mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-09-10 17:00:41 -04:00
Code Issues Packages Projects Releases Wiki Activity

apparmor: mark static tables and structs as read only

Browse Source 
static tables, and structs that are initialized as part of their
data section or during init should be read only to protect against
accidental or malicous changes.

Signed-off-by: John Johansen <john.johansen@canonical.com>
This commit is contained in:
John Johansen
2026-07-23 15:46:45 -07:00
parent 1bd6061109
commit a3ed5d43f7
8 changed files with 22 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
security/apparmor/file.c
View File

@@ -93,7 +93,7 @@ static void file_audit_cb(struct audit_buffer *ab, void *va)
* Returns: %0 or error on failure
*/
int aa_audit_file(const struct cred *subj_cred,
struct aa_profile *profile, struct aa_perms *perms,
struct aa_profile *profile, const struct aa_perms *perms,
const char *op, u32 request, const char *name,
const char *target, struct aa_label *tlabel,
kuid_t ouid, const char *info, int error)

2
security/apparmor/include/file.h
View File

@@ -72,7 +72,7 @@ struct path_cond {
#define COMBINED_PERM_MASK(X) ((X).allow | (X).audit | (X).quiet | (X).kill)
int aa_audit_file(const struct cred *cred,
struct aa_profile *profile, struct aa_perms *perms,
struct aa_profile *profile, const struct aa_perms *perms,
const char *op, u32 request, const char *name,
const char *target, struct aa_label *tlabel, kuid_t ouid,
const char *info, int error);

2
security/apparmor/include/match.h
View File

@@ -125,7 +125,7 @@ static inline size_t table_size(size_t len, size_t el_size)
#define aa_state_t unsigned int
struct aa_dfa *aa_dfa_unpack(void *blob, size_t size, int flags);
struct aa_dfa *aa_dfa_unpack(const void *blob, size_t size, int flags);
aa_state_t aa_dfa_match_len(struct aa_dfa *dfa, aa_state_t start,
const char *str, int len);
aa_state_t aa_dfa_match(struct aa_dfa *dfa, aa_state_t start,

4
security/apparmor/include/perms.h
View File

@@ -96,8 +96,8 @@ struct aa_perms {
#define AA_INDEX_NONE 0
#define ALL_PERMS_MASK 0xffffffff
extern struct aa_perms nullperms;
extern struct aa_perms allperms;
extern const struct aa_perms nullperms;
extern const struct aa_perms allperms;
/**
* aa_perms_accum_raw - accumulate perms with out masking off overlapping perms

15
security/apparmor/lib.c
View File

@@ -20,8 +20,8 @@
#include "include/perms.h"
#include "include/policy.h"
struct aa_perms nullperms;
struct aa_perms allperms = { .allow = ALL_PERMS_MASK,
const struct aa_perms nullperms;
const struct aa_perms allperms = { .allow = ALL_PERMS_MASK,
.quiet = ALL_PERMS_MASK,
.hide = ALL_PERMS_MASK };
@@ -30,7 +30,7 @@ struct val_table_ent {
int value;
};
static struct val_table_ent debug_values_table[] = {
static const struct val_table_ent debug_values_table[] = {
{ "N", DEBUG_NONE },
{ "none", DEBUG_NONE },
{ "n", DEBUG_NONE },
@@ -49,10 +49,11 @@ static struct val_table_ent debug_values_table[] = {
{ NULL, 0 }
};
static struct val_table_ent *val_table_find_ent(struct val_table_ent *table,
const char *name, size_t len)
static const struct val_table_ent *
val_table_find_ent(const struct val_table_ent *table,
const char *name, size_t len)
{
struct val_table_ent *entry;
const struct val_table_ent *entry;
for (entry = table; entry->str != NULL; entry++) {
if (strncmp(entry->str, name, len) == 0 &&
@@ -64,7 +65,7 @@ static struct val_table_ent *val_table_find_ent(struct val_table_ent *table,
int aa_parse_debug_params(const char *str)
{
struct val_table_ent *ent;
const struct val_table_ent *ent;
const char *next;
int val = 0;

8
security/apparmor/lsm.c
View File

@@ -2500,16 +2500,16 @@ static int __init apparmor_nf_ip_init(void)
}
#endif
static char nulldfa_src[] __aligned(8) = {
static const char nulldfa_src[] __aligned(8) = {
#include "nulldfa.in"
};
static struct aa_dfa *nulldfa;
static struct aa_dfa *nulldfa __ro_after_init;
static char stacksplitdfa_src[] __aligned(8) = {
#include "stacksplitdfa.in"
};
struct aa_dfa *stacksplitdfa;
struct aa_policydb *nullpdb;
struct aa_dfa *stacksplitdfa __ro_after_init;
struct aa_policydb *nullpdb __ro_after_init;
static int __init aa_setup_dfa_engine(void)
{

6
security/apparmor/match.c
View File

@@ -31,7 +31,7 @@
*
* NOTE: must be freed by kvfree (not kfree)
*/
static struct table_header *unpack_table(char *blob, size_t bsize)
static struct table_header *unpack_table(const char *blob, size_t bsize)
{
struct table_header *table = ERR_PTR(-EPROTO);
struct table_header th;
@@ -312,11 +312,11 @@ static struct table_header *remap_data16_to_data32(struct table_header *old)
*
* Returns: an unpacked dfa ready for matching or ERR_PTR on failure
*/
struct aa_dfa *aa_dfa_unpack(void *blob, size_t size, int flags)
struct aa_dfa *aa_dfa_unpack(const void *blob, size_t size, int flags)
{
int hsize;
int error = -ENOMEM;
char *data = blob;
const char *data = blob;
struct table_header *table = NULL;
struct aa_dfa *dfa = kzalloc_obj(struct aa_dfa);
if (!dfa)

3
security/apparmor/mount.c
View File

@@ -136,7 +136,8 @@ static int audit_mount(const struct cred *subj_cred,
const char *name, const char *src_name,
const char *type, const char *trans,
unsigned long flags, const void *data, u32 request,
struct aa_perms *perms, const char *info, int error)
const struct aa_perms *perms, const char *info,
int error)
{
int audit_type = AUDIT_APPARMOR_AUTO;
DEFINE_AUDIT_DATA(ad, LSM_AUDIT_DATA_NONE, AA_CLASS_MOUNT, op);