sysctl: expand use of proc_dointvec_minmax_sysadmin
Several sysctls expect a state where the highest value (in extra2) is
locked once set for that boot. Yama does this, and kptr_restrict should
be doing it. This extracts Yama's logic and adds it to the existing
proc_dointvec_minmax_sysadmin, taking care to avoid the simple boolean
states (which do not get locked). Since Yama wants to be checking a
different capabilities, we build wrappers for both cases (CAP_SYS_ADMIN
and CAP_SYS_PTRACE).
Signed-off-by: Kees Cook <keescook@chromium.org>
4 files changed
