[RFC PATCH 23/39] yama: preserve scope locking with numeric sysctl bounds

[wen . yang]

From: Wen Yang <wen.yang@xxxxxxxxx>

Set the numeric minimum to the maximum when ptrace scope is locked.

Suggested-by: Joel Granados <joel.granados@xxxxxxxxxx>
Signed-off-by: Wen Yang <wen.yang@xxxxxxxxx>
---
 security/yama/yama_lsm.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/security/yama/yama_lsm.c b/security/yama/yama_lsm.c
index cef3776cf3b2..aa4deec29919 100644
--- a/security/yama/yama_lsm.c
+++ b/security/yama/yama_lsm.c
@@ -439,14 +439,12 @@ static int yama_dointvec_minmax(const struct ctl_table *table, int write,
 
 	/* Lock the max value if it ever gets set. */
 	table_copy = *table;
-	if (*(int *)table_copy.data == *(int *)table_copy.extra2)
-		table_copy.extra1 = table_copy.extra2;
+	if (READ_ONCE(*(int *)table_copy.data) == (int)table_copy.max)
+		table_copy.min = table_copy.max;
 
 	return proc_dointvec_minmax(&table_copy, write, buffer, lenp, ppos);
 }
 
-static int max_scope = YAMA_SCOPE_NO_ATTACH;
-
 static const struct ctl_table yama_sysctl_table[] = {
 	{
 		.procname       = "ptrace_scope",
@@ -454,8 +452,8 @@ static const struct ctl_table yama_sysctl_table[] = {
 		.maxlen         = sizeof(int),
 		.mode           = 0644,
 		.proc_handler   = yama_dointvec_minmax,
-		.extra1         = SYSCTL_ZERO,
-		.extra2         = &max_scope,
+		.min		= 0,
+		.max		= YAMA_SCOPE_NO_ATTACH,
 	},
 };
 static void __init yama_init_sysctl(void)
-- 
2.25.1