This adds a helper for apparmor sysctls to allow world-read, root-write
unsigned integer sysctls. This is used by the next patch in the series.
Signed-off-by: Ryan Lee <ryan....@canonical.com>
---
security/apparmor/lsm.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index 9b086451f6e3..b9a92e500242 100644
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -2404,6 +2404,17 @@ static int apparmor_dointvec(struct ctl_table *table,
int write,
return proc_dointvec(table, write, buffer, lenp, ppos);
}
+static int apparmor_can_read_douintvec(struct ctl_table *table, int write,
+ void *buffer, size_t *lenp, loff_t *ppos)
+{
+ if (!apparmor_enabled)
+ return -EINVAL;
+ if (write && !aa_current_policy_admin_capable(NULL))
+ return -EPERM;
+
+ return proc_douintvec(table, write, buffer, lenp, ppos);
+}
+
static int userns_restrict_dointvec(struct ctl_table *table, int write,
void *buffer, size_t *lenp, loff_t *ppos)
{
--
Note: if the sysctl approach is not taken, this patch should be dropped.
