Re: unconfined_t access to a new file type
Zdenek Pytela <[email protected]> Tue, 5 Dec 2023 15:56:02 +0100
| Newsgroups | gmane.linux.redhat.fedora.selinux |
|---|---|
| Message-ID | <CAO4UijBcDf4iMSTW=eAgpUbZ+MXAaykjZYmOBqYvO3oN204xRg@mail.gmail.com> |
--===============3784615624458349664== Content-Type: multipart/alternative; boundary="000000000000955461060bc46f63" --000000000000955461060bc46f63 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Tue, Dec 5, 2023 at 8:03=E2=80=AFAM Wart <[email protected]> wrote: > I created a new policy module using sepolgen for my RL9 server to manage > the shibboleth service, then started customizing it. Part of the new > policy is a new shibboleth_etc_t file type. > > This system is also using puppet to manage various config files on the > filesystem. > > The shibd process, running in its shibd_t domain, is able to read this > file type with no problem, but I notice that puppet (running in the > unconfined_t domain) now generates a new AVC denial when trying to > access files of this new file type. > > Do I need to explicitly allow the unconfined_t domain access to my new > file type, or is there some other piece that I'm missing? > > --Mike > > fc file: > > /usr/sbin/shibd -- gen_context(system_u:object_r:shibd_exec_t,s= 0) > /etc/shibboleth(/.*)? -- > gen_context(system_u:object_r:shibboleth_etc_t,s0) > /var/log/shibboleth(/.*)? > gen_context(system_u:object_r:shibboleth_var_log_t,s0) > /var/cache/shibboleth(/.*)? > gen_context(system_u:object_r:shibboleth_var_cache_t,s0) > /var/run/shibboleth -d > gen_context(system_u:object_r:shibboleth_var_run_t,s0) > /var/run/shibboleth/shibd.sock -s > gen_context(system_u:object_r:shibboleth_var_run_t,s0) > /etc/shibboleth/.*.pem -- gen_context(system_u:object_r:cert_t,s0) > /etc/shibboleth/.*pem -- gen_context(system_u:object_r:cert_t,s0) > > if file: > > ## <summary>policy for shibd</summary> > > ######################################## > ## <summary> > ## Execute shibd_exec_t in the shibd domain. > ## </summary> > ## <param name=3D"domain"> > ## <summary> > ## Domain allowed to transition. > ## </summary> > ## </param> > # > interface(`shibd_domtrans',` > gen_require(` > type shibd_t, shibd_exec_t; > ') > > corecmd_search_bin($1) > domtrans_pattern($1, shibd_exec_t, shibd_t) > ') > > ###################################### > ## <summary> > ## Execute shibd in the caller domain. > ## </summary> > ## <param name=3D"domain"> > ## <summary> > ## Domain allowed access. > ## </summary> > ## </param> > # > interface(`shibd_exec',` > gen_require(` > type shibd_exec_t; > ') > > corecmd_search_bin($1) > can_exec($1, shibd_exec_t) > ') > > > > te file: > > policy_module(local_shibd, 1.0.0) > > ######################################## > # > # Declarations > # > > require { > type httpd_t; > type var_run_t; > type cert_t; > type http_port_t; > type kernel_t; > class file { append create getattr open read rename unlink write > }; > class dir { add_name remove_name search write }; > class tcp_socket { name_connect }; > class sock_file { create setattr write }; > class unix_stream_socket { connectto }; > class unix_dgram_socket { create getopt sendto setopt }; > } > type shibd_t; > type shibd_exec_t; > type shibboleth_etc_t; > type shibboleth_var_log_t; > type shibboleth_var_cache_t; > type shibboleth_var_run_t; > init_daemon_domain(shibd_t, shibd_exec_t) > > > permissive shibd_t; > > ######################################## > # > # shibd local policy > # > allow shibd_t self:capability { setgid setuid }; > allow shibd_t self:process { fork signal_perms }; > allow shibd_t self:fifo_file rw_fifo_file_perms; > allow shibd_t self:unix_stream_socket create_stream_socket_perms; > > domain_use_interactive_fds(shibd_t) > > files_read_etc_files(shibd_t) > > auth_use_nsswitch(shibd_t) > > miscfiles_read_localization(shibd_t) > > allow shibd_t shibboleth_etc_t:file { getattr open read }; > > allow shibd_t shibboleth_var_log_t:dir { add_name remove_name search > write }; > allow shibd_t shibboleth_var_log_t:file { append create getattr open > read rename unlink write }; > allow shibd_t cert_t:file { open read }; > allow shibd_t shibboleth_var_run_t:dir { add_name remove_name search > write }; > allow shibd_t shibboleth_var_run_t:sock_file { create setattr unlink }; > allow shibd_t shibboleth_var_cache_t:dir { add_name remove_name search > write }; > allow shibd_t shibboleth_var_cache_t:file { create getattr open read > unlink write }; > allow shibd_t http_port_t:tcp_socket name_connect; > > # Let apache talk to shibd and vice versa > allow httpd_t shibboleth_etc_t:file { getattr open read }; > allow httpd_t shibd_t:unix_stream_socket connectto; > allow httpd_t shibboleth_var_run_t:dir search; > allow httpd_t shibboleth_var_run_t:sock_file write; > allow shibd_t kernel_t:unix_dgram_socket sendto; > allow shibd_t self:unix_dgram_socket { create getopt setopt }; > You should assign any type you define to an attribute using interfaces like files_type() and others, refer e.g. to https://github.com/fedora-selinux/selinux-policy/blame/rawhide/policy/modul= es/contrib/ntp.te#L24-L25 > The AVC denial: > > ---- > time->Mon Dec 4 14:40:45 2023 > node=3Dllodmt.ligo-la.caltech.edu type=3DPROCTITLE > msg=3Daudit(1701722445.997:630306): > > proctitle=3D707570706574206167656E743A206170706C79696E6720636F6E666967757= 26174696F6E > node=3Dllodmt.ligo-la.caltech.edu type=3DPATH > msg=3Daudit(1701722445.997:630306): item=3D0 > name=3D"/etc/shibboleth/shibboleth2.xml" inode=3D17384656 dev=3D09:7e > mode=3D0100644 ouid=3D0 ogid=3D0 rdev=3D00:00 > obj=3Dsystem_u:object_r:shibboleth_etc_t:s0 nametype=3DNORMAL cap_fp=3D0 > cap_fi=3D0 cap_fe=3D0 cap_fver=3D0 cap_frootid=3D0 > node=3Dllodmt.ligo-la.caltech.edu type=3DCWD > msg=3Daudit(1701722445.997:630306): cwd=3D"/" > node=3Dllodmt.ligo-la.caltech.edu type=3DSYSCALL > msg=3Daudit(1701722445.997:630306): arch=3Dc000003e syscall=3D257 success= =3Dyes > exit=3D35 a0=3Dffffff9c a1=3D7fa634a38e68 a2=3D80000 a3=3D0 items=3D1 ppi= d=3D2725223 > pid=3D4135271 auid=3D4294967295 uid=3D0 gid=3D0 euid=3D0 suid=3D0 fsuid= =3D0 egid=3D0 > sgid=3D0 fsgid=3D0 tty=3D(none) ses=3D4294967295 comm=3D"puppet" > exe=3D"/opt/puppetlabs/puppet/bin/ruby" > subj=3Dsystem_u:system_r:unconfined_service_t:s0 key=3D(null) > node=3Dllodmt.ligo-la.caltech.edu type=3DAVC > msg=3Daudit(1701722445.997:630306): avc: denied { open } for > pid=3D4135271 comm=3D"puppet" path=3D"/etc/shibboleth/shibboleth2.xml" > dev=3D"md126" ino=3D17384656 > scontext=3Dsystem_u:system_r:unconfined_service_t:s0 > tcontext=3Dsystem_u:object_r:shibboleth_etc_t:s0 tclass=3Dfile permissive= =3D1 > node=3Dllodmt.ligo-la.caltech.edu type=3DAVC > msg=3Daudit(1701722445.997:630306): avc: denied { read } for > pid=3D4135271 comm=3D"puppet" name=3D"shibboleth2.xml" dev=3D"md126" > ino=3D17384656 scontext=3Dsystem_u:system_r:unconfined_service_t:s0 > tcontext=3Dsystem_u:object_r:shibboleth_etc_t:s0 tclass=3Dfile permissive= =3D1 > Also note it is unconfined_service_t here which is a type different to unconfined_t. > -- > _______________________________________________ > selinux mailing list -- [email protected] > To unsubscribe send an email to [email protected] > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedoraproject.org/archives/list/[email protected]= .org > Do not reply to spam, report it: > https://pagure.io/fedora-infrastructure/new_issue > --=20 Zdenek Pytela Security SELinux team --000000000000955461060bc46f63 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr"><div dir=3D"ltr"><br></div><br><div class=3D"gmail_quote">= <div dir=3D"ltr" class=3D"gmail_attr">On Tue, Dec 5, 2023 at 8:03=E2=80=AFA= M Wart <<a href=3D"mailto:[email protected]">[email protected]</a>> wrote= :<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.= 8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">I created a ne= w policy module using sepolgen for my RL9 server to manage <br> the shibboleth service, then started customizing it.=C2=A0 Part of the new = <br> policy is a new shibboleth_etc_t file type.<br> <br> This system is also using puppet to manage various config files on the <br> filesystem.<br> <br> The shibd process, running in its shibd_t domain, is able to read this <br> file type with no problem, but I notice that puppet (running in the <br> unconfined_t domain) now generates a new AVC denial when trying to <br> access files of this new file type.<br> <br> Do I need to explicitly allow the unconfined_t domain access to my new <br> file type, or is there some other piece that I'm missing?<br> <br> --Mike<br> <br> fc file:<br> <br> /usr/sbin/shibd=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0--=C2=A0 =C2=A0gen_context= (system_u:object_r:shibd_exec_t,s0)<br> /etc/shibboleth(/.*)?=C2=A0 =C2=A0-- <br> gen_context(system_u:object_r:shibboleth_etc_t,s0)<br> /var/log/shibboleth(/.*)? <br> gen_context(system_u:object_r:shibboleth_var_log_t,s0)<br> /var/cache/shibboleth(/.*)? <br> gen_context(system_u:object_r:shibboleth_var_cache_t,s0)<br> /var/run/shibboleth=C2=A0 =C2=A0 =C2=A0-d <br> gen_context(system_u:object_r:shibboleth_var_run_t,s0)<br> /var/run/shibboleth/shibd.sock=C2=A0 -s <br> gen_context(system_u:object_r:shibboleth_var_run_t,s0)<br> /etc/shibboleth/.*.pem=C2=A0 --=C2=A0 =C2=A0gen_context(system_u:object_r:c= ert_t,s0)<br> /etc/shibboleth/.*pem=C2=A0 =C2=A0--=C2=A0 =C2=A0gen_context(system_u:objec= t_r:cert_t,s0)<br> <br> if file:<br> <br> ## <summary>policy for shibd</summary><br> <br> ########################################<br> ## <summary><br> ##=C2=A0 =C2=A0 =C2=A0 Execute shibd_exec_t in the shibd domain.<br> ## </summary><br> ## <param name=3D"domain"><br> ## <summary><br> ##=C2=A0 =C2=A0 =C2=A0 Domain allowed to transition.<br> ## </summary><br> ## </param><br> #<br> interface(`shibd_domtrans',`<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0gen_require(`<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0type shibd_t,= shibd_exec_t;<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0')<br> <br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0corecmd_search_bin($1)<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0domtrans_pattern($1, shibd_exec_t, shibd_= t)<br> ')<br> <br> ######################################<br> ## <summary><br> ##=C2=A0 =C2=A0 =C2=A0 Execute shibd in the caller domain.<br> ## </summary><br> ## <param name=3D"domain"><br> ##=C2=A0 =C2=A0 =C2=A0 <summary><br> ##=C2=A0 =C2=A0 =C2=A0 Domain allowed access.<br> ##=C2=A0 =C2=A0 =C2=A0 </summary><br> ## </param><br> #<br> interface(`shibd_exec',`<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0gen_require(`<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0type shibd_ex= ec_t;<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0')<br> <br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0corecmd_search_bin($1)<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0can_exec($1, shibd_exec_t)<br> ')<br> <br> <br> <br> te file:<br> <br> policy_module(local_shibd, 1.0.0)<br> <br> ########################################<br> #<br> # Declarations<br> #<br> <br> require {<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0type httpd_t;<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0type var_run_t;<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0type cert_t;<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0type http_port_t;<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0type kernel_t;<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0class file { append create getattr open r= ead rename unlink write };<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0class dir { add_name remove_name search w= rite };<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0class tcp_socket { name_connect };<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0class sock_file { create setattr write };= <br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0class unix_stream_socket { connectto };<b= r> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0class unix_dgram_socket { create getopt s= endto setopt };<br> }<br> type shibd_t;<br> type shibd_exec_t;<br> type shibboleth_etc_t;<br> type shibboleth_var_log_t;<br> type shibboleth_var_cache_t;<br> type shibboleth_var_run_t;<br> init_daemon_domain(shibd_t, shibd_exec_t)<br> <br> <br> permissive shibd_t;<br> <br> ########################################<br> #<br> # shibd local policy<br> #<br> allow shibd_t self:capability { setgid setuid };<br> allow shibd_t self:process { fork signal_perms };<br> allow shibd_t self:fifo_file rw_fifo_file_perms;<br> allow shibd_t self:unix_stream_socket create_stream_socket_perms;<br> <br> domain_use_interactive_fds(shibd_t)<br> <br> files_read_etc_files(shibd_t)<br> <br> auth_use_nsswitch(shibd_t)<br> <br> miscfiles_read_localization(shibd_t)<br> <br> allow shibd_t shibboleth_etc_t:file { getattr open read };<br> <br> allow shibd_t shibboleth_var_log_t:dir { add_name remove_name search <br> write };<br> allow shibd_t shibboleth_var_log_t:file { append create getattr open <br> read rename unlink write };<br> allow shibd_t cert_t:file { open read };<br> allow shibd_t shibboleth_var_run_t:dir { add_name remove_name search <br> write };<br> allow shibd_t shibboleth_var_run_t:sock_file { create setattr unlink };<br> allow shibd_t shibboleth_var_cache_t:dir { add_name remove_name search <br> write };<br> allow shibd_t shibboleth_var_cache_t:file { create getattr open read <br> unlink write };<br> allow shibd_t http_port_t:tcp_socket name_connect;<br> <br> # Let apache talk to shibd and vice versa<br> allow httpd_t shibboleth_etc_t:file { getattr open read };<br> allow httpd_t shibd_t:unix_stream_socket connectto;<br> allow httpd_t shibboleth_var_run_t:dir search;<br> allow httpd_t shibboleth_var_run_t:sock_file write;<br> allow shibd_t kernel_t:unix_dgram_socket sendto;<br> allow shibd_t self:unix_dgram_socket { create getopt setopt };<br></blockqu= ote><div><br></div><div>You should assign any type you define to an attribu= te using interfaces like files_type() and others, refer e.g. to<br></div><d= iv><a href=3D"https://github.com/fedora-selinux/selinux-policy/blame/rawhid= e/policy/modules/contrib/ntp.te#L24-L25">https://github.com/fedora-selinux/= selinux-policy/blame/rawhide/policy/modules/contrib/ntp.te#L24-L25</a></div= ><div><br></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0= px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> <br> The AVC denial:<br> <br> ----<br> time->Mon Dec=C2=A0 4 14:40:45 2023<br> node=3D<a href=3D"http://llodmt.ligo-la.caltech.edu" rel=3D"noreferrer" tar= get=3D"_blank">llodmt.ligo-la.caltech.edu</a> type=3DPROCTITLE <br> msg=3Daudit(1701722445.997:630306): <br> proctitle=3D707570706574206167656E743A206170706C79696E6720636F6E66696775726= 174696F6E<br> node=3D<a href=3D"http://llodmt.ligo-la.caltech.edu" rel=3D"noreferrer" tar= get=3D"_blank">llodmt.ligo-la.caltech.edu</a> type=3DPATH <br> msg=3Daudit(1701722445.997:630306): item=3D0 <br> name=3D"/etc/shibboleth/shibboleth2.xml" inode=3D17384656 dev=3D0= 9:7e <br> mode=3D0100644 ouid=3D0 ogid=3D0 rdev=3D00:00 <br> obj=3Dsystem_u:object_r:shibboleth_etc_t:s0 nametype=3DNORMAL cap_fp=3D0 <b= r> cap_fi=3D0 cap_fe=3D0 cap_fver=3D0 cap_frootid=3D0<br> node=3D<a href=3D"http://llodmt.ligo-la.caltech.edu" rel=3D"noreferrer" tar= get=3D"_blank">llodmt.ligo-la.caltech.edu</a> type=3DCWD <br> msg=3Daudit(1701722445.997:630306): cwd=3D"/"<br> node=3D<a href=3D"http://llodmt.ligo-la.caltech.edu" rel=3D"noreferrer" tar= get=3D"_blank">llodmt.ligo-la.caltech.edu</a> type=3DSYSCALL <br> msg=3Daudit(1701722445.997:630306): arch=3Dc000003e syscall=3D257 success= =3Dyes <br> exit=3D35 a0=3Dffffff9c a1=3D7fa634a38e68 a2=3D80000 a3=3D0 items=3D1 ppid= =3D2725223 <br> pid=3D4135271 auid=3D4294967295 uid=3D0 gid=3D0 euid=3D0 suid=3D0 fsuid=3D0= egid=3D0 <br> sgid=3D0 fsgid=3D0 tty=3D(none) ses=3D4294967295 comm=3D"puppet" = <br> exe=3D"/opt/puppetlabs/puppet/bin/ruby" <br> subj=3Dsystem_u:system_r:unconfined_service_t:s0 key=3D(null)<br> node=3D<a href=3D"http://llodmt.ligo-la.caltech.edu" rel=3D"noreferrer" tar= get=3D"_blank">llodmt.ligo-la.caltech.edu</a> type=3DAVC <br> msg=3Daudit(1701722445.997:630306): avc:=C2=A0 denied=C2=A0 { open } for <b= r> pid=3D4135271 comm=3D"puppet" path=3D"/etc/shibboleth/shibbo= leth2.xml" <br> dev=3D"md126" ino=3D17384656 <br> scontext=3Dsystem_u:system_r:unconfined_service_t:s0 <br> tcontext=3Dsystem_u:object_r:shibboleth_etc_t:s0 tclass=3Dfile permissive= =3D1<br> node=3D<a href=3D"http://llodmt.ligo-la.caltech.edu" rel=3D"noreferrer" tar= get=3D"_blank">llodmt.ligo-la.caltech.edu</a> type=3DAVC <br> msg=3Daudit(1701722445.997:630306): avc:=C2=A0 denied=C2=A0 { read } for <b= r> pid=3D4135271 comm=3D"puppet" name=3D"shibboleth2.xml" = dev=3D"md126" <br> ino=3D17384656 scontext=3Dsystem_u:system_r:unconfined_service_t:s0 <br> tcontext=3Dsystem_u:object_r:shibboleth_etc_t:s0 tclass=3Dfile permissive= =3D1<br></blockquote><div><br></div><div>Also note it is unconfined_service= _t here which is a type different to unconfined_t.</div><div>=C2=A0<br></di= v><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;borde= r-left:1px solid rgb(204,204,204);padding-left:1ex"> --<br> _______________________________________________<br> selinux mailing list -- <a href=3D"mailto:[email protected]" = target=3D"_blank">[email protected]</a><br> To unsubscribe send an email to <a href=3D"mailto:[email protected]= aproject.org" target=3D"_blank">[email protected]</a><b= r> Fedora Code of Conduct: <a href=3D"https://docs.fedoraproject.org/en-US/pro= ject/code-of-conduct/" rel=3D"noreferrer" target=3D"_blank">https://docs.fe= doraproject.org/en-US/project/code-of-conduct/</a><br> List Guidelines: <a href=3D"https://fedoraproject.org/wiki/Mailing_list_gui= delines" rel=3D"noreferrer" target=3D"_blank">https://fedoraproject.org/wik= i/Mailing_list_guidelines</a><br> List Archives: <a href=3D"https://lists.fedoraproject.org/archives/list/sel= [email protected]" rel=3D"noreferrer" target=3D"_blank">https://= lists.fedoraproject.org/archives/list/[email protected]</a><b= r> Do not reply to spam, report it: <a href=3D"https://pagure.io/fedora-infras= tructure/new_issue" rel=3D"noreferrer" target=3D"_blank">https://pagure.io/= fedora-infrastructure/new_issue</a><br> </blockquote></div><br clear=3D"all"><br><span class=3D"gmail_signature_pre= fix">-- </span><br><div dir=3D"ltr" class=3D"gmail_signature"><div dir=3D"l= tr"><div><div dir=3D"ltr"><div><div dir=3D"ltr"><div><div dir=3D"ltr"><div>= <div dir=3D"ltr"><div><div dir=3D"ltr"><div><div dir=3D"ltr"><br> Zdenek Pytela</div><div dir=3D"ltr">Security SELinux team</div></div></div>= </div></div></div></div></div></div></div></div></div></div></div></div> --000000000000955461060bc46f63-- --===============3784615624458349664== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: inline LS0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18Kc2VsaW51 eCBtYWlsaW5nIGxpc3QgLS0gc2VsaW51eEBsaXN0cy5mZWRvcmFwcm9qZWN0Lm9yZwpUbyB1bnN1 YnNjcmliZSBzZW5kIGFuIGVtYWlsIHRvIHNlbGludXgtbGVhdmVAbGlzdHMuZmVkb3JhcHJvamVj dC5vcmcKRmVkb3JhIENvZGUgb2YgQ29uZHVjdDogaHR0cHM6Ly9kb2NzLmZlZG9yYXByb2plY3Qu b3JnL2VuLVVTL3Byb2plY3QvY29kZS1vZi1jb25kdWN0LwpMaXN0IEd1aWRlbGluZXM6IGh0dHBz Oi8vZmVkb3JhcHJvamVjdC5vcmcvd2lraS9NYWlsaW5nX2xpc3RfZ3VpZGVsaW5lcwpMaXN0IEFy Y2hpdmVzOiBodHRwczovL2xpc3RzLmZlZG9yYXByb2plY3Qub3JnL2FyY2hpdmVzL2xpc3Qvc2Vs aW51eEBsaXN0cy5mZWRvcmFwcm9qZWN0Lm9yZwpEbyBub3QgcmVwbHkgdG8gc3BhbSwgcmVwb3J0 IGl0OiBodHRwczovL3BhZ3VyZS5pby9mZWRvcmEtaW5mcmFzdHJ1Y3R1cmUvbmV3X2lzc3VlCg== --===============3784615624458349664==--