Sandro/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-09-18 23:09:29 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

apparmor: constify aa_label parameters on read-only query helpers

Browse Source 
Several label helpers only read from their struct aa_label * arguments:
they compare labels, test subset relationships, or check the mediation
bitmask, all via direct field/index access. Mark those parameters
const struct aa_label * to document intent and let the compiler enforce
that the label is not modified.

The converted functions are:
  - label_mediates(), label_mediates_safe()
  - aa_label_cmp() (and its vec_cmp() helper)
  - __aa_label_next_not_in_set(), aa_label_is_subset(),
    aa_label_is_unconfined_subset()
  - __aa_subj_label_is_cached()
  - aa_label_next_confined(), aa_label_next_in_merge()

These all access the label through direct indexing or manual iterators
rather than the label_for_each()/fn_for_each() macros, which are not
const-correct and so gate the majority of the remaining label consumers
(the print, match, and permission-check paths) from being constified.

No functional change.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Assisted-by: Claude:claude-opus-4.8
This commit is contained in:
John Johansen
2026-08-10 22:49:43 -07:00
parent 01a915e823
commit fbedf6d92e
2 changed files with 23 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
security/apparmor/include/label.h
+12 -11
View File
@@ -165,7 +165,7 @@ do { \
#define labels_profile(X) ((X)->vec[(X)->size - 1])
int aa_label_next_confined(struct aa_label *l, int i);
int aa_label_next_confined(const struct aa_label *l, int i);
/* for each profile in a label */
#define label_for_each(I, L, P) \
@@ -246,12 +246,12 @@ int aa_label_next_confined(struct aa_label *l, int i);
#define fn_for_each_not_in_set(L1, L2, P, FN) \
fn_for_each2_XXX((L1), (L2), P, FN, _not_in_set)
static inline bool label_mediates(struct aa_label *L, unsigned char C)
static inline bool label_mediates(const struct aa_label *L, unsigned char C)
{
return (L)->mediates & (((u64) 1) << (C));
}
static inline bool label_mediates_safe(struct aa_label *L, unsigned char C)
static inline bool label_mediates_safe(const struct aa_label *L, unsigned char C)
{
if (C > AA_CLASS_LAST)
return false;
@@ -268,11 +268,12 @@ void aa_label_kref(struct kref *kref);
bool aa_label_init(struct aa_label *label, int size, gfp_t gfp);
struct aa_label *aa_label_alloc(int size, struct aa_proxy *proxy, gfp_t gfp);
bool aa_label_is_subset(struct aa_label *set, struct aa_label *sub);
bool aa_label_is_unconfined_subset(struct aa_label *set, struct aa_label *sub);
bool aa_label_is_subset(const struct aa_label *set, const struct aa_label *sub);
bool aa_label_is_unconfined_subset(const struct aa_label *set,
const struct aa_label *sub);
struct aa_profile *__aa_label_next_not_in_set(struct label_it *I,
struct aa_label *set,
struct aa_label *sub);
const struct aa_label *set,
const struct aa_label *sub);
bool aa_label_remove(struct aa_label *label);
struct aa_label *aa_label_insert(struct aa_labelset *ls, struct aa_label *l);
bool aa_label_replace(struct aa_label *old, struct aa_label *new);
@@ -280,8 +281,8 @@ bool aa_label_make_newest(struct aa_labelset *ls, struct aa_label *old,
struct aa_label *new);
struct aa_profile *aa_label_next_in_merge(struct label_it *I,
struct aa_label *a,
struct aa_label *b);
const struct aa_label *a,
const struct aa_label *b);
struct aa_label *aa_label_find_merge(struct aa_label *a, struct aa_label *b);
struct aa_label *aa_label_merge(struct aa_label *a, struct aa_label *b,
gfp_t gfp);
@@ -462,8 +463,8 @@ static inline void aa_put_label(struct aa_label *l)
}
/* wrapper fn to indicate semantics of the check */
static inline bool __aa_subj_label_is_cached(struct aa_label *subj_label,
struct aa_label *obj_label)
static inline bool __aa_subj_label_is_cached(const struct aa_label *subj_label,
const struct aa_label *obj_label)
{
return aa_label_is_subset(obj_label, subj_label);
}
security/apparmor/label.c
+11 -9
View File
@@ -165,7 +165,8 @@ static int profile_cmp(struct aa_profile *a, struct aa_profile *b)
* ==0 if @a == @b
* >0 if @a > @b
*/
static int vec_cmp(struct aa_profile **a, int an, struct aa_profile **b, int bn)
static int vec_cmp(struct aa_profile * const *a, int an,
struct aa_profile * const *b, int bn)
{
int i;
@@ -473,7 +474,7 @@ fail:
* ==0 if a == b
* >0 if a > b
*/
static int label_cmp(struct aa_label *a, struct aa_label *b)
static int label_cmp(const struct aa_label *a, const struct aa_label *b)
{
AA_BUG(!b);
@@ -484,7 +485,7 @@ static int label_cmp(struct aa_label *a, struct aa_label *b)
}
/* helper fn for label_for_each_confined */
int aa_label_next_confined(struct aa_label *label, int i)
int aa_label_next_confined(const struct aa_label *label, int i)
{
AA_BUG(!label);
AA_BUG(i < 0);
@@ -507,8 +508,8 @@ int aa_label_next_confined(struct aa_label *label, int i)
* else NULL if @sub is a subset of @set
*/
struct aa_profile *__aa_label_next_not_in_set(struct label_it *I,
struct aa_label *set,
struct aa_label *sub)
const struct aa_label *set,
const struct aa_label *sub)
{
AA_BUG(!set);
AA_BUG(!I);
@@ -544,7 +545,7 @@ struct aa_profile *__aa_label_next_not_in_set(struct label_it *I,
* Returns: true if @sub is subset of @set
* else false
*/
bool aa_label_is_subset(struct aa_label *set, struct aa_label *sub)
bool aa_label_is_subset(const struct aa_label *set, const struct aa_label *sub)
{
struct label_it i = { };
@@ -571,7 +572,8 @@ bool aa_label_is_subset(struct aa_label *set, struct aa_label *sub)
* Returns: true if @sub is special_subset of @set
* else false
*/
bool aa_label_is_unconfined_subset(struct aa_label *set, struct aa_label *sub)
bool aa_label_is_unconfined_subset(const struct aa_label *set,
const struct aa_label *sub)
{
struct label_it i = { };
struct aa_profile *p;
@@ -991,8 +993,8 @@ struct aa_label *aa_label_insert(struct aa_labelset *ls, struct aa_label *label)
* else null if no more profiles
*/
struct aa_profile *aa_label_next_in_merge(struct label_it *I,
struct aa_label *a,
struct aa_label *b)
const struct aa_label *a,
const struct aa_label *b)
{
AA_BUG(!a);
AA_BUG(!b);