[apparmor] [RFC, PATCH 2/3] apparmor: Add an apparmor_can_read_douintvec for unsigned int apparmor sysctls

[John Johansen]

On 9/13/24 16:20, Ryan Lee wrote:
> This adds a helper for apparmor sysctls to allow world-read, root-write
> unsigned integer sysctls. This is used by the next patch in the series.
> 
> Signed-off-by: Ryan Lee <ryan.lee at canonical.com>

soft nak as this is a dependency of patch 3/3 and with it not landing
there is no point for this atm.

> ---
>   security/apparmor/lsm.c | 11 +++++++++++
>   1 file changed, 11 insertions(+)
> 
> diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
> index 9b086451f6e3..b9a92e500242 100644
> --- a/security/apparmor/lsm.c
> +++ b/security/apparmor/lsm.c
> @@ -2404,6 +2404,17 @@ static int apparmor_dointvec(struct ctl_table *table, int write,
>   	return proc_dointvec(table, write, buffer, lenp, ppos);
>   }
>   
> +static int apparmor_can_read_douintvec(struct ctl_table *table, int write,
> +			     void *buffer, size_t *lenp, loff_t *ppos)
> +{
> +	if (!apparmor_enabled)
> +		return -EINVAL;
> +	if (write && !aa_current_policy_admin_capable(NULL))
> +		return -EPERM;
> +
> +	return proc_douintvec(table, write, buffer, lenp, ppos);
> +}
> +
>   static int userns_restrict_dointvec(struct ctl_table *table, int write,
>   				    void *buffer, size_t *lenp, loff_t *ppos)
>   {