apparmor: constify aa_profile parameters on read-only compute paths

A number of functions take a struct aa_profile * argument that is only
ever read from: they compute DFA matches or apply the profile's mode
flags without modifying the profile, taking a reference on it, or
touching its embedded label. Mark those parameters const struct
aa_profile * to document intent and let the compiler enforce it.

The converted functions are the permission "compute" path plus a few
pure readers:
  - aa_apply_modes_to_perms(), aa_profile_match_label()
  - AUDIT_MODE()
  - aa_label_match() and its match_component()/label_compound_match()/
    label_components_match() helpers (label.c)
  - match_component()/label_compound_match()/label_components_match()/
    label_match()/change_profile_perms()/aa_xattrs_match() (domain.c)
  - match_iface()/match_addr_iface()/match_addr_iface_label()/
    skb_match_to_sk()/skb_match_to_cmd() (af_inet.c)
  - aa_profile_capget(), path_flags(), profile_query_cb()

The remaining aa_profile * parameters cannot be made const: the audit
path stores &profile->label into the owned, refcounted
apparmor_audit_data.subj_label/peer fields, and the domain/lifecycle
paths take references on the profile's embedded label
(aa_get_label()/aa_get_newest_label()/aa_get_profile()) or write
profile fields.

No functional change.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Assisted-by: Claude:claude-opus-4.8

10 files changed, 25 insertions, 23 deletions

diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c
index 22317817d1f5..5b42140e12e8 100644
--- a/security/apparmor/apparmorfs.c
+++ b/security/apparmor/apparmorfs.c
@@ -856,7 +856,8 @@ static const struct file_operations aa_fs_ns_revision_fops = {
 	.release	= ns_revision_release,
 };
 
-static void profile_query_cb(struct aa_profile *profile, struct aa_perms *perms,
+static void profile_query_cb(const struct aa_profile *profile,
+			     struct aa_perms *perms,
 			     const char *match_str, size_t match_len)
 {
 	struct aa_ruleset *rules = profile->label.rules[0];
diff --git a/security/apparmor/capability.c b/security/apparmor/capability.c
index b9ea6bc45c1a..2f3c6c84358d 100644
--- a/security/apparmor/capability.c
+++ b/security/apparmor/capability.c
@@ -191,7 +191,7 @@ int aa_capable(const struct cred *subj_cred, struct aa_label *label,
 	return error;
 }
 
-kernel_cap_t aa_profile_capget(struct aa_profile *profile)
+kernel_cap_t aa_profile_capget(const struct aa_profile *profile)
 {
 	struct aa_ruleset *rules = profile->label.rules[0];
 	aa_state_t state;
diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c
index 3b80db6663ad..e20d177a4357 100644
--- a/security/apparmor/domain.c
+++ b/security/apparmor/domain.c
@@ -91,8 +91,8 @@ out:
  * If a subns profile is not to be matched should be prescreened with
  * visibility test.
  */
-static inline aa_state_t match_component(struct aa_profile *profile,
-					 struct aa_profile *tp,
+static inline aa_state_t match_component(const struct aa_profile *profile,
+					 const struct aa_profile *tp,
 					 bool stack, aa_state_t state)
 {
 	struct aa_ruleset *rules = profile->label.rules[0];
@@ -127,7 +127,7 @@ static inline aa_state_t match_component(struct aa_profile *profile,
  * @perms should be preinitialized with allperms OR a previous permission
  *        check to be stacked.
  */
-static int label_compound_match(struct aa_profile *profile,
+static int label_compound_match(const struct aa_profile *profile,
 				struct aa_label *label, bool stack,
 				aa_state_t state, bool inview, u32 request,
 				struct aa_perms *perms)
@@ -189,7 +189,7 @@ fail:
  * @perms should be preinitialized with allperms OR a previous permission
  *        check to be stacked.
  */
-static int label_components_match(struct aa_profile *profile,
+static int label_components_match(const struct aa_profile *profile,
 				  struct aa_label *label, bool stack,
 				  aa_state_t start, bool inview, u32 request,
 				  struct aa_perms *perms)
@@ -253,7 +253,7 @@ fail:
  *
  * Returns: the state the match finished in, may be the none matching state
  */
-static int label_match(struct aa_profile *profile, struct aa_label *label,
+static int label_match(const struct aa_profile *profile, struct aa_label *label,
 		       bool stack, aa_state_t state, bool inview, u32 request,
 		       struct aa_perms *perms)
 {
@@ -287,7 +287,7 @@ static int label_match(struct aa_profile *profile, struct aa_label *label,
  * currently only matches full label A//&B//&C or individual components A, B, C
  * not arbitrary combinations. Eg. A//&B, C
  */
-static int change_profile_perms(struct aa_profile *profile,
+static int change_profile_perms(const struct aa_profile *profile,
 				struct aa_label *target, bool stack,
 				u32 request, aa_state_t start,
 				struct aa_perms *perms)
@@ -311,7 +311,7 @@ static int change_profile_perms(struct aa_profile *profile,
  * Returns: number of extended attributes that matched, or < 0 on error
  */
 static int aa_xattrs_match(const struct path *path,
-			   struct aa_profile *profile, aa_state_t state)
+			   const struct aa_profile *profile, aa_state_t state)
 {
 	AA_BUG(!path);
 	AA_BUG(!profile);
@@ -319,7 +319,7 @@ static int aa_xattrs_match(const struct path *path,
 	int i;
 	struct dentry *d;
 	char *value = NULL;
-	struct aa_attachment *attach = &profile->attach;
+	const struct aa_attachment *attach = &profile->attach;
 	int size, value_size = 0, ret = attach->xattr_count;
 
 	if (!attach->xattr_count)
diff --git a/security/apparmor/include/capability.h b/security/apparmor/include/capability.h
index 3fb8b8f2182a..89a9c75d8f44 100644
--- a/security/apparmor/include/capability.h
+++ b/security/apparmor/include/capability.h
@@ -37,7 +37,7 @@ struct aa_caps {
 
 extern struct aa_sfs_entry aa_sfs_entry_caps[];
 
-kernel_cap_t aa_profile_capget(struct aa_profile *profile);
+kernel_cap_t aa_profile_capget(const struct aa_profile *profile);
 int aa_capable(const struct cred *subj_cred, struct aa_label *label,
 	       int cap, unsigned int opts);
 
diff --git a/security/apparmor/include/label.h b/security/apparmor/include/label.h
index 37cb135de323..eb2240173ba3 100644
--- a/security/apparmor/include/label.h
+++ b/security/apparmor/include/label.h
@@ -342,7 +342,7 @@ static inline const char *aa_label_str_split(const char *str)
 
 struct aa_perms;
 struct aa_ruleset;
-int aa_label_match(struct aa_profile *profile, struct aa_ruleset *rules,
+int aa_label_match(const struct aa_profile *profile, struct aa_ruleset *rules,
 		   struct aa_label *label, aa_state_t state, bool subns,
 		   u32 request, struct aa_perms *perms);
 
diff --git a/security/apparmor/include/perms.h b/security/apparmor/include/perms.h
index 65ca3f30b4c2..ee25eb8e78e4 100644
--- a/security/apparmor/include/perms.h
+++ b/security/apparmor/include/perms.h
@@ -206,11 +206,11 @@ void aa_audit_perm_names(struct audit_buffer *ab, const char * const *names,
 			 u32 mask);
 void aa_audit_perm_mask(struct audit_buffer *ab, u32 mask, const char *chrs,
 			u32 chrsmask, const char * const *names, u32 namesmask);
-void aa_apply_modes_to_perms(struct aa_profile *profile,
+void aa_apply_modes_to_perms(const struct aa_profile *profile,
 			     struct aa_perms *perms);
 void aa_perms_accum(struct aa_perms *accum, const struct aa_perms *addend);
 void aa_perms_accum_raw(struct aa_perms *accum, const struct aa_perms *addend);
-void aa_profile_match_label(struct aa_profile *profile,
+void aa_profile_match_label(const struct aa_profile *profile,
 			    struct aa_ruleset *rules, struct aa_label *label,
 			    int type, u32 request, struct aa_perms *perms);
 int aa_check_perms(struct aa_profile *profile, const struct aa_perms *perms,
diff --git a/security/apparmor/include/policy.h b/security/apparmor/include/policy.h
index eae9db08fb93..23b9f0e5df3c 100644
--- a/security/apparmor/include/policy.h
+++ b/security/apparmor/include/policy.h
@@ -433,7 +433,7 @@ static inline void aa_put_profile(struct aa_profile *p)
 		kref_put(&p->label.count.count, aa_label_kref);
 }
 
-static inline int AUDIT_MODE(struct aa_profile *profile)
+static inline int AUDIT_MODE(const struct aa_profile *profile)
 {
 	if (aa_g_audit != AUDIT_NORMAL)
 		return aa_g_audit;
diff --git a/security/apparmor/label.c b/security/apparmor/label.c
index 32efef2f617a..c95488b0b55c 100644
--- a/security/apparmor/label.c
+++ b/security/apparmor/label.c
@@ -1290,9 +1290,9 @@ out:
  * If a subns profile is not to be matched should be prescreened with
  * visibility test.
  */
-static inline aa_state_t match_component(struct aa_profile *profile,
+static inline aa_state_t match_component(const struct aa_profile *profile,
 					 struct aa_ruleset *rules,
-					 struct aa_profile *tp,
+					 const struct aa_profile *tp,
 					 aa_state_t state)
 {
 	const char *ns_name;
@@ -1324,7 +1324,7 @@ static inline aa_state_t match_component(struct aa_profile *profile,
  * @perms should be preinitialized with allperms OR a previous permission
  *        check to be stacked.
  */
-static int label_compound_match(struct aa_profile *profile,
+static int label_compound_match(const struct aa_profile *profile,
 				struct aa_ruleset *rules,
 				struct aa_label *label,
 				aa_state_t state, bool inview, u32 request,
@@ -1380,7 +1380,7 @@ fail:
  * @perms should be preinitialized with allperms OR a previous permission
  *        check to be stacked.
  */
-static int label_components_match(struct aa_profile *profile,
+static int label_components_match(const struct aa_profile *profile,
 				  struct aa_ruleset *rules,
 				  struct aa_label *label, aa_state_t start,
 				  bool inview, u32 request,
@@ -1439,7 +1439,7 @@ fail:
  *
  * Returns: the state the match finished in, may be the none matching state
  */
-int aa_label_match(struct aa_profile *profile, struct aa_ruleset *rules,
+int aa_label_match(const struct aa_profile *profile, struct aa_ruleset *rules,
 		   struct aa_label *label, aa_state_t state, bool inview,
 		   u32 request, struct aa_perms *perms)
 {
diff --git a/security/apparmor/lib.c b/security/apparmor/lib.c
index e6401f291541..e97bb7240e0e 100644
--- a/security/apparmor/lib.c
+++ b/security/apparmor/lib.c
@@ -361,7 +361,8 @@ void aa_audit_perm_mask(struct audit_buffer *ab, u32 mask, const char *chrs,
  *
  * TODO: split into profile and ns based flags for when accumulating perms
  */
-void aa_apply_modes_to_perms(struct aa_profile *profile, struct aa_perms *perms)
+void aa_apply_modes_to_perms(const struct aa_profile *profile,
+			     struct aa_perms *perms)
 {
 	if (KILL_MODE(profile))
 		perms->kill = ~perms->allow;
@@ -389,7 +390,7 @@ void aa_apply_modes_to_perms(struct aa_profile *profile, struct aa_perms *perms)
 	}
 }
 
-void aa_profile_match_label(struct aa_profile *profile,
+void aa_profile_match_label(const struct aa_profile *profile,
 			    struct aa_ruleset *rules,
 			    struct aa_label *label,
 			    int type, u32 request, struct aa_perms *perms)
diff --git a/security/apparmor/mount.c b/security/apparmor/mount.c
index 8b920164cd88..84273a3ab150 100644
--- a/security/apparmor/mount.c
+++ b/security/apparmor/mount.c
@@ -211,7 +211,7 @@ static int do_match_mnt(struct aa_policydb *policy, aa_state_t start,
 }
 
 
-static int path_flags(struct aa_profile *profile, const struct path *path)
+static int path_flags(const struct aa_profile *profile, const struct path *path)
 {
 	AA_BUG(!profile);
 	AA_BUG(!path);