From f4f76b791afd3bfab64165574a216833210a0ed5 Mon Sep 17 00:00:00 2001 From: Fan Wu Date: Fri, 2 Oct 2026 19:51:30 -0700 Subject: ipe: constify token_default() token_default() does not modify its argument, so make it const. Assisted-by: LLM Signed-off-by: Fan Wu --- security/ipe/policy_parser.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'security') diff --git a/security/ipe/policy_parser.c b/security/ipe/policy_parser.c index 6fa5bebf8471..f1c05e53667f 100644 --- a/security/ipe/policy_parser.c +++ b/security/ipe/policy_parser.c @@ -201,7 +201,7 @@ out: * * %false - The token is not "DEFAULT" * * %true - The token is "DEFAULT" */ -static bool token_default(char *token) +static bool token_default(const char *token) { return !strcmp(token, "DEFAULT"); } -- cgit v1.2.3 From e4933dbcb7eccf98ecb059d9b740420a477b1520 Mon Sep 17 00:00:00 2001 From: Fan Wu Date: Fri, 2 Oct 2026 19:51:31 -0700 Subject: ipe: use designated initializers for audit name tables The audit name tables are indexed by enum values but initialized positionally. Adding an enum value in the middle can associate the following names with the wrong values. Use designated initializers to bind each name to its enum value. No functional changes. Assisted-by: LLM Signed-off-by: Fan Wu --- security/ipe/audit.c | 44 ++++++++++++++++++++++---------------------- 1 file changed, 22 insertions(+), 22 deletions(-) (limited to 'security') diff --git a/security/ipe/audit.c b/security/ipe/audit.c index 93fb59fbddd6..5b4f24914c74 100644 --- a/security/ipe/audit.c +++ b/security/ipe/audit.c @@ -34,34 +34,34 @@ "new_policy_digest=" IPE_AUDIT_HASH_ALG ":" static const char *const audit_op_names[__IPE_OP_MAX + 1] = { - "EXECUTE", - "FIRMWARE", - "KMODULE", - "KEXEC_IMAGE", - "KEXEC_INITRAMFS", - "POLICY", - "X509_CERT", - "UNKNOWN", + [IPE_OP_EXEC] = "EXECUTE", + [IPE_OP_FIRMWARE] = "FIRMWARE", + [IPE_OP_KERNEL_MODULE] = "KMODULE", + [IPE_OP_KEXEC_IMAGE] = "KEXEC_IMAGE", + [IPE_OP_KEXEC_INITRAMFS] = "KEXEC_INITRAMFS", + [IPE_OP_POLICY] = "POLICY", + [IPE_OP_X509] = "X509_CERT", + [IPE_OP_INVALID] = "UNKNOWN", }; static const char *const audit_hook_names[__IPE_HOOK_MAX] = { - "BPRM_CHECK", - "BPRM_CREDS_FOR_EXEC", - "MMAP", - "MPROTECT", - "KERNEL_READ", - "KERNEL_LOAD", + [IPE_HOOK_BPRM_CHECK] = "BPRM_CHECK", + [IPE_HOOK_BPRM_CREDS_FOR_EXEC] = "BPRM_CREDS_FOR_EXEC", + [IPE_HOOK_MMAP] = "MMAP", + [IPE_HOOK_MPROTECT] = "MPROTECT", + [IPE_HOOK_KERNEL_READ] = "KERNEL_READ", + [IPE_HOOK_KERNEL_LOAD] = "KERNEL_LOAD", }; static const char *const audit_prop_names[__IPE_PROP_MAX] = { - "boot_verified=FALSE", - "boot_verified=TRUE", - "dmverity_roothash=", - "dmverity_signature=FALSE", - "dmverity_signature=TRUE", - "fsverity_digest=", - "fsverity_signature=FALSE", - "fsverity_signature=TRUE", + [IPE_PROP_BOOT_VERIFIED_FALSE] = "boot_verified=FALSE", + [IPE_PROP_BOOT_VERIFIED_TRUE] = "boot_verified=TRUE", + [IPE_PROP_DMV_ROOTHASH] = "dmverity_roothash=", + [IPE_PROP_DMV_SIG_FALSE] = "dmverity_signature=FALSE", + [IPE_PROP_DMV_SIG_TRUE] = "dmverity_signature=TRUE", + [IPE_PROP_FSV_DIGEST] = "fsverity_digest=", + [IPE_PROP_FSV_SIG_FALSE] = "fsverity_signature=FALSE", + [IPE_PROP_FSV_SIG_TRUE] = "fsverity_signature=TRUE", }; /** -- cgit v1.2.3 From 6adc404a9867eee83e9555eac36dfd0066fa3839 Mon Sep 17 00:00:00 2001 From: Fan Wu Date: Fri, 2 Oct 2026 19:51:32 -0700 Subject: ipe: check parser token table sizes The parser token tables contain one entry for each enum value followed by a terminator. Add static assertions so adding an enum value without a corresponding token fails the build. Assisted-by: LLM Signed-off-by: Fan Wu --- security/ipe/policy_parser.c | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'security') diff --git a/security/ipe/policy_parser.c b/security/ipe/policy_parser.c index f1c05e53667f..309a61594e1d 100644 --- a/security/ipe/policy_parser.c +++ b/security/ipe/policy_parser.c @@ -128,6 +128,8 @@ static const match_table_t header_tokens = { {__IPE_HEADER_MAX, NULL} }; +static_assert(ARRAY_SIZE(header_tokens) == __IPE_HEADER_MAX + 1); + /** * parse_header() - Parse policy header information. * @line: Supplies header line to be parsed. @@ -240,6 +242,8 @@ static const match_table_t operation_tokens = { {IPE_OP_INVALID, NULL} }; +static_assert(ARRAY_SIZE(operation_tokens) == __IPE_OP_MAX + 1); + /** * parse_operation() - Parse the operation type given a token string. * @t: Supplies the token string to be parsed. @@ -259,6 +263,8 @@ static const match_table_t action_tokens = { {IPE_ACTION_INVALID, NULL} }; +static_assert(ARRAY_SIZE(action_tokens) == __IPE_ACTION_MAX + 1); + /** * parse_action() - Parse the action type given a token string. * @t: Supplies the token string to be parsed. @@ -284,6 +290,8 @@ static const match_table_t property_tokens = { {IPE_PROP_INVALID, NULL} }; +static_assert(ARRAY_SIZE(property_tokens) == __IPE_PROP_MAX + 1); + /** * parse_property() - Parse a rule property given a token string. * @t: Supplies the token string to be parsed. -- cgit v1.2.3 From a53d9c9ca5e1ced65f39708f36d06a42672f8ffe Mon Sep 17 00:00:00 2001 From: Fan Wu Date: Fri, 2 Oct 2026 19:51:33 -0700 Subject: ipe: correct policy text ownership comment Policy text is separately allocated only when p->pkcs7 is NULL. Correct the comment to match the existing free logic. No functional changes. Assisted-by: LLM Signed-off-by: Fan Wu --- security/ipe/policy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'security') diff --git a/security/ipe/policy.c b/security/ipe/policy.c index 827867be4fac..e542329726bc 100644 --- a/security/ipe/policy.c +++ b/security/ipe/policy.c @@ -52,7 +52,7 @@ void ipe_free_policy(struct ipe_policy *p) ipe_del_policyfs_node(p); ipe_free_parsed_policy(p->parsed); /* - * p->text is allocated only when p->pkcs7 is not NULL + * p->text is allocated only when p->pkcs7 is NULL * otherwise it points to the plaintext data inside the pkcs7 */ if (!p->pkcs7) -- cgit v1.2.3 From 0e5f66bf052223aa5c8caeb8554a7577b54c302f Mon Sep 17 00:00:00 2001 From: Fan Wu Date: Fri, 2 Oct 2026 19:51:34 -0700 Subject: ipe: fix enforcement audit ipe_audit_enforce() starts an audit buffer but writes the state change with audit_log(), which logs its own record. Ending the unused buffer then emits an extra empty AUDIT_MAC_STATUS record. Remove the unused buffer and log the state change with audit_log() alone. Fixes: a68916eaedcd ("ipe: add permissive toggle") Assisted-by: LLM Signed-off-by: Fan Wu --- security/ipe/audit.c | 8 -------- 1 file changed, 8 deletions(-) (limited to 'security') diff --git a/security/ipe/audit.c b/security/ipe/audit.c index 5b4f24914c74..b6f8fb54085a 100644 --- a/security/ipe/audit.c +++ b/security/ipe/audit.c @@ -262,18 +262,10 @@ void ipe_audit_policy_load(const struct ipe_policy *const p) */ void ipe_audit_enforce(bool new_enforce, bool old_enforce) { - struct audit_buffer *ab; - - ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_MAC_STATUS); - if (!ab) - return; - audit_log(audit_context(), GFP_KERNEL, AUDIT_MAC_STATUS, "enforcing=%d old_enforcing=%d auid=%u ses=%u" " enabled=1 old-enabled=1 lsm=ipe res=1", new_enforce, old_enforce, from_kuid(&init_user_ns, audit_get_loginuid(current)), audit_get_sessionid(current)); - - audit_log_end(ab); } -- cgit v1.2.3