On Sun, Mar 10, 2024 at 10:18:07AM +0100, Thomas Weißschuh wrote: > Hi! > > On 2024-03-03 15:34:08+0100, Joel Granados wrote: > > Just to be sure I'm following. This is V2 of "[PATCH] sysctl: treewide: > > constify ctl_table_root::set_ownership". Right? I ask, because the > > subject changes slightly. > > No, the v1 of this patch is linked in the patch log below. > > The patches for ::set_ownership and ::permissions are changing two > different callbacks and both of them are needed. Awesome. thx for clarifying. So the ::permissions one I have reviewed and have added to the constification branch in sysctl repo for testing. I'm missing the review for the set_ownership one. Best > > The v2 for set_ownership is here: > https://lore.kernel.org/lkml/20240223-sysctl-const-ownership-v2-1-f9ba1795aaf2@xxxxxxxxxxxxxx/ > > Regards > > > > > Best > > > > On Fri, Feb 23, 2024 at 04:52:16PM +0100, Thomas Weißschuh wrote: > > > The permissions callback is not supposed to modify the ctl_table. > > > Enforce this expectation via the typesystem. > > > > > > The patch was created with the following coccinelle script: > > > > > > @@ > > > identifier func, head, ctl; > > > @@ > > > > > > int func( > > > struct ctl_table_header *head, > > > - struct ctl_table *ctl) > > > + const struct ctl_table *ctl) > > > { ... } > > > > > > (insert_entry() from fs/proc/proc_sysctl.c is a false-positive) > > > > > > The three changed locations were validated through manually inspection > > > and compilation. > > > > > > In addition a search for '.permissions =' was done over the full tree to > > > look for places that were missed by coccinelle. > > > None were found. > > > > > > This change also is a step to put "struct ctl_table" into .rodata > > > throughout the kernel. > > > > > > Signed-off-by: Thomas Weißschuh <linux@xxxxxxxxxxxxxx> > > > --- > > > To: Luis Chamberlain <mcgrof@xxxxxxxxxx> > > > To: Kees Cook <keescook@xxxxxxxxxxxx> > > > To: Joel Granados <j.granados@xxxxxxxxxxx> > > > To: David S. Miller <davem@xxxxxxxxxxxxx> > > > Signed-off-by: Thomas Weißschuh <linux@xxxxxxxxxxxxxx> > > > > > > Changes in v2: > > > - flesh out commit messages > > > - Integrate changes to set_ownership and ctl_table_args into a single > > > series > > > - Link to v1: https://lore.kernel.org/r/20231226-sysctl-const-permissions-v1-1-5cd3c91f6299@xxxxxxxxxxxxxx > > > --- > > > The patch is meant to be merged via the sysctl tree. > > > > > > There is an upcoming series that will introduce a new implementation of > > > .permission which would need to be adapted [0]. > > > The adaption would be trivial as the 'table' parameter also not modified > > > there. > > > > > > This change was originally part of the sysctl-const series [1]. > > > To slim down that series and reduce the message load on other > > > maintainers to a minimumble, submit this patch on its own. > > > > > > [0] https://lore.kernel.org/lkml/20240222160915.315255-1-aleksandr.mikhalitsyn@xxxxxxxxxxxxx/ > > > [1] https://lore.kernel.org/lkml/20231204-const-sysctl-v2-2-7a5060b11447@xxxxxxxxxxxxxx/ > > > --- > > > include/linux/sysctl.h | 2 +- > > > ipc/ipc_sysctl.c | 2 +- > > > kernel/ucount.c | 2 +- > > > net/sysctl_net.c | 2 +- > > > 4 files changed, 4 insertions(+), 4 deletions(-) > > > > > > diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h > > > index ee7d33b89e9e..0a55b5aade16 100644 > > > --- a/include/linux/sysctl.h > > > +++ b/include/linux/sysctl.h > > > @@ -207,7 +207,7 @@ struct ctl_table_root { > > > void (*set_ownership)(struct ctl_table_header *head, > > > struct ctl_table *table, > > > kuid_t *uid, kgid_t *gid); > > > - int (*permissions)(struct ctl_table_header *head, struct ctl_table *table); > > > + int (*permissions)(struct ctl_table_header *head, const struct ctl_table *table); > > > }; > > > > > > #define register_sysctl(path, table) \ > > > diff --git a/ipc/ipc_sysctl.c b/ipc/ipc_sysctl.c > > > index 8c62e443f78b..b087787f608f 100644 > > > --- a/ipc/ipc_sysctl.c > > > +++ b/ipc/ipc_sysctl.c > > > @@ -190,7 +190,7 @@ static int set_is_seen(struct ctl_table_set *set) > > > return ¤t->nsproxy->ipc_ns->ipc_set == set; > > > } > > > > > > -static int ipc_permissions(struct ctl_table_header *head, struct ctl_table *table) > > > +static int ipc_permissions(struct ctl_table_header *head, const struct ctl_table *table) > > > { > > > int mode = table->mode; > > > > > > diff --git a/kernel/ucount.c b/kernel/ucount.c > > > index 4aa6166cb856..90300840256b 100644 > > > --- a/kernel/ucount.c > > > +++ b/kernel/ucount.c > > > @@ -38,7 +38,7 @@ static int set_is_seen(struct ctl_table_set *set) > > > } > > > > > > static int set_permissions(struct ctl_table_header *head, > > > - struct ctl_table *table) > > > + const struct ctl_table *table) > > > { > > > struct user_namespace *user_ns = > > > container_of(head->set, struct user_namespace, set); > > > diff --git a/net/sysctl_net.c b/net/sysctl_net.c > > > index 051ed5f6fc93..ba9a49de9600 100644 > > > --- a/net/sysctl_net.c > > > +++ b/net/sysctl_net.c > > > @@ -40,7 +40,7 @@ static int is_seen(struct ctl_table_set *set) > > > > > > /* Return standard mode bits for table entry. */ > > > static int net_ctl_permissions(struct ctl_table_header *head, > > > - struct ctl_table *table) > > > + const struct ctl_table *table) > > > { > > > struct net *net = container_of(head->set, struct net, sysctls); > > > > > > > > > --- > > > base-commit: ffd2cb6b718e189e7e2d5d0c19c25611f92e061a > > > change-id: 20231226-sysctl-const-permissions-d7cfd02a7637 > > > > > > Best regards, > > > -- > > > Thomas Weißschuh <linux@xxxxxxxxxxxxxx> > > > > > > > -- > > > > Joel Granados > > -- Joel Granados
Attachment:
signature.asc
Description: PGP signature
