> We would like to be able to make a const pointer a guarantee that nothing that receives the pointer may write to the resulting memory. This allows const pointers to be passed across security-domain boundaries.
I've always wished that were the case too. It would also allow the compiler more optimization opportunities, because it could assume that a call to f(&x) will not change x unless a non-const pointer to x has escaped.
> Container describes behavior in a macro common in the Linux, BSD, and Windows kernels that, given a pointer to a structure member, returns a pointer to the enclosing structure [20]. This may or may not be permitted behavior according to the standard, due to the ambiguous definition of ‘object’.
I'm not sure what interpretation of the C standard would disallow this. For the initial member of a structure it seems particularly clear-cut that it is allowed:
C99, 6.7.2.1.13:
"A pointer to a structure object, suitably converted, points to its initial member (or if that member is a bit-field, then to the unit in which it resides), and vice versa. There may be unnamed padding within a structure object, but not at its beginning."
This seems to pretty unambiguously state that you can convert a pointer to an initial member to a pointer to the enclosing struct. I can't imagine what interpretation of the standard would disallow this, or even disallow using offsetof() to convert a non-first member to a pointer to the struct.