Re: [PATCH] keys: trusted: dcp: Make dcp_trusted_key_ops const

Re: [PATCH] keys: trusted: dcp: Make dcp_trusted_key_ops const

[Jarkko Sakkinen]

On Sun, Jun 21, 2026 at 09:05:40PM -0400, Berkay Yürekli wrote:
> Mark the dcp_trusted_key_ops structure as const to improve kernel
> self-protection. This structure contains function pointers that are
> initialized once during module initialization and never modified.
> 
> Making function pointers read-only protects against memory corruption
> attacks where an attacker might overwrite these pointers to redirect
> execution flow, as recommended in Documentation/security/self-protection.rst.
> 
> Signed-off-by: mcss <ps1296@owsa.nl>

full name please

> 
> ---
>  include/keys/trusted_dcp.h          | 2 +-
>  security/keys/trusted-keys/trusted_dcp.c | 2 +-
>  2 files changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/include/keys/trusted_dcp.h b/include/keys/trusted_dcp.h
> index 9aaa42075b40..8ee24f2d21ff 100644
> --- a/include/keys/trusted_dcp.h
> +++ b/include/keys/trusted_dcp.h
> @@ -6,6 +6,6 @@
>  #ifndef TRUSTED_DCP_H
>  #define TRUSTED_DCP_H
>  
> -extern struct trusted_key_ops dcp_trusted_key_ops;
> +extern const struct trusted_key_ops dcp_trusted_key_ops;
>  
>  #endif
> diff --git a/security/keys/trusted-keys/trusted_dcp.c b/security/keys/
> trusted-keys/trusted_dcp.c
> index 7b6eb655df0c..f638078640f9 100644
> --- a/security/keys/trusted-keys/trusted_dcp.c
> +++ b/security/keys/trusted-keys/trusted_dcp.c
> @@ -347,7 +347,7 @@ static void trusted_dcp_exit(void)
>   unregister_key_type(&key_type_trusted);
>  }
>  
> -struct trusted_key_ops dcp_trusted_key_ops = {
> +const struct trusted_key_ops dcp_trusted_key_ops = {
>   .exit = trusted_dcp_exit,
>   .init = trusted_dcp_init,
>   .seal = trusted_dcp_seal,
> --
> 2.54.0
> 

BR, Jarkko