Hey Thomas
Just to be sure I'm following. This is V2 of "[PATCH] sysctl: treewide:
constify ctl_table_root::set_ownership". Right? I ask, because the
subject changes slightly.
Best
On Fri, Feb 23, 2024 at 04:52:16PM +0100, Thomas Weißschuh wrote:
> The permissions callback is not supposed to modify the ctl_table.
> Enforce this expectation via the typesystem.
>
> The patch was created with the following coccinelle script:
>
> @@
> identifier func, head, ctl;
> @@
>
> int func(
> struct ctl_table_header *head,
> - struct ctl_table *ctl)
> + const struct ctl_table *ctl)
> { ... }
>
> (insert_entry() from fs/proc/proc_sysctl.c is a false-positive)
>
> The three changed locations were validated through manually inspection
> and compilation.
>
> In addition a search for '.permissions =' was done over the full tree to
> look for places that were missed by coccinelle.
> None were found.
>
> This change also is a step to put "struct ctl_table" into .rodata
> throughout the kernel.
>
> Signed-off-by: Thomas Weißschuh <linux@xxxxxxxxxxxxxx>
> ---
> To: Luis Chamberlain <mcgrof@xxxxxxxxxx>
> To: Kees Cook <keescook@xxxxxxxxxxxx>
> To: Joel Granados <j.granados@xxxxxxxxxxx>
> To: David S. Miller <davem@xxxxxxxxxxxxx>
> Signed-off-by: Thomas Weißschuh <linux@xxxxxxxxxxxxxx>
>
> Changes in v2:
> - flesh out commit messages
> - Integrate changes to set_ownership and ctl_table_args into a single
> series
> - Link to v1: https://lore.kernel.org/r/20231226-sysctl-const-permissions-v1-1-5cd3c91f6299@xxxxxxxxxxxxxx
> ---
> The patch is meant to be merged via the sysctl tree.
>
> There is an upcoming series that will introduce a new implementation of
> .permission which would need to be adapted [0].
> The adaption would be trivial as the 'table' parameter also not modified
> there.
>
> This change was originally part of the sysctl-const series [1].
> To slim down that series and reduce the message load on other
> maintainers to a minimumble, submit this patch on its own.
>
> [0] https://lore.kernel.org/lkml/20240222160915.315255-1-aleksandr.mikhalitsyn@xxxxxxxxxxxxx/
> [1] https://lore.kernel.org/lkml/20231204-const-sysctl-v2-2-7a5060b11447@xxxxxxxxxxxxxx/
> ---
> include/linux/sysctl.h | 2 +-
> ipc/ipc_sysctl.c | 2 +-
> kernel/ucount.c | 2 +-
> net/sysctl_net.c | 2 +-
> 4 files changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h
> index ee7d33b89e9e..0a55b5aade16 100644
> --- a/include/linux/sysctl.h
> +++ b/include/linux/sysctl.h
> @@ -207,7 +207,7 @@ struct ctl_table_root {
> void (*set_ownership)(struct ctl_table_header *head,
> struct ctl_table *table,
> kuid_t *uid, kgid_t *gid);
> - int (*permissions)(struct ctl_table_header *head, struct ctl_table *table);
> + int (*permissions)(struct ctl_table_header *head, const struct ctl_table *table);
> };
>
> #define register_sysctl(path, table) \
> diff --git a/ipc/ipc_sysctl.c b/ipc/ipc_sysctl.c
> index 8c62e443f78b..b087787f608f 100644
> --- a/ipc/ipc_sysctl.c
> +++ b/ipc/ipc_sysctl.c
> @@ -190,7 +190,7 @@ static int set_is_seen(struct ctl_table_set *set)
> return ¤t->nsproxy->ipc_ns->ipc_set == set;
> }
>
> -static int ipc_permissions(struct ctl_table_header *head, struct ctl_table *table)
> +static int ipc_permissions(struct ctl_table_header *head, const struct ctl_table *table)
> {
> int mode = table->mode;
>
> diff --git a/kernel/ucount.c b/kernel/ucount.c
> index 4aa6166cb856..90300840256b 100644
> --- a/kernel/ucount.c
> +++ b/kernel/ucount.c
> @@ -38,7 +38,7 @@ static int set_is_seen(struct ctl_table_set *set)
> }
>
> static int set_permissions(struct ctl_table_header *head,
> - struct ctl_table *table)
> + const struct ctl_table *table)
> {
> struct user_namespace *user_ns =
> container_of(head->set, struct user_namespace, set);
> diff --git a/net/sysctl_net.c b/net/sysctl_net.c
> index 051ed5f6fc93..ba9a49de9600 100644
> --- a/net/sysctl_net.c
> +++ b/net/sysctl_net.c
> @@ -40,7 +40,7 @@ static int is_seen(struct ctl_table_set *set)
>
> /* Return standard mode bits for table entry. */
> static int net_ctl_permissions(struct ctl_table_header *head,
> - struct ctl_table *table)
> + const struct ctl_table *table)
> {
> struct net *net = container_of(head->set, struct net, sysctls);
>
>
> ---
> base-commit: ffd2cb6b718e189e7e2d5d0c19c25611f92e061a
> change-id: 20231226-sysctl-const-permissions-d7cfd02a7637
>
> Best regards,
> --
> Thomas Weißschuh <linux@xxxxxxxxxxxxxx>
>
--
Joel Granados
Attachment:
signature.asc
Description: PGP signature
