[apparmor] [RFC, PATCH 2/3] apparmor: Add an apparmor_can_read_douintvec for unsigned int apparmor sysctls

[Ryan Lee]

This adds a helper for apparmor sysctls to allow world-read, root-write
unsigned integer sysctls. This is used by the next patch in the series.

Signed-off-by: Ryan Lee <ryan.lee at canonical.com>
---
 security/apparmor/lsm.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index 9b086451f6e3..b9a92e500242 100644
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -2404,6 +2404,17 @@ static int apparmor_dointvec(struct ctl_table *table, int write,
 	return proc_dointvec(table, write, buffer, lenp, ppos);
 }
 
+static int apparmor_can_read_douintvec(struct ctl_table *table, int write,
+			     void *buffer, size_t *lenp, loff_t *ppos)
+{
+	if (!apparmor_enabled)
+		return -EINVAL;
+	if (write && !aa_current_policy_admin_capable(NULL))
+		return -EPERM;
+
+	return proc_douintvec(table, write, buffer, lenp, ppos);
+}
+
 static int userns_restrict_dointvec(struct ctl_table *table, int write,
 				    void *buffer, size_t *lenp, loff_t *ppos)
 {
-- 
Note: if the sysctl approach is not taken, this patch should be dropped.