[v2] sysctl: treewide: constify ctl_table_root::permissions

Commit Message

Thomas Weißschuh Feb. 23, 2024, 3:52 p.m. UTC

The permissions callback is not supposed to modify the ctl_table.
Enforce this expectation via the typesystem.

The patch was created with the following coccinelle script:

  @@
  identifier func, head, ctl;
  @@

  int func(
    struct ctl_table_header *head,
  - struct ctl_table *ctl)
  + const struct ctl_table *ctl)
  { ... }

(insert_entry() from fs/proc/proc_sysctl.c is a false-positive)

The three changed locations were validated through manually inspection
and compilation.

In addition a search for '.permissions =' was done over the full tree to
look for places that were missed by coccinelle.
None were found.

This change also is a step to put "struct ctl_table" into .rodata
throughout the kernel.

Signed-off-by: Thomas Weißschuh <[e-mail]>
---
To: Luis Chamberlain <[e-mail]>
To: Kees Cook <[e-mail]>
To: Joel Granados <[e-mail]>
To: David S. Miller <[e-mail]>
Signed-off-by: Thomas Weißschuh <[e-mail]>

Changes in v2:
- flesh out commit messages
- Integrate changes to set_ownership and ctl_table_args into a single
  series
- Link to v1: https://lore.kernel.org/r/[e-mail]
---
The patch is meant to be merged via the sysctl tree.

There is an upcoming series that will introduce a new implementation of
.permission which would need to be adapted [0].
The adaption would be trivial as the 'table' parameter also not modified
there.

This change was originally part of the sysctl-const series [1].
To slim down that series and reduce the message load on other
maintainers to a minimumble, submit this patch on its own.

[0] https://lore.kernel.org/lkml/[e-mail]/
[1] https://lore.kernel.org/lkml/[e-mail]/
---
 include/linux/sysctl.h | 2 +-
 ipc/ipc_sysctl.c       | 2 +-
 kernel/ucount.c        | 2 +-
 net/sysctl_net.c       | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)


---
base-commit: ffd2cb6b718e189e7e2d5d0c19c25611f92e061a
change-id: 20231226-sysctl-const-permissions-d7cfd02a7637

Best regards,

Comments

Joel Granados March 3, 2024, 2:34 p.m. UTC | #1

Hey Thomas

Just to be sure I'm following. This is V2 of "[PATCH] sysctl: treewide:
constify ctl_table_root::set_ownership". Right? I ask, because the
subject changes slightly.

Best

On Fri, Feb 23, 2024 at 04:52:16PM +0100, Thomas Weißschuh wrote:
> The permissions callback is not supposed to modify the ctl_table.
> Enforce this expectation via the typesystem.
> 
> The patch was created with the following coccinelle script:
> 
>   @@
>   identifier func, head, ctl;
>   @@
> 
>   int func(
>     struct ctl_table_header *head,
>   - struct ctl_table *ctl)
>   + const struct ctl_table *ctl)
>   { ... }
> 
> (insert_entry() from fs/proc/proc_sysctl.c is a false-positive)
> 
> The three changed locations were validated through manually inspection
> and compilation.
> 
> In addition a search for '.permissions =' was done over the full tree to
> look for places that were missed by coccinelle.
> None were found.
> 
> This change also is a step to put "struct ctl_table" into .rodata
> throughout the kernel.
> 
> Signed-off-by: Thomas Weißschuh <[e-mail]>
> ---
> To: Luis Chamberlain <[e-mail]>
> To: Kees Cook <[e-mail]>
> To: Joel Granados <[e-mail]>
> To: David S. Miller <[e-mail]>
> Signed-off-by: Thomas Weißschuh <[e-mail]>
> 
> Changes in v2:
> - flesh out commit messages
> - Integrate changes to set_ownership and ctl_table_args into a single
>   series
> - Link to v1: https://lore.kernel.org/r/[e-mail]
> ---
> The patch is meant to be merged via the sysctl tree.
> 
> There is an upcoming series that will introduce a new implementation of
> .permission which would need to be adapted [0].
> The adaption would be trivial as the 'table' parameter also not modified
> there.
> 
> This change was originally part of the sysctl-const series [1].
> To slim down that series and reduce the message load on other
> maintainers to a minimumble, submit this patch on its own.
> 
> [0] https://lore.kernel.org/lkml/[e-mail]/
> [1] https://lore.kernel.org/lkml/[e-mail]/
> ---
>  include/linux/sysctl.h | 2 +-
>  ipc/ipc_sysctl.c       | 2 +-
>  kernel/ucount.c        | 2 +-
>  net/sysctl_net.c       | 2 +-
>  4 files changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h
> index ee7d33b89e9e..0a55b5aade16 100644
> --- a/include/linux/sysctl.h
> +++ b/include/linux/sysctl.h
> @@ -207,7 +207,7 @@ struct ctl_table_root {
>  	void (*set_ownership)(struct ctl_table_header *head,
>  			      struct ctl_table *table,
>  			      kuid_t *uid, kgid_t *gid);
> -	int (*permissions)(struct ctl_table_header *head, struct ctl_table *table);
> +	int (*permissions)(struct ctl_table_header *head, const struct ctl_table *table);
>  };
>  
>  #define register_sysctl(path, table)	\
> diff --git a/ipc/ipc_sysctl.c b/ipc/ipc_sysctl.c
> index 8c62e443f78b..b087787f608f 100644
> --- a/ipc/ipc_sysctl.c
> +++ b/ipc/ipc_sysctl.c
> @@ -190,7 +190,7 @@ static int set_is_seen(struct ctl_table_set *set)
>  	return &current->nsproxy->ipc_ns->ipc_set == set;
>  }
>  
> -static int ipc_permissions(struct ctl_table_header *head, struct ctl_table *table)
> +static int ipc_permissions(struct ctl_table_header *head, const struct ctl_table *table)
>  {
>  	int mode = table->mode;
>  
> diff --git a/kernel/ucount.c b/kernel/ucount.c
> index 4aa6166cb856..90300840256b 100644
> --- a/kernel/ucount.c
> +++ b/kernel/ucount.c
> @@ -38,7 +38,7 @@ static int set_is_seen(struct ctl_table_set *set)
>  }
>  
>  static int set_permissions(struct ctl_table_header *head,
> -				  struct ctl_table *table)
> +			   const struct ctl_table *table)
>  {
>  	struct user_namespace *user_ns =
>  		container_of(head->set, struct user_namespace, set);
> diff --git a/net/sysctl_net.c b/net/sysctl_net.c
> index 051ed5f6fc93..ba9a49de9600 100644
> --- a/net/sysctl_net.c
> +++ b/net/sysctl_net.c
> @@ -40,7 +40,7 @@ static int is_seen(struct ctl_table_set *set)
>  
>  /* Return standard mode bits for table entry. */
>  static int net_ctl_permissions(struct ctl_table_header *head,
> -			       struct ctl_table *table)
> +			       const struct ctl_table *table)
>  {
>  	struct net *net = container_of(head->set, struct net, sysctls);
>  
> 
> ---
> base-commit: ffd2cb6b718e189e7e2d5d0c19c25611f92e061a
> change-id: 20231226-sysctl-const-permissions-d7cfd02a7637
> 
> Best regards,
> -- 
> Thomas Weißschuh <[e-mail]>
>

Thomas Weißschuh March 10, 2024, 9:18 a.m. UTC | #2

Hi!

On 2024-03-03 15:34:08+0100, Joel Granados wrote:
> Just to be sure I'm following. This is V2 of "[PATCH] sysctl: treewide:
> constify ctl_table_root::set_ownership". Right? I ask, because the
> subject changes slightly.

No, the v1 of this patch is linked in the patch log below.

The patches for ::set_ownership and ::permissions are changing two
different callbacks and both of them are needed.

The v2 for set_ownership is here:
https://lore.kernel.org/lkml/[e-mail]/

Regards

> 
> Best
> 
> On Fri, Feb 23, 2024 at 04:52:16PM +0100, Thomas Weißschuh wrote:
> > The permissions callback is not supposed to modify the ctl_table.
> > Enforce this expectation via the typesystem.
> > 
> > The patch was created with the following coccinelle script:
> > 
> >   @@
> >   identifier func, head, ctl;
> >   @@
> > 
> >   int func(
> >     struct ctl_table_header *head,
> >   - struct ctl_table *ctl)
> >   + const struct ctl_table *ctl)
> >   { ... }
> > 
> > (insert_entry() from fs/proc/proc_sysctl.c is a false-positive)
> > 
> > The three changed locations were validated through manually inspection
> > and compilation.
> > 
> > In addition a search for '.permissions =' was done over the full tree to
> > look for places that were missed by coccinelle.
> > None were found.
> > 
> > This change also is a step to put "struct ctl_table" into .rodata
> > throughout the kernel.
> > 
> > Signed-off-by: Thomas Weißschuh <[e-mail]>
> > ---
> > To: Luis Chamberlain <[e-mail]>
> > To: Kees Cook <[e-mail]>
> > To: Joel Granados <[e-mail]>
> > To: David S. Miller <[e-mail]>
> > Signed-off-by: Thomas Weißschuh <[e-mail]>
> > 
> > Changes in v2:
> > - flesh out commit messages
> > - Integrate changes to set_ownership and ctl_table_args into a single
> >   series
> > - Link to v1: https://lore.kernel.org/r/[e-mail]
> > ---
> > The patch is meant to be merged via the sysctl tree.
> > 
> > There is an upcoming series that will introduce a new implementation of
> > .permission which would need to be adapted [0].
> > The adaption would be trivial as the 'table' parameter also not modified
> > there.
> > 
> > This change was originally part of the sysctl-const series [1].
> > To slim down that series and reduce the message load on other
> > maintainers to a minimumble, submit this patch on its own.
> > 
> > [0] https://lore.kernel.org/lkml/[e-mail]/
> > [1] https://lore.kernel.org/lkml/[e-mail]/
> > ---
> >  include/linux/sysctl.h | 2 +-
> >  ipc/ipc_sysctl.c       | 2 +-
> >  kernel/ucount.c        | 2 +-
> >  net/sysctl_net.c       | 2 +-
> >  4 files changed, 4 insertions(+), 4 deletions(-)
> > 
> > diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h
> > index ee7d33b89e9e..0a55b5aade16 100644
> > --- a/include/linux/sysctl.h
> > +++ b/include/linux/sysctl.h
> > @@ -207,7 +207,7 @@ struct ctl_table_root {
> >  	void (*set_ownership)(struct ctl_table_header *head,
> >  			      struct ctl_table *table,
> >  			      kuid_t *uid, kgid_t *gid);
> > -	int (*permissions)(struct ctl_table_header *head, struct ctl_table *table);
> > +	int (*permissions)(struct ctl_table_header *head, const struct ctl_table *table);
> >  };
> >  
> >  #define register_sysctl(path, table)	\
> > diff --git a/ipc/ipc_sysctl.c b/ipc/ipc_sysctl.c
> > index 8c62e443f78b..b087787f608f 100644
> > --- a/ipc/ipc_sysctl.c
> > +++ b/ipc/ipc_sysctl.c
> > @@ -190,7 +190,7 @@ static int set_is_seen(struct ctl_table_set *set)
> >  	return &current->nsproxy->ipc_ns->ipc_set == set;
> >  }
> >  
> > -static int ipc_permissions(struct ctl_table_header *head, struct ctl_table *table)
> > +static int ipc_permissions(struct ctl_table_header *head, const struct ctl_table *table)
> >  {
> >  	int mode = table->mode;
> >  
> > diff --git a/kernel/ucount.c b/kernel/ucount.c
> > index 4aa6166cb856..90300840256b 100644
> > --- a/kernel/ucount.c
> > +++ b/kernel/ucount.c
> > @@ -38,7 +38,7 @@ static int set_is_seen(struct ctl_table_set *set)
> >  }
> >  
> >  static int set_permissions(struct ctl_table_header *head,
> > -				  struct ctl_table *table)
> > +			   const struct ctl_table *table)
> >  {
> >  	struct user_namespace *user_ns =
> >  		container_of(head->set, struct user_namespace, set);
> > diff --git a/net/sysctl_net.c b/net/sysctl_net.c
> > index 051ed5f6fc93..ba9a49de9600 100644
> > --- a/net/sysctl_net.c
> > +++ b/net/sysctl_net.c
> > @@ -40,7 +40,7 @@ static int is_seen(struct ctl_table_set *set)
> >  
> >  /* Return standard mode bits for table entry. */
> >  static int net_ctl_permissions(struct ctl_table_header *head,
> > -			       struct ctl_table *table)
> > +			       const struct ctl_table *table)
> >  {
> >  	struct net *net = container_of(head->set, struct net, sysctls);
> >  
> > 
> > ---
> > base-commit: ffd2cb6b718e189e7e2d5d0c19c25611f92e061a
> > change-id: 20231226-sysctl-const-permissions-d7cfd02a7637
> > 
> > Best regards,
> > -- 
> > Thomas Weißschuh <[e-mail]>
> > 
> 
> -- 
> 
> Joel Granados

Joel Granados March 11, 2024, 9:22 a.m. UTC | #3

On Sun, Mar 10, 2024 at 10:18:07AM +0100, Thomas Weißschuh wrote:
> Hi!
> 
> On 2024-03-03 15:34:08+0100, Joel Granados wrote:
> > Just to be sure I'm following. This is V2 of "[PATCH] sysctl: treewide:
> > constify ctl_table_root::set_ownership". Right? I ask, because the
> > subject changes slightly.
> 
> No, the v1 of this patch is linked in the patch log below.
> 
> The patches for ::set_ownership and ::permissions are changing two
> different callbacks and both of them are needed.
Awesome. thx for clarifying. So the ::permissions one I have reviewed
and have added to the constification branch in sysctl repo for testing.
I'm missing the review for the set_ownership one.

Best

> 
> The v2 for set_ownership is here:
> https://lore.kernel.org/lkml/[e-mail]/
> 
> Regards
> 
> > 
> > Best
> > 
> > On Fri, Feb 23, 2024 at 04:52:16PM +0100, Thomas Weißschuh wrote:
> > > The permissions callback is not supposed to modify the ctl_table.
> > > Enforce this expectation via the typesystem.
> > > 
> > > The patch was created with the following coccinelle script:
> > > 
> > >   @@
> > >   identifier func, head, ctl;
> > >   @@
> > > 
> > >   int func(
> > >     struct ctl_table_header *head,
> > >   - struct ctl_table *ctl)
> > >   + const struct ctl_table *ctl)
> > >   { ... }
> > > 
> > > (insert_entry() from fs/proc/proc_sysctl.c is a false-positive)
> > > 
> > > The three changed locations were validated through manually inspection
> > > and compilation.
> > > 
> > > In addition a search for '.permissions =' was done over the full tree to
> > > look for places that were missed by coccinelle.
> > > None were found.
> > > 
> > > This change also is a step to put "struct ctl_table" into .rodata
> > > throughout the kernel.
> > > 
> > > Signed-off-by: Thomas Weißschuh <[e-mail]>
> > > ---
> > > To: Luis Chamberlain <[e-mail]>
> > > To: Kees Cook <[e-mail]>
> > > To: Joel Granados <[e-mail]>
> > > To: David S. Miller <[e-mail]>
> > > Signed-off-by: Thomas Weißschuh <[e-mail]>
> > > 
> > > Changes in v2:
> > > - flesh out commit messages
> > > - Integrate changes to set_ownership and ctl_table_args into a single
> > >   series
> > > - Link to v1: https://lore.kernel.org/r/[e-mail]
> > > ---
> > > The patch is meant to be merged via the sysctl tree.
> > > 
> > > There is an upcoming series that will introduce a new implementation of
> > > .permission which would need to be adapted [0].
> > > The adaption would be trivial as the 'table' parameter also not modified
> > > there.
> > > 
> > > This change was originally part of the sysctl-const series [1].
> > > To slim down that series and reduce the message load on other
> > > maintainers to a minimumble, submit this patch on its own.
> > > 
> > > [0] https://lore.kernel.org/lkml/[e-mail]/
> > > [1] https://lore.kernel.org/lkml/[e-mail]/
> > > ---
> > >  include/linux/sysctl.h | 2 +-
> > >  ipc/ipc_sysctl.c       | 2 +-
> > >  kernel/ucount.c        | 2 +-
> > >  net/sysctl_net.c       | 2 +-
> > >  4 files changed, 4 insertions(+), 4 deletions(-)
> > > 
> > > diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h
> > > index ee7d33b89e9e..0a55b5aade16 100644
> > > --- a/include/linux/sysctl.h
> > > +++ b/include/linux/sysctl.h
> > > @@ -207,7 +207,7 @@ struct ctl_table_root {
> > >  	void (*set_ownership)(struct ctl_table_header *head,
> > >  			      struct ctl_table *table,
> > >  			      kuid_t *uid, kgid_t *gid);
> > > -	int (*permissions)(struct ctl_table_header *head, struct ctl_table *table);
> > > +	int (*permissions)(struct ctl_table_header *head, const struct ctl_table *table);
> > >  };
> > >  
> > >  #define register_sysctl(path, table)	\
> > > diff --git a/ipc/ipc_sysctl.c b/ipc/ipc_sysctl.c
> > > index 8c62e443f78b..b087787f608f 100644
> > > --- a/ipc/ipc_sysctl.c
> > > +++ b/ipc/ipc_sysctl.c
> > > @@ -190,7 +190,7 @@ static int set_is_seen(struct ctl_table_set *set)
> > >  	return &current->nsproxy->ipc_ns->ipc_set == set;
> > >  }
> > >  
> > > -static int ipc_permissions(struct ctl_table_header *head, struct ctl_table *table)
> > > +static int ipc_permissions(struct ctl_table_header *head, const struct ctl_table *table)
> > >  {
> > >  	int mode = table->mode;
> > >  
> > > diff --git a/kernel/ucount.c b/kernel/ucount.c
> > > index 4aa6166cb856..90300840256b 100644
> > > --- a/kernel/ucount.c
> > > +++ b/kernel/ucount.c
> > > @@ -38,7 +38,7 @@ static int set_is_seen(struct ctl_table_set *set)
> > >  }
> > >  
> > >  static int set_permissions(struct ctl_table_header *head,
> > > -				  struct ctl_table *table)
> > > +			   const struct ctl_table *table)
> > >  {
> > >  	struct user_namespace *user_ns =
> > >  		container_of(head->set, struct user_namespace, set);
> > > diff --git a/net/sysctl_net.c b/net/sysctl_net.c
> > > index 051ed5f6fc93..ba9a49de9600 100644
> > > --- a/net/sysctl_net.c
> > > +++ b/net/sysctl_net.c
> > > @@ -40,7 +40,7 @@ static int is_seen(struct ctl_table_set *set)
> > >  
> > >  /* Return standard mode bits for table entry. */
> > >  static int net_ctl_permissions(struct ctl_table_header *head,
> > > -			       struct ctl_table *table)
> > > +			       const struct ctl_table *table)
> > >  {
> > >  	struct net *net = container_of(head->set, struct net, sysctls);
> > >  
> > > 
> > > ---
> > > base-commit: ffd2cb6b718e189e7e2d5d0c19c25611f92e061a
> > > change-id: 20231226-sysctl-const-permissions-d7cfd02a7637
> > > 
> > > Best regards,
> > > -- 
> > > Thomas Weißschuh <[e-mail]>
> > > 
> > 
> > -- 
> > 
> > Joel Granados
> 
>

Patch

diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h
index ee7d33b89e9e..0a55b5aade16 100644
--- a/include/linux/sysctl.h
+++ b/include/linux/sysctl.h
@@ -207,7 +207,7 @@  struct ctl_table_root {
 	void (*set_ownership)(struct ctl_table_header *head,
 			      struct ctl_table *table,
 			      kuid_t *uid, kgid_t *gid);
-	int (*permissions)(struct ctl_table_header *head, struct ctl_table *table);
+	int (*permissions)(struct ctl_table_header *head, const struct ctl_table *table);
 };
 
 #define register_sysctl(path, table)	\
diff --git a/ipc/ipc_sysctl.c b/ipc/ipc_sysctl.c
index 8c62e443f78b..b087787f608f 100644
--- a/ipc/ipc_sysctl.c
+++ b/ipc/ipc_sysctl.c
@@ -190,7 +190,7 @@  static int set_is_seen(struct ctl_table_set *set)
 	return &current->nsproxy->ipc_ns->ipc_set == set;
 }
 
-static int ipc_permissions(struct ctl_table_header *head, struct ctl_table *table)
+static int ipc_permissions(struct ctl_table_header *head, const struct ctl_table *table)
 {
 	int mode = table->mode;
 
diff --git a/kernel/ucount.c b/kernel/ucount.c
index 4aa6166cb856..90300840256b 100644
--- a/kernel/ucount.c
+++ b/kernel/ucount.c
@@ -38,7 +38,7 @@  static int set_is_seen(struct ctl_table_set *set)
 }
 
 static int set_permissions(struct ctl_table_header *head,
-				  struct ctl_table *table)
+			   const struct ctl_table *table)
 {
 	struct user_namespace *user_ns =
 		container_of(head->set, struct user_namespace, set);
diff --git a/net/sysctl_net.c b/net/sysctl_net.c
index 051ed5f6fc93..ba9a49de9600 100644
--- a/net/sysctl_net.c
+++ b/net/sysctl_net.c
@@ -40,7 +40,7 @@  static int is_seen(struct ctl_table_set *set)
 
 /* Return standard mode bits for table entry. */
 static int net_ctl_permissions(struct ctl_table_header *head,
-			       struct ctl_table *table)
+			       const struct ctl_table *table)
 {
 	struct net *net = container_of(head->set, struct net, sysctls);