Commit a721f7b8 authored by Khadija Kamran's avatar Khadija Kamran Committed by Paul Moore
Browse files

lsm: constify 'bprm' parameter in security_bprm_committed_creds() 



Three LSMs register the implementations for the 'bprm_committed_creds()'
hook: AppArmor, SELinux and tomoyo. Looking at the function
implementations we may observe that the 'bprm' parameter is not changing.

Mark the 'bprm' parameter of LSM hook security_bprm_committed_creds() as
'const' since it will not be changing in the LSM hook.

Signed-off-by: default avatarKhadija Kamran <kamrankhadijadj@gmail.com>
[PM: minor merge fuzzing due to other constification patches]
Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
parent 64fc9526

include/linux/lsm_hook_defs.h

+1 −1
Original line number Diff line number Diff line
@@ -53,7 +53,7 @@ LSM_HOOK(int, 0, bprm_creds_for_exec, struct linux_binprm *bprm) 
LSM_HOOK(int, 0, bprm_creds_from_file, struct linux_binprm *bprm, const struct file *file)

LSM_HOOK(int, 0, bprm_check_security, struct linux_binprm *bprm)

LSM_HOOK(void, LSM_RET_VOID, bprm_committing_creds, const struct linux_binprm *bprm)

LSM_HOOK(void, LSM_RET_VOID, bprm_committed_creds, struct linux_binprm *bprm)

LSM_HOOK(void, LSM_RET_VOID, bprm_committed_creds, const struct linux_binprm *bprm)

LSM_HOOK(int, 0, fs_context_submount, struct fs_context *fc, struct super_block *reference)

LSM_HOOK(int, 0, fs_context_dup, struct fs_context *fc,

	 struct fs_context *src_sc)

include/linux/security.h

+2 −2
Original line number Diff line number Diff line
@@ -293,7 +293,7 @@ int security_bprm_creds_for_exec(struct linux_binprm *bprm); 
int security_bprm_creds_from_file(struct linux_binprm *bprm, const struct file *file);

int security_bprm_check(struct linux_binprm *bprm);

void security_bprm_committing_creds(const struct linux_binprm *bprm);

void security_bprm_committed_creds(struct linux_binprm *bprm);

void security_bprm_committed_creds(const struct linux_binprm *bprm);

int security_fs_context_submount(struct fs_context *fc, struct super_block *reference);

int security_fs_context_dup(struct fs_context *fc, struct fs_context *src_fc);

int security_fs_context_parse_param(struct fs_context *fc, struct fs_parameter *param);
@@ -627,7 +627,7 @@ static inline void security_bprm_committing_creds(const struct linux_binprm *bpr 
{

}



static inline void security_bprm_committed_creds(struct linux_binprm *bprm)

static inline void security_bprm_committed_creds(const struct linux_binprm *bprm)

{

}

security/apparmor/lsm.c

+1 −1
Original line number Diff line number Diff line
@@ -756,7 +756,7 @@ static void apparmor_bprm_committing_creds(const struct linux_binprm *bprm) 
 * apparmor_bprm_committed_creds() - do cleanup after new creds committed

 * @bprm: binprm for the exec  (NOT NULL)

 */

static void apparmor_bprm_committed_creds(struct linux_binprm *bprm)

static void apparmor_bprm_committed_creds(const struct linux_binprm *bprm)

{

	/* clear out temporary/transitional state from the context */

	aa_clear_task_ctx_trans(task_ctx(current));

security/security.c

+1 −1
Original line number Diff line number Diff line
@@ -1134,7 +1134,7 @@ void security_bprm_committing_creds(const struct linux_binprm *bprm) 
 * process such as clearing out non-inheritable signal state.  This is called

 * immediately after commit_creds().

 */

void security_bprm_committed_creds(struct linux_binprm *bprm)

void security_bprm_committed_creds(const struct linux_binprm *bprm)

{

	call_void_hook(bprm_committed_creds, bprm);

}

security/selinux/hooks.c

+1 −1
Original line number Diff line number Diff line
@@ -2501,7 +2501,7 @@ static void selinux_bprm_committing_creds(const struct linux_binprm *bprm) 
 * Clean up the process immediately after the installation of new credentials

 * due to exec

 */

static void selinux_bprm_committed_creds(struct linux_binprm *bprm)

static void selinux_bprm_committed_creds(const struct linux_binprm *bprm)

{

	const struct task_security_struct *tsec = selinux_cred(current_cred());

	u32 osid, sid;