1751f872cc
Add the const qualifier to all the ctl_tables in the tree except for
watchdog_hardlockup_sysctl, memory_allocation_profiling_sysctls,
loadpin_sysctl_table and the ones calling register_net_sysctl (./net,
drivers/inifiniband dirs). These are special cases as they use a
registration function with a non-const qualified ctl_table argument or
modify the arrays before passing them on to the registration function.
Constifying ctl_table structs will prevent the modification of
proc_handler function pointers as the arrays would reside in .rodata.
This is made possible after commit 78eb4ea25c ("sysctl: treewide:
constify the ctl_table argument of proc_handlers") constified all the
proc_handlers.
Created this by running an spatch followed by a sed command:
Spatch:
virtual patch
@
depends on !(file in "net")
disable optional_qualifier
@
identifier table_name != {
watchdog_hardlockup_sysctl,
iwcm_ctl_table,
ucma_ctl_table,
memory_allocation_profiling_sysctls,
loadpin_sysctl_table
};
@@
+ const
struct ctl_table table_name [] = { ... };
sed:
sed --in-place \
-e "s/struct ctl_table .table = &uts_kern/const struct ctl_table *table = \&uts_kern/" \
kernel/utsname_sysctl.c
Reviewed-by: Song Liu <song@kernel.org>
Acked-by: Steven Rostedt (Google) <rostedt@goodmis.org> # for kernel/trace/
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com> # SCSI
Reviewed-by: Darrick J. Wong <djwong@kernel.org> # xfs
Acked-by: Jani Nikula <jani.nikula@intel.com>
Acked-by: Corey Minyard <cminyard@mvista.com>
Acked-by: Wei Liu <wei.liu@kernel.org>
Acked-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Bill O'Donnell <bodonnel@redhat.com>
Acked-by: Baoquan He <bhe@redhat.com>
Acked-by: Ashutosh Dixit <ashutosh.dixit@intel.com>
Acked-by: Anna Schumaker <anna.schumaker@oracle.com>
Signed-off-by: Joel Granados <joel.granados@kernel.org>
99 lines
2.1 KiB
C
99 lines
2.1 KiB
C
// SPDX-License-Identifier: GPL-2.0-or-later
|
|
/*
|
|
* FIPS 200 support.
|
|
*
|
|
* Copyright (c) 2008 Neil Horman <nhorman@tuxdriver.com>
|
|
*/
|
|
|
|
#include <linux/export.h>
|
|
#include <linux/fips.h>
|
|
#include <linux/init.h>
|
|
#include <linux/module.h>
|
|
#include <linux/kernel.h>
|
|
#include <linux/sysctl.h>
|
|
#include <linux/notifier.h>
|
|
#include <linux/string_choices.h>
|
|
#include <generated/utsrelease.h>
|
|
|
|
int fips_enabled;
|
|
EXPORT_SYMBOL_GPL(fips_enabled);
|
|
|
|
ATOMIC_NOTIFIER_HEAD(fips_fail_notif_chain);
|
|
EXPORT_SYMBOL_GPL(fips_fail_notif_chain);
|
|
|
|
/* Process kernel command-line parameter at boot time. fips=0 or fips=1 */
|
|
static int fips_enable(char *str)
|
|
{
|
|
fips_enabled = !!simple_strtol(str, NULL, 0);
|
|
pr_info("fips mode: %s\n", str_enabled_disabled(fips_enabled));
|
|
return 1;
|
|
}
|
|
|
|
__setup("fips=", fips_enable);
|
|
|
|
#define FIPS_MODULE_NAME CONFIG_CRYPTO_FIPS_NAME
|
|
#ifdef CONFIG_CRYPTO_FIPS_CUSTOM_VERSION
|
|
#define FIPS_MODULE_VERSION CONFIG_CRYPTO_FIPS_VERSION
|
|
#else
|
|
#define FIPS_MODULE_VERSION UTS_RELEASE
|
|
#endif
|
|
|
|
static char fips_name[] = FIPS_MODULE_NAME;
|
|
static char fips_version[] = FIPS_MODULE_VERSION;
|
|
|
|
static const struct ctl_table crypto_sysctl_table[] = {
|
|
{
|
|
.procname = "fips_enabled",
|
|
.data = &fips_enabled,
|
|
.maxlen = sizeof(int),
|
|
.mode = 0444,
|
|
.proc_handler = proc_dointvec
|
|
},
|
|
{
|
|
.procname = "fips_name",
|
|
.data = &fips_name,
|
|
.maxlen = 64,
|
|
.mode = 0444,
|
|
.proc_handler = proc_dostring
|
|
},
|
|
{
|
|
.procname = "fips_version",
|
|
.data = &fips_version,
|
|
.maxlen = 64,
|
|
.mode = 0444,
|
|
.proc_handler = proc_dostring
|
|
},
|
|
};
|
|
|
|
static struct ctl_table_header *crypto_sysctls;
|
|
|
|
static void crypto_proc_fips_init(void)
|
|
{
|
|
crypto_sysctls = register_sysctl("crypto", crypto_sysctl_table);
|
|
}
|
|
|
|
static void crypto_proc_fips_exit(void)
|
|
{
|
|
unregister_sysctl_table(crypto_sysctls);
|
|
}
|
|
|
|
void fips_fail_notify(void)
|
|
{
|
|
if (fips_enabled)
|
|
atomic_notifier_call_chain(&fips_fail_notif_chain, 0, NULL);
|
|
}
|
|
EXPORT_SYMBOL_GPL(fips_fail_notify);
|
|
|
|
static int __init fips_init(void)
|
|
{
|
|
crypto_proc_fips_init();
|
|
return 0;
|
|
}
|
|
|
|
static void __exit fips_exit(void)
|
|
{
|
|
crypto_proc_fips_exit();
|
|
}
|
|
|
|
subsys_initcall(fips_init);
|
|
module_exit(fips_exit);
|