From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI, MENTIONS_GIT_HOSTING,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 26DC4C433DB for ; Thu, 21 Jan 2021 13:21:53 +0000 (UTC) Received: from whitealder.osuosl.org (smtp1.osuosl.org [140.211.166.138]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 8BF69206A3 for ; Thu, 21 Jan 2021 13:21:52 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 8BF69206A3 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=ubuntu.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=containers-bounces@lists.linux-foundation.org Received: from localhost (localhost [127.0.0.1]) by whitealder.osuosl.org (Postfix) with ESMTP id 21DB286CAE; Thu, 21 Jan 2021 13:21:52 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from whitealder.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id L3TybLXhE0dq; Thu, 21 Jan 2021 13:21:44 +0000 (UTC) Received: from lists.linuxfoundation.org (lf-lists.osuosl.org [140.211.9.56]) by whitealder.osuosl.org (Postfix) with ESMTP id B5EBD86CC8; Thu, 21 Jan 2021 13:21:44 +0000 (UTC) Received: from lf-lists.osuosl.org (localhost [127.0.0.1]) by lists.linuxfoundation.org (Postfix) with ESMTP id 9CF55C0FA7; Thu, 21 Jan 2021 13:21:44 +0000 (UTC) Received: from fraxinus.osuosl.org (smtp4.osuosl.org [140.211.166.137]) by lists.linuxfoundation.org (Postfix) with ESMTP id 93CB8C013A for ; Thu, 21 Jan 2021 13:21:43 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by fraxinus.osuosl.org (Postfix) with ESMTP id 774AB86239 for ; Thu, 21 Jan 2021 13:21:43 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from fraxinus.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Jcpzl0bMNNMg for ; Thu, 21 Jan 2021 13:21:40 +0000 (UTC) X-Greylist: domain auto-whitelisted by SQLgrey-1.7.6 Received: from youngberry.canonical.com (youngberry.canonical.com [91.189.89.112]) by fraxinus.osuosl.org (Postfix) with ESMTPS id 29730861F1 for ; Thu, 21 Jan 2021 13:21:40 +0000 (UTC) Received: from ip5f5af0a0.dynamic.kabel-deutschland.de ([95.90.240.160] helo=wittgenstein.fritz.box) by youngberry.canonical.com with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1l2Zsp-0005g7-Ri; Thu, 21 Jan 2021 13:20:20 +0000 From: Christian Brauner To: Alexander Viro , Christoph Hellwig , linux-fsdevel@vger.kernel.org Subject: [PATCH v6 00/40] idmapped mounts Date: Thu, 21 Jan 2021 14:19:19 +0100 Message-Id: <20210121131959.646623-1-christian.brauner@ubuntu.com> X-Mailer: git-send-email 2.30.0 MIME-Version: 1.0 Cc: Lennart Poettering , Mimi Zohar , James Bottomley , Andreas Dilger , containers@lists.linux-foundation.org, Tycho Andersen , Paul Moore , Jonathan Corbet , smbarber@chromium.org, linux-ext4@vger.kernel.org, Mrunal Patel , Kees Cook , Arnd Bergmann , selinux@vger.kernel.org, Josh Triplett , Seth Forshee , Aleksa Sarai , Andy Lutomirski , OGAWA Hirofumi , Geoffrey Thomas , David Howells , John Johansen , Theodore Tso , Dmitry Kasatkin , Stephen Smalley , linux-xfs@vger.kernel.org, linux-security-module@vger.kernel.org, "Eric W. Biederman" , linux-api@vger.kernel.org, Casey Schaufler , Alban Crequy , linux-integrity@vger.kernel.org, Linus Torvalds , Todd Kjos X-BeenThere: containers@lists.linux-foundation.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Linux Containers List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Errors-To: containers-bounces@lists.linux-foundation.org Sender: "Containers" SGV5IGV2ZXJ5b25lLAoKVGhlIG9ubHkgbWFqb3IgY2hhbmdlIGlzIHRoZSB1cGRhdGVkIHZlcnNp b24gb2YgaGNoJ3MgcGFjaCB0byBwb3J0IHhmcwp0byBzdXBwb3J0IGlkbWFwcGVkIG1vdW50cy4g VGhhbmtzIGFnYWluIHRvIENocmlzdG9waCBmb3IgZG9pbmcgdGhhdAp3b3JrLgooT3RoZXJ3aXNl IEFja2VkLWJ5cyBhbmQgUmV2aWV3ZWQtYnlzIHdlcmUgYWRkZWQgYW5kIHRoZSB0cmVlIHJlb3Jk ZXJlZAogdG8gZGVjb3VwbGUgZmlsZXN5c3RlbSBzcGVjaWZpYyBjb252ZXJzaW9uIGZyb20gdGhl IHZmcyB3b3JrIHNvIHRoZXkKIGNhbiBwcm9jZWVkIGluZGVwZW5kZW50LgogRm9yIGEgZnVsbCBs aXN0IG9mIG1ham9yIGNoYW5nZXMgYmV0d2VlbiB2ZXJzaW9ucyBzZWUgdGhlIGVuZCBvZiB0aGlz CiBjb3ZlciBsZXR0ZXIuIFBsZWFzZSBhbHNvIG5vdGUgdGhlIGxhcmdlIHhmc3Rlc3RzIHRlc3Rz dWl0ZSBpbiBwYXRjaCA0MgogdGhhdCBoYXMgYmVlbiBrZXB0IGFzIHBhcnQgb2YgdGhpcyBzZXJp ZXMuIEl0IHZlcmlmaWVzIGNvcnJlY3QgdmZzCiBiZWhhdmlvciB3aXRoIGFuZCB3aXRob3V0IGlk bWFwcGVkIG1vdW50cyBpbmNsdWRpbmcgY292ZXJpbmcgbmV3ZXIgdmZzCiBmZWF0dXJlcyBzdWNo IGFzIGlvX3VyaW5nLgogSSBjdXJyZW50bHkgc3RpbGwgcGxhbiB0byB0YXJnZXQgdGhlIHY1LjEy IG1lcmdlIHdpbmRvdy4pCgpXaXRoIHRoaXMgcGF0Y2hzZXQgd2UgbWFrZSBpdCBwb3NzaWJsZSB0 byBhdHRhY2ggaWRtYXBwaW5ncyB0byBtb3VudHMsCmkuZS4gc2ltcGx5IHB1dCBkaWZmZXJlbnQg YmluZCBtb3VudHMgY2FuIGV4cG9zZSB0aGUgc2FtZSBmaWxlIG9yCmRpcmVjdG9yeSB3aXRoIGRp ZmZlcmVudCBvd25lcnNoaXAuClNoaWZ0aW5nIG9mIG93bmVyc2hpcCBvbiBhIHBlci1tb3VudCBi YXNpcyBoYW5kbGVzIGEgd2lkZSByYW5nZSBvZgpsb25nIHN0YW5kaW5nIHVzZS1jYXNlcy4gSGVy ZSBhcmUganVzdCBhIGZldzoKLSBTaGlmdGluZyBvZiBhIHN1YnNldCBvZiBvd25lcnNoaXAtbGVz cyBmaWxlc3lzdGVtcyAodmZhdCkgZm9yIHVzZSBieQogIG11bHRpcGxlIHVzZXJzLCBlZmZlY3Rp dmVseSBhbGxvd2luZyBmb3IgREFDIG9uIHN1Y2ggZGV2aWNlcwogIChzeXN0ZW1kLCBBbmRyb2lk LCAuLi4pCi0gQWxsb3cgcmVtYXBwaW5nIHVpZC9naWQgb24gZXh0ZXJuYWwgZmlsZXN5c3RlbXMg b3IgcGF0aHMgKFVTQiBzdGlja3MsCiAgbmV0d29yayBmaWxlc3lzdGVtLCAuLi4pIHRvIG1hdGNo IHRoZSBsb2NhbCBzeXN0ZW0ncyB1c2VyIGFuZCBncm91cHMuCiAgKERhdmlkIEhvd2VsbHMgaW50 ZW5kcyB0byBwb3J0IEFGUyBhcyBhIGZpcnN0IGNhbmRpZGF0ZS4pCi0gU2hpZnRpbmcgb2YgYSBj b250YWluZXIgcm9vdGZzIG9yIGJhc2UgaW1hZ2Ugd2l0aG91dCBoYXZpbmcgdG8gbWFuZ2xlCiAg ZXZlcnkgZmlsZSAocnVuYywgRG9ja2VyLCBjb250YWluZXJkLCBrOHMsIExYRCwgc3lzdGVtZCAu Li4pCi0gU2hhcmluZyBvZiBkYXRhIGJldHdlZW4gaG9zdCBvciBwcml2aWxlZ2VkIGNvbnRhaW5l cnMgd2l0aAogIHVucHJpdmlsZWdlZCBjb250YWluZXJzIChydW5DLCBEb2NrZXIsIGNvbnRhaW5l cmQsIGs4cywgTFhELCAuLi4pCi0gRGF0YSBzaGFyaW5nIGJldHdlZW4gbXVsdGlwbGUgdXNlciBu YW1lc3BhY2VzIHdpdGggaW5jb21wYXRpYmxlIG1hcHMKICAoTFhELCBrOHMsIC4uLikKClRoZXJl IGhhcyBiZWVuIHNpZ25pZmljYW50IGludGVyZXN0IGluIHRoaXMgcGF0Y2hzZXQgYXMgZXZpZGVu Y2VkIGJ5CnVzZXIgY29tbWVudGluZyBvbiBwcmV2aW91cyB2ZXJzaW9uIG9mIHRoaXMgcGF0Y2hz ZXQuIFRoZXkgaW5jbHVkZQpjb250YWluZXJkLCBDaHJvbWVPUywgc3lzdGVtZCwgTFhEIGFuZCBh IHJhbmdlIG9mIG90aGVycy4gVGhlcmUgaXMKYWxyZWFkeSBhIHBhdGNoc2V0IHVwIGZvciBjb250 YWluZXJkLCB0aGUgZGVmYXVsdCBLdWJlcm5ldGVzIGNvbnRhaW5lcgpydW50aW1lIGh0dHBzOi8v Z2l0aHViLmNvbS9jb250YWluZXJkL2NvbnRhaW5lcmQvcHVsbC80NzM0CnRvIG1ha2UgdXNlIG9m IHRoaXMuIHN5c3RlbWQgaW50ZW5kcyB0byB1c2UgaXQgaW4gdGhlaXIgc3lzdGVtZC1ob21lZApp bXBsZW1lbnRhdGlvbiBmb3IgcG9ydGFibGUgaG9tZSBkaXJlY3Rvcmllcy4gQ2hyb21lT1Mgd2Fu dHMgdG8gbWFrZSB1c2UKb2YgaXQgdG8gc2hhcmUgZGF0YSBiZXR3ZWVuIHRoZSBob3N0IGFuZCB0 aGUgTGludXggY29udGFpbmVycyB0aGV5IHJ1bgpvbiBDaHJvbWUtIGFuZCBQaXhlbGJvb2tzLiBU aGVyZSdzIGFsc28gYSBmZXcgdGFsa3MgdGhhdCBvZiBwZW9wbGUgd2hvCmFyZSBnb2luZyB0byBt YWtlIHVzZSBvZiB0aGlzLiBUaGUgbW9zdCByZWNlbnQgb25lIHdhcyBhIENOQ0Ygd2ViaW5hcgpo dHRwczovL3d3dy5jbmNmLmlvL3dwLWNvbnRlbnQvdXBsb2Fkcy8yMDIwLzEyL1Jvb3RsZXNzLUNv bnRhaW5lcnMtaW4tR2l0cG9kLnBkZgphbmQgdXBjb21pbmcgdGFsayBkdXJpbmcgRk9TREVNLgoo RndpdywgZm9yIGZ1biBhbmQgc2luY2UgSSB3YW50ZWQgdG8gZG8gdGhpcyBmb3IgYSBsb25nIHRp bWUgSSd2ZSBwb3J0ZWQKIG15IGhvbWUgZGlyZWN0b3J5IHRvIGJlIGNvbXBsZXRlbHkgcG9ydGFi bGUgd2l0aCBhIHNpbXBsZSBzZXJ2aWNlIGZpbGUKIHRoYXQgbm93IG1vdW50cyBteSBob21lIGRp cmVjdG9yeSBvbiBhbiBleHQ0IGZvcm1hdHRlZCB1c2Igc3RpY2sgd2l0aAogYW4gaWQgbWFwcGlu ZyBtYXBwaW5nIGFsbCBmaWxlcyB0byB0aGUgcmFuZG9tIHVpZCBJJ20gYXNzaWduZWQgYXQKIGxv Z2luLikKCk1ha2luZyBpdCBwb3NzaWJsZSB0byBzaGFyZSBkaXJlY3RvcmllcyBhbmQgbW91bnRz IGJldHdlZW4gdXNlcnMgd2l0aApkaWZmZXJlbnQgdWlkcyBhbmQgZ2lkcyBpcyBpdHNlbGYgcXVp dGUgYW4gaW1wb3J0YW50IHVzZS1jYXNlIGluCmRpc3RyaWJ1dGVkIHN5c3RlbXMgZW52aXJvbm1l bnRzLiBJdCdzIG9mIGNvdXJzZSBlc3BlY2lhbGx5IHVzZWZ1bCBpbgpnZW5lcmFsIGZvciBwb3J0 YWJsZSB1c2Igc3RpY2tzLCBzaGFyaW5nIGRhdGEgYmV0d2VlbiBtdWx0aXBsZSB1c2VycyBpbiwK YW5kIHNoYXJpbmcgaG9tZSBkaXJlY3RvcmllcyBiZXR3ZWVuIG11bHRpcGxlIHVzZXJzLiBUaGUg bGFzdCBleGFtcGxlIGlzCm5vdyBlbGVnYW50bHkgZXhwcmVzc2VkIGluIHN5c3RlbWQncyBob21l ZCBjb25jZXB0IGZvciBwb3J0YWJsZSBob21lCmRpcmVjdG9yaWVzLiBBcyBtZW50aW9uZWQgYWJv dmUsIGlkbWFwcGVkIG1vdW50cyBhbHNvIGFsbG93IGRhdGEgZnJvbQp0aGUgaG9zdCB0byBiZSBz aGFyZWQgd2l0aCB1bnByaXZpbGVnZWQgY29udGFpbmVycywgYmV0d2VlbiBwcml2aWxlZ2VkCmFu ZCB1bnByaXZpbGVnZWQgY29udGFpbmVycyBzaW11bHRhbmVvdXNseSBhbmQgaW4gYWRkaXRpb24g YWxzbyBiZXR3ZWVuCnVucHJpdmlsZWdlZCBjb250YWluZXJzIHdpdGggZGlmZmVyZW50IGlkbWFw cGluZ3Mgd2hlbmV2ZXIgdGhleSBhcmUgdXNlZAp0byBpc29sYXRlIG9uZSBjb250YWluZXIgY29t cGxldGVseSBmcm9tIGFub3RoZXIgY29udGFpbmVyLgoKV2UgaGF2ZSBpbXBsZW1lbnRlZCBhbmQg cHJvcG9zZWQgbXVsdGlwbGUgc29sdXRpb25zIHRvIHRoaXMgYmVmb3JlLiBUaGlzCmluY2x1ZGVk IHRoZSBpbnRyb2R1Y3Rpb24gb2YgZnNpZCBtYXBwaW5ncywgYSB0aW55IGZpbGVzeXN0ZW0gSSd2 ZQphdXRob3JlZCB3aXRoIFNldGggRm9yc2hlZSB0aGF0IGlzIGN1cnJlbnRseSBjYXJyaWVkIGlu IFVidW50dSB0aGF0IGhhcwpzaG93biB0byBiZSB0aGUgd3JvbmcgYXBwcm9hY2gsIGFuZCB0aGUg Y29uY2VwdHVhbCBoYWNrIG9mIGNhbGxpbmcKb3ZlcnJpZGUgY3JlZHMgZGlyZWN0bHkgaW4gdGhl IHZmcy4gSW4gYWRkaXRpb24sIHRvIHNvbWUgb2YgdGhlc2UKc29sdXRpb25zIGJlaW5nIGhhY2t5 IG5vbmUgb2YgdGhlc2Ugc29sdXRpb25zIGhhdmUgY292ZXJlZCBhbGwgb2YgdGhlCmFib3ZlIHVz ZS1jYXNlcy4KCklkbWFwcGluZ3MgYmVjb21lIGEgcHJvcGVydHkgb2Ygc3RydWN0IHZmc21vdW50 IGluc3RlYWQgb2YgdHlpbmcgaXQgdG8gYQpwcm9jZXNzIGJlaW5nIGluc2lkZSBvZiBhIHVzZXIg bmFtZXNwYWNlIHdoaWNoIGhhcyBiZWVuIHRoZSBjYXNlIGZvciBhbGwKb3RoZXIgcHJvcG9zZWQg YXBwcm9hY2hlcy4gSXQgYWxzbyBhbGxvd3MgdG8gcGFzcyBkb3duIHRoZSB1c2VyCm5hbWVzcGFj ZSBpbnRvIHRoZSBmaWxlc3lzdGVtcyB3aGljaCBpcyBhIGNsZWFuIHdheSBpbnN0ZWFkIG9mIHZp b2xhdGluZwpjYWxsaW5nIGNvbnZlbnRpb25zIGJ5IHN0cmFwcGluZyB0aGUgdXNlciBuYW1lc3Bh Y2UgaW5mb3JtYXRpb24gdGhhdCBpcwphIHByb3BlcnR5IG9mIHRoZSBtb3VudCB0byB0aGUgY2Fs bGVyJ3MgY3JlZGVudGlhbHMgb3Igc2ltaWxhciBoYWNrcy4KRWFjaCBtb3VudCBjYW4gaGF2ZSBh IHNlcGFyYXRlIGlkbWFwcGluZyBhbmQgaWRtYXBwZWQgbW91bnRzIGNhbiBldmVuIGJlCmNyZWF0 ZWQgaW4gdGhlIGluaXRpYWwgdXNlciBuYW1lc3BhY2UgdW5ibG9ja2luZyBhIHJhbmdlIG9mIHVz ZS1jYXNlcy4KClRvIHRoaXMgZW5kIHRoZSB2ZnNtb3VudCBzdHJ1Y3QgZ2FpbnMgYSBuZXcgc3Ry dWN0IHVzZXJfbmFtZXNwYWNlCm1lbWJlci4gVGhlIGlkbWFwcGluZyBvZiB0aGUgdXNlciBuYW1l c3BhY2UgYmVjb21lcyB0aGUgaWRtYXBwaW5nIG9mIHRoZQptb3VudC4gQSBjYWxsZXIgdGhhdCBp cyBwcml2aWxlZ2VkIHdpdGggcmVzcGVjdCB0byB0aGUgdXNlciBuYW1lc3BhY2Ugb2YKdGhlIHN1 cGVyYmxvY2sgb2YgdGhlIHVuZGVybHlpbmcgZmlsZXN5c3RlbSBjYW4gY3JlYXRlIGFuIGlkbWFw cGVkCm1vdW50LiBJbiB0aGUgZnV0dXJlLCB3ZSBjYW4gZW5hYmxlIHVucHJpdmlsZWdlZCB1c2Ut Y2FzZXMgYnkgY2hlY2tpbmcKd2hldGhlciB0aGUgY2FsbGVyIGlzIHByaXZpbGVnZWQgd3J0IHRv IHRoZSB1c2VyIG5hbWVzcGFjZSB0aGF0IGFuCmFscmVhZHkgaWRtYXBwZWQgbW91bnQgaGFzIGJl ZW4gbWFya2VkIHdpdGgsIGFsbG93aW5nIHRoZW0gdG8gY2hhbmdlIHRoZQppZG1hcHBpbmcuIEZv ciBub3csIGtlZXAgdGhpbmdzIHNpbXBsZSB1bnRpbCB0aGUgbmVlZCBhcmlzZXMuCk5vdGUsIHRo YXQgd2l0aCBzeXNjYWxsIGludGVyY2VwdGlvbiBpdCBpcyBhbHJlYWR5IHBvc3NpYmxlIHRvIGlu dGVyY2VwdAppZG1hcHBlZCBtb3VudCByZXF1ZXN0cyBmcm9tIHVucHJpdmlsZWdlZCBjb250YWlu ZXJzIGFuZCBoYW5kbGUgdGhlbSBpbgphIHN1ZmZpY2llbnRseSBwcml2aWxlZ2VkIGNvbnRhaW5l ciBtYW5hZ2VyLiBTdXBwb3J0IGZvciB0aGlzIGlzIGFscmVhZHkKYXZhaWxhYmxlIGluIExYRCBh bmQgd2lsbCBiZSBhdmFpbGFibGUgaW4gcnVuQyB3aGVyZSBzeXNjYWxsCmludGVyY2VwdGlvbiBp cyBjdXJyZW50bHkgaW4gdGhlIHByb2Nlc3Mgb2YgYmVjb21pbmcgcGFydCBvZiB0aGUgcnVudGlt ZQpzcGVjOiBodHRwczovL2dpdGh1Yi5jb20vb3BlbmNvbnRhaW5lcnMvcnVudGltZS1zcGVjL3B1 bGwvMTA3NC4KClRoZSB1c2VyIG5hbWVzcGFjZSB0aGUgbW91bnQgd2lsbCBiZSBtYXJrZWQgd2l0 aCBjYW4gYmUgc3BlY2lmaWVkIGJ5CnBhc3NpbmcgYSBmaWxlIGRlc2NyaXB0b3IgcmVmZXJpbmcg dG8gdGhlIHVzZXIgbmFtZXNwYWNlIGFzIGFuIGFyZ3VtZW50CnRvIHRoZSBuZXcgbW91bnRfc2V0 YXR0cigpIHN5c2NhbGwgdG9nZXRoZXIgd2l0aCB0aGUgbmV3Ck1PVU5UX0FUVFJfSURNQVAgZmxh Zy4gQnkgZGVmYXVsdCB2ZnNtb3VudHMgYXJlIG1hcmtlZCB3aXRoIHRoZSBpbml0aWFsCnVzZXIg bmFtZXNwYWNlIGFuZCBubyBiZWhhdmlvcmFsIG9yIHBlcmZvcm1hbmNlIGNoYW5nZXMgYXJlIG9i c2VydmVkLgpBbGwgbWFwcGluZyBvcGVyYXRpb25zIGFyZSBub3BzIGZvciB0aGUgaW5pdGlhbCB1 c2VyIG5hbWVzcGFjZS4gV2hlbiBhCmZpbGUvaW5vZGUgaXMgYWNjZXNzZWQgdGhyb3VnaCBhbiBp ZG1hcHBlZCBtb3VudCB0aGUgaV91aWQgYW5kIGlfZ2lkIG9mCnRoZSBpbm9kZSB3aWxsIGJlIHJl bWFwcGVkIGFjY29yZGluZyB0byB0aGUgdXNlciBuYW1lc3BhY2UgdGhlIG1vdW50IGhhcwpiZWVu IG1hcmtlZCB3aXRoLgoKSW4gb3JkZXIgdG8gc3VwcG9ydCBpZG1hcHBlZCBtb3VudHMsIGZpbGVz eXN0ZW1zIG5lZWQgdG8gYmUgY2hhbmdlZCBhbmQKbWFyayB0aGVtc2VsdmVzIHdpdGggdGhlIEZT X0FMTE9XX0lETUFQIGZsYWcgaW4gZnNfZmxhZ3MuIFRoZSBpbml0aWFsCnZlcnNpb24gY29udGFp bnMgZmF0LCBleHQ0LCBhbmQgeGZzIGluY2x1ZGluZyBhIGxpc3Qgb2YgZXhhbXBsZXMuCkJ1dCBw YXRjaGVzIGZvciBvdGhlciBmaWxlc3lzdGVtcyBhcmUgYWN0aXZlbHkgd29ya2VkIG9uIGFuZCB3 aWxsIGJlCnNlbnQgb3V0IHNlcGFyYXRlbHkuIFdlIGFyZSBoZXJlIHRvIHNlZSB0aGlzIHRocm91 Z2ggYW5kIHRoZXJlIGFyZQptdWx0aXBsZSBwZW9wbGUgaW52b2x2ZWQgaW4gY29udmVydGluZyBm aWxlc3lzdGVtcy4gU28gZmlsZXN5c3RlbQpkZXZlbG9wZXJzIGFyZSBub3QgbGVmdCBhbG9uZSB3 aXRoIHRoaXMgYW5kIGFyZSBwcm92aWRlZCB3aXRoIGEgbGFyZ2UKdGVzdHN1aXRlIHRvIHZlcmlm eSB0aGF0IHRoZWlyIHBvcnQgaXMgY29ycmVjdC4KClRoZXJlIGlzIGEgc2ltcGxlIHRvb2wgYXZh aWxhYmxlIGF0Cmh0dHBzOi8vZ2l0aHViLmNvbS9icmF1bmVyL21vdW50LWlkbWFwcGVkIHRoYXQg YWxsb3dzIHRvIGNyZWF0ZSBpZG1hcHBlZAptb3VudHMgc28gcGVvcGxlIGNhbiBwbGF5IHdpdGgg dGhpcyBwYXRjaCBzZXJpZXMuIEhlcmUgYXJlIGEgZmV3CmlsbHVzdHJhdGlvbnM6CgoxLiBDcmVh dGUgYSBzaW1wbGUgaWRtYXBwZWQgbW91bnQgb2YgYW5vdGhlciB1c2VyJ3MgaG9tZSBkaXJlY3Rv cnkKCnUxMDAxQGYyLXZtOi8kIHN1ZG8gLi9tb3VudC1pZG1hcHBlZCAtLW1hcC1tb3VudCBiOjEw MDA6MTAwMToxIC9ob21lL3VidW50dS8gL21udAp1MTAwMUBmMi12bTovJCBscyAtYWwgL2hvbWUv dWJ1bnR1Lwp0b3RhbCAyOApkcnd4ci14ci14IDIgdWJ1bnR1IHVidW50dSA0MDk2IE9jdCAyOCAy MjowNyAuCmRyd3hyLXhyLXggNCByb290ICAgcm9vdCAgIDQwOTYgT2N0IDI4IDA0OjAwIC4uCi1y dy0tLS0tLS0gMSB1YnVudHUgdWJ1bnR1IDMxNTQgT2N0IDI4IDIyOjEyIC5iYXNoX2hpc3RvcnkK LXJ3LXItLXItLSAxIHVidW50dSB1YnVudHUgIDIyMCBGZWIgMjUgIDIwMjAgLmJhc2hfbG9nb3V0 Ci1ydy1yLS1yLS0gMSB1YnVudHUgdWJ1bnR1IDM3NzEgRmViIDI1ICAyMDIwIC5iYXNocmMKLXJ3 LXItLXItLSAxIHVidW50dSB1YnVudHUgIDgwNyBGZWIgMjUgIDIwMjAgLnByb2ZpbGUKLXJ3LXIt LXItLSAxIHVidW50dSB1YnVudHUgICAgMCBPY3QgMTYgMTY6MTEgLnN1ZG9fYXNfYWRtaW5fc3Vj Y2Vzc2Z1bAotcnctLS0tLS0tIDEgdWJ1bnR1IHVidW50dSAxMTQ0IE9jdCAyOCAwMDo0MyAudmlt aW5mbwp1MTAwMUBmMi12bTovJCBscyAtYWwgL21udC8KdG90YWwgMjgKZHJ3eHIteHIteCAgMiB1 MTAwMSB1MTAwMSA0MDk2IE9jdCAyOCAyMjowNyAuCmRyd3hyLXhyLXggMjkgcm9vdCAgcm9vdCAg NDA5NiBPY3QgMjggMjI6MDEgLi4KLXJ3LS0tLS0tLSAgMSB1MTAwMSB1MTAwMSAzMTU0IE9jdCAy OCAyMjoxMiAuYmFzaF9oaXN0b3J5Ci1ydy1yLS1yLS0gIDEgdTEwMDEgdTEwMDEgIDIyMCBGZWIg MjUgIDIwMjAgLmJhc2hfbG9nb3V0Ci1ydy1yLS1yLS0gIDEgdTEwMDEgdTEwMDEgMzc3MSBGZWIg MjUgIDIwMjAgLmJhc2hyYwotcnctci0tci0tICAxIHUxMDAxIHUxMDAxICA4MDcgRmViIDI1ICAy MDIwIC5wcm9maWxlCi1ydy1yLS1yLS0gIDEgdTEwMDEgdTEwMDEgICAgMCBPY3QgMTYgMTY6MTEg LnN1ZG9fYXNfYWRtaW5fc3VjY2Vzc2Z1bAotcnctLS0tLS0tICAxIHUxMDAxIHUxMDAxIDExNDQg T2N0IDI4IDAwOjQzIC52aW1pbmZvCnUxMDAxQGYyLXZtOi8kIHRvdWNoIC9tbnQvbXktZmlsZQp1 MTAwMUBmMi12bTovJCBzZXRmYWNsIC1tIHU6MTAwMTpyd3ggL21udC9teS1maWxlCnUxMDAxQGYy LXZtOi8kIHN1ZG8gc2V0Y2FwIC1uIDEwMDEgY2FwX25ldF9yYXcrZXAgL21udC9teS1maWxlCnUx MDAxQGYyLXZtOi8kIGxzIC1hbCAvbW50L215LWZpbGUKLXJ3LXJ3eHItLSsgMSB1MTAwMSB1MTAw MSAwIE9jdCAyOCAyMjoxNCAvbW50L215LWZpbGUKdTEwMDFAZjItdm06LyQgbHMgLWFsIC9ob21l L3VidW50dS9teS1maWxlCi1ydy1yd3hyLS0rIDEgdWJ1bnR1IHVidW50dSAwIE9jdCAyOCAyMjox NCAvaG9tZS91YnVudHUvbXktZmlsZQp1MTAwMUBmMi12bTovJCBnZXRmYWNsIC9tbnQvbXktZmls ZQpnZXRmYWNsOiBSZW1vdmluZyBsZWFkaW5nICcvJyBmcm9tIGFic29sdXRlIHBhdGggbmFtZXMK IyBmaWxlOiBtbnQvbXktZmlsZQojIG93bmVyOiB1MTAwMQojIGdyb3VwOiB1MTAwMQp1c2VyOjpy dy0KdXNlcjp1MTAwMTpyd3gKZ3JvdXA6OnJ3LQptYXNrOjpyd3gKb3RoZXI6OnItLQp1MTAwMUBm Mi12bTovJCBnZXRmYWNsIC9ob21lL3VidW50dS9teS1maWxlCmdldGZhY2w6IFJlbW92aW5nIGxl YWRpbmcgJy8nIGZyb20gYWJzb2x1dGUgcGF0aCBuYW1lcwojIGZpbGU6IGhvbWUvdWJ1bnR1L215 LWZpbGUKIyBvd25lcjogdWJ1bnR1CiMgZ3JvdXA6IHVidW50dQp1c2VyOjpydy0KdXNlcjp1YnVu dHU6cnd4Cmdyb3VwOjpydy0KbWFzazo6cnd4Cm90aGVyOjpyLS0KCjIuIENyZWF0ZSBtYXBwaW5n IG9mIHRoZSB3aG9sZSBleHQ0IHJvb3RmcyB3aXRob3V0IGEgbWFwcGluZyBmb3IgdWlkIGFuZCBn aWQgMAoKdWJ1bnR1QGYyLXZtOn4kIHN1ZG8gL21vdW50LWlkbWFwcGVkIC0tbWFwLW1vdW50IGI6 MToxOjY1NTM2IC8gL21udC8KdWJ1bnR1QGYyLXZtOn4kIGZpbmRtbnQgfCBncmVwIG1udArilJTi lIAvbW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAvZGV2L3NkYTIgIGV4dDQgICAg ICAgcncscmVsYXRpbWUKICDilJTilIAvbW50L21udCAgICAgICAgICAgICAgICAgICAgICAgICAg L2Rldi9zZGEyICBleHQ0ICAgICAgIHJ3LHJlbGF0aW1lCnVidW50dUBmMi12bTp+JCBzdWRvIG1r ZGlyIC9BUy1ST09ULUNBTi1DUkVBVEUKdWJ1bnR1QGYyLXZtOn4kIHN1ZG8gbWtkaXIgL21udC9B Uy1ST09ULUNBTlQtQ1JFQVRFCm1rZGlyOiBjYW5ub3QgY3JlYXRlIGRpcmVjdG9yeSDigJgvbW50 L0FTLVJPT1QtQ0FOVC1DUkVBVEXigJk6IFZhbHVlIHRvbyBsYXJnZSBmb3IgZGVmaW5lZCBkYXRh IHR5cGUKdWJ1bnR1QGYyLXZtOn4kIG1rZGlyIC9tbnQvaG9tZS91YnVudHUvQVMtVVNFUi0xMDAw LUNBTi1DUkVBVEUKCjMuIENyZWF0ZSBhIHZmYXQgdXNiIG1vdW50IGFuZCBleHBvc2UgdG8gdXNl ciAxMDAxIGFuZCA1MDAwCgp1YnVudHVAZjItdm06LyQgc3VkbyBtb3VudCAvZGV2L3NkYiAvbW50 CnVidW50dUBmMi12bTovJCBmaW5kbW50ICB8IGdyZXAgbW50CuKUlOKUgC9tbnQgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIC9kZXYvc2RiIHZmYXQgICAgICAgcncscmVsYXRpbWUsZm1h c2s9MDAyMixkbWFzaz0wMDIyLGNvZGVwYWdlPTQzNyxpb2NoYXJzZXQ9aXNvODg1OS0xLHNob3J0 bmFtZT1taXhlZCxlcnJvcnM9cmVtb3VudC1ybwp1YnVudHVAZjItdm06LyQgbHMgLWFsIC9tbnQK dG90YWwgMTIKZHJ3eHIteHIteCAgMiByb290IHJvb3QgNDA5NiBKYW4gIDEgIDE5NzAgLgpkcnd4 ci14ci14IDM0IHJvb3Qgcm9vdCA0MDk2IE9jdCAyOCAyMjoyNCAuLgotcnd4ci14ci14ICAxIHJv b3Qgcm9vdCAgICA0IE9jdCAyOCAwMzo0NCBhYWEKLXJ3eHIteHIteCAgMSByb290IHJvb3QgICAg MCBPY3QgMjggMDE6MDkgYmJiCnVidW50dUBmMi12bTovJCBzdWRvIC9tb3VudC1pZG1hcHBlZCAt LW1hcC1tb3VudCBiOjA6MTAwMToxIC9tbnQgL21udC0xMDAxLwp1YnVudHVAZjItdm06LyQgbHMg LWFsIC9tbnQtMTAwMS8KdG90YWwgMTIKZHJ3eHIteHIteCAgMiB1MTAwMSB1MTAwMSA0MDk2IEph biAgMSAgMTk3MCAuCmRyd3hyLXhyLXggMzQgcm9vdCAgcm9vdCAgNDA5NiBPY3QgMjggMjI6MjQg Li4KLXJ3eHIteHIteCAgMSB1MTAwMSB1MTAwMSAgICA0IE9jdCAyOCAwMzo0NCBhYWEKLXJ3eHIt eHIteCAgMSB1MTAwMSB1MTAwMSAgICAwIE9jdCAyOCAwMTowOSBiYmIKdWJ1bnR1QGYyLXZtOi8k IHN1ZG8gL21vdW50LWlkbWFwcGVkIC0tbWFwLW1vdW50IGI6MDo1MDAwOjEgL21udCAvbW50LTUw MDAvCnVidW50dUBmMi12bTovJCBscyAtYWwgL21udC01MDAwLwp0b3RhbCAxMgpkcnd4ci14ci14 ICAyIDUwMDAgNTAwMCA0MDk2IEphbiAgMSAgMTk3MCAuCmRyd3hyLXhyLXggMzQgcm9vdCByb290 IDQwOTYgT2N0IDI4IDIyOjI0IC4uCi1yd3hyLXhyLXggIDEgNTAwMCA1MDAwICAgIDQgT2N0IDI4 IDAzOjQ0IGFhYQotcnd4ci14ci14ICAxIDUwMDAgNTAwMCAgICAwIE9jdCAyOCAwMTowOSBiYmIK CjQuIENyZWF0ZSBhbiBpZG1hcHBlZCByb290ZnMgbW91bnQgZm9yIGEgY29udGFpbmVyCgpyb290 QGYyLXZtOn4jIGxzIC1hbCAvdmFyL2xpYi9seGMvZjIvcm9vdGZzLwp0b3RhbCA2OApkcnd4ci14 ci14IDE3IDIwMDAwIDIwMDAwIDQwOTYgU2VwIDI0IDA3OjQ4IC4KZHJ3eHJ3eC0tLSAgMyAyMDAw MCAyMDAwMCA0MDk2IE9jdCAxNiAxOToyNiAuLgpscnd4cnd4cnd4ICAxIDIwMDAwIDIwMDAwICAg IDcgU2VwIDI0IDA3OjQzIGJpbiAtPiB1c3IvYmluCmRyd3hyLXhyLXggIDIgMjAwMDAgMjAwMDAg NDA5NiBBcHIgMTUgIDIwMjAgYm9vdApkcnd4ci14ci14ICAzIDIwMDAwIDIwMDAwIDQwOTYgT2N0 IDE2IDE5OjI2IGRldgpkcnd4ci14ci14IDYxIDIwMDAwIDIwMDAwIDQwOTYgT2N0IDE2IDE5OjI2 IGV0Ywpkcnd4ci14ci14ICAzIDIwMDAwIDIwMDAwIDQwOTYgU2VwIDI0IDA3OjQ1IGhvbWUKbHJ3 eHJ3eHJ3eCAgMSAyMDAwMCAyMDAwMCAgICA3IFNlcCAyNCAwNzo0MyBsaWIgLT4gdXNyL2xpYgps cnd4cnd4cnd4ICAxIDIwMDAwIDIwMDAwICAgIDkgU2VwIDI0IDA3OjQzIGxpYjMyIC0+IHVzci9s aWIzMgpscnd4cnd4cnd4ICAxIDIwMDAwIDIwMDAwICAgIDkgU2VwIDI0IDA3OjQzIGxpYjY0IC0+ IHVzci9saWI2NApscnd4cnd4cnd4ICAxIDIwMDAwIDIwMDAwICAgMTAgU2VwIDI0IDA3OjQzIGxp YngzMiAtPiB1c3IvbGlieDMyCmRyd3hyLXhyLXggIDIgMjAwMDAgMjAwMDAgNDA5NiBTZXAgMjQg MDc6NDMgbWVkaWEKZHJ3eHIteHIteCAgMiAyMDAwMCAyMDAwMCA0MDk2IFNlcCAyNCAwNzo0MyBt bnQKZHJ3eHIteHIteCAgMiAyMDAwMCAyMDAwMCA0MDk2IFNlcCAyNCAwNzo0MyBvcHQKZHJ3eHIt eHIteCAgMiAyMDAwMCAyMDAwMCA0MDk2IEFwciAxNSAgMjAyMCBwcm9jCmRyd3gtLS0tLS0gIDIg MjAwMDAgMjAwMDAgNDA5NiBTZXAgMjQgMDc6NDMgcm9vdApkcnd4ci14ci14ICAyIDIwMDAwIDIw MDAwIDQwOTYgU2VwIDI0IDA3OjQ1IHJ1bgpscnd4cnd4cnd4ICAxIDIwMDAwIDIwMDAwICAgIDgg U2VwIDI0IDA3OjQzIHNiaW4gLT4gdXNyL3NiaW4KZHJ3eHIteHIteCAgMiAyMDAwMCAyMDAwMCA0 MDk2IFNlcCAyNCAwNzo0MyBzcnYKZHJ3eHIteHIteCAgMiAyMDAwMCAyMDAwMCA0MDk2IEFwciAx NSAgMjAyMCBzeXMKZHJ3eHJ3eHJ3dCAgMiAyMDAwMCAyMDAwMCA0MDk2IFNlcCAyNCAwNzo0NCB0 bXAKZHJ3eHIteHIteCAxMyAyMDAwMCAyMDAwMCA0MDk2IFNlcCAyNCAwNzo0MyB1c3IKZHJ3eHIt eHIteCAxMiAyMDAwMCAyMDAwMCA0MDk2IFNlcCAyNCAwNzo0NCB2YXIKcm9vdEBmMi12bTp+IyAv bW91bnQtaWRtYXBwZWQgLS1tYXAtbW91bnQgYjoyMDAwMDoxMDAwMDoxMDAwMDAgL3Zhci9saWIv bHhjL2YyL3Jvb3Rmcy8gL21udApyb290QGYyLXZtOn4jIGxzIC1hbCAvbW50CnRvdGFsIDY4CmRy d3hyLXhyLXggMTcgMTAwMDAgMTAwMDAgNDA5NiBTZXAgMjQgMDc6NDggLgpkcnd4ci14ci14IDM0 IHJvb3QgIHJvb3QgIDQwOTYgT2N0IDI4IDIyOjI0IC4uCmxyd3hyd3hyd3ggIDEgMTAwMDAgMTAw MDAgICAgNyBTZXAgMjQgMDc6NDMgYmluIC0+IHVzci9iaW4KZHJ3eHIteHIteCAgMiAxMDAwMCAx MDAwMCA0MDk2IEFwciAxNSAgMjAyMCBib290CmRyd3hyLXhyLXggIDMgMTAwMDAgMTAwMDAgNDA5 NiBPY3QgMTYgMTk6MjYgZGV2CmRyd3hyLXhyLXggNjEgMTAwMDAgMTAwMDAgNDA5NiBPY3QgMTYg MTk6MjYgZXRjCmRyd3hyLXhyLXggIDMgMTAwMDAgMTAwMDAgNDA5NiBTZXAgMjQgMDc6NDUgaG9t ZQpscnd4cnd4cnd4ICAxIDEwMDAwIDEwMDAwICAgIDcgU2VwIDI0IDA3OjQzIGxpYiAtPiB1c3Iv bGliCmxyd3hyd3hyd3ggIDEgMTAwMDAgMTAwMDAgICAgOSBTZXAgMjQgMDc6NDMgbGliMzIgLT4g dXNyL2xpYjMyCmxyd3hyd3hyd3ggIDEgMTAwMDAgMTAwMDAgICAgOSBTZXAgMjQgMDc6NDMgbGli NjQgLT4gdXNyL2xpYjY0Cmxyd3hyd3hyd3ggIDEgMTAwMDAgMTAwMDAgICAxMCBTZXAgMjQgMDc6 NDMgbGlieDMyIC0+IHVzci9saWJ4MzIKZHJ3eHIteHIteCAgMiAxMDAwMCAxMDAwMCA0MDk2IFNl cCAyNCAwNzo0MyBtZWRpYQpkcnd4ci14ci14ICAyIDEwMDAwIDEwMDAwIDQwOTYgU2VwIDI0IDA3 OjQzIG1udApkcnd4ci14ci14ICAyIDEwMDAwIDEwMDAwIDQwOTYgU2VwIDI0IDA3OjQzIG9wdApk cnd4ci14ci14ICAyIDEwMDAwIDEwMDAwIDQwOTYgQXByIDE1ICAyMDIwIHByb2MKZHJ3eC0tLS0t LSAgMiAxMDAwMCAxMDAwMCA0MDk2IFNlcCAyNCAwNzo0MyByb290CmRyd3hyLXhyLXggIDIgMTAw MDAgMTAwMDAgNDA5NiBTZXAgMjQgMDc6NDUgcnVuCmxyd3hyd3hyd3ggIDEgMTAwMDAgMTAwMDAg ICAgOCBTZXAgMjQgMDc6NDMgc2JpbiAtPiB1c3Ivc2Jpbgpkcnd4ci14ci14ICAyIDEwMDAwIDEw MDAwIDQwOTYgU2VwIDI0IDA3OjQzIHNydgpkcnd4ci14ci14ICAyIDEwMDAwIDEwMDAwIDQwOTYg QXByIDE1ICAyMDIwIHN5cwpkcnd4cnd4cnd0ICAyIDEwMDAwIDEwMDAwIDQwOTYgU2VwIDI0IDA3 OjQ0IHRtcApkcnd4ci14ci14IDEzIDEwMDAwIDEwMDAwIDQwOTYgU2VwIDI0IDA3OjQzIHVzcgpk cnd4ci14ci14IDEyIDEwMDAwIDEwMDAwIDQwOTYgU2VwIDI0IDA3OjQ0IHZhcgpyb290QGYyLXZt On4jIGx4Yy1zdGFydCBmMiAjIHVzZXMgL21udCBhcyByb290ZnMKcm9vdEBmMi12bTp+IyBseGMt YXR0YWNoIGYyIC0tIGNhdCAvcHJvYy8xL3VpZF9tYXAKICAgICAgICAgMCAgICAgIDEwMDAwICAg ICAgMTAwMDAKcm9vdEBmMi12bTp+IyBseGMtYXR0YWNoIGYyIC0tIGNhdCAvcHJvYy8xL2dpZF9t YXAKICAgICAgICAgMCAgICAgIDEwMDAwICAgICAgMTAwMDAKcm9vdEBmMi12bTp+IyBseGMtYXR0 YWNoIGYyIC0tIGxzIC1hbCAvCnRvdGFsIDUyCmRyd3hyLXhyLXggIDE3IHJvb3QgICByb290ICAg IDQwOTYgU2VwIDI0IDA3OjQ4IC4KZHJ3eHIteHIteCAgMTcgcm9vdCAgIHJvb3QgICAgNDA5NiBT ZXAgMjQgMDc6NDggLi4KbHJ3eHJ3eHJ3eCAgIDEgcm9vdCAgIHJvb3QgICAgICAgNyBTZXAgMjQg MDc6NDMgYmluIC0+IHVzci9iaW4KZHJ3eHIteHIteCAgIDIgcm9vdCAgIHJvb3QgICAgNDA5NiBB cHIgMTUgIDIwMjAgYm9vdApkcnd4ci14ci14ICAgNSByb290ICAgcm9vdCAgICAgNTAwIE9jdCAy OCAyMzozOSBkZXYKZHJ3eHIteHIteCAgNjEgcm9vdCAgIHJvb3QgICAgNDA5NiBPY3QgMjggMjM6 MzkgZXRjCmRyd3hyLXhyLXggICAzIHJvb3QgICByb290ICAgIDQwOTYgU2VwIDI0IDA3OjQ1IGhv bWUKbHJ3eHJ3eHJ3eCAgIDEgcm9vdCAgIHJvb3QgICAgICAgNyBTZXAgMjQgMDc6NDMgbGliIC0+ IHVzci9saWIKbHJ3eHJ3eHJ3eCAgIDEgcm9vdCAgIHJvb3QgICAgICAgOSBTZXAgMjQgMDc6NDMg bGliMzIgLT4gdXNyL2xpYjMyCmxyd3hyd3hyd3ggICAxIHJvb3QgICByb290ICAgICAgIDkgU2Vw IDI0IDA3OjQzIGxpYjY0IC0+IHVzci9saWI2NApscnd4cnd4cnd4ICAgMSByb290ICAgcm9vdCAg ICAgIDEwIFNlcCAyNCAwNzo0MyBsaWJ4MzIgLT4gdXNyL2xpYngzMgpkcnd4ci14ci14ICAgMiBy b290ICAgcm9vdCAgICA0MDk2IFNlcCAyNCAwNzo0MyBtZWRpYQpkcnd4ci14ci14ICAgMiByb290 ICAgcm9vdCAgICA0MDk2IFNlcCAyNCAwNzo0MyBtbnQKZHJ3eHIteHIteCAgIDIgcm9vdCAgIHJv b3QgICAgNDA5NiBTZXAgMjQgMDc6NDMgb3B0CmRyLXhyLXhyLXggMjMyIG5vYm9keSBub2dyb3Vw ICAgIDAgT2N0IDI4IDIzOjM5IHByb2MKZHJ3eC0tLS0tLSAgIDIgcm9vdCAgIHJvb3QgICAgNDA5 NiBPY3QgMjggMjM6NDEgcm9vdApkcnd4ci14ci14ICAxMiByb290ICAgcm9vdCAgICAgMzYwIE9j dCAyOCAyMzozOSBydW4KbHJ3eHJ3eHJ3eCAgIDEgcm9vdCAgIHJvb3QgICAgICAgOCBTZXAgMjQg MDc6NDMgc2JpbiAtPiB1c3Ivc2Jpbgpkcnd4ci14ci14ICAgMiByb290ICAgcm9vdCAgICA0MDk2 IFNlcCAyNCAwNzo0MyBzcnYKZHIteHIteHIteCAgMTMgbm9ib2R5IG5vZ3JvdXAgICAgMCBPY3Qg MjggMjM6Mzkgc3lzCmRyd3hyd3hyd3QgIDExIHJvb3QgICByb290ICAgIDQwOTYgT2N0IDI4IDIz OjQwIHRtcApkcnd4ci14ci14ICAxMyByb290ICAgcm9vdCAgICA0MDk2IFNlcCAyNCAwNzo0MyB1 c3IKZHJ3eHIteHIteCAgMTIgcm9vdCAgIHJvb3QgICAgNDA5NiBTZXAgMjQgMDc6NDQgdmFyCnJv b3RAZjItdm06fiMgbHhjLWF0dGFjaCBmMiAtLSBscyAtYWwgL215LWZpbGUKLXJ3LXItLXItLSAx IHJvb3Qgcm9vdCAwIE9jdCAyOCAyMzo0MyAvbXktZmlsZQpyb290QGYyLXZtOn4jIGxzIC1hbCAv dmFyL2xpYi9seGMvZjIvcm9vdGZzL215LWZpbGUKLXJ3LXItLXItLSAxIDIwMDAwIDIwMDAwIDAg T2N0IDI4IDIzOjQzIC92YXIvbGliL2x4Yy9mMi9yb290ZnMvbXktZmlsZQoKSSdkIGxpa2UgdG8g c2F5IHRoYW5rcyB0bzoKQWwgZm9yIHBvaW50aW5nIG1lIGludG8gdGhlIGRpcmVjdGlvbiB0byBh dm9pZCBpbm9kZSBhbGlhcyBpc3N1ZXMgZHVyaW5nCmxvb2t1cC4gRGF2aWQgZm9yIHZhcmlvdXMg ZGlzY3Vzc2lvbnMgYXJvdW5kIHRoaXMuIENocmlzdG9waCBmb3IgcG9ydGluZwp4ZnMsIHByb3Zp ZGluZyBnb29kIHJldmlld3MgYW5kIGZvciBiZWluZyBpbnZvbHZlZCBpbiB0aGUgb3JpZ2luYWwg aWRlYS4KVHljaG8gZm9yIGhlbHBpbmcgd2l0aCB0aGlzIHNlcmllcyBhbmQgb24gZnV0dXJlIHBh dGNoZXMgdG8gY29udmVydApmaWxlc3lzdGVtcy4gQWxiYW4gQ3JlcXV5IGFuZCB0aGUgS2ludm9s ayBwZWVwcyBsb2NhdGVkIGp1c3QgYSBmZXcKc3RyZWV0cyBhd2F5IGZyb20gbWUgaW4gQmVybGlu IGZvciBwcm92aWRpbmcgdXNlLWNhc2UgZGlzY3Vzc2lvbnMgYW5kCndyaXRpbmcgcGF0Y2hlcyBm b3IgY29udGFpbmVyZC4gU3TDqXBoYW5lIGZvciBoaXMgaW52YWx1YWJsZSBpbnB1dCBvbgptYW55 IHRoaW5ncyBhbmQgbGV2ZWwgaGVhZCBhbmQgZW5hYmxpbmcgbWUgdG8gd29yayBvbiB0aGlzLiBB bWlyIGZvcgpleHBsYWluaW5nIGFuZCBkaXNjdXNzaW5nIGFzcGVjdHMgb2Ygb3ZlcmxheWZzIHdp dGggbWUuIEknZCBsaWtlIHRvCmVzcGVjaWFsbHkgdGhhbmsgU2V0aCBGb3JzaGVlLiBIZSBwcm92 aWRlZCBhIGxvdCBvZiBnb29kIGFuYWx5c2lzLApzdWdnZXN0aW9ucywgYW5kIHBhcnRpY2lwYXRl ZCBpbiBzaG9ydC1ub3RpY2UgZGlzY3Vzc2lvbnMgaW4gYm90aCBjaGF0CmFuZCB2aWRlbyBmb3Ig c29tZSBuaXR0eS1ncml0dHkgdGVjaG5pY2FsIGRldGFpbHMuCgpUaGlzIHNlcmllcyBjYW4gYmUg Zm91bmQgYW5kIHB1bGxlZCBmcm9tIHRoZSB0aHJlZSB1c3VhbCBsb2NhdGlvbnM6Cmh0dHBzOi8v Z2l0Lmtlcm5lbC5vcmcvcHViL3NjbS9saW51eC9rZXJuZWwvZ2l0L2JyYXVuZXIvbGludXguZ2l0 L2xvZy8/aD1pZG1hcHBlZF9tb3VudHMKaHR0cHM6Ly9naXRodWIuY29tL2JyYXVuZXIvbGludXgv dHJlZS9pZG1hcHBlZF9tb3VudHMKaHR0cHM6Ly9naXRsYWIuY29tL2JyYXVuZXIvbGludXgvLS9j b21taXRzL2lkbWFwcGVkX21vdW50cwoKLyogdjUgKi8KLSBBZHJlc3MgQ2hyaXN0b3BoJ3MgZmVl ZGJhY2suCi0gVXNlIHY1LjExLXJjMyBhcyBuZXcgYmFzZS4KLSBBZGQgQ2hyaXN0b3BoJ3MgeGZz IHBvcnQuCgovKiB2NCAqLwotIFNwbGl0IG91dCBzZXZlcmFsIHByZXBhcmF0b3J5IHBhdGNoZXMg ZnJvbSB0aGUgaW5pdGlhbCBtb3VudF9zZXRhdHRyCiAgcGF0Y2ggYXMgcmVxdWVzdGVkIGJ5IENo cmlzdG9waC4KLSBBZGQgbmV3IHRlc3RzIGZvciBmaWxlL2RpcmVjdG9yeSBjcmVhdGlvbiBpbiBk aXJlY3RvcmllcyB3aXRoIHRoZQogIHNldGdpZCBiaXQgc2V0LiBTcGVjaWZpY2FsbHksIHZlcmlm eSB0aGF0IHRoZSBzZXRnaWQgYml0IGlzIGNvcnJlY3RseQogIGlnbm9yZWQgd2hlbiBjcmVhdGlu ZyBhIGZpbGUgd2l0aCB0aGUgc2V0Z2lkIGJpdCBhbmQgdGhlIHBhcmVudAogIGRpcmVjdG9yeSdz IGlfZ2lkIGlzbid0IGluX2dyb3VwX3AoKSBhbmQgdGhlIGNhbGxlciBpc24ndAogIGNhcGFibGVf d3J0X2lub2RlX3VpZGdpZCgpIG92ZXIgdGhlIHBhcmVudCBkaXJlY3RvcnkncyBpbm9kZSB3aGVu CiAgaW5vZGVfaW5pdF9vd25lcigpIGlzIGNhbGxlZC4KICBDb252ZXJzZWx5LCB2ZXJpZnkgdGhh dCB0aGUgc2V0Z2lkIGJpdCBpcyBzZXQgd2hlbiBjcmVhdGluZyBhIGZpbGUKICB3aXRoIHRoZSBz ZXRnaWQgYml0IGFuZCB0aGUgcGFyZW50J3MgaV9naWQgaXMgZWl0aGVyIGluX2dyb3VwX3AoKSBv cgogIHRoZSBjYWxsZXIgaXMgY2FwYWJsZV93cnRfaW5vZGVfdWlkZ2lkKCkgb3ZlciB0aGUgcGFy ZW50IGRpcmVjdG9yeSdzCiAgaW5vZGUuIEluIGFkZGl0aW9uYSwgdmVyaWZ5IHRoYXQgdGhlIHNl dGdpZCBiaXQgaXMgYWx3YXlzIGluaGVyaXRlZAogIHdoZW4gY3JlYXRpbmcgZGlyZWN0b3JpZXMu CiAgVGVzdCBhbGwgb2YgdGhpcyBvbiByZWd1bGFyIG1vdW50cywgaWRtYXBwZWQgbW91bnRzLCBh bmQgb24gaWRtYXBwZWQKICBtb3VudHMgaW4gdXNlciBuYW1lc3BhY2VzLgotIEFkZCBuZXcgdGVz dHMgdG8gdmVyaWZ5IHRoYXQgdGhlIGlfZ2lkIG9mIG5ld2x5IGNyZWF0ZWQgZmlsZXMgb3IKICBk aXJlY3RvcmllcyBpcyBjb3JyZWN0bHkgc2V0IHRvIHRoZSBwYXJlbnQgZGlyZWN0b3J5J3MgaV9n aWQgd2hlbiB0aGUKICBwYXJlbnQgZGlyZWN0b3J5IGhhcyB0aGUgc2V0Z2lkIGJpdCBzZXQuCi0g VXNlICJtbnRfdXNlcm5zIiBhcyB0aGUgZGUgZmFjdG8gbmFtZSBmb3IgYSB2ZnNtb3VudCdzIHVz ZXIgbmFtZXNwYWNlCiAgZXZlcnl3aGVyZSBhcyBzdWdnZXN0ZWQgYnkgU2VyZ2UuCi0gUmV1c2Ug ZXhpc3RpbmcgcHJvcGFnYXRpb24gZmxhZ3MgaW5zdGVhZCBvZiBpbnRyb2R1Y2luZyBuZXcgb25l cyBhcwogIHN1Z2dlc3RlZCBieSBDaHJpc3RvcGguIChUaGlzIGlzIGluIGxpbmUgd2l0aCBMaW51 cyByZXF1ZXN0IHRvIG5vdAogIGludHJvZHVjZSB0b28gbWFueSBuZXcgZmxhZ3MgYXMgZXZpZGVu Y2VkIGJ5IHByaW9yIGRpc2N1c3Npb25zIG9uCiAgb3RoZXIgcGF0Y2hzZXRzIHN1Y2ggYXMgb3Bl bmF0MigpLikKLSBBZGQgZmlyc3Qgc2V0IG9mIEFja2VkLWJ5cyBmcm9tIFNlcmdlIGFuZCBSZXZp ZXdlZC1ieXMgZnJvbSBDaHJpc3RvcGguCi0gRml4IGNvbW1pdCBtZXNzYWdlcyB0byByZWZsZWN0 IHRoZSBmYWN0IHRoYXQgd2UgbW9kaWZ5IGV4aXN0aW5nCiAgdmZzIGhlbHBlcnMgYnV0IGRvIG5v dCBpbnRyb2R1Y2UgbmV3IG9uZXMgbGlrZSB3ZSBkaWQgaW4gdGhlIGZpcnN0CiAgdmVyc2lvbi4g U29tZSBjb21taXQgbWVzc2FnZXMgc3RpbGwgaW1wbGllZCB3ZSB3ZXJlIGFkZGluZyBuZXcKICBo ZWxwZXJzLgotIFJlZm9ybWF0IGFsbCBjb21taXQgbWVzc2FnZXMgdG8gYWRoZXJlIHRvIDczIGNo YXIgbGVuZ3RoIGxpbWl0IGFuZAogIHdyYXAgYWxsIGxpbmVzIGluIGNvbW1pdHMgYXQgODAgY2hh cnMgd2hlbmV2ZXIgdGhpcyBkb2Vzbid0IGhpbmRlcgogIGxlZ2liaWxpdHkuCi0gU2ltcGxpZnkg dmFyaW91cyBjb2RlcGF0aHMgd2l0aCBDaHJpc3RvcGgncyBzdWdnZXN0aW9ucy4KCi8qIHYzICov Ci0gVGhlIG1ham9yIGNoYW5nZSBpcyB0aGUgcG9ydCBvZiB0aGUgdGVzdC1zdWl0ZSBmcm9tIHRo ZQogIGtlcm5lbC1pbnRlcm5hbCBzZWxmdGVzdHMgZnJhbWV3b3JrIHRvIHhmc3Rlc3RzIGFzIHJl cXVlc3RlZCBieQogIERhcnJpY2sgYW5kIENocmlzdG9waC4gVGhlIHRlc3Qtc3VpdGUgZm9yIHhm c3Rlc3RzIGlzIHBhdGNoIDM4IGluIHRoaXMKICBzZXJpZXMuIEl0IGhhcyBiZWVuIGtlcHQgYXMg cGFydCBvZiB0aGlzIHNlcmllcyBldmVuIHRob3VnaCBpdCBiZWxvbmdzCiAgdG8geGZzdGVzdHMg c28gaXQncyBlYXNpZXIgdG8gc2VlIHdoYXQgaXMgdGVzdGVkIGFuZCB0byBrZWVwIGl0CiAgaW4t c3luYy4KLSBOb3RlLCB0aGUgdGVzdC1zdWl0ZSBub3cgaGFzIGJlZW4gZXh0ZW5kZWQgdG8gY292 ZXIgaW9fdXJpbmcgYW5kCiAgaWRtYXBwZWQgbW91bnRzLiBUaGUgSU9SSU5HX1JFR0lTVEVSX1BF UlNPTkFMSVRZIGZlYXR1cmUgYWxsb3dzIHRvCiAgcmVnaXN0ZXIgdGhlIGNhbGxlcidzIGNyZWRl bnRpYWxzIHdpdGggaW9fdXJpbmcgYW5kIHJldHVybnMgYW4gaWQKICBhc3NvY2lhdGVkIHdpdGgg dGhlc2UgY3JlZGVudGlhbHMuIFRoaXMgaXMgdXNlZnVsIGZvciBhcHBsaWNhdGlvbnMKICB0aGF0 IHdpc2ggdG8gc2hhcmUgYSByaW5nIGJldHdlZW4gc2VwYXJhdGUgdXNlcnMvcHJvY2Vzc2VzLiBD YWxsZXJzCiAgY2FuIHBhc3MgaW4gdGhlIGNyZWRlbnRpYWwgaWQgaW4gdGhlIHNxZSBwZXJzb25h bGl0eSBmaWVsZC4gSWYgc2V0LAogIHRoYXQgcGFydGljdWxhciBzcWUgd2lsbCBiZSBpc3N1ZWQg d2l0aCB0aGVzZSBjcmVkZW50aWFscy4KICBUaGUgdGVzdC1zdWl0ZSBub3cgdGVzdHMgdGhhdCB0 aGUgb3BlbmF0KiBvcGVyYXRpb25zIHdpdGggZGlmZmVyZW50CiAgcmVnaXN0ZXJlZCBjcmVkZW50 aWFscyB3b3JrIGNvcnJlY3RseSBhbmQgc2FmZWx5IG9uIHJlZ3VsYXIgbW91bnRzLCBvbgogIHJl Z3VsYXIgbW91bnRzIGluc2lkZSB1c2VyIG5hbWVzcGFjZXMsIG9uIGlkbWFwcGVkIG1vdW50cywg YW5kIG9uCiAgaWRtYXBwZWQgbW91bnRzIGluc2lkZSB1c2VyIG5hbWVzcGFjZXMuCgovKiB2MiAq LwotIFRoZSBtYWpvciBjaGFuZ2UgaXMgdGhlIHJld29yayByZXF1ZXN0ZWQgYnkgQ2hyaXN0b3Bo IGFuZCBvdGhlcnMgdG8KICBhZGFwdCBhbGwgcmVsZXZhbnQgaGVscGVycyBhbmQgaW5vZGVfb3Bl cmF0aW9ucyBtZXRob2RzIHRvIGFjY291bnQgZm9yCiAgaWRtYXBwZWQgbW91bnRzIGluc3RlYWQg b2YgaW50cm9kdWNpbmcgbmV3IGhlbHBlcnMgYW5kIG1ldGhvZHMKICBzcGVjaWZpYyB0byBpZG1h cHBlZCBtb3VudHMgbGlrZSB3ZSBkaWQgYmVmb3JlLiBXZSd2ZSBhbHNvIG1vdmVkIHRoZQogIG92 ZXJsYXlmcyBjb252ZXJzaW9uIHRvIGhhbmRsZSBpZG1hcHBlZCBtb3VudHMgaW50byBhIHNlcGFy YXRlCiAgcGF0Y2hzZXQgdGhhdCB3aWxsIGJlIHNlbnQgb3V0IHNlcGFyYXRlbHkgYWZ0ZXIgdGhl IGNvcmUgY2hhbmdlcwogIGxhbmRlZC4gVGhlIGNvbnZlcnRlZCBmaWxlc3l0ZW1zIGluIHRoaXMg c2VyaWVzIGluY2x1ZGUgZmF0IGFuZCBleHQ0LgogIEFzIHBlciBDaHJpc3RvcGgncyByZXF1ZXN0 IHRoZSB2ZnMtd2lkZSBjb25maWcgb3B0aW9uIHRvIGRpc2FibGUKICBpZG1hcHBlZCBtb3VudHMg aGFzIGJlZW4gcmVtb3ZlZC4gSW5zdGVhZCB0aGUgZmlsZXN5c3RlbXMgY2FuIGRlY2lkZQogIHdo ZXRoZXIgb3Igbm90IHRoZXkgd2FudCB0byBhbGxvdyBpZG1hcCBtb3VudHMgdGhyb3VnaCBhIGNv bmZpZwogIG9wdGlvbi4gVGhlc2UgY29uZmlnIG9wdGlvbnMgZGVmYXVsdCB0byBvZmYuIEhhdmlu ZyBhIGNvbmZpZyBvcHRpb24KICBhbGxvd3MgdXMgdG8gZ2FpbiBzb21lIGNvbmZpZGVuY2UgaW4g dGhlIHBhdGNoc2V0IG92ZXIgbXVsdGlwbGUga2VybmVsCiAgcmVsZWFzZXMuCi0gVGhpcyB2ZXJz aW9uIGludHJvZHVjZXMgYSBsYXJnZSB0ZXN0LXN1aXRlIHRvIHRlc3QgY3VycmVudCB2ZnMKICBi ZWhhdmlvciBhbmQgaWRtYXBwZWQgbW91bnRzIGJlaGF2aW9yLiBUaGlzIHRlc3Qtc3VpdGUgaXMg aW50ZW5kZWQgdG8KICBncm93IG92ZXIgdGltZS4KLSBXaGlsZSB3aGlsZSB3b3JraW5nIG9uIGFk YXB0aW5nIHRoaXMgcGF0Y2hzZXQgdG8gdGhlIHJlcXVlc3RlZAogIGNoYW5nZXMsIHRoZSBydW5D IGFuZCBjb250YWluZXJkIGNyb3dkIHdhcyBuaWNlIGVub3VnaCB0byBhZGFwdAogIGNvbnRhaW5l cmQgdG8gdGhpcyBwYXRjaHNldCB0byBtYWtlIHVzZSBvZiBpZG1hcHBlZCBtb3VudHMgaW4gb25l IG9mCiAgdGhlIG1vc3Qgd2lkZWx5IHVzZWQgY29udGFpbmVyIHJ1bnRpbWVzOgogIGh0dHBzOi8v Z2l0aHViLmNvbS9jb250YWluZXJkL2NvbnRhaW5lcmQvcHVsbC80NzM0CgpUaGUgc29sdXRpb24g cHJvcG9zZWQgaGVyZSBoYXMgaXQncyBvcmlnaW5zIGluIG11bHRpcGxlIGRpc2N1c3Npb25zCmR1 cmluZyBMaW51eCBQbHVtYmVycyAyMDE3IGR1cmluZyBhbmQgYWZ0ZXIgdGhlIGVuZCBvZiB0aGUg Y29udGFpbmVycwptaWNyb2NvbmZlcmVuY2UuClRvIHRoZSBiZXN0IG9mIG15IGtub3dsZWRnZSB0 aGlzIGludm9sdmVkIEFsZWtzYSwgU3TDqXBoYW5lLCBFcmljLCBEYXZpZCwKSmFtZXMsIGFuZCBt eXNlbGYuVGhlIG9yaWdpbmFsIGlkZWEgb3IgYSB2YXJpYW50IHRoZXJlb2YgaGFzIGJlZW4KZGlz Y3Vzc2VkLCBhZ2FpbiB0byB0aGUgYmVzdCBvZiBteSBrbm93bGVkZ2UsIGFmdGVyIGEgTGludXgg Y29uZmVyZW5jZQppbiBTdC4gUGV0ZXJzYnVyZyBpbiBSdXNzaWEgaW4gMjAxNyBiZXR3ZWVuIENo cmlzdG9waCwgVHljaG8sIGFuZApteXNlbGYuCldlJ3ZlIHRha2VuIHRoZSB0aW1lIHRvIGltcGxl bWVudCBhIHdvcmtpbmcgdmVyc2lvbiBvZiB0aGlzIHNvbHV0aW9uCm92ZXIgdGhlIGxhc3Qgd2Vl a3MgdG8gdGhlIGJlc3Qgb2YgbXkgYWJpbGl0aWVzLiBUeWNobyBoYXMgc2lnbmVkIHVwCmZvciB0 aGlzIHNsaWd0aGx5IGNyYXp5IGVuZGVhdm91ciBhcyB3ZWxsIGFuZCBoZSBoYXMgaGVscGVkIHdp dGggdGhlCmNvbnZlcnNpb24gb2YgdGhlIHhhdHRyIGNvZGVwYXRocyBhbmQgd2lsbCBiZSBpbnZv bHZlZCB3aXRoIG90aGVycyBpbgpjb252ZXJ0aW5nIGFkZGl0aW9uYWwgZmlsZXN5c3RlbXMuCgpU aGFua3MhCkNocmlzdGlhbgoKQ2hyaXN0aWFuIEJyYXVuZXIgKDM3KToKICBtb3VudDogYXR0YWNo IG1hcHBpbmdzIHRvIG1vdW50cwogIGZzOiBhZGQgaWQgdHJhbnNsYXRpb24gaGVscGVycwogIGZz OiBhZGQgZmlsZSBhbmQgcGF0aCBwZXJtaXNzaW9ucyBoZWxwZXJzCiAgY2FwYWJpbGl0eTogaGFu ZGxlIGlkbWFwcGVkIG1vdW50cwogIG5hbWVpOiBtYWtlIHBlcm1pc3Npb24gaGVscGVycyBpZG1h cHBlZCBtb3VudCBhd2FyZQogIGlub2RlOiBtYWtlIGluaXQgYW5kIHBlcm1pc3Npb24gaGVscGVy cyBpZG1hcHBlZCBtb3VudCBhd2FyZQogIGF0dHI6IGhhbmRsZSBpZG1hcHBlZCBtb3VudHMKICBh Y2w6IGhhbmRsZSBpZG1hcHBlZCBtb3VudHMKICBjb21tb25jYXA6IGhhbmRsZSBpZG1hcHBlZCBt b3VudHMKICBzdGF0OiBoYW5kbGUgaWRtYXBwZWQgbW91bnRzCiAgbmFtZWk6IGhhbmRsZSBpZG1h cHBlZCBtb3VudHMgaW4gbWF5XyooKSBoZWxwZXJzCiAgbmFtZWk6IGludHJvZHVjZSBzdHJ1Y3Qg cmVuYW1lZGF0YQogIG5hbWVpOiBwcmVwYXJlIGZvciBpZG1hcHBlZCBtb3VudHMKICBvcGVuOiBo YW5kbGUgaWRtYXBwZWQgbW91bnRzIGluIGRvX3RydW5jYXRlKCkKICBvcGVuOiBoYW5kbGUgaWRt YXBwZWQgbW91bnRzCiAgYWZfdW5peDogaGFuZGxlIGlkbWFwcGVkIG1vdW50cwogIHV0aW1lczog aGFuZGxlIGlkbWFwcGVkIG1vdW50cwogIGZjbnRsOiBoYW5kbGUgaWRtYXBwZWQgbW91bnRzCiAg aW5pdDogaGFuZGxlIGlkbWFwcGVkIG1vdW50cwogIGlvY3RsOiBoYW5kbGUgaWRtYXBwZWQgbW91 bnRzCiAgd291bGRfZHVtcDogaGFuZGxlIGlkbWFwcGVkIG1vdW50cwogIGV4ZWM6IGhhbmRsZSBp ZG1hcHBlZCBtb3VudHMKICBmczogbWFrZSBoZWxwZXJzIGlkbWFwIG1vdW50IGF3YXJlCiAgYXBw YXJtb3I6IGhhbmRsZSBpZG1hcHBlZCBtb3VudHMKICBpbWE6IGhhbmRsZSBpZG1hcHBlZCBtb3Vu dHMKICBlY3J5cHRmczogZG8gbm90IG1vdW50IG9uIHRvcCBvZiBpZG1hcHBlZCBtb3VudHMKICBv dmVybGF5ZnM6IGRvIG5vdCBtb3VudCBvbiB0b3Agb2YgaWRtYXBwZWQgbW91bnRzCiAgbmFtZXNw YWNlOiB0YWtlIGxvY2tfbW91bnRfaGFzaCgpIGRpcmVjdGx5IHdoZW4gY2hhbmdpbmcgZmxhZ3MK ICBtb3VudDogbWFrZSB7bG9jayx1bmxvY2t9X21vdW50X2hhc2goKSBzdGF0aWMKICBuYW1lc3Bh Y2U6IG9ubHkgdGFrZSByZWFkIGxvY2sgaW4gZG9fcmVjb25maWd1cmVfbW50KCkKICBmczogc3Bs aXQgb3V0IGZ1bmN0aW9ucyB0byBob2xkIHdyaXRlcnMKICBmczogYWRkIGF0dHJfZmxhZ3NfdG9f bW50X2ZsYWdzIGhlbHBlcgogIGZzOiBhZGQgbW91bnRfc2V0YXR0cigpCiAgZnM6IGludHJvZHVj ZSBNT1VOVF9BVFRSX0lETUFQCiAgdGVzdHM6IGFkZCBtb3VudF9zZXRhdHRyKCkgc2VsZnRlc3Rz CiAgZmF0OiBoYW5kbGUgaWRtYXBwZWQgbW91bnRzCiAgZXh0NDogc3VwcG9ydCBpZG1hcHBlZCBt b3VudHMKCkNocmlzdG9waCBIZWxsd2lnICgxKToKICB4ZnM6IHN1cHBvcnQgaWRtYXBwZWQgbW91 bnRzCgpUeWNobyBBbmRlcnNlbiAoMSk6CiAgeGF0dHI6IGhhbmRsZSBpZG1hcHBlZCBtb3VudHMK CiBEb2N1bWVudGF0aW9uL2ZpbGVzeXN0ZW1zL2xvY2tpbmcucnN0ICAgICAgICAgfCAgICA3ICst CiBEb2N1bWVudGF0aW9uL2ZpbGVzeXN0ZW1zL3BvcnRpbmcucnN0ICAgICAgICAgfCAgICAyICsK IERvY3VtZW50YXRpb24vZmlsZXN5c3RlbXMvdmZzLnJzdCAgICAgICAgICAgICB8ICAgMTkgKy0K IGFyY2gvYWxwaGEva2VybmVsL3N5c2NhbGxzL3N5c2NhbGwudGJsICAgICAgICB8ICAgIDEgKwog YXJjaC9hcm0vdG9vbHMvc3lzY2FsbC50YmwgICAgICAgICAgICAgICAgICAgIHwgICAgMSArCiBh cmNoL2FybTY0L2luY2x1ZGUvYXNtL3VuaXN0ZC5oICAgICAgICAgICAgICAgfCAgICAyICstCiBh cmNoL2FybTY0L2luY2x1ZGUvYXNtL3VuaXN0ZDMyLmggICAgICAgICAgICAgfCAgICAyICsKIGFy Y2gvaWE2NC9rZXJuZWwvc3lzY2FsbHMvc3lzY2FsbC50YmwgICAgICAgICB8ICAgIDEgKwogYXJj aC9tNjhrL2tlcm5lbC9zeXNjYWxscy9zeXNjYWxsLnRibCAgICAgICAgIHwgICAgMSArCiBhcmNo L21pY3JvYmxhemUva2VybmVsL3N5c2NhbGxzL3N5c2NhbGwudGJsICAgfCAgICAxICsKIGFyY2gv bWlwcy9rZXJuZWwvc3lzY2FsbHMvc3lzY2FsbF9uMzIudGJsICAgICB8ICAgIDEgKwogYXJjaC9t aXBzL2tlcm5lbC9zeXNjYWxscy9zeXNjYWxsX242NC50YmwgICAgIHwgICAgMSArCiBhcmNoL21p cHMva2VybmVsL3N5c2NhbGxzL3N5c2NhbGxfbzMyLnRibCAgICAgfCAgICAxICsKIGFyY2gvcGFy aXNjL2tlcm5lbC9zeXNjYWxscy9zeXNjYWxsLnRibCAgICAgICB8ICAgIDEgKwogYXJjaC9wb3dl cnBjL2tlcm5lbC9zeXNjYWxscy9zeXNjYWxsLnRibCAgICAgIHwgICAgMSArCiBhcmNoL3Bvd2Vy cGMvcGxhdGZvcm1zL2NlbGwvc3B1ZnMvaW5vZGUuYyAgICAgfCAgICA1ICstCiBhcmNoL3MzOTAv a2VybmVsL3N5c2NhbGxzL3N5c2NhbGwudGJsICAgICAgICAgfCAgICAxICsKIGFyY2gvc2gva2Vy bmVsL3N5c2NhbGxzL3N5c2NhbGwudGJsICAgICAgICAgICB8ICAgIDEgKwogYXJjaC9zcGFyYy9r ZXJuZWwvc3lzY2FsbHMvc3lzY2FsbC50YmwgICAgICAgIHwgICAgMSArCiBhcmNoL3g4Ni9lbnRy eS9zeXNjYWxscy9zeXNjYWxsXzMyLnRibCAgICAgICAgfCAgICAxICsKIGFyY2gveDg2L2VudHJ5 L3N5c2NhbGxzL3N5c2NhbGxfNjQudGJsICAgICAgICB8ICAgIDEgKwogYXJjaC94dGVuc2Eva2Vy bmVsL3N5c2NhbGxzL3N5c2NhbGwudGJsICAgICAgIHwgICAgMSArCiBkcml2ZXJzL2FuZHJvaWQv YmluZGVyZnMuYyAgICAgICAgICAgICAgICAgICAgfCAgICA2ICstCiBkcml2ZXJzL2Jhc2UvZGV2 dG1wZnMuYyAgICAgICAgICAgICAgICAgICAgICAgfCAgIDE1ICstCiBmcy85cC9hY2wuYyAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfCAgICA4ICstCiBmcy85cC92OWZzLmggICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfCAgICAzICstCiBmcy85cC92OWZzX3Zmcy5o ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfCAgICAzICstCiBmcy85cC92ZnNfaW5vZGUu YyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfCAgIDM2ICstCiBmcy85cC92ZnNfaW5vZGVf ZG90bC5jICAgICAgICAgICAgICAgICAgICAgICAgfCAgIDM5ICstCiBmcy85cC94YXR0ci5jICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfCAgICAxICsKIGZzL2FkZnMvYWRmcy5oICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8ICAgIDMgKy0KIGZzL2FkZnMvaW5vZGUuYyAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8ICAgIDUgKy0KIGZzL2FmZnMvYWZmcy5oICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8ICAgMjQgKy0KIGZzL2FmZnMvaW5vZGUuYyAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8ICAgIDcgKy0KIGZzL2FmZnMvbmFtZWkuYyAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8ICAgMTUgKy0KIGZzL2Fmcy9kaXIuYyAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8ICAgMzQgKy0KIGZzL2Fmcy9pbm9kZS5jICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8ICAgIDkgKy0KIGZzL2Fmcy9pbnRlcm5hbC5o ICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8ICAgIDcgKy0KIGZzL2Fmcy9zZWN1cml0eS5j ICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8ICAgIDMgKy0KIGZzL2Fmcy94YXR0ci5jICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8ICAgIDIgKwogZnMvYXR0ci5jICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIHwgIDEyNiArLQogZnMvYXV0b2ZzL3Jvb3QuYyAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIHwgICAxNyArLQogZnMvYmFkX2lub2RlLmMgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIHwgICAzNiArLQogZnMvYmZzL2Rpci5jICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIHwgICAxMiArLQogZnMvYnRyZnMvYWNsLmMgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIHwgICAgNiArLQogZnMvYnRyZnMvY3RyZWUuaCAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIHwgICAgMyArLQogZnMvYnRyZnMvaW5vZGUuYyAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIHwgICA0NiArLQogZnMvYnRyZnMvaW9jdGwuYyAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIHwgICAyNyArLQogZnMvYnRyZnMvdGVzdHMvYnRy ZnMtdGVzdHMuYyAgICAgICAgICAgICAgICAgIHwgICAgMiArLQogZnMvYnRyZnMveGF0dHIuYyAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIHwgICAgMiArCiBmcy9jYWNoZWZpbGVzL2ludGVy ZmFjZS5jICAgICAgICAgICAgICAgICAgICAgfCAgICA0ICstCiBmcy9jYWNoZWZpbGVzL25hbWVp LmMgICAgICAgICAgICAgICAgICAgICAgICAgfCAgIDIxICstCiBmcy9jYWNoZWZpbGVzL3hhdHRy LmMgICAgICAgICAgICAgICAgICAgICAgICAgfCAgIDI5ICstCiBmcy9jZXBoL2FjbC5jICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgfCAgICA2ICstCiBmcy9jZXBoL2Rpci5jICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgfCAgIDIzICstCiBmcy9jZXBoL2lub2RlLmMgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgfCAgIDE4ICstCiBmcy9jZXBoL3N1cGVyLmggICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgfCAgIDEyICstCiBmcy9jZXBoL3hhdHRyLmMgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgfCAgICAxICsKIGZzL2NpZnMvY2lmc2ZzLmMgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICB8ICAgIDUgKy0KIGZzL2NpZnMvY2lmc2ZzLmggICAg ICAgICAgICAgICAgICAgICAgICAgICAgICB8ICAgMjUgKy0KIGZzL2NpZnMvZGlyLmMgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICB8ICAgIDggKy0KIGZzL2NpZnMvaW5vZGUuYyAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICB8ICAgMjYgKy0KIGZzL2NpZnMvbGluay5jICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICB8ICAgIDMgKy0KIGZzL2NpZnMveGF0dHIuYyAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICB8ICAgIDEgKwogZnMvY29kYS9jb2RhX2xpbnV4Lmgg ICAgICAgICAgICAgICAgICAgICAgICAgIHwgICAgOCArLQogZnMvY29kYS9kaXIuYyAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIHwgICAxOCArLQogZnMvY29kYS9pbm9kZS5jICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIHwgICAgOSArLQogZnMvY29kYS9waW9jdGwuYyAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIHwgICAgNiArLQogZnMvY29uZmlnZnMvY29uZmlnZnNf aW50ZXJuYWwuaCAgICAgICAgICAgICAgIHwgICAgNiArLQogZnMvY29uZmlnZnMvZGlyLmMgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIHwgICAgMyArLQogZnMvY29uZmlnZnMvaW5vZGUuYyAg ICAgICAgICAgICAgICAgICAgICAgICAgIHwgICAgNSArLQogZnMvY29uZmlnZnMvc3ltbGluay5j ICAgICAgICAgICAgICAgICAgICAgICAgIHwgICAgNiArLQogZnMvY29yZWR1bXAuYyAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIHwgICAxMCArLQogZnMvY3J5cHRvL3BvbGljeS5jICAg ICAgICAgICAgICAgICAgICAgICAgICAgIHwgICAgMiArLQogZnMvZGVidWdmcy9pbm9kZS5jICAg ICAgICAgICAgICAgICAgICAgICAgICAgIHwgICAgOSArLQogZnMvZWNyeXB0ZnMvY3J5cHRvLmMg ICAgICAgICAgICAgICAgICAgICAgICAgIHwgICAgNCArLQogZnMvZWNyeXB0ZnMvaW5vZGUuYyAg ICAgICAgICAgICAgICAgICAgICAgICAgIHwgICA4NSArLQogZnMvZWNyeXB0ZnMvbWFpbi5jICAg ICAgICAgICAgICAgICAgICAgICAgICAgIHwgICAgNiArCiBmcy9lY3J5cHRmcy9tbWFwLmMgICAg ICAgICAgICAgICAgICAgICAgICAgICAgfCAgICA0ICstCiBmcy9lZml2YXJmcy9maWxlLmMgICAg ICAgICAgICAgICAgICAgICAgICAgICAgfCAgICAyICstCiBmcy9lZml2YXJmcy9pbm9kZS5jICAg ICAgICAgICAgICAgICAgICAgICAgICAgfCAgICA0ICstCiBmcy9lcm9mcy9pbm9kZS5jICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgfCAgICA3ICstCiBmcy9lcm9mcy9pbnRlcm5hbC5oICAg ICAgICAgICAgICAgICAgICAgICAgICAgfCAgICA1ICstCiBmcy9leGVjLmMgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgfCAgIDEyICstCiBmcy9leGZhdC9leGZhdF9mcy5oICAg ICAgICAgICAgICAgICAgICAgICAgICAgfCAgICA4ICstCiBmcy9leGZhdC9maWxlLmMgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgfCAgIDE0ICstCiBmcy9leGZhdC9uYW1laS5jICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgfCAgIDE0ICstCiBmcy9leHQyL2FjbC5jICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgfCAgICA2ICstCiBmcy9leHQyL2FjbC5oICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgfCAgICAzICstCiBmcy9leHQyL2V4dDIuaCAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgfCAgICA1ICstCiBmcy9leHQyL2lhbGxvYy5jICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgfCAgICAyICstCiBmcy9leHQyL2lub2RlLmMgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgfCAgIDE1ICstCiBmcy9leHQyL2lvY3RsLmMgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgfCAgICA2ICstCiBmcy9leHQyL25hbWVpLmMgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgfCAgIDIyICstCiBmcy9leHQyL3hhdHRyX3NlY3VyaXR5 LmMgICAgICAgICAgICAgICAgICAgICAgfCAgICAxICsKIGZzL2V4dDIveGF0dHJfdHJ1c3RlZC5j ICAgICAgICAgICAgICAgICAgICAgICB8ICAgIDEgKwogZnMvZXh0Mi94YXR0cl91c2VyLmMgICAg ICAgICAgICAgICAgICAgICAgICAgIHwgICAgMSArCiBmcy9leHQ0L2FjbC5jICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgfCAgICA1ICstCiBmcy9leHQ0L2FjbC5oICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgfCAgICAzICstCiBmcy9leHQ0L2V4dDQuaCAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgfCAgIDIyICstCiBmcy9leHQ0L2lhbGxvYy5jICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgfCAgICA3ICstCiBmcy9leHQ0L2lub2RlLmMgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgfCAgIDIxICstCiBmcy9leHQ0L2lvY3RsLmMgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgfCAgIDIwICstCiBmcy9leHQ0L25hbWVpLmMgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgfCAgIDQ5ICstCiBmcy9leHQ0L3N1cGVyLmMgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgfCAgICAyICstCiBmcy9leHQ0L3hhdHRyX2h1cmQuYyAgICAg ICAgICAgICAgICAgICAgICAgICAgfCAgICAxICsKIGZzL2V4dDQveGF0dHJfc2VjdXJpdHkuYyAg ICAgICAgICAgICAgICAgICAgICB8ICAgIDEgKwogZnMvZXh0NC94YXR0cl90cnVzdGVkLmMgICAg ICAgICAgICAgICAgICAgICAgIHwgICAgMSArCiBmcy9leHQ0L3hhdHRyX3VzZXIuYyAgICAgICAg ICAgICAgICAgICAgICAgICAgfCAgICAxICsKIGZzL2YyZnMvYWNsLmMgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICB8ICAgIDYgKy0KIGZzL2YyZnMvYWNsLmggICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICB8ICAgIDMgKy0KIGZzL2YyZnMvZjJmcy5oICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICB8ICAgIDcgKy0KIGZzL2YyZnMvZmlsZS5jICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICB8ICAgMzYgKy0KIGZzL2YyZnMvbmFtZWkuYyAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICB8ICAgMjMgKy0KIGZzL2YyZnMveGF0dHIuYyAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICB8ICAgIDQgKy0KIGZzL2ZhdC9mYXQuaCAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICB8ICAgIDYgKy0KIGZzL2ZhdC9maWxlLmMgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICB8ICAgMjQgKy0KIGZzL2ZhdC9uYW1laV9tc2Rvcy5jICAgICAgICAg ICAgICAgICAgICAgICAgICB8ICAgMTIgKy0KIGZzL2ZhdC9uYW1laV92ZmF0LmMgICAgICAgICAg ICAgICAgICAgICAgICAgICB8ICAgMTUgKy0KIGZzL2ZjbnRsLmMgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICB8ICAgIDMgKy0KIGZzL2Z1c2UvYWNsLmMgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICB8ICAgIDMgKy0KIGZzL2Z1c2UvZGlyLmMgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICB8ICAgNDYgKy0KIGZzL2Z1c2UvZnVzZV9pLmggICAgICAgICAgICAg ICAgICAgICAgICAgICAgICB8ICAgIDQgKy0KIGZzL2Z1c2UveGF0dHIuYyAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICB8ICAgIDIgKwogZnMvZ2ZzMi9hY2wuYyAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIHwgICAgNSArLQogZnMvZ2ZzMi9hY2wuaCAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIHwgICAgMyArLQogZnMvZ2ZzMi9maWxlLmMgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIHwgICAgNCArLQogZnMvZ2ZzMi9pbm9kZS5jICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIHwgICA2NCArLQogZnMvZ2ZzMi9pbm9kZS5oICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIHwgICAgMyArLQogZnMvZ2ZzMi94YXR0ci5jICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIHwgICAgMSArCiBmcy9oZnMvYXR0ci5jICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgfCAgICAxICsKIGZzL2hmcy9kaXIuYyAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICB8ICAgMTMgKy0KIGZzL2hmcy9oZnNfZnMuaCAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICB8ICAgIDMgKy0KIGZzL2hmcy9pbm9kZS5jICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICB8ICAgIDggKy0KIGZzL2hmc3BsdXMvZGlyLmMgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICB8ICAgMjIgKy0KIGZzL2hmc3BsdXMvaGZzcGx1c19mcy5oICAgICAgICAg ICAgICAgICAgICAgICB8ICAgIDUgKy0KIGZzL2hmc3BsdXMvaW5vZGUuYyAgICAgICAgICAgICAg ICAgICAgICAgICAgICB8ICAgMTYgKy0KIGZzL2hmc3BsdXMvaW9jdGwuYyAgICAgICAgICAgICAg ICAgICAgICAgICAgICB8ICAgIDIgKy0KIGZzL2hmc3BsdXMveGF0dHIuYyAgICAgICAgICAgICAg ICAgICAgICAgICAgICB8ICAgIDEgKwogZnMvaGZzcGx1cy94YXR0cl9zZWN1cml0eS5jICAgICAg ICAgICAgICAgICAgIHwgICAgMSArCiBmcy9oZnNwbHVzL3hhdHRyX3RydXN0ZWQuYyAgICAgICAg ICAgICAgICAgICAgfCAgICAxICsKIGZzL2hmc3BsdXMveGF0dHJfdXNlci5jICAgICAgICAgICAg ICAgICAgICAgICB8ICAgIDEgKwogZnMvaG9zdGZzL2hvc3Rmc19rZXJuLmMgICAgICAgICAgICAg ICAgICAgICAgIHwgICAyOSArLQogZnMvaHBmcy9ocGZzX2ZuLmggICAgICAgICAgICAgICAgICAg ICAgICAgICAgIHwgICAgMiArLQogZnMvaHBmcy9pbm9kZS5jICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIHwgICAgNyArLQogZnMvaHBmcy9uYW1laS5jICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIHwgICAyMCArLQogZnMvaHVnZXRsYmZzL2lub2RlLmMgICAgICAgICAgICAgICAg ICAgICAgICAgIHwgICAzNSArLQogZnMvaW5pdC5jICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIHwgICAyNCArLQogZnMvaW5vZGUuYyAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIHwgICA0NCArLQogZnMvaW50ZXJuYWwuaCAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIHwgICAgMiArLQogZnMvamZmczIvYWNsLmMgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIHwgICAgNiArLQogZnMvamZmczIvYWNsLmggICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIHwgICAgMyArLQogZnMvamZmczIvZGlyLmMgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIHwgICAzMyArLQogZnMvamZmczIvZnMuYyAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIHwgICAgNyArLQogZnMvamZmczIvb3MtbGludXguaCAgICAgICAgICAgICAgICAg ICAgICAgICAgIHwgICAgMiArLQogZnMvamZmczIvc2VjdXJpdHkuYyAgICAgICAgICAgICAgICAg ICAgICAgICAgIHwgICAgMSArCiBmcy9qZmZzMi94YXR0cl90cnVzdGVkLmMgICAgICAgICAgICAg ICAgICAgICAgfCAgICAxICsKIGZzL2pmZnMyL3hhdHRyX3VzZXIuYyAgICAgICAgICAgICAgICAg ICAgICAgICB8ICAgIDEgKwogZnMvamZzL2FjbC5jICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIHwgICAgNSArLQogZnMvamZzL2ZpbGUuYyAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIHwgICAgOSArLQogZnMvamZzL2lvY3RsLmMgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIHwgICAgMiArLQogZnMvamZzL2pmc19hY2wuaCAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIHwgICAgMyArLQogZnMvamZzL2pmc19pbm9kZS5jICAgICAgICAgICAgICAgICAgICAg ICAgICAgIHwgICAgMiArLQogZnMvamZzL2pmc19pbm9kZS5oICAgICAgICAgICAgICAgICAgICAg ICAgICAgIHwgICAgMiArLQogZnMvamZzL25hbWVpLmMgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIHwgICAyMSArLQogZnMvamZzL3hhdHRyLmMgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIHwgICAgMiArCiBmcy9rZXJuZnMvZGlyLmMgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgfCAgICA2ICstCiBmcy9rZXJuZnMvaW5vZGUuYyAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgfCAgIDE5ICstCiBmcy9rZXJuZnMva2VybmZzLWludGVybmFsLmggICAgICAgICAgICAg ICAgICAgfCAgICA5ICstCiBmcy9saWJmcy5jICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgfCAgIDI4ICstCiBmcy9taW5peC9iaXRtYXAuYyAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgfCAgICAyICstCiBmcy9taW5peC9maWxlLmMgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgfCAgICA3ICstCiBmcy9taW5peC9pbm9kZS5jICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgfCAgICA2ICstCiBmcy9taW5peC9taW5peC5oICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgfCAgICAzICstCiBmcy9taW5peC9uYW1laS5jICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgfCAgIDI0ICstCiBmcy9tb3VudC5oICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgfCAgIDEwIC0KIGZzL25hbWVpLmMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICB8ICA1MTIgKysrKy0tCiBmcy9uYW1lc3BhY2UuYyAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgfCAgNDgwICsrKysrLQogZnMvbmZzL2Rpci5jICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIHwgICAyNSArLQogZnMvbmZzL2lub2RlLmMgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIHwgICAgOSArLQogZnMvbmZzL2ludGVybmFsLmggICAgICAgICAgICAgICAg ICAgICAgICAgICAgIHwgICAxNCArLQogZnMvbmZzL25hbWVzcGFjZS5jICAgICAgICAgICAgICAg ICAgICAgICAgICAgIHwgICAxNSArLQogZnMvbmZzL25mczNfZnMuaCAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIHwgICAgMyArLQogZnMvbmZzL25mczNhY2wuYyAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIHwgICAgMyArLQogZnMvbmZzL25mczRwcm9jLmMgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIHwgICAgMyArCiBmcy9uZnNkL25mczJhY2wuYyAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgfCAgICA2ICstCiBmcy9uZnNkL25mczNhY2wuYyAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgfCAgICA2ICstCiBmcy9uZnNkL25mczRhY2wuYyAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgfCAgICA1ICstCiBmcy9uZnNkL25mczRyZWNvdmVyLmMgICAgICAgICAgICAg ICAgICAgICAgICAgfCAgICA2ICstCiBmcy9uZnNkL25mc2ZoLmMgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgfCAgICAzICstCiBmcy9uZnNkL25mc3Byb2MuYyAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgfCAgICAyICstCiBmcy9uZnNkL3Zmcy5jICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgfCAgIDUwICstCiBmcy9uaWxmczIvaW5vZGUuYyAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgfCAgIDE0ICstCiBmcy9uaWxmczIvaW9jdGwuYyAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgfCAgICAyICstCiBmcy9uaWxmczIvbmFtZWkuYyAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgfCAgIDE5ICstCiBmcy9uaWxmczIvbmlsZnMuaCAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgfCAgICA2ICstCiBmcy9ub3RpZnkvZmFub3RpZnkvZmFub3RpZnlfdXNlci5j ICAgICAgICAgICAgfCAgICAyICstCiBmcy9ub3RpZnkvaW5vdGlmeS9pbm90aWZ5X3VzZXIuYyAg ICAgICAgICAgICAgfCAgICAyICstCiBmcy9udGZzL2lub2RlLmMgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgfCAgICA2ICstCiBmcy9udGZzL2lub2RlLmggICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgfCAgICAzICstCiBmcy9vY2ZzMi9hY2wuYyAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgfCAgICA2ICstCiBmcy9vY2ZzMi9hY2wuaCAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgfCAgICAzICstCiBmcy9vY2ZzMi9kbG1mcy9kbG1mcy5jICAgICAgICAgICAg ICAgICAgICAgICAgfCAgIDE3ICstCiBmcy9vY2ZzMi9maWxlLmMgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgfCAgIDE4ICstCiBmcy9vY2ZzMi9maWxlLmggICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgfCAgIDExICstCiBmcy9vY2ZzMi9pb2N0bC5jICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgfCAgICAyICstCiBmcy9vY2ZzMi9uYW1laS5jICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgfCAgIDIxICstCiBmcy9vY2ZzMi9yZWZjb3VudHRyZWUuYyAgICAgICAgICAg ICAgICAgICAgICAgfCAgICA0ICstCiBmcy9vY2ZzMi94YXR0ci5jICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgfCAgICAzICsKIGZzL29tZnMvZGlyLmMgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICB8ICAgMTMgKy0KIGZzL29tZnMvZmlsZS5jICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICB8ICAgIDcgKy0KIGZzL29tZnMvaW5vZGUuYyAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICB8ICAgIDIgKy0KIGZzL29wZW4uYyAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICB8ICAgMzUgKy0KIGZzL29yYW5nZWZzL2FjbC5jICAgICAgICAgICAgICAgICAg ICAgICAgICAgICB8ICAgIDYgKy0KIGZzL29yYW5nZWZzL2lub2RlLmMgICAgICAgICAgICAgICAg ICAgICAgICAgICB8ICAgMjAgKy0KIGZzL29yYW5nZWZzL25hbWVpLmMgICAgICAgICAgICAgICAg ICAgICAgICAgICB8ICAgMTIgKy0KIGZzL29yYW5nZWZzL29yYW5nZWZzLWtlcm5lbC5oICAgICAg ICAgICAgICAgICB8ICAgMTMgKy0KIGZzL29yYW5nZWZzL3hhdHRyLmMgICAgICAgICAgICAgICAg ICAgICAgICAgICB8ICAgIDEgKwogZnMvb3ZlcmxheWZzL2NvcHlfdXAuYyAgICAgICAgICAgICAg ICAgICAgICAgIHwgICAyMiArLQogZnMvb3ZlcmxheWZzL2Rpci5jICAgICAgICAgICAgICAgICAg ICAgICAgICAgIHwgICAzMSArLQogZnMvb3ZlcmxheWZzL2ZpbGUuYyAgICAgICAgICAgICAgICAg ICAgICAgICAgIHwgICAgNiArLQogZnMvb3ZlcmxheWZzL2lub2RlLmMgICAgICAgICAgICAgICAg ICAgICAgICAgIHwgICAyNyArLQogZnMvb3ZlcmxheWZzL292ZXJsYXlmcy5oICAgICAgICAgICAg ICAgICAgICAgIHwgICA0NSArLQogZnMvb3ZlcmxheWZzL3N1cGVyLmMgICAgICAgICAgICAgICAg ICAgICAgICAgIHwgICAyMSArLQogZnMvb3ZlcmxheWZzL3V0aWwuYyAgICAgICAgICAgICAgICAg ICAgICAgICAgIHwgICAgNCArLQogZnMvcG9zaXhfYWNsLmMgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIHwgIDEwMyArLQogZnMvcHJvYy9iYXNlLmMgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIHwgICAyOCArLQogZnMvcHJvYy9mZC5jICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIHwgICAgNSArLQogZnMvcHJvYy9mZC5oICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIHwgICAgMyArLQogZnMvcHJvYy9nZW5lcmljLmMgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIHwgICAxMiArLQogZnMvcHJvYy9pbnRlcm5hbC5oICAgICAgICAgICAgICAgICAg ICAgICAgICAgIHwgICAgNiArLQogZnMvcHJvYy9wcm9jX25ldC5jICAgICAgICAgICAgICAgICAg ICAgICAgICAgIHwgICAgNSArLQogZnMvcHJvYy9wcm9jX3N5c2N0bC5jICAgICAgICAgICAgICAg ICAgICAgICAgIHwgICAxNSArLQogZnMvcHJvYy9yb290LmMgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIHwgICAgNSArLQogZnMvcHJvY19uYW1lc3BhY2UuYyAgICAgICAgICAgICAgICAg ICAgICAgICAgIHwgICAgMyArCiBmcy9yYW1mcy9maWxlLW5vbW11LmMgICAgICAgICAgICAgICAg ICAgICAgICAgfCAgICA5ICstCiBmcy9yYW1mcy9pbm9kZS5jICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgfCAgIDE4ICstCiBmcy9yZWlzZXJmcy9hY2wuaCAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgfCAgICAzICstCiBmcy9yZWlzZXJmcy9pbm9kZS5jICAgICAgICAgICAgICAgICAg ICAgICAgICAgfCAgICA3ICstCiBmcy9yZWlzZXJmcy9pb2N0bC5jICAgICAgICAgICAgICAgICAg ICAgICAgICAgfCAgICA0ICstCiBmcy9yZWlzZXJmcy9uYW1laS5jICAgICAgICAgICAgICAgICAg ICAgICAgICAgfCAgIDIxICstCiBmcy9yZWlzZXJmcy9yZWlzZXJmcy5oICAgICAgICAgICAgICAg ICAgICAgICAgfCAgICAzICstCiBmcy9yZWlzZXJmcy94YXR0ci5jICAgICAgICAgICAgICAgICAg ICAgICAgICAgfCAgIDEzICstCiBmcy9yZWlzZXJmcy94YXR0ci5oICAgICAgICAgICAgICAgICAg ICAgICAgICAgfCAgICAzICstCiBmcy9yZWlzZXJmcy94YXR0cl9hY2wuYyAgICAgICAgICAgICAg ICAgICAgICAgfCAgICA4ICstCiBmcy9yZWlzZXJmcy94YXR0cl9zZWN1cml0eS5jICAgICAgICAg ICAgICAgICAgfCAgICAzICstCiBmcy9yZWlzZXJmcy94YXR0cl90cnVzdGVkLmMgICAgICAgICAg ICAgICAgICAgfCAgICAzICstCiBmcy9yZWlzZXJmcy94YXR0cl91c2VyLmMgICAgICAgICAgICAg ICAgICAgICAgfCAgICAzICstCiBmcy9yZW1hcF9yYW5nZS5jICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgfCAgICA3ICstCiBmcy9zdGF0LmMgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgfCAgIDI2ICstCiBmcy9zeXN2L2ZpbGUuYyAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgfCAgICA3ICstCiBmcy9zeXN2L2lhbGxvYy5jICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgfCAgICAyICstCiBmcy9zeXN2L2l0cmVlLmMgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgfCAgICA2ICstCiBmcy9zeXN2L25hbWVpLmMgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgfCAgIDIxICstCiBmcy9zeXN2L3N5c3YuaCAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgfCAgICAzICstCiBmcy90cmFjZWZzL2lub2RlLmMgICAgICAgICAgICAgICAgICAg ICAgICAgICAgfCAgICA0ICstCiBmcy91Ymlmcy9kaXIuYyAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgfCAgIDMwICstCiBmcy91Ymlmcy9maWxlLmMgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgfCAgICA1ICstCiBmcy91Ymlmcy9pb2N0bC5jICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgfCAgICAyICstCiBmcy91Ymlmcy91Ymlmcy5oICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgfCAgICA1ICstCiBmcy91Ymlmcy94YXR0ci5jICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgfCAgICAxICsKIGZzL3VkZi9maWxlLmMgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICB8ICAgIDkgKy0KIGZzL3VkZi9pYWxsb2MuYyAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICB8ICAgIDIgKy0KIGZzL3VkZi9uYW1laS5jICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICB8ICAgMjQgKy0KIGZzL3VkZi9zeW1saW5rLmMgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICB8ICAgIDcgKy0KIGZzL3Vmcy9pYWxsb2MuYyAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICB8ICAgIDIgKy0KIGZzL3Vmcy9pbm9kZS5jICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICB8ICAgIDcgKy0KIGZzL3Vmcy9uYW1laS5jICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICB8ICAgMTkgKy0KIGZzL3Vmcy91ZnMuaCAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICB8ICAgIDMgKy0KIGZzL3V0aW1lcy5jICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICB8ICAgIDMgKy0KIGZzL3Zib3hzZi9kaXIuYyAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICB8ICAgMTIgKy0KIGZzL3Zib3hzZi91dGlscy5jICAgICAgICAgICAgICAgICAgICAg ICAgICAgICB8ICAgIDkgKy0KIGZzL3Zib3hzZi92ZnNtb2QuaCAgICAgICAgICAgICAgICAgICAg ICAgICAgICB8ICAgIDggKy0KIGZzL3Zlcml0eS9lbmFibGUuYyAgICAgICAgICAgICAgICAgICAg ICAgICAgICB8ICAgIDIgKy0KIGZzL3hhdHRyLmMgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICB8ICAxMzkgKy0KIGZzL3hmcy94ZnNfYWNsLmMgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICB8ICAgIDUgKy0KIGZzL3hmcy94ZnNfYWNsLmggICAgICAgICAgICAgICAgICAgICAg ICAgICAgICB8ICAgIDMgKy0KIGZzL3hmcy94ZnNfZmlsZS5jICAgICAgICAgICAgICAgICAgICAg ICAgICAgICB8ICAgIDQgKy0KIGZzL3hmcy94ZnNfaW5vZGUuYyAgICAgICAgICAgICAgICAgICAg ICAgICAgICB8ICAgMjYgKy0KIGZzL3hmcy94ZnNfaW5vZGUuaCAgICAgICAgICAgICAgICAgICAg ICAgICAgICB8ICAgMTYgKy0KIGZzL3hmcy94ZnNfaW9jdGwuYyAgICAgICAgICAgICAgICAgICAg ICAgICAgICB8ICAgMzUgKy0KIGZzL3hmcy94ZnNfaW9jdGwzMi5jICAgICAgICAgICAgICAgICAg ICAgICAgICB8ICAgIDYgKy0KIGZzL3hmcy94ZnNfaW9wcy5jICAgICAgICAgICAgICAgICAgICAg ICAgICAgICB8ICAxMDEgKy0KIGZzL3hmcy94ZnNfaW9wcy5oICAgICAgICAgICAgICAgICAgICAg ICAgICAgICB8ICAgIDMgKy0KIGZzL3hmcy94ZnNfaXRhYmxlLmMgICAgICAgICAgICAgICAgICAg ICAgICAgICB8ICAgMTcgKy0KIGZzL3hmcy94ZnNfaXRhYmxlLmggICAgICAgICAgICAgICAgICAg ICAgICAgICB8ICAgIDEgKwogZnMveGZzL3hmc19xbS5jICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIHwgICAgMyArLQogZnMveGZzL3hmc19zdXBlci5jICAgICAgICAgICAgICAgICAgICAg ICAgICAgIHwgICAgMiArLQogZnMveGZzL3hmc19zeW1saW5rLmMgICAgICAgICAgICAgICAgICAg ICAgICAgIHwgICAgNSArLQogZnMveGZzL3hmc19zeW1saW5rLmggICAgICAgICAgICAgICAgICAg ICAgICAgIHwgICAgNSArLQogZnMveGZzL3hmc194YXR0ci5jICAgICAgICAgICAgICAgICAgICAg ICAgICAgIHwgICAgNyArLQogZnMvem9uZWZzL3N1cGVyLmMgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIHwgICAgOSArLQogaW5jbHVkZS9saW51eC9jYXBhYmlsaXR5LmggICAgICAgICAgICAg ICAgICAgIHwgICAxNCArLQogaW5jbHVkZS9saW51eC9mcy5oICAgICAgICAgICAgICAgICAgICAg ICAgICAgIHwgIDE4NiArKy0KIGluY2x1ZGUvbGludXgvaW1hLmggICAgICAgICAgICAgICAgICAg ICAgICAgICB8ICAgMTggKy0KIGluY2x1ZGUvbGludXgvbHNtX2hvb2tfZGVmcy5oICAgICAgICAg ICAgICAgICB8ICAgMTUgKy0KIGluY2x1ZGUvbGludXgvbHNtX2hvb2tzLmggICAgICAgICAgICAg ICAgICAgICB8ICAgIDEgKwogaW5jbHVkZS9saW51eC9tb3VudC5oICAgICAgICAgICAgICAgICAg ICAgICAgIHwgICAgNyArCiBpbmNsdWRlL2xpbnV4L25mc19mcy5oICAgICAgICAgICAgICAgICAg ICAgICAgfCAgICA3ICstCiBpbmNsdWRlL2xpbnV4L3Bvc2l4X2FjbC5oICAgICAgICAgICAgICAg ICAgICAgfCAgIDIxICstCiBpbmNsdWRlL2xpbnV4L3Bvc2l4X2FjbF94YXR0ci5oICAgICAgICAg ICAgICAgfCAgIDEyICstCiBpbmNsdWRlL2xpbnV4L3NlY3VyaXR5LmggICAgICAgICAgICAgICAg ICAgICAgfCAgIDU0ICstCiBpbmNsdWRlL2xpbnV4L3N5c2NhbGxzLmggICAgICAgICAgICAgICAg ICAgICAgfCAgICA0ICsKIGluY2x1ZGUvbGludXgveGF0dHIuaCAgICAgICAgICAgICAgICAgICAg ICAgICB8ICAgMzAgKy0KIGluY2x1ZGUvdWFwaS9hc20tZ2VuZXJpYy91bmlzdGQuaCAgICAgICAg ICAgICB8ICAgIDQgKy0KIGluY2x1ZGUvdWFwaS9saW51eC9tb3VudC5oICAgICAgICAgICAgICAg ICAgICB8ICAgMTYgKwogaXBjL21xdWV1ZS5jICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIHwgICAgOSArLQoga2VybmVsL2F1ZGl0c2MuYyAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIHwgICAgNSArLQoga2VybmVsL2JwZi9pbm9kZS5jICAgICAgICAgICAgICAgICAgICAgICAg ICAgIHwgICAxMyArLQoga2VybmVsL2NhcGFiaWxpdHkuYyAgICAgICAgICAgICAgICAgICAgICAg ICAgIHwgICAxNCArLQoga2VybmVsL2Nncm91cC9jZ3JvdXAuYyAgICAgICAgICAgICAgICAgICAg ICAgIHwgICAgMiArLQoga2VybmVsL3N5cy5jICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIHwgICAgMiArLQogbW0vbWFkdmlzZS5jICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIHwgICAgNSArLQogbW0vbWVtY29udHJvbC5jICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIHwgICAgMiArLQogbW0vbWluY29yZS5jICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIHwgICAgNSArLQogbW0vc2htZW0uYyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIHwgICA1MCArLQogbmV0L3NvY2tldC5jICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIHwgICAgNiArLQogbmV0L3VuaXgvYWZfdW5peC5jICAgICAgICAgICAgICAgICAgICAgICAg ICAgIHwgICAgNSArLQogc2VjdXJpdHkvYXBwYXJtb3IvYXBwYXJtb3Jmcy5jICAgICAgICAgICAg ICAgIHwgICAgMyArLQogc2VjdXJpdHkvYXBwYXJtb3IvZG9tYWluLmMgICAgICAgICAgICAgICAg ICAgIHwgICAxMyArLQogc2VjdXJpdHkvYXBwYXJtb3IvZmlsZS5jICAgICAgICAgICAgICAgICAg ICAgIHwgICAgNCArLQogc2VjdXJpdHkvYXBwYXJtb3IvbHNtLmMgICAgICAgICAgICAgICAgICAg ICAgIHwgICAyMSArLQogc2VjdXJpdHkvY29tbW9uY2FwLmMgICAgICAgICAgICAgICAgICAgICAg ICAgIHwgIDEwOCArLQogc2VjdXJpdHkvaW50ZWdyaXR5L2V2bS9ldm1fY3J5cHRvLmMgICAgICAg ICAgIHwgICAxMSArLQogc2VjdXJpdHkvaW50ZWdyaXR5L2V2bS9ldm1fbWFpbi5jICAgICAgICAg ICAgIHwgICAgNCArLQogc2VjdXJpdHkvaW50ZWdyaXR5L2V2bS9ldm1fc2VjZnMuYyAgICAgICAg ICAgIHwgICAgMiArLQogc2VjdXJpdHkvaW50ZWdyaXR5L2ltYS9pbWEuaCAgICAgICAgICAgICAg ICAgIHwgICAxOSArLQogc2VjdXJpdHkvaW50ZWdyaXR5L2ltYS9pbWFfYXBpLmMgICAgICAgICAg ICAgIHwgICAxMCArLQogc2VjdXJpdHkvaW50ZWdyaXR5L2ltYS9pbWFfYXBwcmFpc2UuYyAgICAg ICAgIHwgICAyMyArLQogc2VjdXJpdHkvaW50ZWdyaXR5L2ltYS9pbWFfYXN5bW1ldHJpY19rZXlz LmMgIHwgICAgMyArLQogc2VjdXJpdHkvaW50ZWdyaXR5L2ltYS9pbWFfbWFpbi5jICAgICAgICAg ICAgIHwgICAzNyArLQogc2VjdXJpdHkvaW50ZWdyaXR5L2ltYS9pbWFfcG9saWN5LmMgICAgICAg ICAgIHwgICAyMCArLQogc2VjdXJpdHkvaW50ZWdyaXR5L2ltYS9pbWFfcXVldWVfa2V5cy5jICAg ICAgIHwgICAgNCArLQogc2VjdXJpdHkvc2VjdXJpdHkuYyAgICAgICAgICAgICAgICAgICAgICAg ICAgIHwgICAyNSArLQogc2VjdXJpdHkvc2VsaW51eC9ob29rcy5jICAgICAgICAgICAgICAgICAg ICAgIHwgICAyMyArLQogc2VjdXJpdHkvc21hY2svc21hY2tfbHNtLmMgICAgICAgICAgICAgICAg ICAgIHwgICAyMiArLQogdG9vbHMvaW5jbHVkZS91YXBpL2FzbS1nZW5lcmljL3VuaXN0ZC5oICAg ICAgIHwgICAgNCArLQogdG9vbHMvdGVzdGluZy9zZWxmdGVzdHMvTWFrZWZpbGUgICAgICAgICAg ICAgIHwgICAgMSArCiAuLi4vc2VsZnRlc3RzL21vdW50X3NldGF0dHIvLmdpdGlnbm9yZSAgICAg ICAgfCAgICAxICsKIC4uLi90ZXN0aW5nL3NlbGZ0ZXN0cy9tb3VudF9zZXRhdHRyL01ha2VmaWxl ICB8ICAgIDcgKwogdG9vbHMvdGVzdGluZy9zZWxmdGVzdHMvbW91bnRfc2V0YXR0ci9jb25maWcg IHwgICAgMSArCiAuLi4vbW91bnRfc2V0YXR0ci9tb3VudF9zZXRhdHRyX3Rlc3QuYyAgICAgICAg fCAxNDI0ICsrKysrKysrKysrKysrKysrCiAzNDIgZmlsZXMgY2hhbmdlZCwgNDg4OCBpbnNlcnRp b25zKCspLCAxNzUwIGRlbGV0aW9ucygtKQogY3JlYXRlIG1vZGUgMTAwNjQ0IHRvb2xzL3Rlc3Rp bmcvc2VsZnRlc3RzL21vdW50X3NldGF0dHIvLmdpdGlnbm9yZQogY3JlYXRlIG1vZGUgMTAwNjQ0 IHRvb2xzL3Rlc3Rpbmcvc2VsZnRlc3RzL21vdW50X3NldGF0dHIvTWFrZWZpbGUKIGNyZWF0ZSBt b2RlIDEwMDY0NCB0b29scy90ZXN0aW5nL3NlbGZ0ZXN0cy9tb3VudF9zZXRhdHRyL2NvbmZpZwog Y3JlYXRlIG1vZGUgMTAwNjQ0IHRvb2xzL3Rlc3Rpbmcvc2VsZnRlc3RzL21vdW50X3NldGF0dHIv bW91bnRfc2V0YXR0cl90ZXN0LmMKCgpiYXNlLWNvbW1pdDogMTljMzI5ZjY4MDg5OTViMTQyYjM5 NjYzMDFmMjE3YzgzMWU3Y2YzMQotLSAKMi4zMC4wCgoKX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX18KQ29udGFpbmVycyBtYWlsaW5nIGxpc3QKQ29udGFpbmVy c0BsaXN0cy5saW51eC1mb3VuZGF0aW9uLm9yZwpodHRwczovL2xpc3RzLmxpbnV4Zm91bmRhdGlv bi5vcmcvbWFpbG1hbi9saXN0aW5mby9jb250YWluZXJz From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI, MENTIONS_GIT_HOSTING,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4E66BC433E0 for ; Thu, 21 Jan 2021 15:44:36 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id CE9262074A for ; Thu, 21 Jan 2021 15:44:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2387434AbhAUPoF (ORCPT ); Thu, 21 Jan 2021 10:44:05 -0500 Received: from youngberry.canonical.com ([91.189.89.112]:53777 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731809AbhAUNVc (ORCPT ); Thu, 21 Jan 2021 08:21:32 -0500 Received: from ip5f5af0a0.dynamic.kabel-deutschland.de ([95.90.240.160] helo=wittgenstein.fritz.box) by youngberry.canonical.com with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1l2Zsp-0005g7-Ri; Thu, 21 Jan 2021 13:20:20 +0000 From: Christian Brauner To: Alexander Viro , Christoph Hellwig , linux-fsdevel@vger.kernel.org Cc: John Johansen , James Morris , Mimi Zohar , Dmitry Kasatkin , Stephen Smalley , Casey Schaufler , Arnd Bergmann , Andreas Dilger , OGAWA Hirofumi , Geoffrey Thomas , Mrunal Patel , Josh Triplett , Andy Lutomirski , Theodore Tso , Alban Crequy , Tycho Andersen , David Howells , James Bottomley , Seth Forshee , =?UTF-8?q?St=C3=A9phane=20Graber?= , Linus Torvalds , Aleksa Sarai , Lennart Poettering , "Eric W. Biederman" , smbarber@chromium.org, Phil Estes , Serge Hallyn , Kees Cook , Todd Kjos , Paul Moore , Jonathan Corbet , containers@lists.linux-foundation.org, linux-security-module@vger.kernel.org, linux-api@vger.kernel.org, linux-ext4@vger.kernel.org, linux-xfs@vger.kernel.org, linux-integrity@vger.kernel.org, selinux@vger.kernel.org, Christian Brauner Subject: [PATCH v6 00/40] idmapped mounts Date: Thu, 21 Jan 2021 14:19:19 +0100 Message-Id: <20210121131959.646623-1-christian.brauner@ubuntu.com> X-Mailer: git-send-email 2.30.0 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org Hey everyone, The only major change is the updated version of hch's pach to port xfs to support idmapped mounts. Thanks again to Christoph for doing that work. (Otherwise Acked-bys and Reviewed-bys were added and the tree reordered to decouple filesystem specific conversion from the vfs work so they can proceed independent. For a full list of major changes between versions see the end of this cover letter. Please also note the large xfstests testsuite in patch 42 that has been kept as part of this series. It verifies correct vfs behavior with and without idmapped mounts including covering newer vfs features such as io_uring. I currently still plan to target the v5.12 merge window.) With this patchset we make it possible to attach idmappings to mounts, i.e. simply put different bind mounts can expose the same file or directory with different ownership. Shifting of ownership on a per-mount basis handles a wide range of long standing use-cases. Here are just a few: - Shifting of a subset of ownership-less filesystems (vfat) for use by multiple users, effectively allowing for DAC on such devices (systemd, Android, ...) - Allow remapping uid/gid on external filesystems or paths (USB sticks, network filesystem, ...) to match the local system's user and groups. (David Howells intends to port AFS as a first candidate.) - Shifting of a container rootfs or base image without having to mangle every file (runc, Docker, containerd, k8s, LXD, systemd ...) - Sharing of data between host or privileged containers with unprivileged containers (runC, Docker, containerd, k8s, LXD, ...) - Data sharing between multiple user namespaces with incompatible maps (LXD, k8s, ...) There has been significant interest in this patchset as evidenced by user commenting on previous version of this patchset. They include containerd, ChromeOS, systemd, LXD and a range of others. There is already a patchset up for containerd, the default Kubernetes container runtime https://github.com/containerd/containerd/pull/4734 to make use of this. systemd intends to use it in their systemd-homed implementation for portable home directories. ChromeOS wants to make use of it to share data between the host and the Linux containers they run on Chrome- and Pixelbooks. There's also a few talks that of people who are going to make use of this. The most recent one was a CNCF webinar https://www.cncf.io/wp-content/uploads/2020/12/Rootless-Containers-in-Gitpod.pdf and upcoming talk during FOSDEM. (Fwiw, for fun and since I wanted to do this for a long time I've ported my home directory to be completely portable with a simple service file that now mounts my home directory on an ext4 formatted usb stick with an id mapping mapping all files to the random uid I'm assigned at login.) Making it possible to share directories and mounts between users with different uids and gids is itself quite an important use-case in distributed systems environments. It's of course especially useful in general for portable usb sticks, sharing data between multiple users in, and sharing home directories between multiple users. The last example is now elegantly expressed in systemd's homed concept for portable home directories. As mentioned above, idmapped mounts also allow data from the host to be shared with unprivileged containers, between privileged and unprivileged containers simultaneously and in addition also between unprivileged containers with different idmappings whenever they are used to isolate one container completely from another container. We have implemented and proposed multiple solutions to this before. This included the introduction of fsid mappings, a tiny filesystem I've authored with Seth Forshee that is currently carried in Ubuntu that has shown to be the wrong approach, and the conceptual hack of calling override creds directly in the vfs. In addition, to some of these solutions being hacky none of these solutions have covered all of the above use-cases. Idmappings become a property of struct vfsmount instead of tying it to a process being inside of a user namespace which has been the case for all other proposed approaches. It also allows to pass down the user namespace into the filesystems which is a clean way instead of violating calling conventions by strapping the user namespace information that is a property of the mount to the caller's credentials or similar hacks. Each mount can have a separate idmapping and idmapped mounts can even be created in the initial user namespace unblocking a range of use-cases. To this end the vfsmount struct gains a new struct user_namespace member. The idmapping of the user namespace becomes the idmapping of the mount. A caller that is privileged with respect to the user namespace of the superblock of the underlying filesystem can create an idmapped mount. In the future, we can enable unprivileged use-cases by checking whether the caller is privileged wrt to the user namespace that an already idmapped mount has been marked with, allowing them to change the idmapping. For now, keep things simple until the need arises. Note, that with syscall interception it is already possible to intercept idmapped mount requests from unprivileged containers and handle them in a sufficiently privileged container manager. Support for this is already available in LXD and will be available in runC where syscall interception is currently in the process of becoming part of the runtime spec: https://github.com/opencontainers/runtime-spec/pull/1074. The user namespace the mount will be marked with can be specified by passing a file descriptor refering to the user namespace as an argument to the new mount_setattr() syscall together with the new MOUNT_ATTR_IDMAP flag. By default vfsmounts are marked with the initial user namespace and no behavioral or performance changes are observed. All mapping operations are nops for the initial user namespace. When a file/inode is accessed through an idmapped mount the i_uid and i_gid of the inode will be remapped according to the user namespace the mount has been marked with. In order to support idmapped mounts, filesystems need to be changed and mark themselves with the FS_ALLOW_IDMAP flag in fs_flags. The initial version contains fat, ext4, and xfs including a list of examples. But patches for other filesystems are actively worked on and will be sent out separately. We are here to see this through and there are multiple people involved in converting filesystems. So filesystem developers are not left alone with this and are provided with a large testsuite to verify that their port is correct. There is a simple tool available at https://github.com/brauner/mount-idmapped that allows to create idmapped mounts so people can play with this patch series. Here are a few illustrations: 1. Create a simple idmapped mount of another user's home directory u1001@f2-vm:/$ sudo ./mount-idmapped --map-mount b:1000:1001:1 /home/ubuntu/ /mnt u1001@f2-vm:/$ ls -al /home/ubuntu/ total 28 drwxr-xr-x 2 ubuntu ubuntu 4096 Oct 28 22:07 . drwxr-xr-x 4 root root 4096 Oct 28 04:00 .. -rw------- 1 ubuntu ubuntu 3154 Oct 28 22:12 .bash_history -rw-r--r-- 1 ubuntu ubuntu 220 Feb 25 2020 .bash_logout -rw-r--r-- 1 ubuntu ubuntu 3771 Feb 25 2020 .bashrc -rw-r--r-- 1 ubuntu ubuntu 807 Feb 25 2020 .profile -rw-r--r-- 1 ubuntu ubuntu 0 Oct 16 16:11 .sudo_as_admin_successful -rw------- 1 ubuntu ubuntu 1144 Oct 28 00:43 .viminfo u1001@f2-vm:/$ ls -al /mnt/ total 28 drwxr-xr-x 2 u1001 u1001 4096 Oct 28 22:07 . drwxr-xr-x 29 root root 4096 Oct 28 22:01 .. -rw------- 1 u1001 u1001 3154 Oct 28 22:12 .bash_history -rw-r--r-- 1 u1001 u1001 220 Feb 25 2020 .bash_logout -rw-r--r-- 1 u1001 u1001 3771 Feb 25 2020 .bashrc -rw-r--r-- 1 u1001 u1001 807 Feb 25 2020 .profile -rw-r--r-- 1 u1001 u1001 0 Oct 16 16:11 .sudo_as_admin_successful -rw------- 1 u1001 u1001 1144 Oct 28 00:43 .viminfo u1001@f2-vm:/$ touch /mnt/my-file u1001@f2-vm:/$ setfacl -m u:1001:rwx /mnt/my-file u1001@f2-vm:/$ sudo setcap -n 1001 cap_net_raw+ep /mnt/my-file u1001@f2-vm:/$ ls -al /mnt/my-file -rw-rwxr--+ 1 u1001 u1001 0 Oct 28 22:14 /mnt/my-file u1001@f2-vm:/$ ls -al /home/ubuntu/my-file -rw-rwxr--+ 1 ubuntu ubuntu 0 Oct 28 22:14 /home/ubuntu/my-file u1001@f2-vm:/$ getfacl /mnt/my-file getfacl: Removing leading '/' from absolute path names # file: mnt/my-file # owner: u1001 # group: u1001 user::rw- user:u1001:rwx group::rw- mask::rwx other::r-- u1001@f2-vm:/$ getfacl /home/ubuntu/my-file getfacl: Removing leading '/' from absolute path names # file: home/ubuntu/my-file # owner: ubuntu # group: ubuntu user::rw- user:ubuntu:rwx group::rw- mask::rwx other::r-- 2. Create mapping of the whole ext4 rootfs without a mapping for uid and gid 0 ubuntu@f2-vm:~$ sudo /mount-idmapped --map-mount b:1:1:65536 / /mnt/ ubuntu@f2-vm:~$ findmnt | grep mnt └─/mnt /dev/sda2 ext4 rw,relatime └─/mnt/mnt /dev/sda2 ext4 rw,relatime ubuntu@f2-vm:~$ sudo mkdir /AS-ROOT-CAN-CREATE ubuntu@f2-vm:~$ sudo mkdir /mnt/AS-ROOT-CANT-CREATE mkdir: cannot create directory ‘/mnt/AS-ROOT-CANT-CREATE’: Value too large for defined data type ubuntu@f2-vm:~$ mkdir /mnt/home/ubuntu/AS-USER-1000-CAN-CREATE 3. Create a vfat usb mount and expose to user 1001 and 5000 ubuntu@f2-vm:/$ sudo mount /dev/sdb /mnt ubuntu@f2-vm:/$ findmnt | grep mnt └─/mnt /dev/sdb vfat rw,relatime,fmask=0022,dmask=0022,codepage=437,iocharset=iso8859-1,shortname=mixed,errors=remount-ro ubuntu@f2-vm:/$ ls -al /mnt total 12 drwxr-xr-x 2 root root 4096 Jan 1 1970 . drwxr-xr-x 34 root root 4096 Oct 28 22:24 .. -rwxr-xr-x 1 root root 4 Oct 28 03:44 aaa -rwxr-xr-x 1 root root 0 Oct 28 01:09 bbb ubuntu@f2-vm:/$ sudo /mount-idmapped --map-mount b:0:1001:1 /mnt /mnt-1001/ ubuntu@f2-vm:/$ ls -al /mnt-1001/ total 12 drwxr-xr-x 2 u1001 u1001 4096 Jan 1 1970 . drwxr-xr-x 34 root root 4096 Oct 28 22:24 .. -rwxr-xr-x 1 u1001 u1001 4 Oct 28 03:44 aaa -rwxr-xr-x 1 u1001 u1001 0 Oct 28 01:09 bbb ubuntu@f2-vm:/$ sudo /mount-idmapped --map-mount b:0:5000:1 /mnt /mnt-5000/ ubuntu@f2-vm:/$ ls -al /mnt-5000/ total 12 drwxr-xr-x 2 5000 5000 4096 Jan 1 1970 . drwxr-xr-x 34 root root 4096 Oct 28 22:24 .. -rwxr-xr-x 1 5000 5000 4 Oct 28 03:44 aaa -rwxr-xr-x 1 5000 5000 0 Oct 28 01:09 bbb 4. Create an idmapped rootfs mount for a container root@f2-vm:~# ls -al /var/lib/lxc/f2/rootfs/ total 68 drwxr-xr-x 17 20000 20000 4096 Sep 24 07:48 . drwxrwx--- 3 20000 20000 4096 Oct 16 19:26 .. lrwxrwxrwx 1 20000 20000 7 Sep 24 07:43 bin -> usr/bin drwxr-xr-x 2 20000 20000 4096 Apr 15 2020 boot drwxr-xr-x 3 20000 20000 4096 Oct 16 19:26 dev drwxr-xr-x 61 20000 20000 4096 Oct 16 19:26 etc drwxr-xr-x 3 20000 20000 4096 Sep 24 07:45 home lrwxrwxrwx 1 20000 20000 7 Sep 24 07:43 lib -> usr/lib lrwxrwxrwx 1 20000 20000 9 Sep 24 07:43 lib32 -> usr/lib32 lrwxrwxrwx 1 20000 20000 9 Sep 24 07:43 lib64 -> usr/lib64 lrwxrwxrwx 1 20000 20000 10 Sep 24 07:43 libx32 -> usr/libx32 drwxr-xr-x 2 20000 20000 4096 Sep 24 07:43 media drwxr-xr-x 2 20000 20000 4096 Sep 24 07:43 mnt drwxr-xr-x 2 20000 20000 4096 Sep 24 07:43 opt drwxr-xr-x 2 20000 20000 4096 Apr 15 2020 proc drwx------ 2 20000 20000 4096 Sep 24 07:43 root drwxr-xr-x 2 20000 20000 4096 Sep 24 07:45 run lrwxrwxrwx 1 20000 20000 8 Sep 24 07:43 sbin -> usr/sbin drwxr-xr-x 2 20000 20000 4096 Sep 24 07:43 srv drwxr-xr-x 2 20000 20000 4096 Apr 15 2020 sys drwxrwxrwt 2 20000 20000 4096 Sep 24 07:44 tmp drwxr-xr-x 13 20000 20000 4096 Sep 24 07:43 usr drwxr-xr-x 12 20000 20000 4096 Sep 24 07:44 var root@f2-vm:~# /mount-idmapped --map-mount b:20000:10000:100000 /var/lib/lxc/f2/rootfs/ /mnt root@f2-vm:~# ls -al /mnt total 68 drwxr-xr-x 17 10000 10000 4096 Sep 24 07:48 . drwxr-xr-x 34 root root 4096 Oct 28 22:24 .. lrwxrwxrwx 1 10000 10000 7 Sep 24 07:43 bin -> usr/bin drwxr-xr-x 2 10000 10000 4096 Apr 15 2020 boot drwxr-xr-x 3 10000 10000 4096 Oct 16 19:26 dev drwxr-xr-x 61 10000 10000 4096 Oct 16 19:26 etc drwxr-xr-x 3 10000 10000 4096 Sep 24 07:45 home lrwxrwxrwx 1 10000 10000 7 Sep 24 07:43 lib -> usr/lib lrwxrwxrwx 1 10000 10000 9 Sep 24 07:43 lib32 -> usr/lib32 lrwxrwxrwx 1 10000 10000 9 Sep 24 07:43 lib64 -> usr/lib64 lrwxrwxrwx 1 10000 10000 10 Sep 24 07:43 libx32 -> usr/libx32 drwxr-xr-x 2 10000 10000 4096 Sep 24 07:43 media drwxr-xr-x 2 10000 10000 4096 Sep 24 07:43 mnt drwxr-xr-x 2 10000 10000 4096 Sep 24 07:43 opt drwxr-xr-x 2 10000 10000 4096 Apr 15 2020 proc drwx------ 2 10000 10000 4096 Sep 24 07:43 root drwxr-xr-x 2 10000 10000 4096 Sep 24 07:45 run lrwxrwxrwx 1 10000 10000 8 Sep 24 07:43 sbin -> usr/sbin drwxr-xr-x 2 10000 10000 4096 Sep 24 07:43 srv drwxr-xr-x 2 10000 10000 4096 Apr 15 2020 sys drwxrwxrwt 2 10000 10000 4096 Sep 24 07:44 tmp drwxr-xr-x 13 10000 10000 4096 Sep 24 07:43 usr drwxr-xr-x 12 10000 10000 4096 Sep 24 07:44 var root@f2-vm:~# lxc-start f2 # uses /mnt as rootfs root@f2-vm:~# lxc-attach f2 -- cat /proc/1/uid_map 0 10000 10000 root@f2-vm:~# lxc-attach f2 -- cat /proc/1/gid_map 0 10000 10000 root@f2-vm:~# lxc-attach f2 -- ls -al / total 52 drwxr-xr-x 17 root root 4096 Sep 24 07:48 . drwxr-xr-x 17 root root 4096 Sep 24 07:48 .. lrwxrwxrwx 1 root root 7 Sep 24 07:43 bin -> usr/bin drwxr-xr-x 2 root root 4096 Apr 15 2020 boot drwxr-xr-x 5 root root 500 Oct 28 23:39 dev drwxr-xr-x 61 root root 4096 Oct 28 23:39 etc drwxr-xr-x 3 root root 4096 Sep 24 07:45 home lrwxrwxrwx 1 root root 7 Sep 24 07:43 lib -> usr/lib lrwxrwxrwx 1 root root 9 Sep 24 07:43 lib32 -> usr/lib32 lrwxrwxrwx 1 root root 9 Sep 24 07:43 lib64 -> usr/lib64 lrwxrwxrwx 1 root root 10 Sep 24 07:43 libx32 -> usr/libx32 drwxr-xr-x 2 root root 4096 Sep 24 07:43 media drwxr-xr-x 2 root root 4096 Sep 24 07:43 mnt drwxr-xr-x 2 root root 4096 Sep 24 07:43 opt dr-xr-xr-x 232 nobody nogroup 0 Oct 28 23:39 proc drwx------ 2 root root 4096 Oct 28 23:41 root drwxr-xr-x 12 root root 360 Oct 28 23:39 run lrwxrwxrwx 1 root root 8 Sep 24 07:43 sbin -> usr/sbin drwxr-xr-x 2 root root 4096 Sep 24 07:43 srv dr-xr-xr-x 13 nobody nogroup 0 Oct 28 23:39 sys drwxrwxrwt 11 root root 4096 Oct 28 23:40 tmp drwxr-xr-x 13 root root 4096 Sep 24 07:43 usr drwxr-xr-x 12 root root 4096 Sep 24 07:44 var root@f2-vm:~# lxc-attach f2 -- ls -al /my-file -rw-r--r-- 1 root root 0 Oct 28 23:43 /my-file root@f2-vm:~# ls -al /var/lib/lxc/f2/rootfs/my-file -rw-r--r-- 1 20000 20000 0 Oct 28 23:43 /var/lib/lxc/f2/rootfs/my-file I'd like to say thanks to: Al for pointing me into the direction to avoid inode alias issues during lookup. David for various discussions around this. Christoph for porting xfs, providing good reviews and for being involved in the original idea. Tycho for helping with this series and on future patches to convert filesystems. Alban Crequy and the Kinvolk peeps located just a few streets away from me in Berlin for providing use-case discussions and writing patches for containerd. Stéphane for his invaluable input on many things and level head and enabling me to work on this. Amir for explaining and discussing aspects of overlayfs with me. I'd like to especially thank Seth Forshee. He provided a lot of good analysis, suggestions, and participated in short-notice discussions in both chat and video for some nitty-gritty technical details. This series can be found and pulled from the three usual locations: https://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux.git/log/?h=idmapped_mounts https://github.com/brauner/linux/tree/idmapped_mounts https://gitlab.com/brauner/linux/-/commits/idmapped_mounts /* v5 */ - Adress Christoph's feedback. - Use v5.11-rc3 as new base. - Add Christoph's xfs port. /* v4 */ - Split out several preparatory patches from the initial mount_setattr patch as requested by Christoph. - Add new tests for file/directory creation in directories with the setgid bit set. Specifically, verify that the setgid bit is correctly ignored when creating a file with the setgid bit and the parent directory's i_gid isn't in_group_p() and the caller isn't capable_wrt_inode_uidgid() over the parent directory's inode when inode_init_owner() is called. Conversely, verify that the setgid bit is set when creating a file with the setgid bit and the parent's i_gid is either in_group_p() or the caller is capable_wrt_inode_uidgid() over the parent directory's inode. In additiona, verify that the setgid bit is always inherited when creating directories. Test all of this on regular mounts, idmapped mounts, and on idmapped mounts in user namespaces. - Add new tests to verify that the i_gid of newly created files or directories is correctly set to the parent directory's i_gid when the parent directory has the setgid bit set. - Use "mnt_userns" as the de facto name for a vfsmount's user namespace everywhere as suggested by Serge. - Reuse existing propagation flags instead of introducing new ones as suggested by Christoph. (This is in line with Linus request to not introduce too many new flags as evidenced by prior discussions on other patchsets such as openat2().) - Add first set of Acked-bys from Serge and Reviewed-bys from Christoph. - Fix commit messages to reflect the fact that we modify existing vfs helpers but do not introduce new ones like we did in the first version. Some commit messages still implied we were adding new helpers. - Reformat all commit messages to adhere to 73 char length limit and wrap all lines in commits at 80 chars whenever this doesn't hinder legibility. - Simplify various codepaths with Christoph's suggestions. /* v3 */ - The major change is the port of the test-suite from the kernel-internal selftests framework to xfstests as requested by Darrick and Christoph. The test-suite for xfstests is patch 38 in this series. It has been kept as part of this series even though it belongs to xfstests so it's easier to see what is tested and to keep it in-sync. - Note, the test-suite now has been extended to cover io_uring and idmapped mounts. The IORING_REGISTER_PERSONALITY feature allows to register the caller's credentials with io_uring and returns an id associated with these credentials. This is useful for applications that wish to share a ring between separate users/processes. Callers can pass in the credential id in the sqe personality field. If set, that particular sqe will be issued with these credentials. The test-suite now tests that the openat* operations with different registered credentials work correctly and safely on regular mounts, on regular mounts inside user namespaces, on idmapped mounts, and on idmapped mounts inside user namespaces. /* v2 */ - The major change is the rework requested by Christoph and others to adapt all relevant helpers and inode_operations methods to account for idmapped mounts instead of introducing new helpers and methods specific to idmapped mounts like we did before. We've also moved the overlayfs conversion to handle idmapped mounts into a separate patchset that will be sent out separately after the core changes landed. The converted filesytems in this series include fat and ext4. As per Christoph's request the vfs-wide config option to disable idmapped mounts has been removed. Instead the filesystems can decide whether or not they want to allow idmap mounts through a config option. These config options default to off. Having a config option allows us to gain some confidence in the patchset over multiple kernel releases. - This version introduces a large test-suite to test current vfs behavior and idmapped mounts behavior. This test-suite is intended to grow over time. - While while working on adapting this patchset to the requested changes, the runC and containerd crowd was nice enough to adapt containerd to this patchset to make use of idmapped mounts in one of the most widely used container runtimes: https://github.com/containerd/containerd/pull/4734 The solution proposed here has it's origins in multiple discussions during Linux Plumbers 2017 during and after the end of the containers microconference. To the best of my knowledge this involved Aleksa, Stéphane, Eric, David, James, and myself.The original idea or a variant thereof has been discussed, again to the best of my knowledge, after a Linux conference in St. Petersburg in Russia in 2017 between Christoph, Tycho, and myself. We've taken the time to implement a working version of this solution over the last weeks to the best of my abilities. Tycho has signed up for this sligthly crazy endeavour as well and he has helped with the conversion of the xattr codepaths and will be involved with others in converting additional filesystems. Thanks! Christian Christian Brauner (37): mount: attach mappings to mounts fs: add id translation helpers fs: add file and path permissions helpers capability: handle idmapped mounts namei: make permission helpers idmapped mount aware inode: make init and permission helpers idmapped mount aware attr: handle idmapped mounts acl: handle idmapped mounts commoncap: handle idmapped mounts stat: handle idmapped mounts namei: handle idmapped mounts in may_*() helpers namei: introduce struct renamedata namei: prepare for idmapped mounts open: handle idmapped mounts in do_truncate() open: handle idmapped mounts af_unix: handle idmapped mounts utimes: handle idmapped mounts fcntl: handle idmapped mounts init: handle idmapped mounts ioctl: handle idmapped mounts would_dump: handle idmapped mounts exec: handle idmapped mounts fs: make helpers idmap mount aware apparmor: handle idmapped mounts ima: handle idmapped mounts ecryptfs: do not mount on top of idmapped mounts overlayfs: do not mount on top of idmapped mounts namespace: take lock_mount_hash() directly when changing flags mount: make {lock,unlock}_mount_hash() static namespace: only take read lock in do_reconfigure_mnt() fs: split out functions to hold writers fs: add attr_flags_to_mnt_flags helper fs: add mount_setattr() fs: introduce MOUNT_ATTR_IDMAP tests: add mount_setattr() selftests fat: handle idmapped mounts ext4: support idmapped mounts Christoph Hellwig (1): xfs: support idmapped mounts Tycho Andersen (1): xattr: handle idmapped mounts Documentation/filesystems/locking.rst | 7 +- Documentation/filesystems/porting.rst | 2 + Documentation/filesystems/vfs.rst | 19 +- arch/alpha/kernel/syscalls/syscall.tbl | 1 + arch/arm/tools/syscall.tbl | 1 + arch/arm64/include/asm/unistd.h | 2 +- arch/arm64/include/asm/unistd32.h | 2 + arch/ia64/kernel/syscalls/syscall.tbl | 1 + arch/m68k/kernel/syscalls/syscall.tbl | 1 + arch/microblaze/kernel/syscalls/syscall.tbl | 1 + arch/mips/kernel/syscalls/syscall_n32.tbl | 1 + arch/mips/kernel/syscalls/syscall_n64.tbl | 1 + arch/mips/kernel/syscalls/syscall_o32.tbl | 1 + arch/parisc/kernel/syscalls/syscall.tbl | 1 + arch/powerpc/kernel/syscalls/syscall.tbl | 1 + arch/powerpc/platforms/cell/spufs/inode.c | 5 +- arch/s390/kernel/syscalls/syscall.tbl | 1 + arch/sh/kernel/syscalls/syscall.tbl | 1 + arch/sparc/kernel/syscalls/syscall.tbl | 1 + arch/x86/entry/syscalls/syscall_32.tbl | 1 + arch/x86/entry/syscalls/syscall_64.tbl | 1 + arch/xtensa/kernel/syscalls/syscall.tbl | 1 + drivers/android/binderfs.c | 6 +- drivers/base/devtmpfs.c | 15 +- fs/9p/acl.c | 8 +- fs/9p/v9fs.h | 3 +- fs/9p/v9fs_vfs.h | 3 +- fs/9p/vfs_inode.c | 36 +- fs/9p/vfs_inode_dotl.c | 39 +- fs/9p/xattr.c | 1 + fs/adfs/adfs.h | 3 +- fs/adfs/inode.c | 5 +- fs/affs/affs.h | 24 +- fs/affs/inode.c | 7 +- fs/affs/namei.c | 15 +- fs/afs/dir.c | 34 +- fs/afs/inode.c | 9 +- fs/afs/internal.h | 7 +- fs/afs/security.c | 3 +- fs/afs/xattr.c | 2 + fs/attr.c | 126 +- fs/autofs/root.c | 17 +- fs/bad_inode.c | 36 +- fs/bfs/dir.c | 12 +- fs/btrfs/acl.c | 6 +- fs/btrfs/ctree.h | 3 +- fs/btrfs/inode.c | 46 +- fs/btrfs/ioctl.c | 27 +- fs/btrfs/tests/btrfs-tests.c | 2 +- fs/btrfs/xattr.c | 2 + fs/cachefiles/interface.c | 4 +- fs/cachefiles/namei.c | 21 +- fs/cachefiles/xattr.c | 29 +- fs/ceph/acl.c | 6 +- fs/ceph/dir.c | 23 +- fs/ceph/inode.c | 18 +- fs/ceph/super.h | 12 +- fs/ceph/xattr.c | 1 + fs/cifs/cifsfs.c | 5 +- fs/cifs/cifsfs.h | 25 +- fs/cifs/dir.c | 8 +- fs/cifs/inode.c | 26 +- fs/cifs/link.c | 3 +- fs/cifs/xattr.c | 1 + fs/coda/coda_linux.h | 8 +- fs/coda/dir.c | 18 +- fs/coda/inode.c | 9 +- fs/coda/pioctl.c | 6 +- fs/configfs/configfs_internal.h | 6 +- fs/configfs/dir.c | 3 +- fs/configfs/inode.c | 5 +- fs/configfs/symlink.c | 6 +- fs/coredump.c | 10 +- fs/crypto/policy.c | 2 +- fs/debugfs/inode.c | 9 +- fs/ecryptfs/crypto.c | 4 +- fs/ecryptfs/inode.c | 85 +- fs/ecryptfs/main.c | 6 + fs/ecryptfs/mmap.c | 4 +- fs/efivarfs/file.c | 2 +- fs/efivarfs/inode.c | 4 +- fs/erofs/inode.c | 7 +- fs/erofs/internal.h | 5 +- fs/exec.c | 12 +- fs/exfat/exfat_fs.h | 8 +- fs/exfat/file.c | 14 +- fs/exfat/namei.c | 14 +- fs/ext2/acl.c | 6 +- fs/ext2/acl.h | 3 +- fs/ext2/ext2.h | 5 +- fs/ext2/ialloc.c | 2 +- fs/ext2/inode.c | 15 +- fs/ext2/ioctl.c | 6 +- fs/ext2/namei.c | 22 +- fs/ext2/xattr_security.c | 1 + fs/ext2/xattr_trusted.c | 1 + fs/ext2/xattr_user.c | 1 + fs/ext4/acl.c | 5 +- fs/ext4/acl.h | 3 +- fs/ext4/ext4.h | 22 +- fs/ext4/ialloc.c | 7 +- fs/ext4/inode.c | 21 +- fs/ext4/ioctl.c | 20 +- fs/ext4/namei.c | 49 +- fs/ext4/super.c | 2 +- fs/ext4/xattr_hurd.c | 1 + fs/ext4/xattr_security.c | 1 + fs/ext4/xattr_trusted.c | 1 + fs/ext4/xattr_user.c | 1 + fs/f2fs/acl.c | 6 +- fs/f2fs/acl.h | 3 +- fs/f2fs/f2fs.h | 7 +- fs/f2fs/file.c | 36 +- fs/f2fs/namei.c | 23 +- fs/f2fs/xattr.c | 4 +- fs/fat/fat.h | 6 +- fs/fat/file.c | 24 +- fs/fat/namei_msdos.c | 12 +- fs/fat/namei_vfat.c | 15 +- fs/fcntl.c | 3 +- fs/fuse/acl.c | 3 +- fs/fuse/dir.c | 46 +- fs/fuse/fuse_i.h | 4 +- fs/fuse/xattr.c | 2 + fs/gfs2/acl.c | 5 +- fs/gfs2/acl.h | 3 +- fs/gfs2/file.c | 4 +- fs/gfs2/inode.c | 64 +- fs/gfs2/inode.h | 3 +- fs/gfs2/xattr.c | 1 + fs/hfs/attr.c | 1 + fs/hfs/dir.c | 13 +- fs/hfs/hfs_fs.h | 3 +- fs/hfs/inode.c | 8 +- fs/hfsplus/dir.c | 22 +- fs/hfsplus/hfsplus_fs.h | 5 +- fs/hfsplus/inode.c | 16 +- fs/hfsplus/ioctl.c | 2 +- fs/hfsplus/xattr.c | 1 + fs/hfsplus/xattr_security.c | 1 + fs/hfsplus/xattr_trusted.c | 1 + fs/hfsplus/xattr_user.c | 1 + fs/hostfs/hostfs_kern.c | 29 +- fs/hpfs/hpfs_fn.h | 2 +- fs/hpfs/inode.c | 7 +- fs/hpfs/namei.c | 20 +- fs/hugetlbfs/inode.c | 35 +- fs/init.c | 24 +- fs/inode.c | 44 +- fs/internal.h | 2 +- fs/jffs2/acl.c | 6 +- fs/jffs2/acl.h | 3 +- fs/jffs2/dir.c | 33 +- fs/jffs2/fs.c | 7 +- fs/jffs2/os-linux.h | 2 +- fs/jffs2/security.c | 1 + fs/jffs2/xattr_trusted.c | 1 + fs/jffs2/xattr_user.c | 1 + fs/jfs/acl.c | 5 +- fs/jfs/file.c | 9 +- fs/jfs/ioctl.c | 2 +- fs/jfs/jfs_acl.h | 3 +- fs/jfs/jfs_inode.c | 2 +- fs/jfs/jfs_inode.h | 2 +- fs/jfs/namei.c | 21 +- fs/jfs/xattr.c | 2 + fs/kernfs/dir.c | 6 +- fs/kernfs/inode.c | 19 +- fs/kernfs/kernfs-internal.h | 9 +- fs/libfs.c | 28 +- fs/minix/bitmap.c | 2 +- fs/minix/file.c | 7 +- fs/minix/inode.c | 6 +- fs/minix/minix.h | 3 +- fs/minix/namei.c | 24 +- fs/mount.h | 10 - fs/namei.c | 512 ++++-- fs/namespace.c | 480 +++++- fs/nfs/dir.c | 25 +- fs/nfs/inode.c | 9 +- fs/nfs/internal.h | 14 +- fs/nfs/namespace.c | 15 +- fs/nfs/nfs3_fs.h | 3 +- fs/nfs/nfs3acl.c | 3 +- fs/nfs/nfs4proc.c | 3 + fs/nfsd/nfs2acl.c | 6 +- fs/nfsd/nfs3acl.c | 6 +- fs/nfsd/nfs4acl.c | 5 +- fs/nfsd/nfs4recover.c | 6 +- fs/nfsd/nfsfh.c | 3 +- fs/nfsd/nfsproc.c | 2 +- fs/nfsd/vfs.c | 50 +- fs/nilfs2/inode.c | 14 +- fs/nilfs2/ioctl.c | 2 +- fs/nilfs2/namei.c | 19 +- fs/nilfs2/nilfs.h | 6 +- fs/notify/fanotify/fanotify_user.c | 2 +- fs/notify/inotify/inotify_user.c | 2 +- fs/ntfs/inode.c | 6 +- fs/ntfs/inode.h | 3 +- fs/ocfs2/acl.c | 6 +- fs/ocfs2/acl.h | 3 +- fs/ocfs2/dlmfs/dlmfs.c | 17 +- fs/ocfs2/file.c | 18 +- fs/ocfs2/file.h | 11 +- fs/ocfs2/ioctl.c | 2 +- fs/ocfs2/namei.c | 21 +- fs/ocfs2/refcounttree.c | 4 +- fs/ocfs2/xattr.c | 3 + fs/omfs/dir.c | 13 +- fs/omfs/file.c | 7 +- fs/omfs/inode.c | 2 +- fs/open.c | 35 +- fs/orangefs/acl.c | 6 +- fs/orangefs/inode.c | 20 +- fs/orangefs/namei.c | 12 +- fs/orangefs/orangefs-kernel.h | 13 +- fs/orangefs/xattr.c | 1 + fs/overlayfs/copy_up.c | 22 +- fs/overlayfs/dir.c | 31 +- fs/overlayfs/file.c | 6 +- fs/overlayfs/inode.c | 27 +- fs/overlayfs/overlayfs.h | 45 +- fs/overlayfs/super.c | 21 +- fs/overlayfs/util.c | 4 +- fs/posix_acl.c | 103 +- fs/proc/base.c | 28 +- fs/proc/fd.c | 5 +- fs/proc/fd.h | 3 +- fs/proc/generic.c | 12 +- fs/proc/internal.h | 6 +- fs/proc/proc_net.c | 5 +- fs/proc/proc_sysctl.c | 15 +- fs/proc/root.c | 5 +- fs/proc_namespace.c | 3 + fs/ramfs/file-nommu.c | 9 +- fs/ramfs/inode.c | 18 +- fs/reiserfs/acl.h | 3 +- fs/reiserfs/inode.c | 7 +- fs/reiserfs/ioctl.c | 4 +- fs/reiserfs/namei.c | 21 +- fs/reiserfs/reiserfs.h | 3 +- fs/reiserfs/xattr.c | 13 +- fs/reiserfs/xattr.h | 3 +- fs/reiserfs/xattr_acl.c | 8 +- fs/reiserfs/xattr_security.c | 3 +- fs/reiserfs/xattr_trusted.c | 3 +- fs/reiserfs/xattr_user.c | 3 +- fs/remap_range.c | 7 +- fs/stat.c | 26 +- fs/sysv/file.c | 7 +- fs/sysv/ialloc.c | 2 +- fs/sysv/itree.c | 6 +- fs/sysv/namei.c | 21 +- fs/sysv/sysv.h | 3 +- fs/tracefs/inode.c | 4 +- fs/ubifs/dir.c | 30 +- fs/ubifs/file.c | 5 +- fs/ubifs/ioctl.c | 2 +- fs/ubifs/ubifs.h | 5 +- fs/ubifs/xattr.c | 1 + fs/udf/file.c | 9 +- fs/udf/ialloc.c | 2 +- fs/udf/namei.c | 24 +- fs/udf/symlink.c | 7 +- fs/ufs/ialloc.c | 2 +- fs/ufs/inode.c | 7 +- fs/ufs/namei.c | 19 +- fs/ufs/ufs.h | 3 +- fs/utimes.c | 3 +- fs/vboxsf/dir.c | 12 +- fs/vboxsf/utils.c | 9 +- fs/vboxsf/vfsmod.h | 8 +- fs/verity/enable.c | 2 +- fs/xattr.c | 139 +- fs/xfs/xfs_acl.c | 5 +- fs/xfs/xfs_acl.h | 3 +- fs/xfs/xfs_file.c | 4 +- fs/xfs/xfs_inode.c | 26 +- fs/xfs/xfs_inode.h | 16 +- fs/xfs/xfs_ioctl.c | 35 +- fs/xfs/xfs_ioctl32.c | 6 +- fs/xfs/xfs_iops.c | 101 +- fs/xfs/xfs_iops.h | 3 +- fs/xfs/xfs_itable.c | 17 +- fs/xfs/xfs_itable.h | 1 + fs/xfs/xfs_qm.c | 3 +- fs/xfs/xfs_super.c | 2 +- fs/xfs/xfs_symlink.c | 5 +- fs/xfs/xfs_symlink.h | 5 +- fs/xfs/xfs_xattr.c | 7 +- fs/zonefs/super.c | 9 +- include/linux/capability.h | 14 +- include/linux/fs.h | 186 ++- include/linux/ima.h | 18 +- include/linux/lsm_hook_defs.h | 15 +- include/linux/lsm_hooks.h | 1 + include/linux/mount.h | 7 + include/linux/nfs_fs.h | 7 +- include/linux/posix_acl.h | 21 +- include/linux/posix_acl_xattr.h | 12 +- include/linux/security.h | 54 +- include/linux/syscalls.h | 4 + include/linux/xattr.h | 30 +- include/uapi/asm-generic/unistd.h | 4 +- include/uapi/linux/mount.h | 16 + ipc/mqueue.c | 9 +- kernel/auditsc.c | 5 +- kernel/bpf/inode.c | 13 +- kernel/capability.c | 14 +- kernel/cgroup/cgroup.c | 2 +- kernel/sys.c | 2 +- mm/madvise.c | 5 +- mm/memcontrol.c | 2 +- mm/mincore.c | 5 +- mm/shmem.c | 50 +- net/socket.c | 6 +- net/unix/af_unix.c | 5 +- security/apparmor/apparmorfs.c | 3 +- security/apparmor/domain.c | 13 +- security/apparmor/file.c | 4 +- security/apparmor/lsm.c | 21 +- security/commoncap.c | 108 +- security/integrity/evm/evm_crypto.c | 11 +- security/integrity/evm/evm_main.c | 4 +- security/integrity/evm/evm_secfs.c | 2 +- security/integrity/ima/ima.h | 19 +- security/integrity/ima/ima_api.c | 10 +- security/integrity/ima/ima_appraise.c | 23 +- security/integrity/ima/ima_asymmetric_keys.c | 3 +- security/integrity/ima/ima_main.c | 37 +- security/integrity/ima/ima_policy.c | 20 +- security/integrity/ima/ima_queue_keys.c | 4 +- security/security.c | 25 +- security/selinux/hooks.c | 23 +- security/smack/smack_lsm.c | 22 +- tools/include/uapi/asm-generic/unistd.h | 4 +- tools/testing/selftests/Makefile | 1 + .../selftests/mount_setattr/.gitignore | 1 + .../testing/selftests/mount_setattr/Makefile | 7 + tools/testing/selftests/mount_setattr/config | 1 + .../mount_setattr/mount_setattr_test.c | 1424 +++++++++++++++++ 342 files changed, 4888 insertions(+), 1750 deletions(-) create mode 100644 tools/testing/selftests/mount_setattr/.gitignore create mode 100644 tools/testing/selftests/mount_setattr/Makefile create mode 100644 tools/testing/selftests/mount_setattr/config create mode 100644 tools/testing/selftests/mount_setattr/mount_setattr_test.c base-commit: 19c329f6808995b142b3966301f217c831e7cf31 -- 2.30.0