lsm: constify 'bprm' parameter in security_bprm_committing_creds()
Subsystems (3)
PATCH 1/1 lsm: constify 'bprm' parameter in security_bprm_committing_creds()
The 'bprm_committing_creds' hook has implementations registered in SELinux and Apparmor. Looking at the function implementations we observe that the 'bprm' parameter is not changing.
Mark the 'bprm' parameter of LSM hook security_bprm_committing_creds() as 'const' since it will not be changing in the LSM hook.
Signed-off-by Khadija Kamran <[email protected]>
--- include/linux/lsm_hook_defs.h | 2 +- include/linux/security.h | 4 ++-- security/apparmor/lsm.c | 2 +- security/security.c | 2 +- security/selinux/hooks.c | 2 +- 5 files changed, 6 insertions(+), 6 deletions(-)
include/linux/lsm_hook_defs.h +1 -1
@@ -52,7 +52,7 @@ LSM_HOOK(int, 0, vm_enough_memory, struct mm_struct *mm, long pages) LSM_HOOK(int, 0, bprm_creds_for_exec, struct linux_binprm *bprm) LSM_HOOK(int, 0, bprm_creds_from_file, struct linux_binprm *bprm, const struct file *file) LSM_HOOK(int, 0, bprm_check_security, struct linux_binprm *bprm) -LSM_HOOK(void, LSM_RET_VOID, bprm_committing_creds, struct linux_binprm *bprm) +LSM_HOOK(void, LSM_RET_VOID, bprm_committing_creds, const struct linux_binprm *bprm) LSM_HOOK(void, LSM_RET_VOID, bprm_committed_creds, struct linux_binprm *bprm) LSM_HOOK(int, 0, fs_context_dup, struct fs_context *fc, struct fs_context *src_sc)
include/linux/security.h +2 -2
@@ -291,7 +291,7 @@ int security_vm_enough_memory_mm(struct mm_struct *mm, long pages);int security_bprm_creds_for_exec (struct linux_binprm *bprm);int security_bprm_creds_from_file (struct linux_binprm *bprm,const struct file *file);int security_bprm_check (struct linux_binprm *bprm); -void security_bprm_committing_creds (struct linux_binprm *bprm); +void security_bprm_committing_creds (const struct linux_binprm *bprm);void security_bprm_committed_creds (struct linux_binprm *bprm);int security_fs_context_dup (struct fs_context *fc,struct fs_context *src_fc);int security_fs_context_parse_param (struct fs_context *fc,struct fs_parameter *param);
@@ -621,7 +621,7 @@ static inline int security_bprm_check(struct linux_binprm *bprm)return 0 ; } -static inline void security_bprm_committing_creds (struct linux_binprm *bprm) +static inline void security_bprm_committing_creds (const struct linux_binprm *bprm) { }
security/apparmor/lsm.c +1 -1
@@ -734,7 +734,7 @@ static int apparmor_setprocattr(const char *name, void *value,* apparmor_bprm_committing_creds - do task cleanup on committing new creds * @bprm: binprm for the exec (NOT NULL) */ -static void apparmor_bprm_committing_creds (struct linux_binprm *bprm) +static void apparmor_bprm_committing_creds (const struct linux_binprm *bprm) {struct aa_label *label =aa_current_raw_label ();struct aa_label *new_label =cred_label (bprm->cred);
security/security.c +1 -1
@@ -1117,7 +1117,7 @@ int security_bprm_check(struct linux_binprm *bprm)* open file descriptors to which access will no longer be granted when the * attributes are changed. This is called immediately before commit_creds(). */ -void security_bprm_committing_creds (struct linux_binprm *bprm) +void security_bprm_committing_creds (const struct linux_binprm *bprm) {call_void_hook (bprm_committing_creds, bprm); }
security/selinux/hooks.c +1 -1
@@ -2404,7 +2404,7 @@ static inline void flush_unauthorized_files(const struct cred *cred,/* * Prepare a process for imminent new credential changes due to exec */ -static void selinux_bprm_committing_creds (struct linux_binprm *bprm) +static void selinux_bprm_committing_creds (const struct linux_binprm *bprm) {struct task_security_struct *new_tsec;struct rlimit *rlim, *initrlim;
Signature · 1 line
2.34.1
Quoted 8 lines · On Aug 23, 2023 Khadija Kamran <[email protected]> wrote:
The '
bprm_committing_creds' hook has implementations registered in SELinux and Apparmor. Looking at the function implementations we observe that the 'bprm' parameter is not changing.Mark the 'bprm' parameter of LSM hook
security_bprm_committing_creds()as 'const' since it will not be changing in the LSM hook.
Quoted 8 lines
Signed-off-by Khadija Kamran <[email protected]>--- include/linux/lsm_hook_defs.h | 2 +- include/linux/security.h | 4 ++-- security/apparmor/lsm.c | 2 +- security/security.c | 2 +- security/selinux/hooks.c | 2 +- 5 files changed, 6 insertions(+), 6 deletions(-)
Merged into lsm/next, thanks!
--
paul-moore.com