From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Jeimon <jjjinmeng.zhou@gmail.com>,
"David S. Miller" <davem@davemloft.net>,
Sasha Levin <sashal@kernel.org>
Subject: [PATCH 5.10 007/131] net/nfc/rawsock.c: fix a permission check bug
Date: Mon, 14 Jun 2021 12:26:08 +0200 [thread overview]
Message-ID: <20210614102653.218539315@linuxfoundation.org> (raw)
In-Reply-To: <20210614102652.964395392@linuxfoundation.org>
From: Jeimon <jjjinmeng.zhou@gmail.com>
[ Upstream commit 8ab78863e9eff11910e1ac8bcf478060c29b379e ]
The function rawsock_create() calls a privileged function sk_alloc(), which requires a ns-aware check to check net->user_ns, i.e., ns_capable(). However, the original code checks the init_user_ns using capable(). So we replace the capable() with ns_capable().
Signed-off-by: Jeimon <jjjinmeng.zhou@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/nfc/rawsock.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/nfc/rawsock.c b/net/nfc/rawsock.c
index 9c7eb8455ba8..5f1d438a0a23 100644
--- a/net/nfc/rawsock.c
+++ b/net/nfc/rawsock.c
@@ -329,7 +329,7 @@ static int rawsock_create(struct net *net, struct socket *sock,
return -ESOCKTNOSUPPORT;
if (sock->type == SOCK_RAW) {
- if (!capable(CAP_NET_RAW))
+ if (!ns_capable(net->user_ns, CAP_NET_RAW))
return -EPERM;
sock->ops = &rawsock_raw_ops;
} else {
--
2.30.2
next prev parent reply other threads:[~2021-06-14 11:09 UTC|newest]
Thread overview: 141+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-06-14 10:26 [PATCH 5.10 000/131] 5.10.44-rc1 review Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 5.10 001/131] proc: Track /proc/$pid/attr/ opener mm_struct Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 5.10 002/131] ASoC: max98088: fix ni clock divider calculation Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 5.10 003/131] ASoC: amd: fix for pcm_read() error Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 5.10 004/131] spi: Fix spi device unregister flow Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 5.10 005/131] spi: spi-zynq-qspi: Fix stack violation bug Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 5.10 006/131] bpf: Forbid trampoline attach for functions with variable arguments Greg Kroah-Hartman
2021-06-14 10:26 ` Greg Kroah-Hartman [this message]
2021-06-14 10:26 ` [PATCH 5.10 008/131] usb: cdns3: Fix runtime PM imbalance on error Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 5.10 009/131] ASoC: Intel: bytcr_rt5640: Add quirk for the Glavey TM800A550L tablet Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 5.10 010/131] ASoC: Intel: bytcr_rt5640: Add quirk for the Lenovo Miix 3-830 tablet Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 5.10 011/131] bpf: Add deny list of btf ids check for tracing programs Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 5.10 012/131] vfio-ccw: Reset FSM state to IDLE inside FSM Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 5.10 013/131] vfio-ccw: Serialize FSM IDLE state with I/O completion Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 5.10 014/131] ASoC: sti-sas: add missing MODULE_DEVICE_TABLE Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 5.10 015/131] spi: sprd: Add " Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 5.10 016/131] usb: chipidea: udc: assign interrupt number to USB gadget structure Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 5.10 017/131] isdn: mISDN: netjet: Fix crash in nj_probe: Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 5.10 018/131] bonding: init notify_work earlier to avoid uninitialized use Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 5.10 019/131] netlink: disable IRQs for netlink_lock_table() Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 5.10 020/131] net: mdiobus: get rid of a BUG_ON() Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 5.10 021/131] cgroup: disable controllers at parse time Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 5.10 022/131] wq: handle VM suspension in stall detection Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 5.10 023/131] net/qla3xxx: fix schedule while atomic in ql_sem_spinlock Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 5.10 024/131] RDS tcp loopback connection can hang Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 5.10 025/131] net:sfc: fix non-freed irq in legacy irq mode Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 5.10 026/131] scsi: bnx2fc: Return failure if io_req is already in ABTS processing Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 5.10 027/131] scsi: vmw_pvscsi: Set correct residual data length Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 5.10 028/131] scsi: hisi_sas: Drop free_irq() of devm_request_irq() allocated irq Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 5.10 029/131] scsi: target: qla2xxx: Wait for stop_phase1 at WWN removal Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 5.10 030/131] net: macb: ensure the device is available before accessing GEMGXL control registers Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 5.10 031/131] net: appletalk: cops: Fix data race in cops_probe1 Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 5.10 032/131] net: dsa: microchip: enable phy errata workaround on 9567 Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 5.10 033/131] nvme-fabrics: decode host pathing error for connect Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 5.10 034/131] MIPS: Fix kernel hang under FUNCTION_GRAPH_TRACER and PREEMPT_TRACER Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 5.10 035/131] dm verity: fix require_signatures module_param permissions Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 5.10 036/131] bnx2x: Fix missing error code in bnx2x_iov_init_one() Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 5.10 037/131] nvme-tcp: remove incorrect Kconfig dep in BLK_DEV_NVME Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 5.10 038/131] nvmet: fix false keep-alive timeout when a controller is torn down Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 5.10 039/131] powerpc/fsl: set fsl,i2c-erratum-a004447 flag for P2041 i2c controllers Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 5.10 040/131] powerpc/fsl: set fsl,i2c-erratum-a004447 flag for P1010 " Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 5.10 041/131] spi: Dont have controller clean up spi device before driver unbind Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 5.10 042/131] spi: Cleanup on failure of initial setup Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 5.10 043/131] i2c: mpc: Make use of i2c_recover_bus() Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 5.10 044/131] i2c: mpc: implement erratum A-004447 workaround Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 5.10 045/131] ALSA: seq: Fix race of snd_seq_timer_open() Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 5.10 046/131] ALSA: firewire-lib: fix the context to call snd_pcm_stop_xrun() Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 5.10 047/131] ALSA: hda/realtek: headphone and mic dont work on an Acer laptop Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 5.10 048/131] ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP Elite Dragonfly G2 Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 5.10 049/131] ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP EliteBook x360 1040 G8 Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 5.10 050/131] ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 840 Aero G8 Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 5.10 051/131] ALSA: hda/realtek: fix mute/micmute LEDs for HP ZBook Power G8 Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 5.10 052/131] spi: bcm2835: Fix out-of-bounds access with more than 4 slaves Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 5.10 053/131] Revert "ACPI: sleep: Put the FACS table after using it" Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 5.10 054/131] drm: Fix use-after-free read in drm_getunique() Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 5.10 055/131] drm: Lock pointer access in drm_master_release() Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 5.10 056/131] perf/x86/intel/uncore: Fix M2M event umask for Ice Lake server Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 5.10 057/131] KVM: X86: MMU: Use the correct inherited permissions to get shadow page Greg Kroah-Hartman
2021-06-14 10:26 ` [PATCH 5.10 058/131] kvm: avoid speculation-based attacks from out-of-range memslot accesses Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 059/131] staging: rtl8723bs: Fix uninitialized variables Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 060/131] async_xor: check src_offs is not NULL before updating it Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 061/131] btrfs: return value from btrfs_mark_extent_written() in case of error Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 062/131] btrfs: promote debugging asserts to full-fledged checks in validate_super Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 063/131] cgroup1: dont allow \n in renaming Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 064/131] ftrace: Do not blindly read the ip address in ftrace_bug() Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 065/131] mmc: renesas_sdhi: abort tuning when timeout detected Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 066/131] mmc: renesas_sdhi: Fix HS400 on R-Car M3-W+ Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 067/131] USB: f_ncm: ncm_bitrate (speed) is unsigned Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 068/131] usb: f_ncm: only first packet of aggregate needs to start timer Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 069/131] usb: pd: Set PD_T_SINK_WAIT_CAP to 310ms Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 070/131] usb: dwc3-meson-g12a: fix usb2 PHY glue init when phy0 is disabled Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 071/131] usb: dwc3: meson-g12a: Disable the regulator in the error handling path of the probe Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 072/131] usb: dwc3: gadget: Bail from dwc3_gadget_exit() if dwc->gadget is NULL Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 073/131] usb: dwc3: debugfs: Add and remove endpoint dirs dynamically Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 074/131] usb: dwc3: ep0: fix NULL pointer exception Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 075/131] usb: musb: fix MUSB_QUIRK_B_DISCONNECT_99 handling Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 076/131] usb: typec: wcove: Use LE to CPU conversion when accessing msg->header Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 077/131] usb: typec: ucsi: Clear PPM capability data in ucsi_init() error path Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 078/131] usb: typec: intel_pmc_mux: Put fwnode in error case during ->probe() Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 079/131] usb: typec: intel_pmc_mux: Add missed error check for devm_ioremap_resource() Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 080/131] usb: gadget: f_fs: Ensure io_completion_wq is idle during unbind Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 081/131] USB: serial: ftdi_sio: add NovaTech OrionMX product ID Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 082/131] USB: serial: omninet: add device id for Zyxel Omni 56K Plus Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 083/131] USB: serial: quatech2: fix control-request directions Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 084/131] USB: serial: cp210x: fix alternate function for CP2102N QFN20 Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 085/131] usb: gadget: eem: fix wrong eem header operation Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 086/131] usb: fix various gadgets null ptr deref on 10gbps cabling Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 087/131] usb: fix various gadget panics " Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 088/131] usb: typec: tcpm: cancel vdm and state machine hrtimer when unregister tcpm port Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 089/131] usb: typec: tcpm: cancel frs " Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 090/131] regulator: core: resolve supply for boot-on/always-on regulators Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 091/131] regulator: max77620: Use device_set_of_node_from_dev() Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 092/131] regulator: bd718x7: Fix the BUCK7 voltage setting on BD71837 Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 093/131] regulator: fan53880: Fix missing n_voltages setting Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 094/131] regulator: bd71828: Fix .n_voltages settings Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 095/131] regulator: rtmv20: Fix .set_current_limit/.get_current_limit callbacks Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 096/131] phy: usb: Fix misuse of IS_ENABLED Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 097/131] usb: dwc3: gadget: Disable gadget IRQ during pullup disable Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 098/131] usb: typec: mux: Fix copy-paste mistake in typec_mux_match Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 099/131] drm/mcde: Fix off by 10^3 in calculation Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 100/131] drm/msm/a6xx: fix incorrectly set uavflagprd_inv field for A650 Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 101/131] drm/msm/a6xx: update/fix CP_PROTECT initialization Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 102/131] drm/msm/a6xx: avoid shadow NULL reference in failure path Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 103/131] RDMA/ipoib: Fix warning caused by destroying non-initial netns Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 104/131] RDMA/mlx4: Do not map the core_clock page to user space unless enabled Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 105/131] ARM: cpuidle: Avoid orphan section warning Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 106/131] vmlinux.lds.h: Avoid orphan section with !SMP Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 107/131] tools/bootconfig: Fix error return code in apply_xbc() Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 108/131] phy: cadence: Sierra: Fix error return code in cdns_sierra_phy_probe() Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 109/131] ASoC: core: Fix Null-point-dereference in fmt_single_name() Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 110/131] ASoC: meson: gx-card: fix sound-dai dt schema Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 111/131] phy: ti: Fix an error code in wiz_probe() Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 112/131] gpio: wcd934x: Fix shift-out-of-bounds error Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 113/131] perf: Fix data race between pin_count increment/decrement Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 114/131] sched/fair: Keep load_avg and load_sum synced Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 115/131] sched/fair: Make sure to update tg contrib for blocked load Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 116/131] sched/fair: Fix util_est UTIL_AVG_UNCHANGED handling Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 117/131] x86/nmi_watchdog: Fix old-style NMI watchdog regression on old Intel CPUs Greg Kroah-Hartman
2021-06-14 10:27 ` [PATCH 5.10 118/131] KVM: x86: Ensure liveliness of nested VM-Enter fail tracepoint message Greg Kroah-Hartman
2021-06-14 10:28 ` [PATCH 5.10 119/131] IB/mlx5: Fix initializing CQ fragments buffer Greg Kroah-Hartman
2021-06-14 10:28 ` [PATCH 5.10 120/131] NFS: Fix a potential NULL dereference in nfs_get_client() Greg Kroah-Hartman
2021-06-14 10:28 ` [PATCH 5.10 121/131] NFSv4: Fix deadlock between nfs4_evict_inode() and nfs4_opendata_get_inode() Greg Kroah-Hartman
2021-06-14 10:28 ` [PATCH 5.10 122/131] perf session: Correct buffer copying when peeking events Greg Kroah-Hartman
2021-06-14 10:28 ` [PATCH 5.10 123/131] kvm: fix previous commit for 32-bit builds Greg Kroah-Hartman
2021-06-14 10:28 ` [PATCH 5.10 124/131] NFS: Fix use-after-free in nfs4_init_client() Greg Kroah-Hartman
2021-06-14 10:28 ` [PATCH 5.10 125/131] NFSv4: Fix second deadlock in nfs4_evict_inode() Greg Kroah-Hartman
2021-06-14 10:28 ` [PATCH 5.10 126/131] NFSv4: nfs4_proc_set_acl needs to restore NFS_CAP_UIDGID_NOMAP on error Greg Kroah-Hartman
2021-06-14 10:28 ` [PATCH 5.10 127/131] scsi: core: Fix error handling of scsi_host_alloc() Greg Kroah-Hartman
2021-06-14 10:28 ` [PATCH 5.10 128/131] scsi: core: Fix failure handling of scsi_add_host_with_dma() Greg Kroah-Hartman
2021-06-14 10:28 ` [PATCH 5.10 129/131] scsi: core: Put .shost_dev in failure path if host state changes to RUNNING Greg Kroah-Hartman
2021-06-14 10:28 ` [PATCH 5.10 130/131] scsi: core: Only put parent device if host state differs from SHOST_CREATED Greg Kroah-Hartman
2021-06-14 10:28 ` [PATCH 5.10 131/131] tracing: Correct the length check which causes memory corruption Greg Kroah-Hartman
2021-06-14 13:39 ` [PATCH 5.10 000/131] 5.10.44-rc1 review Naresh Kamboju
2021-06-14 14:01 ` Fox Chen
2021-06-14 15:36 ` Holger Hoffstätte
2021-06-14 16:11 ` Greg Kroah-Hartman
2021-06-14 16:14 ` Greg Kroah-Hartman
2021-06-14 17:55 ` Jon Hunter
2021-06-14 19:36 ` Florian Fainelli
2021-06-14 19:46 ` Pavel Machek
2021-06-15 1:19 ` Samuel Zou
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210614102653.218539315@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=davem@davemloft.net \
--cc=jjjinmeng.zhou@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.