From: Sasha Levin <sashal@kernel.org>
To: stable@vger.kernel.org
Cc: John Johansen <john.johansen@canonical.com>,
Sasha Levin <sashal@kernel.org>
Subject: [PATCH 6.18.y 2/4] apparmor: constify aa_perms parameters that are read-only
Date: Wed, 11 Nov 2026 23:05:47 -0500 [thread overview]
Message-ID: <20261112040513.1836781-2-sashal@kernel.org> (raw)
In-Reply-To: <20261112040513.1836781-1-sashal@kernel.org>
From: John Johansen <john.johansen@canonical.com>
[ Upstream commit e3bc982007fe5e704c6a7f5a189502ece056f68d ]
Several functions take a struct aa_perms * argument that is only ever
read from and never modified through the pointer. Mark those parameters
const struct aa_perms * to document intent and let the compiler enforce
that the permission set is not mutated.
The converted functions are:
- aa_check_perms()
- aa_do_perms()
- do_perms() (af_inet)
- match_label() (af_unix)
- verify_perm()
- aa_perms_accum() / aa_perms_accum_raw() (@addend only)
No functional change.
Signed-off-by: John Johansen <john.johansen@canonical.com>
Assisted-by: Claude:claude-opus-4.8
Stable-dep-of: ce94927fa417 ("apparmor: fix profile leak when a policy load fails")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/apparmor/af_unix.c | 2 +-
security/apparmor/include/net.h | 2 +-
security/apparmor/include/perms.h | 11 ++++++-----
security/apparmor/lib.c | 2 +-
security/apparmor/net.c | 2 +-
security/apparmor/policy_unpack.c | 2 +-
6 files changed, 11 insertions(+), 10 deletions(-)
diff --git a/security/apparmor/af_unix.c b/security/apparmor/af_unix.c
index aa2b31d5598cd..7ba775017586b 100644
--- a/security/apparmor/af_unix.c
+++ b/security/apparmor/af_unix.c
@@ -172,7 +172,7 @@ static aa_state_t match_to_peer(struct aa_policydb *policy, aa_state_t state,
static aa_state_t match_label(struct aa_profile *profile,
struct aa_ruleset *rule, aa_state_t state,
u32 request, struct aa_profile *peer,
- struct aa_perms *p,
+ const struct aa_perms *p,
struct apparmor_audit_data *ad)
{
AA_BUG(!profile);
diff --git a/security/apparmor/include/net.h b/security/apparmor/include/net.h
index 0d0b0ce427238..021a35b94bd7e 100644
--- a/security/apparmor/include/net.h
+++ b/security/apparmor/include/net.h
@@ -86,7 +86,7 @@ extern struct aa_sfs_entry aa_sfs_entry_network[];
extern struct aa_sfs_entry aa_sfs_entry_networkv9[];
int aa_do_perms(struct aa_profile *profile, struct aa_policydb *policy,
- aa_state_t state, u32 request, struct aa_perms *p,
+ aa_state_t state, u32 request, const struct aa_perms *p,
struct apparmor_audit_data *ad);
/* passing in state returned by XXX_mediates_AF() */
aa_state_t aa_match_to_prot(struct aa_policydb *policy, aa_state_t state,
diff --git a/security/apparmor/include/perms.h b/security/apparmor/include/perms.h
index 37a3781b99a08..695d9b0572d4f 100644
--- a/security/apparmor/include/perms.h
+++ b/security/apparmor/include/perms.h
@@ -105,7 +105,7 @@ extern struct aa_perms allperms;
* @addend: perms struct to add to @accum
*/
static inline void aa_perms_accum_raw(struct aa_perms *accum,
- struct aa_perms *addend)
+ const struct aa_perms *addend)
{
accum->deny |= addend->deny;
accum->allow &= addend->allow & ~addend->deny;
@@ -132,7 +132,7 @@ static inline void aa_perms_accum_raw(struct aa_perms *accum,
* @addend: perms struct to add to @accum
*/
static inline void aa_perms_accum(struct aa_perms *accum,
- struct aa_perms *addend)
+ const struct aa_perms *addend)
{
accum->deny |= addend->deny;
accum->allow &= addend->allow & ~accum->deny;
@@ -208,12 +208,13 @@ void aa_audit_perm_mask(struct audit_buffer *ab, u32 mask, const char *chrs,
u32 chrsmask, const char * const *names, u32 namesmask);
void aa_apply_modes_to_perms(struct aa_profile *profile,
struct aa_perms *perms);
-void aa_perms_accum(struct aa_perms *accum, struct aa_perms *addend);
-void aa_perms_accum_raw(struct aa_perms *accum, struct aa_perms *addend);
+void aa_perms_accum(struct aa_perms *accum, const struct aa_perms *addend);
+void aa_perms_accum_raw(struct aa_perms *accum, const struct aa_perms *addend);
void aa_profile_match_label(struct aa_profile *profile,
struct aa_ruleset *rules, struct aa_label *label,
int type, u32 request, struct aa_perms *perms);
-int aa_check_perms(struct aa_profile *profile, struct aa_perms *perms,
+int aa_check_perms(struct aa_profile *profile, const struct aa_perms *perms,
u32 request, struct apparmor_audit_data *ad,
void (*cb)(struct audit_buffer *, void *));
#endif /* __AA_PERM_H */
+
diff --git a/security/apparmor/lib.c b/security/apparmor/lib.c
index 5d53c15e46a9e..3b982770c4ceb 100644
--- a/security/apparmor/lib.c
+++ b/security/apparmor/lib.c
@@ -415,7 +415,7 @@ void aa_profile_match_label(struct aa_profile *profile,
* error code will indicate whether there was an explicit deny
* with a positive value.
*/
-int aa_check_perms(struct aa_profile *profile, struct aa_perms *perms,
+int aa_check_perms(struct aa_profile *profile, const struct aa_perms *perms,
u32 request, struct apparmor_audit_data *ad,
void (*cb)(struct audit_buffer *, void *))
{
diff --git a/security/apparmor/net.c b/security/apparmor/net.c
index cf590dd08540c..73a272576d5d6 100644
--- a/security/apparmor/net.c
+++ b/security/apparmor/net.c
@@ -166,7 +166,7 @@ void audit_net_cb(struct audit_buffer *ab, void *va)
/* standard permission lookup pattern - supports early bailout */
int aa_do_perms(struct aa_profile *profile, struct aa_policydb *policy,
aa_state_t state, u32 request,
- struct aa_perms *p, struct apparmor_audit_data *ad)
+ const struct aa_perms *p, struct apparmor_audit_data *ad)
{
struct aa_perms perms;
diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c
index 391665c27ede1..8dc2adedc7ae1 100644
--- a/security/apparmor/policy_unpack.c
+++ b/security/apparmor/policy_unpack.c
@@ -1257,7 +1257,7 @@ static bool verify_dfa_accept_index(struct aa_dfa *dfa, int table_size)
return true;
}
-static bool verify_perm(struct aa_perms *perm)
+static bool verify_perm(const struct aa_perms *perm)
{
/* TODO: allow option to just force the perms into a valid state */
if (perm->allow & perm->deny)
--
2.53.0
next prev parent reply other threads:[~2026-11-12 4:05 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-07 10:15 FAILED: patch "[PATCH] apparmor: fix profile leak when a policy load fails" failed to apply to 6.18-stable tree Sasha Levin
2026-11-12 4:05 ` [PATCH 6.18.y 1/4] apparmor: refactor xattr attachment, to take the file path Sasha Levin
2026-11-12 4:05 ` Sasha Levin [this message]
2026-11-12 4:05 ` [PATCH 6.18.y 3/4] apparmor: constify aa_profile parameters on read-only compute paths Sasha Levin
2026-11-12 4:05 ` [PATCH 6.18.y 4/4] apparmor: fix profile leak when a policy load fails Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261112040513.1836781-2-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=john.johansen@canonical.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox