lsm: constify 'bprm' parameter in security_bprm_committed_creds()
Subsystems (4)
PATCH 1/1 lsm: constify 'bprm' parameter in security_bprm_committed_creds()
Three LSMs register the implementations for the 'bprm_committed_creds()'
hook: AppArmor, SELinux and tomoyo. Looking at the function implementations we may observe that the 'bprm' parameter is not changing.
Mark the 'bprm' parameter of LSM hook security_bprm_committed_creds() as 'const' since it will not be changing in the LSM hook.
Signed-off-by Khadija Kamran <[email protected]>
--- include/linux/lsm_hook_defs.h | 2 +- include/linux/security.h | 4 ++-- security/apparmor/lsm.c | 2 +- security/security.c | 2 +- security/selinux/hooks.c | 2 +- security/tomoyo/tomoyo.c | 2 +- 6 files changed, 7 insertions(+), 7 deletions(-)
include/linux/lsm_hook_defs.h +1 -1
@@ -53,7 +53,7 @@ LSM_HOOK(int, 0, bprm_creds_for_exec, struct linux_binprm *bprm) LSM_HOOK(int, 0, bprm_creds_from_file, struct linux_binprm *bprm, struct file *file) LSM_HOOK(int, 0, bprm_check_security, struct linux_binprm *bprm) LSM_HOOK(void, LSM_RET_VOID, bprm_committing_creds, struct linux_binprm *bprm) -LSM_HOOK(void, LSM_RET_VOID, bprm_committed_creds, struct linux_binprm *bprm) +LSM_HOOK(void, LSM_RET_VOID, bprm_committed_creds, const struct linux_binprm *bprm) LSM_HOOK(int, 0, fs_context_dup, struct fs_context *fc, struct fs_context *src_sc) LSM_HOOK(int, -ENOPARAM, fs_context_parse_param, struct fs_context *fc,
include/linux/security.h +2 -2
@@ -292,7 +292,7 @@ int security_bprm_creds_for_exec(struct linux_binprm *bprm);int security_bprm_creds_from_file (struct linux_binprm *bprm,struct file *file);int security_bprm_check (struct linux_binprm *bprm);void security_bprm_committing_creds (struct linux_binprm *bprm); -void security_bprm_committed_creds (struct linux_binprm *bprm); +void security_bprm_committed_creds (const struct linux_binprm *bprm);int security_fs_context_dup (struct fs_context *fc,struct fs_context *src_fc);int security_fs_context_parse_param (struct fs_context *fc,struct fs_parameter *param);int security_sb_alloc (struct super_block *sb);
@@ -625,7 +625,7 @@ static inline void security_bprm_committing_creds(struct linux_binprm *bprm) { } -static inline void security_bprm_committed_creds (struct linux_binprm *bprm) +static inline void security_bprm_committed_creds (const struct linux_binprm *bprm) { }
security/apparmor/lsm.c +1 -1
@@ -756,7 +756,7 @@ static void apparmor_bprm_committing_creds(struct linux_binprm *bprm)* apparmor_bprm_committed_creds() - do cleanup after new creds committed * @bprm: binprm for the exec (NOT NULL) */ -static void apparmor_bprm_committed_creds (struct linux_binprm *bprm) +static void apparmor_bprm_committed_creds (const struct linux_binprm *bprm) {/* clear out temporary/transitional state from the context */ aa_clear_task_ctx_trans (task_ctx (current));
security/security.c +1 -1
@@ -1133,7 +1133,7 @@ void security_bprm_committing_creds(struct linux_binprm *bprm)* process such as clearing out non-inheritable signal state. This is called * immediately after commit_creds(). */ -void security_bprm_committed_creds (struct linux_binprm *bprm) +void security_bprm_committed_creds (const struct linux_binprm *bprm) {call_void_hook (bprm_committed_creds, bprm); }
security/selinux/hooks.c +1 -1
@@ -2450,7 +2450,7 @@ static void selinux_bprm_committing_creds(struct linux_binprm *bprm)* Clean up the process immediately after the installation of new credentials * due to exec */ -static void selinux_bprm_committed_creds (struct linux_binprm *bprm) +static void selinux_bprm_committed_creds (const struct linux_binprm *bprm) {const struct task_security_struct *tsec =selinux_cred (current_cred ());u32 osid, sid;
security/tomoyo/tomoyo.c +1 -1
@@ -52,7 +52,7 @@ static int tomoyo_cred_prepare(struct cred *new, const struct cred *old,* * @bprm: Pointer to "struct linux_binprm". */ -static void tomoyo_bprm_committed_creds (struct linux_binprm *bprm) +static void tomoyo_bprm_committed_creds (const struct linux_binprm *bprm) {/* Clear old_domain_info saved by execve() request. */ struct tomoyo_task *s =tomoyo_task (current);
Signature · 1 line
2.34.1
Quoted 9 lines · On Aug 23, 2023 Khadija Kamran <[email protected]> wrote:
Three LSMs register the implementations for the '
bprm_committed_creds()'
hook: AppArmor, SELinux and tomoyo. Looking at the function implementations we may observe that the 'bprm' parameter is not changing.Mark the 'bprm' parameter of LSM hook
security_bprm_committed_creds()as 'const' since it will not be changing in the LSM hook.Signed-off-by Khadija Kamran <[email protected]>
Quoted 8 lines
--- include/linux/lsm_hook_defs.h | 2 +- include/linux/security.h | 4 ++-- security/apparmor/lsm.c | 2 +- security/security.c | 2 +- security/selinux/hooks.c | 2 +- security/tomoyo/tomoyo.c | 2 +- 6 files changed, 7 insertions(+), 7 deletions(-)
Merged into lsm/next, thanks!
--
paul-moore.com