apparmor: constify aa_label parameters on read-only query helpers

Several label helpers only read from their struct aa_label * arguments:
they compare labels, test subset relationships, or check the mediation
bitmask, all via direct field/index access. Mark those parameters
const struct aa_label * to document intent and let the compiler enforce
that the label is not modified.

The converted functions are:
  - label_mediates(), label_mediates_safe()
  - aa_label_cmp() (and its vec_cmp() helper)
  - __aa_label_next_not_in_set(), aa_label_is_subset(),
    aa_label_is_unconfined_subset()
  - __aa_subj_label_is_cached()
  - aa_label_next_confined(), aa_label_next_in_merge()

These all access the label through direct indexing or manual iterators
rather than the label_for_each()/fn_for_each() macros, which are not
const-correct and so gate the majority of the remaining label consumers
(the print, match, and permission-check paths) from being constified.

No functional change.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Assisted-by: Claude:claude-opus-4.8

2 files changed, 23 insertions, 20 deletions

diff --git a/security/apparmor/include/label.h b/security/apparmor/include/label.h
index eb2240173ba3..2c869b7dec97 100644
--- a/security/apparmor/include/label.h
+++ b/security/apparmor/include/label.h
@@ -165,7 +165,7 @@ do {							\
 #define labels_profile(X) ((X)->vec[(X)->size - 1])
 
 
-int aa_label_next_confined(struct aa_label *l, int i);
+int aa_label_next_confined(const struct aa_label *l, int i);
 
 /* for each profile in a label */
 #define label_for_each(I, L, P)						\
@@ -246,12 +246,12 @@ int aa_label_next_confined(struct aa_label *l, int i);
 #define fn_for_each_not_in_set(L1, L2, P, FN)				\
 	fn_for_each2_XXX((L1), (L2), P, FN, _not_in_set)
 
-static inline bool label_mediates(struct aa_label *L, unsigned char C)
+static inline bool label_mediates(const struct aa_label *L, unsigned char C)
 {
 	return (L)->mediates & (((u64) 1) << (C));
 }
 
-static inline bool label_mediates_safe(struct aa_label *L, unsigned char C)
+static inline bool label_mediates_safe(const struct aa_label *L, unsigned char C)
 {
 	if (C > AA_CLASS_LAST)
 		return false;
@@ -268,11 +268,12 @@ void aa_label_kref(struct kref *kref);
 bool aa_label_init(struct aa_label *label, int size, gfp_t gfp);
 struct aa_label *aa_label_alloc(int size, struct aa_proxy *proxy, gfp_t gfp);
 
-bool aa_label_is_subset(struct aa_label *set, struct aa_label *sub);
-bool aa_label_is_unconfined_subset(struct aa_label *set, struct aa_label *sub);
+bool aa_label_is_subset(const struct aa_label *set, const struct aa_label *sub);
+bool aa_label_is_unconfined_subset(const struct aa_label *set,
+				   const struct aa_label *sub);
 struct aa_profile *__aa_label_next_not_in_set(struct label_it *I,
-					     struct aa_label *set,
-					     struct aa_label *sub);
+					     const struct aa_label *set,
+					     const struct aa_label *sub);
 bool aa_label_remove(struct aa_label *label);
 struct aa_label *aa_label_insert(struct aa_labelset *ls, struct aa_label *l);
 bool aa_label_replace(struct aa_label *old, struct aa_label *new);
@@ -280,8 +281,8 @@ bool aa_label_make_newest(struct aa_labelset *ls, struct aa_label *old,
 			  struct aa_label *new);
 
 struct aa_profile *aa_label_next_in_merge(struct label_it *I,
-					  struct aa_label *a,
-					  struct aa_label *b);
+					  const struct aa_label *a,
+					  const struct aa_label *b);
 struct aa_label *aa_label_find_merge(struct aa_label *a, struct aa_label *b);
 struct aa_label *aa_label_merge(struct aa_label *a, struct aa_label *b,
 				gfp_t gfp);
@@ -462,8 +463,8 @@ static inline void aa_put_label(struct aa_label *l)
 }
 
 /* wrapper fn to indicate semantics of the check */
-static inline bool __aa_subj_label_is_cached(struct aa_label *subj_label,
-					  struct aa_label *obj_label)
+static inline bool __aa_subj_label_is_cached(const struct aa_label *subj_label,
+					  const struct aa_label *obj_label)
 {
 	return aa_label_is_subset(obj_label, subj_label);
 }
diff --git a/security/apparmor/label.c b/security/apparmor/label.c
index c95488b0b55c..82742a471055 100644
--- a/security/apparmor/label.c
+++ b/security/apparmor/label.c
@@ -165,7 +165,8 @@ static int profile_cmp(struct aa_profile *a, struct aa_profile *b)
  *          ==0 if @a == @b
  *          >0  if @a > @b
  */
-static int vec_cmp(struct aa_profile **a, int an, struct aa_profile **b, int bn)
+static int vec_cmp(struct aa_profile * const *a, int an,
+		   struct aa_profile * const *b, int bn)
 {
 	int i;
 
@@ -473,7 +474,7 @@ fail:
  *          ==0 if a == b
  *          >0  if a > b
  */
-static int label_cmp(struct aa_label *a, struct aa_label *b)
+static int label_cmp(const struct aa_label *a, const struct aa_label *b)
 {
 	AA_BUG(!b);
 
@@ -484,7 +485,7 @@ static int label_cmp(struct aa_label *a, struct aa_label *b)
 }
 
 /* helper fn for label_for_each_confined */
-int aa_label_next_confined(struct aa_label *label, int i)
+int aa_label_next_confined(const struct aa_label *label, int i)
 {
 	AA_BUG(!label);
 	AA_BUG(i < 0);
@@ -507,8 +508,8 @@ int aa_label_next_confined(struct aa_label *label, int i)
  *     else NULL if @sub is a subset of @set
  */
 struct aa_profile *__aa_label_next_not_in_set(struct label_it *I,
-					      struct aa_label *set,
-					      struct aa_label *sub)
+					      const struct aa_label *set,
+					      const struct aa_label *sub)
 {
 	AA_BUG(!set);
 	AA_BUG(!I);
@@ -544,7 +545,7 @@ struct aa_profile *__aa_label_next_not_in_set(struct label_it *I,
  * Returns: true if @sub is subset of @set
  *     else false
  */
-bool aa_label_is_subset(struct aa_label *set, struct aa_label *sub)
+bool aa_label_is_subset(const struct aa_label *set, const struct aa_label *sub)
 {
 	struct label_it i = { };
 
@@ -571,7 +572,8 @@ bool aa_label_is_subset(struct aa_label *set, struct aa_label *sub)
  * Returns: true if @sub is special_subset of @set
  *     else false
  */
-bool aa_label_is_unconfined_subset(struct aa_label *set, struct aa_label *sub)
+bool aa_label_is_unconfined_subset(const struct aa_label *set,
+				   const struct aa_label *sub)
 {
 	struct label_it i = { };
 	struct aa_profile *p;
@@ -991,8 +993,8 @@ struct aa_label *aa_label_insert(struct aa_labelset *ls, struct aa_label *label)
  *     else null if no more profiles
  */
 struct aa_profile *aa_label_next_in_merge(struct label_it *I,
-					  struct aa_label *a,
-					  struct aa_label *b)
+					  const struct aa_label *a,
+					  const struct aa_label *b)
 {
 	AA_BUG(!a);
 	AA_BUG(!b);