172182 2017-05-16 12:12:17 -0700 [WK2][iOS] Adopt a whitelist for XPC services 2017-05-23 08:57:09 -0700 1 1 1 Unclassified WebKit WebKit2 WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED https://bugs.webkit.org/show_bug.cgi?id=172151 InRadar P2 Normal --- 172462 1 bfulgham bfulgham achristensen andersca bfulgham ggaren sam oldest_to_newest 1309239 0 bfulgham 2017-05-16 12:12:17 -0700 Lock down the sandbox further by denying XPC services access by default, and only permitting connections to things we need to access. 1309240 1 bfulgham 2017-05-16 12:12:28 -0700 <rdar://problem/30669445> 1310184 2 310526 bfulgham 2017-05-18 12:02:30 -0700 Created attachment 310526 Patch 1310191 3 310528 bfulgham 2017-05-18 12:11:34 -0700 Created attachment 310528 Patch 1310192 4 310528 ggaren 2017-05-18 12:21:31 -0700 Comment on attachment 310528 Patch How did we come up with the list of needed services? Might there be services used on unlikely paths that need whitelisting? 1310199 5 bfulgham 2017-05-18 12:32:10 -0700 (In reply to Geoffrey Garen from comment #4) > Comment on attachment 310528 [details] > Patch > > How did we come up with the list of needed services? Might there be services > used on unlikely paths that need whitelisting? These are based on discussion with the Sandboxing team and the global sandboxes they set up for 3rd-party applications. I did local testing with a handful of iOS units of varying screen size and features, but it was not exhaustive. I'd like to get this in a build so that we could get larger QC on it in case we need to add anything else. 1310355 6 310528 sam 2017-05-18 17:20:55 -0700 Comment on attachment 310528 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=310528&action=review > Source/WebKit2/ChangeLog:13 > + > + * Resources/SandboxProfiles/ios/com.apple.WebKit.Databases.sb: > + * Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb: > + * Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb: This could be more fleshed out. > Source/WebKit2/Resources/SandboxProfiles/ios/com.apple.WebKit.Databases.sb:48 > +;; Various services required by system frameworks > +(allow mach-lookup > + (global-name "com.apple.analyticsd") > + (global-name "com.apple.lsd.mapdb")) Are these related to the XPC deny change? > Source/WebKit2/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:70 > > +(deny iokit-get-properties) > +(allow iokit-get-properties > + (iokit-property-prefix "AGXParameterBufferMaxSize") > + (iokit-property-regex #"^AppleJPEG") ; AppleJPEGDriver, EmbeddedCoreMedia > + (iokit-property "AppleTV") > + (iokit-property "BaseAddressAlignmentRequirement") > + (iokit-property "CFBundleIdentifier") > + (iokit-property "DisplayPipePlaneBaseAlignment") > + (iokit-property "DisplayPipeStrideRequirements") > + (iokit-property "ForceSupported") > + (iokit-property-regex "^IOGL(|ES)(|Metal)BundleName") > + (iokit-property-regex #"^InternalStatistics(|Accm)") > + (iokit-property-regex #"^MetalPlugin(Name|ClassName)") > + (iokit-property-regex #"^PerformanceStatistics(|Accum)") > + (iokit-property "Protocol Characteristics") > + (iokit-property "Size") > + (iokit-property "compass-calibration") > + (iokit-property "display-rotation") > + (iokit-property "display-scale"") > + (iokit-property "graphic-options") > + (iokit-property "gyro-interrupt-calibration") > + (iokit-property "hdcp-hoover-protocol") > + (iokit-property-regex #"^parser-(options|type)") > + (iokit-property "product-id") > + (iokit-property "software-behavior") These don't seem like XPC services. > Source/WebKit2/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:77 > + (xpc-service-name-regex #"\.viewservice$") What is this? It seems scarier than the other two. > Source/WebKit2/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:125 > + (global-name "com.apple.analyticsd") > (global-name "com.apple.accountsd.accountmanager") > - (global-name "com.apple.coremedia.audiodeviceclock")) > + (global-name "com.apple.coremedia.audiodeviceclock") > + (global-name "com.apple.lsd.mapdb") How do these relate to the XPC whitelist change? 1310782 7 310528 bfulgham 2017-05-19 14:50:51 -0700 Comment on attachment 310528 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=310528&action=review >> Source/WebKit2/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:70 >> + (iokit-property "software-behavior") > > These don't seem like XPC services. Yeah, I'll split these out into a separate patch. I was trying to get the iOS and macOS sandboxes in sync. >> Source/WebKit2/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:77 >> + (xpc-service-name-regex #"\.viewservice$") > > What is this? It seems scarier than the other two. Right now we don't block any of these things. The Sandboxing team gave me a list of things they are whitelisting in the global application sandboxes, which included these three items. The others were for things without any plausible relevance to WebContent process, so I didn't include them. These seemed like the might be used under some code paths, so I whitelisted them to avoid the chance of breaking something. >> Source/WebKit2/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:125 >> + (global-name "com.apple.lsd.mapdb") > > How do these relate to the XPC whitelist change? 'analyticsd' is needed in newer OS's to support some logging features. We should be whitelisting this, but I can do it as a separate patch. 'lsd.mapdb' should have been whitelisted a few releases ago, but was overlooked since no one was keeping an eye on things. Blocking it means we are making core services do extra work on iOS (prevents access to a cache) 1310911 8 sam 2017-05-19 18:14:08 -0700 (In reply to Brent Fulgham from comment #7) > Comment on attachment 310528 [details] > Patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=310528&action=review > > >> Source/WebKit2/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:70 > >> + (iokit-property "software-behavior") > > > > These don't seem like XPC services. > > Yeah, I'll split these out into a separate patch. I was trying to get the > iOS and macOS sandboxes in sync. Cool. > > >> Source/WebKit2/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:77 > >> + (xpc-service-name-regex #"\.viewservice$") > > > > What is this? It seems scarier than the other two. > > Right now we don't block any of these things. The Sandboxing team gave me a > list of things they are whitelisting in the global application sandboxes, > which included these three items. The others were for things without any > plausible relevance to WebContent process, so I didn't include them. > > These seemed like the might be used under some code paths, so I whitelisted > them to avoid the chance of breaking something. Yeah, but what is #"\.viewservice$ ? > > >> Source/WebKit2/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:125 > >> + (global-name "com.apple.lsd.mapdb") > > > > How do these relate to the XPC whitelist change? > > 'analyticsd' is needed in newer OS's to support some logging features. We > should be whitelisting this, but I can do it as a separate patch. Is it something we want a compromised WebProcess to have access to? > > 'lsd.mapdb' should have been whitelisted a few releases ago, but was > overlooked since no one was keeping an eye on things. Blocking it means we > are making core services do extra work on iOS (prevents access to a cache) Is this cache something we want a compromised WebProcess to have access to? Does it contain all the installed applications, for instance? 1311642 9 310945 bfulgham 2017-05-22 16:04:08 -0700 Created attachment 310945 Patch 1311738 10 310945 sam 2017-05-22 20:03:01 -0700 Comment on attachment 310945 Patch Still curious about those questions, but, this looks good. Ice cold, no XPC! 1311882 11 bfulgham 2017-05-23 08:57:09 -0700 Committed r217277: <http://trac.webkit.org/changeset/217277> 310526 2017-05-18 12:02:30 -0700 2017-05-18 12:11:33 -0700 Patch bug-172182-20170518120230.patch text/plain 5103 bfulgham SW5kZXg6IFNvdXJjZS9XZWJLaXQyL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi S2l0Mi9DaGFuZ2VMb2cJKHJldmlzaW9uIDIxNzA1NykKKysrIFNvdXJjZS9XZWJLaXQyL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE3IEBACisyMDE3LTA1LTE4ICBCcmVudCBG dWxnaGFtICA8YmZ1bGdoYW1AYXBwbGUuY29tPgorCisgICAgICAgIEFkb3B0IFdoaXRlbGlzdCBm b3IgbmVjZXNzYXJ5IFhQQyBzZXJ2aWNlcyBvbmx5CisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJr aXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xNzIxODIKKyAgICAgICAgPHJkYXI6Ly9wcm9ibGVtLzMw NjY5NDQ1PgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAg IFRoaXMgYnJpbmdzIHRoZSBpT1MgV2ViS2l0IHNhbmRib3hlcyBpbiBsaW5lIHdpdGggbWFjT1Mu CisKKyAgICAgICAgKiBSZXNvdXJjZXMvU2FuZGJveFByb2ZpbGVzL2lvcy9jb20uYXBwbGUuV2Vi S2l0LkRhdGFiYXNlcy5zYjoKKyAgICAgICAgKiBSZXNvdXJjZXMvU2FuZGJveFByb2ZpbGVzL2lv cy9jb20uYXBwbGUuV2ViS2l0Lk5ldHdvcmtpbmcuc2I6CisgICAgICAgICogUmVzb3VyY2VzL1Nh bmRib3hQcm9maWxlcy9pb3MvY29tLmFwcGxlLldlYktpdC5XZWJDb250ZW50LnNiOgorCiAyMDE3 LTA1LTE4ICBBbmR5IEVzdGVzICA8YWVzdGVzQGFwcGxlLmNvbT4KIAogICAgICAgICBBZGQgImNv dW50cnlDb2RlIiB0byBBcHBsZVBheUVycm9yQ29udGFjdEZpZWxkCkluZGV4OiBTb3VyY2UvV2Vi S2l0Mi9SZXNvdXJjZXMvU2FuZGJveFByb2ZpbGVzL2lvcy9jb20uYXBwbGUuV2ViS2l0LkRhdGFi YXNlcy5zYgo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2ViS2l0Mi9SZXNvdXJjZXMvU2FuZGJveFBy b2ZpbGVzL2lvcy9jb20uYXBwbGUuV2ViS2l0LkRhdGFiYXNlcy5zYgkocmV2aXNpb24gMjE1NDc0 KQorKysgU291cmNlL1dlYktpdDIvUmVzb3VyY2VzL1NhbmRib3hQcm9maWxlcy9pb3MvY29tLmFw cGxlLldlYktpdC5EYXRhYmFzZXMuc2IJKHdvcmtpbmcgY29weSkKQEAgLTM2LDQgKzM2LDEzIEBA CiAgICAgICAgICJody5hdmFpbGNwdSIKICAgICAgICAgImh3Lm5jcHUiCiAgICAgICAgICJody5t b2RlbCIKLSAgICAgICAgImtlcm4ubWVtb3J5c3RhdHVzX2xldmVsIikpCisgICAgICAgICJrZXJu Lm1lbW9yeXN0YXR1c19sZXZlbCIKKyAgICAgICAgInZtLmZvb3RwcmludF9zdXNwZW5kIikpCisK KyhkZW55IGlva2l0LWdldC1wcm9wZXJ0aWVzKQorKGRlbnkgbWFjaC1sb29rdXAgKHhwYy1zZXJ2 aWNlLW5hbWUtcHJlZml4ICIiKSkKKworOzsgVmFyaW91cyBzZXJ2aWNlcyByZXF1aXJlZCBieSBz eXN0ZW0gZnJhbWV3b3JrcworKGFsbG93IG1hY2gtbG9va3VwCisgICAgKGdsb2JhbC1uYW1lICJj b20uYXBwbGUuYW5hbHl0aWNzZCIpCisgICAgKGdsb2JhbC1uYW1lICJjb20uYXBwbGUubHNkLm1h cGRiIikpCkluZGV4OiBTb3VyY2UvV2ViS2l0Mi9SZXNvdXJjZXMvU2FuZGJveFByb2ZpbGVzL2lv cy9jb20uYXBwbGUuV2ViS2l0Lk5ldHdvcmtpbmcuc2IKPT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL1dl YktpdDIvUmVzb3VyY2VzL1NhbmRib3hQcm9maWxlcy9pb3MvY29tLmFwcGxlLldlYktpdC5OZXR3 b3JraW5nLnNiCShyZXZpc2lvbiAyMTcwNTMpCisrKyBTb3VyY2UvV2ViS2l0Mi9SZXNvdXJjZXMv U2FuZGJveFByb2ZpbGVzL2lvcy9jb20uYXBwbGUuV2ViS2l0Lk5ldHdvcmtpbmcuc2IJKHdvcmtp bmcgY29weSkKQEAgLTM3LDYgKzM3LDkgQEAKICAgICAgICAgImtlcm4ubWVtb3J5c3RhdHVzX2xl dmVsIgogICAgICAgICAidm0uZm9vdHByaW50X3N1c3BlbmQiKSkKIAorKGRlbnkgaW9raXQtZ2V0 LXByb3BlcnRpZXMpCisoZGVueSBtYWNoLWxvb2t1cCAoeHBjLXNlcnZpY2UtbmFtZS1wcmVmaXgg IiIpKQorCiA7OyBBY2Nlc3MgdG8gY2xpZW50J3MgY2FjaGUgZm9sZGVyICYgcmUtdmVuZGluZyB0 byBDRk5ldHdvcmsuCiA7OyBGSVhNRTogUmVtb3ZlIHRoZSB3ZWJraXQgc3BlY2lmaWMgZXh0ZW5z aW9uIGNsYXNzZXMgPHJkYXI6Ly9wcm9ibGVtLzE3NzU1OTMxPgogKGFsbG93IGZpbGUtaXNzdWUt ZXh0ZW5zaW9uIChyZXF1aXJlLWFsbApAQCAtNjcsNiArNzAsOCBAQAogCiA7OyBTZWN1cml0eSBm cmFtZXdvcmsKIChhbGxvdyBtYWNoLWxvb2t1cAorICAgIChnbG9iYWwtbmFtZSAiY29tLmFwcGxl LmFuYWx5dGljc2QiKQorICAgIChnbG9iYWwtbmFtZSAiY29tLmFwcGxlLmxzZC5tYXBkYiIpCiAg ICAgKGdsb2JhbC1uYW1lICJjb20uYXBwbGUub2NzcGQiKQogICAgIChnbG9iYWwtbmFtZSAiY29t LmFwcGxlLnNlY3VyaXR5ZCIpCiAgICAgKGdsb2JhbC1uYW1lICJjb20uYXBwbGUuYWNjb3VudHNk LmFjY291bnRtYW5hZ2VyIikpCkluZGV4OiBTb3VyY2UvV2ViS2l0Mi9SZXNvdXJjZXMvU2FuZGJv eFByb2ZpbGVzL2lvcy9jb20uYXBwbGUuV2ViS2l0LldlYkNvbnRlbnQuc2IKPT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQot LS0gU291cmNlL1dlYktpdDIvUmVzb3VyY2VzL1NhbmRib3hQcm9maWxlcy9pb3MvY29tLmFwcGxl LldlYktpdC5XZWJDb250ZW50LnNiCShyZXZpc2lvbiAyMTcwNTMpCisrKyBTb3VyY2UvV2ViS2l0 Mi9SZXNvdXJjZXMvU2FuZGJveFByb2ZpbGVzL2lvcy9jb20uYXBwbGUuV2ViS2l0LldlYkNvbnRl bnQuc2IJKHdvcmtpbmcgY29weSkKQEAgLTQzLDYgKzQzLDQwIEBACiAgICAgICAgICJrZXJuLm1l bW9yeXN0YXR1c19sZXZlbCIKICAgICAgICAgInZtLmZvb3RwcmludF9zdXNwZW5kIikpCiAKKyhk ZW55IGlva2l0LWdldC1wcm9wZXJ0aWVzKQorKGFsbG93IGlva2l0LWdldC1wcm9wZXJ0aWVzCisg ICAgKGlva2l0LXByb3BlcnR5LXByZWZpeCAiQUdYUGFyYW1ldGVyQnVmZmVyTWF4U2l6ZSIpCisg ICAgKGlva2l0LXByb3BlcnR5LXJlZ2V4ICMiXkFwcGxlSlBFRyIpIDsgQXBwbGVKUEVHRHJpdmVy LCBFbWJlZGRlZENvcmVNZWRpYQorICAgIChpb2tpdC1wcm9wZXJ0eSAiQXBwbGVUViIpCisgICAg KGlva2l0LXByb3BlcnR5ICJCYXNlQWRkcmVzc0FsaWdubWVudFJlcXVpcmVtZW50IikKKyAgICAo aW9raXQtcHJvcGVydHkgIkNGQnVuZGxlSWRlbnRpZmllciIpCisgICAgKGlva2l0LXByb3BlcnR5 ICJEaXNwbGF5UGlwZVBsYW5lQmFzZUFsaWdubWVudCIpCisgICAgKGlva2l0LXByb3BlcnR5ICJE aXNwbGF5UGlwZVN0cmlkZVJlcXVpcmVtZW50cyIpCisgICAgKGlva2l0LXByb3BlcnR5ICJGb3Jj ZVN1cHBvcnRlZCIpCisgICAgKGlva2l0LXByb3BlcnR5LXJlZ2V4ICJeSU9HTCh8RVMpKHxNZXRh bClCdW5kbGVOYW1lIikKKyAgICAoaW9raXQtcHJvcGVydHktcmVnZXggIyJeSW50ZXJuYWxTdGF0 aXN0aWNzKHxBY2NtKSIpCisgICAgKGlva2l0LXByb3BlcnR5LXJlZ2V4ICMiXk1ldGFsUGx1Z2lu KE5hbWV8Q2xhc3NOYW1lKSIpCisgICAgKGlva2l0LXByb3BlcnR5LXJlZ2V4ICMiXlBlcmZvcm1h bmNlU3RhdGlzdGljcyh8QWNjdW0pIikKKyAgICAoaW9raXQtcHJvcGVydHkgIlByb3RvY29sIENo YXJhY3RlcmlzdGljcyIpCisgICAgKGlva2l0LXByb3BlcnR5ICJTaXplIikKKyAgICAoaW9raXQt cHJvcGVydHkgImNvbXBhc3MtY2FsaWJyYXRpb24iKQorICAgIChpb2tpdC1wcm9wZXJ0eSAiZGlz cGxheS1yb3RhdGlvbiIpCisgICAgKGlva2l0LXByb3BlcnR5ICJkaXNwbGF5LXNjYWxlIiIpCisg ICAgKGlva2l0LXByb3BlcnR5ICJncmFwaGljLW9wdGlvbnMiKQorICAgIChpb2tpdC1wcm9wZXJ0 eSAiZ3lyby1pbnRlcnJ1cHQtY2FsaWJyYXRpb24iKQorICAgIChpb2tpdC1wcm9wZXJ0eSAiaGRj cC1ob292ZXItcHJvdG9jb2wiKQorICAgIChpb2tpdC1wcm9wZXJ0eS1yZWdleCAjIl5wYXJzZXIt KG9wdGlvbnN8dHlwZSkiKQorICAgIChpb2tpdC1wcm9wZXJ0eSAicHJvZHVjdC1pZCIpCisgICAg KGlva2l0LXByb3BlcnR5ICJzb2Z0d2FyZS1iZWhhdmlvciIpCispCisKKyhkZW55IG1hY2gtbG9v a3VwICh4cGMtc2VydmljZS1uYW1lLXByZWZpeCAiIikpCisoYWxsb3cgbWFjaC1sb29rdXAKKyAg ICAoeHBjLXNlcnZpY2UtbmFtZSAiY29tLmFwcGxlLkFHWENvbXBpbGVyU2VydmljZSIpCisgICAg KHhwYy1zZXJ2aWNlLW5hbWUgImNvbS5hcHBsZS5hY2Nlc3NpYmlsaXR5LkFjY2Vzc2liaWxpdHlV SVNlcnZlciIpCisgICAgKHhwYy1zZXJ2aWNlLW5hbWUtcmVnZXggIyJcLnZpZXdzZXJ2aWNlJCIp CispCisKIDs7IFJlYWQtb25seSBwcmVmZXJlbmNlcyBhbmQgZGF0YQogKG1vYmlsZS1wcmVmZXJl bmNlcy1yZWFkCiAgICAgImNvbS5hcHBsZS5MYXVuY2hTZXJ2aWNlcyIKQEAgLTg1LDggKzExOSwx MSBAQAogOzsgVmFyaW91cyBzZXJ2aWNlcyByZXF1aXJlZCBieSBDRk5ldHdvcmsgYW5kIG90aGVy IGZyYW1ld29ya3MKIChhbGxvdyBtYWNoLWxvb2t1cAogICAgIChnbG9iYWwtbmFtZSAiY29tLmFw cGxlLlBvd2VyTWFuYWdlbWVudC5jb250cm9sIikKKyAgICAoZ2xvYmFsLW5hbWUgImNvbS5hcHBs ZS5hbmFseXRpY3NkIikKICAgICAoZ2xvYmFsLW5hbWUgImNvbS5hcHBsZS5hY2NvdW50c2QuYWNj b3VudG1hbmFnZXIiKQotICAgIChnbG9iYWwtbmFtZSAiY29tLmFwcGxlLmNvcmVtZWRpYS5hdWRp b2RldmljZWNsb2NrIikpCisgICAgKGdsb2JhbC1uYW1lICJjb20uYXBwbGUuY29yZW1lZGlhLmF1 ZGlvZGV2aWNlY2xvY2siKQorICAgIChnbG9iYWwtbmFtZSAiY29tLmFwcGxlLmxzZC5tYXBkYiIp CispCiAKIChkZW55IGZpbGUtd3JpdGUtY3JlYXRlICh2bm9kZS10eXBlIFNZTUxJTkspKQogKGRl bnkgZmlsZS1yZWFkLXhhdHRyIGZpbGUtd3JpdGUteGF0dHIgKHhhdHRyLXJlZ2V4ICMiXmNvbVwu YXBwbGVcLnNlY3VyaXR5XC5wcml2YXRlXC4iKSkK 310528 2017-05-18 12:11:34 -0700 2017-05-22 16:04:06 -0700 Patch bug-172182-20170518121134.patch text/plain 5024 bfulgham SW5kZXg6IFNvdXJjZS9XZWJLaXQyL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi S2l0Mi9DaGFuZ2VMb2cJKHJldmlzaW9uIDIxNzA1OCkKKysrIFNvdXJjZS9XZWJLaXQyL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE3IEBACisyMDE3LTA1LTE4ICBCcmVudCBG dWxnaGFtICA8YmZ1bGdoYW1AYXBwbGUuY29tPgorCisgICAgICAgIEFkb3B0IFdoaXRlbGlzdCBm b3IgbmVjZXNzYXJ5IFhQQyBzZXJ2aWNlcyBvbmx5CisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJr aXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xNzIxODIKKyAgICAgICAgPHJkYXI6Ly9wcm9ibGVtLzMw NjY5NDQ1PgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAg IFRoaXMgYnJpbmdzIHRoZSBpT1MgV2ViS2l0IHNhbmRib3hlcyBpbiBsaW5lIHdpdGggbWFjT1Mu CisKKyAgICAgICAgKiBSZXNvdXJjZXMvU2FuZGJveFByb2ZpbGVzL2lvcy9jb20uYXBwbGUuV2Vi S2l0LkRhdGFiYXNlcy5zYjoKKyAgICAgICAgKiBSZXNvdXJjZXMvU2FuZGJveFByb2ZpbGVzL2lv cy9jb20uYXBwbGUuV2ViS2l0Lk5ldHdvcmtpbmcuc2I6CisgICAgICAgICogUmVzb3VyY2VzL1Nh bmRib3hQcm9maWxlcy9pb3MvY29tLmFwcGxlLldlYktpdC5XZWJDb250ZW50LnNiOgorCiAyMDE3 LTA1LTE4ICBBbmR5IEVzdGVzICA8YWVzdGVzQGFwcGxlLmNvbT4KIAogICAgICAgICBBZGQgImNv dW50cnlDb2RlIiB0byBBcHBsZVBheUVycm9yQ29udGFjdEZpZWxkCkluZGV4OiBTb3VyY2UvV2Vi S2l0Mi9SZXNvdXJjZXMvU2FuZGJveFByb2ZpbGVzL2lvcy9jb20uYXBwbGUuV2ViS2l0LkRhdGFi YXNlcy5zYgo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2ViS2l0Mi9SZXNvdXJjZXMvU2FuZGJveFBy b2ZpbGVzL2lvcy9jb20uYXBwbGUuV2ViS2l0LkRhdGFiYXNlcy5zYgkocmV2aXNpb24gMjE3MDU4 KQorKysgU291cmNlL1dlYktpdDIvUmVzb3VyY2VzL1NhbmRib3hQcm9maWxlcy9pb3MvY29tLmFw cGxlLldlYktpdC5EYXRhYmFzZXMuc2IJKHdvcmtpbmcgY29weSkKQEAgLTM4LDMgKzM4LDExIEBA CiAgICAgICAgICJody5tb2RlbCIKICAgICAgICAgImtlcm4ubWVtb3J5c3RhdHVzX2xldmVsIgog ICAgICAgICAidm0uZm9vdHByaW50X3N1c3BlbmQiKSkKKworKGRlbnkgaW9raXQtZ2V0LXByb3Bl cnRpZXMpCisoZGVueSBtYWNoLWxvb2t1cCAoeHBjLXNlcnZpY2UtbmFtZS1wcmVmaXggIiIpKQor Cis7OyBWYXJpb3VzIHNlcnZpY2VzIHJlcXVpcmVkIGJ5IHN5c3RlbSBmcmFtZXdvcmtzCisoYWxs b3cgbWFjaC1sb29rdXAKKyAgICAoZ2xvYmFsLW5hbWUgImNvbS5hcHBsZS5hbmFseXRpY3NkIikK KyAgICAoZ2xvYmFsLW5hbWUgImNvbS5hcHBsZS5sc2QubWFwZGIiKSkKSW5kZXg6IFNvdXJjZS9X ZWJLaXQyL1Jlc291cmNlcy9TYW5kYm94UHJvZmlsZXMvaW9zL2NvbS5hcHBsZS5XZWJLaXQuTmV0 d29ya2luZy5zYgo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2ViS2l0Mi9SZXNvdXJjZXMvU2FuZGJv eFByb2ZpbGVzL2lvcy9jb20uYXBwbGUuV2ViS2l0Lk5ldHdvcmtpbmcuc2IJKHJldmlzaW9uIDIx NzA1OCkKKysrIFNvdXJjZS9XZWJLaXQyL1Jlc291cmNlcy9TYW5kYm94UHJvZmlsZXMvaW9zL2Nv bS5hcHBsZS5XZWJLaXQuTmV0d29ya2luZy5zYgkod29ya2luZyBjb3B5KQpAQCAtMzcsNiArMzcs OSBAQAogICAgICAgICAia2Vybi5tZW1vcnlzdGF0dXNfbGV2ZWwiCiAgICAgICAgICJ2bS5mb290 cHJpbnRfc3VzcGVuZCIpKQogCisoZGVueSBpb2tpdC1nZXQtcHJvcGVydGllcykKKyhkZW55IG1h Y2gtbG9va3VwICh4cGMtc2VydmljZS1uYW1lLXByZWZpeCAiIikpCisKIDs7IEFjY2VzcyB0byBj bGllbnQncyBjYWNoZSBmb2xkZXIgJiByZS12ZW5kaW5nIHRvIENGTmV0d29yay4KIDs7IEZJWE1F OiBSZW1vdmUgdGhlIHdlYmtpdCBzcGVjaWZpYyBleHRlbnNpb24gY2xhc3NlcyA8cmRhcjovL3By b2JsZW0vMTc3NTU5MzE+CiAoYWxsb3cgZmlsZS1pc3N1ZS1leHRlbnNpb24gKHJlcXVpcmUtYWxs CkBAIC02Nyw2ICs3MCw4IEBACiAKIDs7IFNlY3VyaXR5IGZyYW1ld29yawogKGFsbG93IG1hY2gt bG9va3VwCisgICAgKGdsb2JhbC1uYW1lICJjb20uYXBwbGUuYW5hbHl0aWNzZCIpCisgICAgKGds b2JhbC1uYW1lICJjb20uYXBwbGUubHNkLm1hcGRiIikKICAgICAoZ2xvYmFsLW5hbWUgImNvbS5h cHBsZS5vY3NwZCIpCiAgICAgKGdsb2JhbC1uYW1lICJjb20uYXBwbGUuc2VjdXJpdHlkIikKICAg ICAoZ2xvYmFsLW5hbWUgImNvbS5hcHBsZS5hY2NvdW50c2QuYWNjb3VudG1hbmFnZXIiKSkKSW5k ZXg6IFNvdXJjZS9XZWJLaXQyL1Jlc291cmNlcy9TYW5kYm94UHJvZmlsZXMvaW9zL2NvbS5hcHBs ZS5XZWJLaXQuV2ViQ29udGVudC5zYgo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2ViS2l0Mi9SZXNv dXJjZXMvU2FuZGJveFByb2ZpbGVzL2lvcy9jb20uYXBwbGUuV2ViS2l0LldlYkNvbnRlbnQuc2IJ KHJldmlzaW9uIDIxNzA1OCkKKysrIFNvdXJjZS9XZWJLaXQyL1Jlc291cmNlcy9TYW5kYm94UHJv ZmlsZXMvaW9zL2NvbS5hcHBsZS5XZWJLaXQuV2ViQ29udGVudC5zYgkod29ya2luZyBjb3B5KQpA QCAtNDMsNiArNDMsNDAgQEAKICAgICAgICAgImtlcm4ubWVtb3J5c3RhdHVzX2xldmVsIgogICAg ICAgICAidm0uZm9vdHByaW50X3N1c3BlbmQiKSkKIAorKGRlbnkgaW9raXQtZ2V0LXByb3BlcnRp ZXMpCisoYWxsb3cgaW9raXQtZ2V0LXByb3BlcnRpZXMKKyAgICAoaW9raXQtcHJvcGVydHktcHJl Zml4ICJBR1hQYXJhbWV0ZXJCdWZmZXJNYXhTaXplIikKKyAgICAoaW9raXQtcHJvcGVydHktcmVn ZXggIyJeQXBwbGVKUEVHIikgOyBBcHBsZUpQRUdEcml2ZXIsIEVtYmVkZGVkQ29yZU1lZGlhCisg ICAgKGlva2l0LXByb3BlcnR5ICJBcHBsZVRWIikKKyAgICAoaW9raXQtcHJvcGVydHkgIkJhc2VB ZGRyZXNzQWxpZ25tZW50UmVxdWlyZW1lbnQiKQorICAgIChpb2tpdC1wcm9wZXJ0eSAiQ0ZCdW5k bGVJZGVudGlmaWVyIikKKyAgICAoaW9raXQtcHJvcGVydHkgIkRpc3BsYXlQaXBlUGxhbmVCYXNl QWxpZ25tZW50IikKKyAgICAoaW9raXQtcHJvcGVydHkgIkRpc3BsYXlQaXBlU3RyaWRlUmVxdWly ZW1lbnRzIikKKyAgICAoaW9raXQtcHJvcGVydHkgIkZvcmNlU3VwcG9ydGVkIikKKyAgICAoaW9r aXQtcHJvcGVydHktcmVnZXggIl5JT0dMKHxFUykofE1ldGFsKUJ1bmRsZU5hbWUiKQorICAgIChp b2tpdC1wcm9wZXJ0eS1yZWdleCAjIl5JbnRlcm5hbFN0YXRpc3RpY3MofEFjY20pIikKKyAgICAo aW9raXQtcHJvcGVydHktcmVnZXggIyJeTWV0YWxQbHVnaW4oTmFtZXxDbGFzc05hbWUpIikKKyAg ICAoaW9raXQtcHJvcGVydHktcmVnZXggIyJeUGVyZm9ybWFuY2VTdGF0aXN0aWNzKHxBY2N1bSki KQorICAgIChpb2tpdC1wcm9wZXJ0eSAiUHJvdG9jb2wgQ2hhcmFjdGVyaXN0aWNzIikKKyAgICAo aW9raXQtcHJvcGVydHkgIlNpemUiKQorICAgIChpb2tpdC1wcm9wZXJ0eSAiY29tcGFzcy1jYWxp YnJhdGlvbiIpCisgICAgKGlva2l0LXByb3BlcnR5ICJkaXNwbGF5LXJvdGF0aW9uIikKKyAgICAo aW9raXQtcHJvcGVydHkgImRpc3BsYXktc2NhbGUiIikKKyAgICAoaW9raXQtcHJvcGVydHkgImdy YXBoaWMtb3B0aW9ucyIpCisgICAgKGlva2l0LXByb3BlcnR5ICJneXJvLWludGVycnVwdC1jYWxp YnJhdGlvbiIpCisgICAgKGlva2l0LXByb3BlcnR5ICJoZGNwLWhvb3Zlci1wcm90b2NvbCIpCisg ICAgKGlva2l0LXByb3BlcnR5LXJlZ2V4ICMiXnBhcnNlci0ob3B0aW9uc3x0eXBlKSIpCisgICAg KGlva2l0LXByb3BlcnR5ICJwcm9kdWN0LWlkIikKKyAgICAoaW9raXQtcHJvcGVydHkgInNvZnR3 YXJlLWJlaGF2aW9yIikKKykKKworKGRlbnkgbWFjaC1sb29rdXAgKHhwYy1zZXJ2aWNlLW5hbWUt cHJlZml4ICIiKSkKKyhhbGxvdyBtYWNoLWxvb2t1cAorICAgICh4cGMtc2VydmljZS1uYW1lICJj b20uYXBwbGUuQUdYQ29tcGlsZXJTZXJ2aWNlIikKKyAgICAoeHBjLXNlcnZpY2UtbmFtZSAiY29t LmFwcGxlLmFjY2Vzc2liaWxpdHkuQWNjZXNzaWJpbGl0eVVJU2VydmVyIikKKyAgICAoeHBjLXNl cnZpY2UtbmFtZS1yZWdleCAjIlwudmlld3NlcnZpY2UkIikKKykKKwogOzsgUmVhZC1vbmx5IHBy ZWZlcmVuY2VzIGFuZCBkYXRhCiAobW9iaWxlLXByZWZlcmVuY2VzLXJlYWQKICAgICAiY29tLmFw cGxlLkxhdW5jaFNlcnZpY2VzIgpAQCAtODUsOCArMTE5LDExIEBACiA7OyBWYXJpb3VzIHNlcnZp Y2VzIHJlcXVpcmVkIGJ5IENGTmV0d29yayBhbmQgb3RoZXIgZnJhbWV3b3JrcwogKGFsbG93IG1h Y2gtbG9va3VwCiAgICAgKGdsb2JhbC1uYW1lICJjb20uYXBwbGUuUG93ZXJNYW5hZ2VtZW50LmNv bnRyb2wiKQorICAgIChnbG9iYWwtbmFtZSAiY29tLmFwcGxlLmFuYWx5dGljc2QiKQogICAgIChn bG9iYWwtbmFtZSAiY29tLmFwcGxlLmFjY291bnRzZC5hY2NvdW50bWFuYWdlciIpCi0gICAgKGds b2JhbC1uYW1lICJjb20uYXBwbGUuY29yZW1lZGlhLmF1ZGlvZGV2aWNlY2xvY2siKSkKKyAgICAo Z2xvYmFsLW5hbWUgImNvbS5hcHBsZS5jb3JlbWVkaWEuYXVkaW9kZXZpY2VjbG9jayIpCisgICAg KGdsb2JhbC1uYW1lICJjb20uYXBwbGUubHNkLm1hcGRiIikKKykKIAogKGRlbnkgZmlsZS13cml0 ZS1jcmVhdGUgKHZub2RlLXR5cGUgU1lNTElOSykpCiAoZGVueSBmaWxlLXJlYWQteGF0dHIgZmls ZS13cml0ZS14YXR0ciAoeGF0dHItcmVnZXggIyJeY29tXC5hcHBsZVwuc2VjdXJpdHlcLnByaXZh dGVcLiIpKQo= 310945 2017-05-22 16:04:08 -0700 2017-05-22 20:03:01 -0700 Patch bug-172182-20170522160407.patch text/plain 2942 bfulgham SW5kZXg6IFNvdXJjZS9XZWJLaXQyL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi S2l0Mi9DaGFuZ2VMb2cJKHJldmlzaW9uIDIxNzI1MSkKKysrIFNvdXJjZS9XZWJLaXQyL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDI0IEBACisyMDE3LTA1LTIyICBCcmVudCBG dWxnaGFtICA8YmZ1bGdoYW1AYXBwbGUuY29tPgorCisgICAgICAgIFtXSzJdW2lPU10gQWRvcHQg YSB3aGl0ZWxpc3QgZm9yIFhQQyBzZXJ2aWNlcworICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0 Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTcyMTgyCisgICAgICAgIDxyZGFyOi8vcHJvYmxlbS8zMDY2 OTQ0NT4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBU ZWxsIHRoZSBTYW5kYm94IHRvIGJsb2NrIGFsbCBYUEMgY29ubmVjdGlvbnMgdGhhdCBhcmUgbm90 IGV4cGxpY2l0bHkgYWxsb3dlZCBieQorICAgICAgICB0aGUgc2FuZGJveCBwcm9maWxlLiBUaGUg ZGVmYXVsdCBiZWhhdmlvciBpcyB0byBhbGxvdyBldmVyeXRoaW5nIGJ5IGRlZmF1bHQuCisKKyAg ICAgICAgSWYgdGhlIHJlc3RyaWN0aW9uIGlzIHNldCBiZWZvcmUgaW5jbHVkaW5nIHRoZSBzdGFu ZGFyZCBpT1Mgc2FuZGJveCBwcm9maWxlcywgdGhlcmUKKyAgICAgICAgZG9lcyBub3Qgc2VlbSB0 byBiZSBhIG5lZWQgdG8gd2hpdGUgbGlzdCBhbnkgb3RoZXIgc2VydmljZXMuIAorCisgICAgICAg IEdlbmVyYWwgd2ViIGJyb3dzaW5nIG9uIG11bHRpcGxlIGRldmljZXMgaW5kaWNhdGUgdGhhdCB0 aGVzZSBzYW5kYm94IHByb2ZpbGVzIHdvcmsKKyAgICAgICAgcHJvcGVybHkgd2l0aCBtZWRpYSwg YWNjZXNzaWJpbGl0eSwgd2ViZ2wsIGFuZCBnZW5lcmFsIHdlYiBjb250ZW50LgorCisgICAgICAg ICogUmVzb3VyY2VzL1NhbmRib3hQcm9maWxlcy9pb3MvY29tLmFwcGxlLldlYktpdC5EYXRhYmFz ZXMuc2I6CisgICAgICAgICogUmVzb3VyY2VzL1NhbmRib3hQcm9maWxlcy9pb3MvY29tLmFwcGxl LldlYktpdC5OZXR3b3JraW5nLnNiOgorICAgICAgICAqIFJlc291cmNlcy9TYW5kYm94UHJvZmls ZXMvaW9zL2NvbS5hcHBsZS5XZWJLaXQuV2ViQ29udGVudC5zYjoKKwogMjAxNy0wNS0yMiAgWW91 ZW5uIEZhYmxldCAgPHlvdWVubkBhcHBsZS5jb20+CiAKICAgICAgICAgUmVtb3ZlIEFWQXVkaW9D YXB0dXJlU291cmNlCkluZGV4OiBTb3VyY2UvV2ViS2l0Mi9SZXNvdXJjZXMvU2FuZGJveFByb2Zp bGVzL2lvcy9jb20uYXBwbGUuV2ViS2l0LkRhdGFiYXNlcy5zYgo9PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3Vy Y2UvV2ViS2l0Mi9SZXNvdXJjZXMvU2FuZGJveFByb2ZpbGVzL2lvcy9jb20uYXBwbGUuV2ViS2l0 LkRhdGFiYXNlcy5zYgkocmV2aXNpb24gMjE3MTMxKQorKysgU291cmNlL1dlYktpdDIvUmVzb3Vy Y2VzL1NhbmRib3hQcm9maWxlcy9pb3MvY29tLmFwcGxlLldlYktpdC5EYXRhYmFzZXMuc2IJKHdv cmtpbmcgY29weSkKQEAgLTI1LDYgKzI1LDggQEAKIChkZW55IGRlZmF1bHQgKHdpdGggcGFydGlh bC1zeW1ib2xpY2F0aW9uKSkKIChhbGxvdyBzeXN0ZW0tYXVkaXQgZmlsZS1yZWFkLW1ldGFkYXRh KQogCisoZGVueSBtYWNoLWxvb2t1cCAoeHBjLXNlcnZpY2UtbmFtZS1wcmVmaXggIiIpKQorCiAo aW1wb3J0ICJjb21tb24uc2IiKQogKGltcG9ydCAicmVtb3ZlZC1kZXYtbm9kZXMuc2IiKQogCklu ZGV4OiBTb3VyY2UvV2ViS2l0Mi9SZXNvdXJjZXMvU2FuZGJveFByb2ZpbGVzL2lvcy9jb20uYXBw bGUuV2ViS2l0Lk5ldHdvcmtpbmcuc2IKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL1dlYktpdDIvUmVz b3VyY2VzL1NhbmRib3hQcm9maWxlcy9pb3MvY29tLmFwcGxlLldlYktpdC5OZXR3b3JraW5nLnNi CShyZXZpc2lvbiAyMTcxMzEpCisrKyBTb3VyY2UvV2ViS2l0Mi9SZXNvdXJjZXMvU2FuZGJveFBy b2ZpbGVzL2lvcy9jb20uYXBwbGUuV2ViS2l0Lk5ldHdvcmtpbmcuc2IJKHdvcmtpbmcgY29weSkK QEAgLTI1LDYgKzI1LDggQEAKIChkZW55IGRlZmF1bHQgKHdpdGggcGFydGlhbC1zeW1ib2xpY2F0 aW9uKSkKIChhbGxvdyBzeXN0ZW0tYXVkaXQgZmlsZS1yZWFkLW1ldGFkYXRhKQogCisoZGVueSBt YWNoLWxvb2t1cCAoeHBjLXNlcnZpY2UtbmFtZS1wcmVmaXggIiIpKQorCiAoaW1wb3J0ICJjb21t b24uc2IiKQogKGltcG9ydCAicmVtb3ZlZC1kZXYtbm9kZXMuc2IiKQogCkluZGV4OiBTb3VyY2Uv V2ViS2l0Mi9SZXNvdXJjZXMvU2FuZGJveFByb2ZpbGVzL2lvcy9jb20uYXBwbGUuV2ViS2l0Lldl YkNvbnRlbnQuc2IKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL1dlYktpdDIvUmVzb3VyY2VzL1NhbmRi b3hQcm9maWxlcy9pb3MvY29tLmFwcGxlLldlYktpdC5XZWJDb250ZW50LnNiCShyZXZpc2lvbiAy MTcxMzEpCisrKyBTb3VyY2UvV2ViS2l0Mi9SZXNvdXJjZXMvU2FuZGJveFByb2ZpbGVzL2lvcy9j b20uYXBwbGUuV2ViS2l0LldlYkNvbnRlbnQuc2IJKHdvcmtpbmcgY29weSkKQEAgLTI1LDYgKzI1 LDggQEAKIChkZW55IGRlZmF1bHQgKHdpdGggcGFydGlhbC1zeW1ib2xpY2F0aW9uKSkKIChhbGxv dyBzeXN0ZW0tYXVkaXQgZmlsZS1yZWFkLW1ldGFkYXRhKQogCisoZGVueSBtYWNoLWxvb2t1cCAo eHBjLXNlcnZpY2UtbmFtZS1wcmVmaXggIiIpKQorCiAoaW1wb3J0ICJVSUtpdC1hcHBzLnNiIikK IChpbXBvcnQgInJlbW92ZWQtZGV2LW5vZGVzLnNiIikKIAo=