Re: [PATCH] keys: trusted: dcp: Make dcp_trusted_key_ops const
From: Jarkko Sakkinen <jarkko@kernel.org>
Date: 2026-06-22 15:24:15
Also in:
keyrings, linux-integrity
On Sun, Jun 21, 2026 at 09:05:40PM -0400, Berkay Yürekli wrote:
Mark the dcp_trusted_key_ops structure as const to improve kernel self-protection. This structure contains function pointers that are initialized once during module initialization and never modified. Making function pointers read-only protects against memory corruption attacks where an attacker might overwrite these pointers to redirect execution flow, as recommended in Documentation/security/self-protection.rst. Signed-off-by: mcss <redacted>
full name please
quoted hunk
--- include/keys/trusted_dcp.h | 2 +- security/keys/trusted-keys/trusted_dcp.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)diff --git a/include/keys/trusted_dcp.h b/include/keys/trusted_dcp.h index 9aaa42075b40..8ee24f2d21ff 100644 --- a/include/keys/trusted_dcp.h +++ b/include/keys/trusted_dcp.h@@ -6,6 +6,6 @@#ifndef TRUSTED_DCP_H #define TRUSTED_DCP_H -extern struct trusted_key_ops dcp_trusted_key_ops; +extern const struct trusted_key_ops dcp_trusted_key_ops; #endifdiff --git a/security/keys/trusted-keys/trusted_dcp.c b/security/keys/trusted-keys/trusted_dcp.c index 7b6eb655df0c..f638078640f9 100644--- a/security/keys/trusted-keys/trusted_dcp.c +++ b/security/keys/trusted-keys/trusted_dcp.c@@ -347,7 +347,7 @@ static void trusted_dcp_exit(void)unregister_key_type(&key_type_trusted); } -struct trusted_key_ops dcp_trusted_key_ops = { +const struct trusted_key_ops dcp_trusted_key_ops = { .exit = trusted_dcp_exit, .init = trusted_dcp_init, .seal = trusted_dcp_seal, -- 2.54.0
BR, Jarkko