--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
meshchatx/src/backend/seccomp_sandbox.py 4bd787ccd70a459a02eececca3f942f0e64ec4ce (4bd787cc) Text, 7.22 KB
T8b949e# SPDX-License-Identifier: 0BSD
T8b949e"""Optional seccomp-BPF syscall denylist for the backend (Linux only).
Complements Landlock filesystem rules. Default action is ALLOW with a small
denylist of kernel-admin and process-introspection syscalls a mesh client never
needs. When libseccomp or the kernel filter is unavailable, apply falls back to
a no-op so the process still starts.
"""
Tff7b72from T7ee787__future__ Tff7b72import Te6edf3annotations
Tff7b72import T7ee787ctypes
Tff7b72import T7ee787ctypesT7ee787.T7ee787util
Tff7b72import T7ee787errno
Tff7b72import T7ee787logging
Tff7b72import T7ee787os
Tff7b72import T7ee787sys
Te6edf3logger Tff7b72= Te6edf3loggingTff7b72.Td2a8ffgetLoggerTb4b4b4(Ta5d6ff"Ta5d6ffmeshchatx.seccompTa5d6ff"Tb4b4b4)
T8b949e# From linux/seccomp.h / libseccomp.h
Te6edf3_SCMP_ACT_ALLOW Tff7b72= T79c0ff0x7FFF0000
Te6edf3_SCMP_ACT_ERRNO_BASE Tff7b72= T79c0ff0x00050000
T8b949e# Dangerous or unused by MeshChatX. Names are resolved via libseccomp so unknown
T8b949e# names on older kernels are skipped instead of failing the whole filter.
Te6edf3_DENIED_SYSCALLS Tff7b72= Tb4b4b4(
Ta5d6ff"Ta5d6ffmountTa5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6ffumountTa5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6ffumount2Ta5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6ffpivot_rootTa5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6ffrebootTa5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6ffkexec_loadTa5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6ffkexec_file_loadTa5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6ffinit_moduleTa5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6fffinit_moduleTa5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6ffdelete_moduleTa5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6ffswaponTa5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6ffswapoffTa5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6ffbpfTa5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6ffuserfaultfdTa5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6ffopen_by_handle_atTa5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6ffname_to_handle_atTa5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6ffsetnsTa5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6ffunshareTa5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6ffacctTa5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6ffiopermTa5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6ffioplTa5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6ffperf_event_openTa5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6ffptraceTa5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6ffprocess_vm_readvTa5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6ffprocess_vm_writevTa5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6ffsyslogTa5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6ffquotactlTa5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6fflookup_dcookieTa5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6fffanotify_initTa5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6ffopen_treeTa5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6ffmove_mountTa5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6fffsopenTa5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6fffsconfigTa5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6fffsmountTa5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6fffspickTa5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6ffmount_setattrTa5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6ffvhangupTa5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6ffuselibTa5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6ffcreate_moduleTa5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6ffquery_moduleTa5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6ffget_kernel_symsTa5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6ffnfsservctlTa5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6ffvm86Ta5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6ffvm86oldTa5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6ff_sysctlTa5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6ffmodify_ldtTa5d6ff"Tb4b4b4,
Tb4b4b4)
Tff7b72def Td2a8ff_seccomp_env_overrideTb4b4b4(Tb4b4b4) Tff7b72-Tff7b72> Tffa657bool Tff7b72| Tff7b72NoneTb4b4b4:
Te6edf3raw Tff7b72= Te6edf3osTff7b72.Td2a8ffenvironTff7b72.Td2a8ffgetTb4b4b4(Ta5d6ff"Ta5d6ffMESHCHAT_SECCOMPTa5d6ff"Tb4b4b4)
Tff7b72if Te6edf3raw Tff7b72is Tff7b72NoneTb4b4b4:
Tff7b72return Tff7b72None
Te6edf3val Tff7b72= Te6edf3rawTff7b72.Td2a8ffstripTb4b4b4(Tb4b4b4)Tff7b72.Td2a8fflowerTb4b4b4(Tb4b4b4)
Tff7b72if Te6edf3val Tff7b72in Tb4b4b4(Ta5d6ff"Ta5d6fffalseTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ff0Ta5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ffnoTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ffoffTa5d6ff"Tb4b4b4)Tb4b4b4:
Tff7b72return Tff7b72False
Tff7b72if Te6edf3val Tff7b72in Tb4b4b4(Ta5d6ff"Ta5d6fftrueTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ff1Ta5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ffyesTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ffonTa5d6ff"Tb4b4b4)Tb4b4b4:
Tff7b72return Tff7b72True
Tff7b72return Tff7b72None
Tff7b72def Td2a8ff_is_androidTb4b4b4(Tb4b4b4) Tff7b72-Tff7b72> Tffa657boolTb4b4b4:
Tff7b72return Tffa657hasattrTb4b4b4(Te6edf3sysTb4b4b4, Ta5d6ff"Ta5d6ffgetandroidapilevelTa5d6ff"Tb4b4b4)
Te6edf3_seccomp_support_cachedTb4b4b4: Tffa657bool Tff7b72| Tff7b72None Tff7b72= Tff7b72None
Te6edf3_seccomp_lib_cached Tff7b72= Tff7b72None
Te6edf3_seccomp_lib_failed Tff7b72= Tff7b72False
Tff7b72def Td2a8ff_load_libseccompTb4b4b4(Tb4b4b4)Tb4b4b4:
T8b949e"""Return a loaded libseccomp CDLL, or None when unavailable."""
Tff7b72global Te6edf3_seccomp_lib_cachedTb4b4b4, Te6edf3_seccomp_lib_failed
Tff7b72if Te6edf3_seccomp_lib_failedTb4b4b4:
Tff7b72return Tff7b72None
Tff7b72if Te6edf3_seccomp_lib_cached Tff7b72is Tff7b72not Tff7b72NoneTb4b4b4:
Tff7b72return Te6edf3_seccomp_lib_cached
Te6edf3candidatesTb4b4b4: Tffa657listTb4b4b4[Tffa657str Tff7b72| Tff7b72NoneTb4b4b4] Tff7b72= Tb4b4b4[
Te6edf3ctypesTff7b72.Td2a8ffutilTff7b72.Td2a8fffind_libraryTb4b4b4(Ta5d6ff"Ta5d6ffseccompTa5d6ff"Tb4b4b4)Tb4b4b4,
Ta5d6ff"Ta5d6fflibseccomp.so.2Ta5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6fflibseccomp.soTa5d6ff"Tb4b4b4,
Tb4b4b4]
Tff7b72for Te6edf3name Tff7b72in Te6edf3candidatesTb4b4b4:
Tff7b72if Tff7b72not Te6edf3nameTb4b4b4:
Tff7b72continue
Tff7b72tryTb4b4b4:
Te6edf3lib Tff7b72= Te6edf3ctypesTff7b72.Td2a8ffCDLLTb4b4b4(Te6edf3nameTb4b4b4)
Tff7b72except Tf85149OSErrorTb4b4b4:
Tff7b72continue
Te6edf3required Tff7b72= Tb4b4b4(
Ta5d6ff"Ta5d6ffseccomp_initTa5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6ffseccomp_rule_addTa5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6ffseccomp_loadTa5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6ffseccomp_releaseTa5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6ffseccomp_syscall_resolve_nameTa5d6ff"Tb4b4b4,
Tb4b4b4)
Tff7b72if Tffa657anyTb4b4b4(Tff7b72not Tffa657hasattrTb4b4b4(Te6edf3libTb4b4b4, Te6edf3attrTb4b4b4) Tff7b72for Te6edf3attr Tff7b72in Te6edf3requiredTb4b4b4)Tb4b4b4:
Tff7b72continue
Te6edf3libTff7b72.Td2a8ffseccomp_initTff7b72.Td2a8ffargtypes Tff7b72= Tb4b4b4[Te6edf3ctypesTff7b72.Td2a8ffc_uint32Tb4b4b4]
Te6edf3libTff7b72.Td2a8ffseccomp_initTff7b72.Td2a8ffrestype Tff7b72= Te6edf3ctypesTff7b72.Td2a8ffc_void_p
Te6edf3libTff7b72.Td2a8ffseccomp_rule_addTff7b72.Td2a8ffargtypes Tff7b72= Tb4b4b4[
Te6edf3ctypesTff7b72.Td2a8ffc_void_pTb4b4b4,
Te6edf3ctypesTff7b72.Td2a8ffc_uint32Tb4b4b4,
Te6edf3ctypesTff7b72.Td2a8ffc_intTb4b4b4,
Te6edf3ctypesTff7b72.Td2a8ffc_uintTb4b4b4,
Tb4b4b4]
Te6edf3libTff7b72.Td2a8ffseccomp_rule_addTff7b72.Td2a8ffrestype Tff7b72= Te6edf3ctypesTff7b72.Td2a8ffc_int
Te6edf3libTff7b72.Td2a8ffseccomp_loadTff7b72.Td2a8ffargtypes Tff7b72= Tb4b4b4[Te6edf3ctypesTff7b72.Td2a8ffc_void_pTb4b4b4]
Te6edf3libTff7b72.Td2a8ffseccomp_loadTff7b72.Td2a8ffrestype Tff7b72= Te6edf3ctypesTff7b72.Td2a8ffc_int
Te6edf3libTff7b72.Td2a8ffseccomp_releaseTff7b72.Td2a8ffargtypes Tff7b72= Tb4b4b4[Te6edf3ctypesTff7b72.Td2a8ffc_void_pTb4b4b4]
Te6edf3libTff7b72.Td2a8ffseccomp_releaseTff7b72.Td2a8ffrestype Tff7b72= Tff7b72None
Te6edf3libTff7b72.Td2a8ffseccomp_syscall_resolve_nameTff7b72.Td2a8ffargtypes Tff7b72= Tb4b4b4[Te6edf3ctypesTff7b72.Td2a8ffc_char_pTb4b4b4]
Te6edf3libTff7b72.Td2a8ffseccomp_syscall_resolve_nameTff7b72.Td2a8ffrestype Tff7b72= Te6edf3ctypesTff7b72.Td2a8ffc_int
Te6edf3_seccomp_lib_cached Tff7b72= Te6edf3lib
Tff7b72return Te6edf3lib
Te6edf3_seccomp_lib_failed Tff7b72= Tff7b72True
Tff7b72return Tff7b72None
Tff7b72def Td2a8ff_act_errnoTb4b4b4(Te6edf3codeTb4b4b4: Tffa657int Tff7b72= Te6edf3errnoTff7b72.Td2a8ffEPERMTb4b4b4) Tff7b72-Tff7b72> Tffa657intTb4b4b4:
Tff7b72return Te6edf3_SCMP_ACT_ERRNO_BASE Tff7b72| Tb4b4b4(Tffa657intTb4b4b4(Te6edf3codeTb4b4b4) Tff7b72& T79c0ff0xFFFFTb4b4b4)
Tff7b72def Td2a8ffseccomp_library_availableTb4b4b4(Tb4b4b4) Tff7b72-Tff7b72> Tffa657boolTb4b4b4:
T8b949e"""Return True when libseccomp can be loaded with the symbols we need."""
Tff7b72return Te6edf3_load_libseccompTb4b4b4(Tb4b4b4) Tff7b72is Tff7b72not Tff7b72None
Tff7b72def Td2a8ffseccomp_kernel_supportedTb4b4b4(Tb4b4b4) Tff7b72-Tff7b72> Tffa657boolTb4b4b4:
T8b949e"""Return True when this host can install a user seccomp-BPF filter."""
Tff7b72global Te6edf3_seccomp_support_cached
Tff7b72if Te6edf3_seccomp_support_cached Tff7b72is Tff7b72not Tff7b72NoneTb4b4b4:
Tff7b72return Te6edf3_seccomp_support_cached
Tff7b72if Te6edf3sysTff7b72.Td2a8ffplatform Tff7b72!= Ta5d6ff"Ta5d6fflinuxTa5d6ff" Tff7b72or Te6edf3_is_androidTb4b4b4(Tb4b4b4)Tb4b4b4:
Te6edf3_seccomp_support_cached Tff7b72= Tff7b72False
Tff7b72return Tff7b72False
Tff7b72if Tff7b72not Te6edf3seccomp_library_availableTb4b4b4(Tb4b4b4)Tb4b4b4:
Te6edf3_seccomp_support_cached Tff7b72= Tff7b72False
Tff7b72return Tff7b72False
T8b949e# Probe by building an empty ALLOW filter without loading it.
Te6edf3lib Tff7b72= Te6edf3_load_libseccompTb4b4b4(Tb4b4b4)
Tff7b72if Te6edf3lib Tff7b72is Tff7b72NoneTb4b4b4:
Te6edf3_seccomp_support_cached Tff7b72= Tff7b72False
Tff7b72return Tff7b72False
Te6edf3ctx Tff7b72= Te6edf3libTff7b72.Td2a8ffseccomp_initTb4b4b4(Te6edf3_SCMP_ACT_ALLOWTb4b4b4)
Tff7b72if Tff7b72not Te6edf3ctxTb4b4b4:
Te6edf3_seccomp_support_cached Tff7b72= Tff7b72False
Tff7b72return Tff7b72False
Te6edf3libTff7b72.Td2a8ffseccomp_releaseTb4b4b4(Te6edf3ctxTb4b4b4)
Te6edf3_seccomp_support_cached Tff7b72= Tff7b72True
Tff7b72return Tff7b72True
Tff7b72def Td2a8ffseccomp_requestedTb4b4b4(Tb4b4b4) Tff7b72-Tff7b72> Tffa657boolTb4b4b4:
Tff7b72if Te6edf3sysTff7b72.Td2a8ffplatform Tff7b72!= Ta5d6ff"Ta5d6fflinuxTa5d6ff" Tff7b72or Te6edf3_is_androidTb4b4b4(Tb4b4b4)Tb4b4b4:
Tff7b72return Tff7b72False
Te6edf3override Tff7b72= Te6edf3_seccomp_env_overrideTb4b4b4(Tb4b4b4)
Tff7b72if Te6edf3override Tff7b72is Tff7b72FalseTb4b4b4:
Tff7b72return Tff7b72False
Tff7b72if Te6edf3override Tff7b72is Tff7b72TrueTb4b4b4:
Tff7b72return Tff7b72True
Tff7b72return Te6edf3seccomp_kernel_supportedTb4b4b4(Tb4b4b4)
Tff7b72def Td2a8ffseccomp_auto_enabledTb4b4b4(Tb4b4b4) Tff7b72-Tff7b72> Tffa657boolTb4b4b4:
Tff7b72return Te6edf3seccomp_requestedTb4b4b4(Tb4b4b4) Tff7b72and Te6edf3_seccomp_env_overrideTb4b4b4(Tb4b4b4) Tff7b72is Tff7b72None
Tff7b72def Td2a8ffseccomp_disabled_by_envTb4b4b4(Tb4b4b4) Tff7b72-Tff7b72> Tffa657boolTb4b4b4:
Tff7b72return Te6edf3_seccomp_env_overrideTb4b4b4(Tb4b4b4) Tff7b72is Tff7b72False
Tff7b72def Td2a8ffapply_seccomp_sandboxTb4b4b4(Tb4b4b4) Tff7b72-Tff7b72> Tffa657boolTb4b4b4:
T8b949e"""Install the denylist filter. Returns True when seccomp-BPF is active.
Falls back to False (no filter) when unsupported, forced off, or install
fails. Never raises into the caller for probe or load failures.
"""
Tff7b72if Tff7b72not Te6edf3seccomp_requestedTb4b4b4(Tb4b4b4)Tb4b4b4:
Tff7b72return Tff7b72False
Te6edf3lib Tff7b72= Te6edf3_load_libseccompTb4b4b4(Tb4b4b4)
Tff7b72if Te6edf3lib Tff7b72is Tff7b72NoneTb4b4b4:
Te6edf3loggerTff7b72.Td2a8ffwarningTb4b4b4(
Ta5d6ff"Ta5d6ffSeccomp requested but libseccomp is unavailable; continuing without itTa5d6ff"Tb4b4b4,
Tb4b4b4)
Tff7b72return Tff7b72False
Te6edf3ctx Tff7b72= Te6edf3libTff7b72.Td2a8ffseccomp_initTb4b4b4(Te6edf3_SCMP_ACT_ALLOWTb4b4b4)
Tff7b72if Tff7b72not Te6edf3ctxTb4b4b4:
Te6edf3loggerTff7b72.Td2a8ffwarningTb4b4b4(Ta5d6ff"Ta5d6ffSeccomp disabled: seccomp_init failedTa5d6ff"Tb4b4b4)
Tff7b72return Tff7b72False
Te6edf3denied Tff7b72= T79c0ff0
Te6edf3loaded Tff7b72= Tff7b72False
Tff7b72tryTb4b4b4:
Tff7b72for Te6edf3name Tff7b72in Te6edf3_DENIED_SYSCALLSTb4b4b4:
Te6edf3nr Tff7b72= Te6edf3libTff7b72.Td2a8ffseccomp_syscall_resolve_nameTb4b4b4(Te6edf3nameTff7b72.Td2a8ffencodeTb4b4b4(Ta5d6ff"Ta5d6ffasciiTa5d6ff"Tb4b4b4)Tb4b4b4)
Tff7b72if Te6edf3nr Tff7b72< T79c0ff0Tb4b4b4:
Tff7b72continue
Te6edf3rc Tff7b72= Te6edf3libTff7b72.Td2a8ffseccomp_rule_addTb4b4b4(Te6edf3ctxTb4b4b4, Te6edf3_act_errnoTb4b4b4(Te6edf3errnoTff7b72.Td2a8ffEPERMTb4b4b4)Tb4b4b4, Te6edf3nrTb4b4b4, T79c0ff0Tb4b4b4)
Tff7b72if Te6edf3rc Tff7b72!= T79c0ff0Tb4b4b4:
Te6edf3loggerTff7b72.Td2a8ffdebugTb4b4b4(
Ta5d6ff"Ta5d6ffSeccomp skip rule for Tffd700%sTa5d6ff: libseccomp rc Tffd700%sTa5d6ff"Tb4b4b4,
Te6edf3nameTb4b4b4,
Te6edf3rcTb4b4b4,
Tb4b4b4)
Tff7b72continue
Te6edf3denied Tff7b72+Tff7b72= T79c0ff1
Tff7b72if Te6edf3denied Tff7b72== T79c0ff0Tb4b4b4:
Te6edf3loggerTff7b72.Td2a8ffwarningTb4b4b4(Ta5d6ff"Ta5d6ffSeccomp disabled: no denylist rules could be installedTa5d6ff"Tb4b4b4)
Tff7b72return Tff7b72False
Te6edf3rc Tff7b72= Te6edf3libTff7b72.Td2a8ffseccomp_loadTb4b4b4(Te6edf3ctxTb4b4b4)
Tff7b72if Te6edf3rc Tff7b72!= T79c0ff0Tb4b4b4:
Te6edf3loggerTff7b72.Td2a8ffwarningTb4b4b4(Ta5d6ff"Ta5d6ffSeccomp disabled: seccomp_load failed with rc Tffd700%sTa5d6ff"Tb4b4b4, Te6edf3rcTb4b4b4)
Tff7b72return Tff7b72False
Te6edf3loaded Tff7b72= Tff7b72True
Tff7b72except Tf85149Exception Tff7b72as Te6edf3excTb4b4b4:
Te6edf3loggerTff7b72.Td2a8ffwarningTb4b4b4(Ta5d6ff"Ta5d6ffSeccomp disabled: Tffd700%sTa5d6ff"Tb4b4b4, Te6edf3excTb4b4b4)
Tff7b72return Tff7b72False
Tff7b72finallyTb4b4b4:
Te6edf3libTff7b72.Td2a8ffseccomp_releaseTb4b4b4(Te6edf3ctxTb4b4b4)
Tff7b72if Tff7b72not Te6edf3loadedTb4b4b4:
Tff7b72return Tff7b72False
Tff7b72if Te6edf3seccomp_auto_enabledTb4b4b4(Tb4b4b4)Tb4b4b4:
Te6edf3loggerTff7b72.Td2a8ffinfoTb4b4b4(
Ta5d6ff"Ta5d6ffSeccomp-BPF syscall denylist enabled (auto-detected, Tffd700%sTa5d6ff rules)Ta5d6ff"Tb4b4b4,
Te6edf3deniedTb4b4b4,
Tb4b4b4)
Tff7b72elseTb4b4b4:
Te6edf3loggerTff7b72.Td2a8ffinfoTb4b4b4(Ta5d6ff"Ta5d6ffSeccomp-BPF syscall denylist enabled (Tffd700%sTa5d6ff rules)Ta5d6ff"Tb4b4b4, Te6edf3deniedTb4b4b4)
Tff7b72return Tff7b72True
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────