep 2020 20:35:05 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from silver.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HBxHuCWPau7n; Wed, 30 Sep 2020 20:34:58 +0000 (UTC) Received: from lists.linuxfoundation.org (lf-lists.osuosl.org [140.211.9.56]) by silver.osuosl.org (Postfix) with ESMTP id 8BB4F20113; Wed, 30 Sep 2020 20:34:58 +0000 (UTC) Received: from lf-lists.osuosl.org (localhost [127.0.0.1]) by lists.linuxfoundation.org (Postfix) with ESMTP id 6D332C016F; Wed, 30 Sep 2020 20:34:58 +0000 (UTC) Received: from hemlock.osuosl.org (smtp2.osuosl.org [140.211.166.133]) by lists.linuxfoundation.org (Postfix) with ESMTP id 86C47C0051 for ; Wed, 30 Sep 2020 20:34:57 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by hemlock.osuosl.org (Postfix) with ESMTP id 6BEB0871A1 for ; Wed, 30 Sep 2020 20:34:57 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from hemlock.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9Lc+wMIVeRaf for ; Wed, 30 Sep 2020 20:34:56 +0000 (UTC) X-Greylist: domain auto-whitelisted by SQLgrey-1.7.6 Received: from mail-wr1-f68.google.com (mail-wr1-f68.google.com [209.85.221.68]) by hemlock.osuosl.org (Postfix) with ESMTPS id 1E2488704B for ; Wed, 30 Sep 2020 20:34:56 +0000 (UTC) Received: by mail-wr1-f68.google.com with SMTP id k15so3211721wrn.10 for ; Wed, 30 Sep 2020 13:34:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=cc:subject:to:references:from:message-id:date:user-agent :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=IspiLrnT2imZY/Ib+JxzPK1rgkTFQ0uem4Utb6KnzxY=; b=b4EbsNm9L32a8sJpoFaT4hyWH+ptKyoaxgjye0AYiOlxBeFrPKNJgYR+UakNy2STga yX9kSFsWwTymYX4CZrw2rug3yhHP+zATsXh+ObeaDw2GqxuIWfH5i9unDwq2sP/eV9GG mFlLS9h8p/vBExDznmT3C3D/MFbTlhF43vcyU64J8Prg+WnylxB64USH0ZW4pPdtAJZj XnAXqN9tamWT92flreZMHVpUBUO0RV1QOJ6slsXRzHpZcv18mLma5Lt7h1V1g1uQNnJl N2CYCPRa4pujcs/uvk7T7/wRD/rqvsKNS4ijTrQ+Rfrjph957/qgQ+t/aX58IKUnl+iV NFCA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:cc:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=IspiLrnT2imZY/Ib+JxzPK1rgkTFQ0uem4Utb6KnzxY=; b=Ez3BwDsM2IT0S8MZ8/PtMzi6/mOmdjEEN77hUKNFzzwzbbbz4M7T7u2DKsqQPzdUpc 5jfEMGUcKW+65mBAI/tAMCkzOIv7228dLzMgzF0w5at6qLuGdo0GQX0xknEGHXhGoDzX wKBcfJEmZItxS6fwW6+CcsCgD+Czcv9SlCdIekwv3S4S4ljYem1FAfJC3yUiFFlktSdS sO5Q98LoGkoihQShEZh2ZPdMrQBo1KTB+Q5Da2mUMrXwWW98fZuGv9016s+EcTk2TtgN QW7mAQrUUxZ3Ik5rKDTF/4goZRroTPW3j4sWLXrRlGXnoJ3VD20qkFJXNCj0DEZoxuVu jaLQ== X-Gm-Message-State: AOAM531xdjtLJMpqdVc1iZ4tYe5YnNoM31LWnrvoiYEfXJN9CVK0PbfF zms0FtY9dwZmluh1gmlWBq4= X-Google-Smtp-Source: ABdhPJxu7WCzwNxAHegKNtrhoSoK3B3wGOn21tufT7z08EpALYEeln9Ii4oycORRXrlIkIl2co1tog== X-Received: by 2002:a5d:570b:: with SMTP id a11mr5099611wrv.139.1601498094353; Wed, 30 Sep 2020 13:34:54 -0700 (PDT) Received: from ?IPv6:2001:a61:2479:6801:d8fe:4132:9f23:7e8f? ([2001:a61:2479:6801:d8fe:4132:9f23:7e8f]) by smtp.gmail.com with ESMTPSA id d83sm4993890wmf.23.2020.09.30.13.34.52 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Wed, 30 Sep 2020 13:34:53 -0700 (PDT) Subject: Re: For review: seccomp_user_notif(2) manual page To: Tycho Andersen References: <45f07f17-18b6-d187-0914-6f341fe90857@gmail.com> <20200930150330.GC284424@cisco> From: "Michael Kerrisk (man-pages)" Message-ID: <8bcd956f-58d2-d2f0-ca7c-0a30f3fcd5b8@gmail.com> Date: Wed, 30 Sep 2020 22:34:51 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 MIME-Version: 1.0 In-Reply-To: <20200930150330.GC284424@cisco> Content-Language: en-US Cc: linux-man , Song Liu , wad@chromium.org, Kees Cook , Daniel Borkmann , Jann Horn , Robert Sesek , Linux Containers , lkml , Alexei Starovoitov , mtk.manpages@gmail.com, Giuseppe Scrivano , bpf@vger.kernel.org, Andy Lutomirski , Christian Brauner X-BeenThere: containers@lists.linux-foundation.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Linux Containers List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Errors-To: containers-bounces@lists.linux-foundation.org Sender: "Containers" SGkgVHljaG8sCgpUaGFua3MgZm9yIHRha2luZyB0aW1lIHRvIGxvb2sgYXQgdGhlIHBhZ2UhCgpP biA5LzMwLzIwIDU6MDMgUE0sIFR5Y2hvIEFuZGVyc2VuIHdyb3RlOgo+IE9uIFdlZCwgU2VwIDMw LCAyMDIwIGF0IDAxOjA3OjM4UE0gKzAyMDAsIE1pY2hhZWwgS2VycmlzayAobWFuLXBhZ2VzKSB3 cm90ZToKPj4gICAgICAgIDIuIEluIG9yZGVyIHRoYXQgdGhlIHN1cGVydmlzb3IgcHJvY2VzcyBj YW4gb2J0YWluICBub3RpZmljYXRpb25zCj4+ICAgICAgICAgICB1c2luZyAgdGhlICBsaXN0ZW5p bmcgIGZpbGUgIGRlc2NyaXB0b3IsIChhIGR1cGxpY2F0ZSBvZikgdGhhdAo+PiAgICAgICAgICAg ZmlsZSBkZXNjcmlwdG9yIG11c3QgYmUgcGFzc2VkIGZyb20gdGhlIHRhcmdldCBwcm9jZXNzIHRv ICB0aGUKPj4gICAgICAgICAgIHN1cGVydmlzb3IgcHJvY2Vzcy4gIE9uZSB3YXkgaW4gd2hpY2gg dGhpcyBjb3VsZCBiZSBkb25lIGlzIGJ5Cj4+ICAgICAgICAgICBwYXNzaW5nIHRoZSBmaWxlIGRl c2NyaXB0b3Igb3ZlciBhIFVOSVggZG9tYWluIHNvY2tldCAgY29ubmVj4oCQCj4+ICAgICAgICAg ICB0aW9uIGJldHdlZW4gdGhlIHR3byBwcm9jZXNzZXMgKHVzaW5nIHRoZSBTQ01fUklHSFRTIGFu Y2lsbGFyeQo+PiAgICAgICAgICAgbWVzc2FnZSB0eXBlIGRlc2NyaWJlZCBpbiB1bml4KDcpKS4g ICBBbm90aGVyICBwb3NzaWJpbGl0eSAgaXMKPj4gICAgICAgICAgIHRoYXQgIHRoZSAgc3VwZXJ2 aXNvciAgbWlnaHQgIGluaGVyaXQgIHRoZSBmaWxlIGRlc2NyaXB0b3IgdmlhCj4+ICAgICAgICAg ICBmb3JrKDIpLgo+IAo+IEl0IGlzIHRlY2huaWNhbGx5IHBvc3NpYmxlIHRvIGluaGVyaXQgdGhl IGZkIHZpYSBmb3JrLCBidXQgaXMgaXQKPiByZWFsbHkgdGhhdCB1c2VmdWw/IFRoZSBjaGlsZCBw cm9jZXNzIHdvdWxkbid0IGJlIGFibGUgdG8gYWN0dWFsbHkgZG8KPiB0aGUgc3lzY2FsbCBpbiBx dWVzdGlvbiwgc2luY2UgaXQgd291bGQgaGF2ZSB0aGUgc2FtZSBmaWx0ZXIuCgpEJ29oISBZZXMs IG9mIGNvdXJzZS4KCkkgdGhpbmsgSSB3YXMgcmVhY2hpbmcgYmVjYXVzZSBpbiBhbiBlYXJsaWVy IGNvbnZlcnNhdGlvbgp5b3UgcmVwbGllZDoKCltbCj4gMy4gVGhlICJ0YXJnZXQgcHJvY2VzcyIg cGFzc2VzIHRoZSAibGlzdGVuaW5nIGZpbGUgZGVzY3JpcHRvciIKPiAgICB0byB0aGUgIm1vbml0 b3JpbmcgcHJvY2VzcyIgdmlhIHRoZSBVTklYIGRvbWFpbiBzb2NrZXQuCgpvciBzb21lIG90aGVy IG1lYW5zLCBpdCBkb2Vzbid0IGhhdmUgdG8gYmUgd2l0aCBTQ01fUklHSFRTLgpdXQoKU28sIHdo YXQgb3RoZXIgbWVhbnM/CgpBbnl3YXksIEkgcmVtb3ZlZCB0aGUgc2VudGVuY2UgbWVudGlvbmlu ZyBmb3JrKCkuCgo+PiAgICAgICAgICAgVGhlICBpbmZvcm1hdGlvbiAgaW4gIHRoZSBub3RpZmlj YXRpb24gY2FuIGJlIHVzZWQgdG8gZGlzY292ZXIKPj4gICAgICAgICAgIHRoZSB2YWx1ZXMgb2Yg cG9pbnRlciBhcmd1bWVudHMgZm9yIHRoZSB0YXJnZXQgcHJvY2VzcydzICBzeXPigJAKPj4gICAg ICAgICAgIHRlbSBjYWxsLiAgKFRoaXMgaXMgc29tZXRoaW5nIHRoYXQgY2FuJ3QgYmUgZG9uZSBm cm9tIHdpdGhpbiBhCj4+ICAgICAgICAgICBzZWNjb21wIGZpbHRlci4pICBUbyBkbyB0aGlzIChh bmQgIGFzc3VtaW5nICBpdCAgaGFzICBzdWl0YWJsZQo+IAo+IHMvVG8gZG8gdGhpcy9PbmUgd2F5 IHRvIGFjY29tcGxpc2ggdGhpcy8gcGVyaGFwcywgc2luY2UgdGhlcmUgYXJlCj4gb3RoZXJzLgoK WWVzLCB0aGFua3MsIGRvbmUuCgo+PiAgICAgICAgICAgcGVybWlzc2lvbnMpLCAgIHRoZSAgIHN1 cGVydmlzb3IgICBvcGVucyAgIHRoZSAgIGNvcnJlc3BvbmRpbmcKPj4gICAgICAgICAgIC9wcm9j L1twaWRdL21lbSBmaWxlLCBzZWVrcyB0byB0aGUgbWVtb3J5IGxvY2F0aW9uIHRoYXQgY29ycmXi gJAKPj4gICAgICAgICAgIHNwb25kcyB0byBvbmUgb2YgdGhlIHBvaW50ZXIgYXJndW1lbnRzIHdo b3NlIHZhbHVlIGlzIHN1cHBsaWVkCj4+ICAgICAgICAgICBpbiB0aGUgbm90aWZpY2F0aW9uIGV2 ZW50LCBhbmQgcmVhZHMgYnl0ZXMgZnJvbSB0aGF0IGxvY2F0aW9uLgo+PiAgICAgICAgICAgKFRo ZSBzdXBlcnZpc29yIG11c3QgYmUgY2FyZWZ1bCB0byBhdm9pZCBhIHJhY2UgY29uZGl0aW9uIHRo YXQKPj4gICAgICAgICAgIGNhbiBvY2N1ciB3aGVuIGRvaW5nIHRoaXM7IHNlZSB0aGUgIGRlc2Ny aXB0aW9uICBvZiAgdGhlICBTRUPigJAKPj4gICAgICAgICAgIENPTVBfSU9DVExfTk9USUZfSURf VkFMSUQgaW9jdGwoMikgb3BlcmF0aW9uIGJlbG93LikgIEluIGFkZGnigJAKPj4gICAgICAgICAg IHRpb24sIHRoZSBzdXBlcnZpc29yIGNhbiBhY2Nlc3Mgb3RoZXIgc3lzdGVtIGluZm9ybWF0aW9u ICB0aGF0Cj4+ICAgICAgICAgICBpcyAgdmlzaWJsZSAgaW4gIHVzZXIgc3BhY2UgYnV0IHdoaWNo IGlzIG5vdCBhY2Nlc3NpYmxlIGZyb20gYQo+PiAgICAgICAgICAgc2VjY29tcCBmaWx0ZXIuCj4+ Cj4+ICAgICAgICAgICDilIzilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDi lIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDi lIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDi lIDilIDilJAKPj4gICAgICAgICAgIOKUgkZJWE1FICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAg4pSCCj4+ICAgICAgICAgICDilJzilIDilIDilIDilIDilIDi lIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDi lIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDi lIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilKQKPj4gICAgICAgICAgIOKUglN1cHBvc2Ug d2UgYXJlIHJlYWRpbmcgYSBwYXRobmFtZSBmcm9tIC9wcm9jL1BJRC9tZW0g4pSCCj4+ICAgICAg ICAgICDilIJmb3IgIGEgc3lzdGVtIGNhbGwgc3VjaCBhcyBta2RpcigpLiBUaGUgcGF0aG5hbWUg Y2FuIOKUggo+PiAgICAgICAgICAg4pSCYmUgYW4gYXJiaXRyYXJ5IGxlbmd0aC4gSG93IGRvIHdl IGtub3cgaG93IG11Y2ggKGhvdyDilIIKPj4gICAgICAgICAgIOKUgm1hbnkgcGFnZXMpIHRvIHJl YWQgZnJvbSAvcHJvYy9QSUQvbWVtPyAgICAgICAgICAgICAg4pSCCj4+ICAgICAgICAgICDilJTi lIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDi lIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDi lIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilJgKPiAKPiBQQVRI X01BWCwgSSBzdXBwb3NlLgoKWWVzLCBJIG1pc3VuZGVyc3Rvb2QgYSBmdW5kYW1lbnRhbCBkZXRh aWwgaGVyZSwgYXMgSmFubiAKYWxzbyBjb25maXJtZWQuCgo+PiAgICAgICAg4pSM4pSA4pSA4pSA 4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA 4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA 4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSQCj4+ICAgICAgICDilIJGSVhN RSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIOKUggo+PiAg ICAgICAg4pSc4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA 4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA 4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSk Cj4+ICAgICAgICDilIJGcm9tIG15IGV4cGVyaW1lbnRzLCAgaXQgIGFwcGVhcnMgIHRoYXQgIGlm ICBhICBTRUPigJAg4pSCCj4+ICAgICAgICDilIJDT01QX0lPQ1RMX05PVElGX1JFQ1YgICBpcyAg ZG9uZSAgYWZ0ZXIgIHRoZSAgdGFyZ2V0IOKUggo+PiAgICAgICAg4pSCcHJvY2VzcyB0ZXJtaW5h dGVzLCB0aGVuIHRoZSBpb2N0bCgpICBzaW1wbHkgIGJsb2NrcyDilIIKPj4gICAgICAgIOKUgihy YXRoZXIgdGhhbiByZXR1cm5pbmcgYW4gZXJyb3IgdG8gaW5kaWNhdGUgdGhhdCB0aGUg4pSCCj4+ ICAgICAgICDilIJ0YXJnZXQgcHJvY2VzcyBubyBsb25nZXIgZXhpc3RzKS4gICAgICAgICAgICAg ICAgICAgIOKUggo+IAo+IFllYWgsIEkgdGhpbmsgQ2hyaXN0aWFuIHdhbnRlZCB0byBmaXggdGhp cyBhdCBzb21lIHBvaW50LAoKRG8geW91IGhhdmUgYSBwb2ludGVyIHRoYXQgZGlzY3Vzc2lvbj8g SSBjb3VsZCBub3QgZmluZCBpdCB3aXRoIGEgCnF1aWNrIHNlYXJjaC4KCj4gYnV0IGl0J3MgYQo+ IGJpdCBzdGlja3kgdG8gZG8uCgpDYW4geW91IHNheSBhIGZldyB3b3JkcyBhYm91dCB0aGUgbmF0 dXJlIG9mIHRoZSBwcm9ibGVtPwoKSW4gdGhlIG1lYW50aW1lLiBJIHRoaW5rIHRoaXMgbWVyaXRz IGEgbm90ZSB1bmRlciBCVUdTLCBhbmQKSSd2ZSBhZGRlZCBvbmUuCgo+IE5vdGUgdGhhdCBpZiB5 b3UgZS5nLiByZWx5IG9uIGZvcmsoKSBhYm92ZSwgdGhlCj4gZmlsdGVyIGlzIHNoYXJlZCB3aXRo IHlvdXIgY3VycmVudCBwcm9jZXNzLCBhbmQgdGhpcyBub3RpZmljYXRpb24KPiB3b3VsZCBuZXZl ciBiZSBwb3NzaWJsZS4gUGVyaGFwcyBhbm90aGVyIHJlYXNvbiB0byBvbWl0IHRoYXQgZnJvbSB0 aGUKPiBtYW4gcGFnZS4KCihZZXMsIGFzIG5vdGVkIGFib3ZlLCBJIHJlbW92ZWQgdGhhdCBzZW50 ZW5jZS4pCgo+PiAgICAgICAgU0VDQ09NUF9JT0NUTF9OT1RJRl9JRF9WQUxJRAo+PiAgICAgICAg ICAgICAgIFRoaXMgb3BlcmF0aW9uIGNhbiBiZSB1c2VkIHRvIGNoZWNrIHRoYXQgYSBub3RpZmlj YXRpb24gSUQKPj4gICAgICAgICAgICAgICByZXR1cm5lZCBieSBhbiBlYXJsaWVyIFNFQ0NPTVBf SU9DVExfTk9USUZfUkVDViAgb3BlcmF0aW9uCj4+ICAgICAgICAgICAgICAgaXMgIHN0aWxsICB2 YWxpZCAgKGkuZS4sICB0aGF0ICB0aGUgIHRhcmdldCAgcHJvY2VzcyBzdGlsbAo+PiAgICAgICAg ICAgICAgIGV4aXN0cykuCj4+Cj4+ICAgICAgICAgICAgICAgVGhlIHRoaXJkIGlvY3RsKDIpIGFy Z3VtZW50IGlzIGEgIHBvaW50ZXIgIHRvICB0aGUgIGNvb2tpZQo+PiAgICAgICAgICAgICAgIChp ZCkgcmV0dXJuZWQgYnkgdGhlIFNFQ0NPTVBfSU9DVExfTk9USUZfUkVDViBvcGVyYXRpb24uCj4+ Cj4+ICAgICAgICAgICAgICAgVGhpcyAgb3BlcmF0aW9uIGlzIG5lY2Vzc2FyeSB0byBhdm9pZCBy YWNlIGNvbmRpdGlvbnMgdGhhdAo+PiAgICAgICAgICAgICAgIGNhbiAgb2NjdXIgICB3aGVuICAg dGhlICAgcGlkICAgcmV0dXJuZWQgICBieSAgIHRoZSAgIFNFQ+KAkAo+PiAgICAgICAgICAgICAg IENPTVBfSU9DVExfTk9USUZfUkVDViAgIG9wZXJhdGlvbiAgIHRlcm1pbmF0ZXMsICBhbmQgIHRo YXQKPj4gICAgICAgICAgICAgICBwcm9jZXNzIElEIGlzIHJldXNlZCBieSBhbm90aGVyIHByb2Nl c3MuICAgQW4gIGV4YW1wbGUgIG9mCj4+ICAgICAgICAgICAgICAgdGhpcyBraW5kIG9mIHJhY2Ug aXMgdGhlIGZvbGxvd2luZwo+Pgo+PiAgICAgICAgICAgICAgIDEuIEEgIG5vdGlmaWNhdGlvbiAg aXMgIGdlbmVyYXRlZCAgb24gIHRoZSAgbGlzdGVuaW5nIGZpbGUKPj4gICAgICAgICAgICAgICAg ICBkZXNjcmlwdG9yLiAgVGhlIHJldHVybmVkICBzZWNjb21wX25vdGlmICBjb250YWlucyAgdGhl Cj4+ICAgICAgICAgICAgICAgICAgUElEIG9mIHRoZSB0YXJnZXQgcHJvY2Vzcy4KPj4KPj4gICAg ICAgICAgICAgICAyLiBUaGUgdGFyZ2V0IHByb2Nlc3MgdGVybWluYXRlcy4KPj4KPj4gICAgICAg ICAgICAgICAzLiBBbm90aGVyIHByb2Nlc3MgaXMgY3JlYXRlZCBvbiB0aGUgc3lzdGVtIHRoYXQg YnkgY2hhbmNlCj4+ICAgICAgICAgICAgICAgICAgcmV1c2VzIHRoZSBQSUQgdGhhdCB3YXMgZnJl ZWQgd2hlbiB0aGUgIHRhcmdldCAgcHJvY2Vzcwo+PiAgICAgICAgICAgICAgICAgIHRlcm1pbmF0 ZXMuCj4+Cj4+ICAgICAgICAgICAgICAgNC4gVGhlICBzdXBlcnZpc29yICBvcGVuKDIpcyAgdGhl IC9wcm9jL1twaWRdL21lbSBmaWxlIGZvcgo+PiAgICAgICAgICAgICAgICAgIHRoZSBQSUQgb2J0 YWluZWQgaW4gc3RlcCAxLCB3aXRoIHRoZSBpbnRlbnRpb24gb2YgKHNheSkKPj4gICAgICAgICAg ICAgICAgICBpbnNwZWN0aW5nIHRoZSBtZW1vcnkgbG9jYXRpb25zIHRoYXQgY29udGFpbnMgdGhl IGFyZ3XigJAKPj4gICAgICAgICAgICAgICAgICBtZW50cyBvZiB0aGUgc3lzdGVtIGNhbGwgdGhh dCB0cmlnZ2VyZWQgIHRoZSAgbm90aWZpY2HigJAKPj4gICAgICAgICAgICAgICAgICB0aW9uIGlu IHN0ZXAgMS4KPj4KPj4gICAgICAgICAgICAgICBJbiB0aGUgYWJvdmUgc2NlbmFyaW8sIHRoZSBy aXNrIGlzIHRoYXQgdGhlIHN1cGVydmlzb3IgbWF5Cj4+ICAgICAgICAgICAgICAgdHJ5IHRvIGFj Y2VzcyB0aGUgbWVtb3J5IG9mIGEgcHJvY2VzcyBvdGhlciB0aGFuIHRoZSAgdGFy4oCQCj4+ICAg ICAgICAgICAgICAgZ2V0LiAgIFRoaXMgIHJhY2UgIGNhbiBiZSBhdm9pZGVkIGJ5IGZvbGxvd2lu ZyB0aGUgY2FsbCB0bwo+PiAgICAgICAgICAgICAgIG9wZW4gd2l0aCBhIFNFQ0NPTVBfSU9DVExf Tk9USUZfSURfVkFMSUQgb3BlcmF0aW9uIHRvIHZlcuKAkAo+PiAgICAgICAgICAgICAgIGlmeSAg dGhhdCAgdGhlICBwcm9jZXNzIHRoYXQgZ2VuZXJhdGVkIHRoZSBub3RpZmljYXRpb24gaXMKPj4g ICAgICAgICAgICAgICBzdGlsbCBhbGl2ZS4gIChOb3RlIHRoYXQgIGlmICB0aGUgIHRhcmdldCAg cHJvY2VzcyAgc3Vic2XigJAKPj4gICAgICAgICAgICAgICBxdWVudGx5ICB0ZXJtaW5hdGVzLCBp dHMgUElEIHdvbid0IGJlIHJldXNlZCBiZWNhdXNlIHRoZXJlCj4+ICAgICAgICAgICAgICAgcmVt YWlucyBhbiBvcGVuIHJlZmVyZW5jZSB0byB0aGUgL3Byb2NbcGlkXS9tZW0gIGZpbGU7ICBpbgo+ PiAgICAgICAgICAgICAgIHRoaXMgIGNhc2UsIGEgc3Vic2VxdWVudCByZWFkKDIpIGZyb20gdGhl IGZpbGUgd2lsbCByZXR1cm4KPj4gICAgICAgICAgICAgICAwLCBpbmRpY2F0aW5nIGVuZCBvZiBm aWxlLikKPj4KPj4gICAgICAgICAgICAgICBPbiBzdWNjZXNzIChpLmUuLCB0aGUgbm90aWZpY2F0 aW9uICBJRCAgaXMgIHN0aWxsICB2YWxpZCksCj4+ICAgICAgICAgICAgICAgdGhpcyAgb3BlcmF0 aW9uICByZXR1cm5zIDAgT24gZmFpbHVyZSAoaS5lLiwgdGhlIG5vdGlmaWNh4oCQCj4gICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgXiBuZWVkIGEgcGVyaW9kPwo+IAo+ PiAgICAgICAg4pSM4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA 4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA 4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA 4pSQCj4+ICAgICAgICDilIJGSVhNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIOKUggo+PiAgICAgICAg4pSc4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA 4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA 4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA 4pSA4pSA4pSA4pSA4pSA4pSA4pSkCj4+ICAgICAgICDilIJJbnRlcmVzdGluZ2x5LCBhZnRlciB0 aGUgZXZlbnQgIGhhZCAgYmVlbiAgcmVjZWl2ZWQsIOKUggo+PiAgICAgICAg4pSCdGhlICBmaWxl IGRlc2NyaXB0b3IgaW5kaWNhdGVzIGFzIHdyaXRhYmxlICh2ZXJpZmllZCDilIIKPj4gICAgICAg IOKUgmZyb20gdGhlIHNvdXJjZSBjb2RlIGFuZCBieSBleHBlcmltZW50KS4gSG93IGlzIHRoaXMg 4pSCCj4+ICAgICAgICDilIJ1c2VmdWw/ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIOKUggo+IAo+IFlvdSdyZSBzYXlpbmcgaXQgc2hvdWxkIGp1c3QgZG8gRVBP TExPVVQgYW5kIG5vdCBFUE9MTFdSTk9STT8gU2VlbXMKPiByZWFzb25hYmxlLgoKTm8sIEknbSBz YXlpbmcgc29tZXRoaW5nIG1vcmUgZnVuZGFtZW50YWw6IHdoeSBpcyB0aGUgRkQgaW5kaWNhdGlu ZyBhcwp3cml0YWJsZT8gQ2FuIHlvdSB3cml0ZSBzb21ldGhpbmcgdG8gaXQ/IElmIHllcywgd2hh dD8gSWYgbm90LCB0aGVuCndoeSBkbyB0aGVzZSBBUElzIHdhbnQgdG8gc2F5IHRoYXQgdGhlIEZE IGlzIHdyaXRhYmxlPwoKPj4gRVhBTVBMRVMKPj4gICAgICAgIFRoZSAoc29tZXdoYXQgY29udHJp dmVkKSBwcm9ncmFtIHNob3duIGJlbG93IGRlbW9uc3RyYXRlcyB0aGUgdXNlCj4gCj4gTWF5IGFs c28gYmUgd29ydGggbWVudGlvbmluZyB0aGUgZXhhbXBsZSBpbgo+IHNhbXBsZXMvc2VjY29tcC91 c2VyLXRyYXAuYyBhcyB3ZWxsLgoKT2ggLS0gSSBtZWFudCB0byBkbyB0aGF0ISBUaGFua3MgZm9y IHRoZSByZW1pbmRpbmcgbWUuCgpUaGFua3MsCgpNaWNoYWVsCgoKLS0gCk1pY2hhZWwgS2Vycmlz awpMaW51eCBtYW4tcGFnZXMgbWFpbnRhaW5lcjsgaHR0cDovL3d3dy5rZXJuZWwub3JnL2RvYy9t YW4tcGFnZXMvCkxpbnV4L1VOSVggU3lzdGVtIFByb2dyYW1taW5nIFRyYWluaW5nOiBodHRwOi8v bWFuNy5vcmcvdHJhaW5pbmcvCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fCkNvbnRhaW5lcnMgbWFpbGluZyBsaXN0CkNvbnRhaW5lcnNAbGlzdHMubGludXgt Zm91bmRhdGlvbi5vcmcKaHR0cHM6Ly9saXN0cy5saW51eGZvdW5kYXRpb24ub3JnL21haWxtYW4v bGlzdGluZm8vY29udGFpbmVycw==