| Message ID | 20250123-sysctl-kees-v1-2-533359e74d66@suse.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | security: Constify sysctl tables | expand |
On Thu, Jan 23, 2025 at 04:33:35PM -0300, Ricardo B. Marliere wrote: > Since commit 7abc9b53bd51 ("sysctl: allow registration of const struct > ctl_table"), the sysctl registration API allows for struct ctl_table to be > in read-only memory. Move loadpin_sysctl_table to be declared at build > time, instead of having to be dynamically allocated at boot time. > > Cc: Thomas Weißschuh <linux@weissschuh.net> > Suggested-by: Thomas Weißschuh <linux@weissschuh.net> > Signed-off-by: Ricardo B. Marliere <rbm@suse.com> Reviewed-by: Kees Cook <kees@kernel.org>
Hi Ricardo,
kernel test robot noticed the following build errors:
[auto build test ERROR on a9a5e0bdc5a77a7c662ad4be0ad661f0b0d5e99d]
url: https://github.com/intel-lab-lkp/linux/commits/Ricardo-B-Marliere/yama-Make-sysctl-table-const/20250124-033808
base: a9a5e0bdc5a77a7c662ad4be0ad661f0b0d5e99d
patch link: https://lore.kernel.org/r/20250123-sysctl-kees-v1-2-533359e74d66%40suse.com
patch subject: [PATCH 2/2] LoadPin: Make sysctl table const
config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20250202/202502021853.d0nqHvPc-lkp@intel.com/config)
compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250202/202502021853.d0nqHvPc-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202502021853.d0nqHvPc-lkp@intel.com/
All errors (new ones prefixed by >>):
>> security/loadpin/loadpin.c:75:34: error: cannot assign to variable 'loadpin_sysctl_table' with const-qualified type 'const struct ctl_table[1]'
75 | loadpin_sysctl_table[0].extra1 = SYSCTL_ZERO;
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ^
security/loadpin/loadpin.c:56:31: note: variable 'loadpin_sysctl_table' declared const here
56 | static const struct ctl_table loadpin_sysctl_table[] = {
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~
57 | {
| ~
58 | .procname = "enforce",
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
59 | .data = &enforce,
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~
60 | .maxlen = sizeof(int),
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
61 | .mode = 0644,
| ~~~~~~~~~~~~~~~~~~~~~~~
62 | .proc_handler = proc_dointvec_minmax,
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
63 | .extra1 = SYSCTL_ONE,
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
64 | .extra2 = SYSCTL_ONE,
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
65 | },
| ~~
66 | };
| ~
security/loadpin/loadpin.c:77:34: error: cannot assign to variable 'loadpin_sysctl_table' with const-qualified type 'const struct ctl_table[1]'
77 | loadpin_sysctl_table[0].extra1 = SYSCTL_ONE;
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ^
security/loadpin/loadpin.c:56:31: note: variable 'loadpin_sysctl_table' declared const here
56 | static const struct ctl_table loadpin_sysctl_table[] = {
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~
57 | {
| ~
58 | .procname = "enforce",
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
59 | .data = &enforce,
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~
60 | .maxlen = sizeof(int),
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
61 | .mode = 0644,
| ~~~~~~~~~~~~~~~~~~~~~~~
62 | .proc_handler = proc_dointvec_minmax,
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
63 | .extra1 = SYSCTL_ONE,
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
64 | .extra2 = SYSCTL_ONE,
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
65 | },
| ~~
66 | };
| ~
2 errors generated.
vim +75 security/loadpin/loadpin.c
9b091556a073a9 Kees Cook 2016-04-20 67
60ba1028fc7b73 Kees Cook 2022-12-09 68 static void set_sysctl(bool is_writable)
9b091556a073a9 Kees Cook 2016-04-20 69 {
9b091556a073a9 Kees Cook 2016-04-20 70 /*
9b091556a073a9 Kees Cook 2016-04-20 71 * If load pinning is not enforced via a read-only block
9b091556a073a9 Kees Cook 2016-04-20 72 * device, allow sysctl to change modes for testing.
9b091556a073a9 Kees Cook 2016-04-20 73 */
60ba1028fc7b73 Kees Cook 2022-12-09 74 if (is_writable)
60ba1028fc7b73 Kees Cook 2022-12-09 @75 loadpin_sysctl_table[0].extra1 = SYSCTL_ZERO;
60ba1028fc7b73 Kees Cook 2022-12-09 76 else
60ba1028fc7b73 Kees Cook 2022-12-09 77 loadpin_sysctl_table[0].extra1 = SYSCTL_ONE;
60ba1028fc7b73 Kees Cook 2022-12-09 78 }
60ba1028fc7b73 Kees Cook 2022-12-09 79 #else
60ba1028fc7b73 Kees Cook 2022-12-09 80 static inline void set_sysctl(bool is_writable) { }
60ba1028fc7b73 Kees Cook 2022-12-09 81 #endif
60ba1028fc7b73 Kees Cook 2022-12-09 82
diff --git a/security/loadpin/loadpin.c b/security/loadpin/loadpin.c index 68252452b66cb913638abbca2adea26219e77d37..e2d664b7602629c08c86d6d02158a4e9dd189b1a 100644 --- a/security/loadpin/loadpin.c +++ b/security/loadpin/loadpin.c @@ -53,7 +53,7 @@ static bool deny_reading_verity_digests; #endif #ifdef CONFIG_SYSCTL -static struct ctl_table loadpin_sysctl_table[] = { +static const struct ctl_table loadpin_sysctl_table[] = { { .procname = "enforce", .data = &enforce,
Since commit 7abc9b53bd51 ("sysctl: allow registration of const struct ctl_table"), the sysctl registration API allows for struct ctl_table to be in read-only memory. Move loadpin_sysctl_table to be declared at build time, instead of having to be dynamically allocated at boot time. Cc: Thomas Weißschuh <linux@weissschuh.net> Suggested-by: Thomas Weißschuh <linux@weissschuh.net> Signed-off-by: Ricardo B. Marliere <rbm@suse.com> --- security/loadpin/loadpin.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)