diff options
| author | David Howells <dhowells@redhat.com> | 2019-06-26 23:02:32 +0300 |
|---|---|---|
| committer | David Howells <dhowells@redhat.com> | 2019-06-26 23:02:32 +0300 |
| commit | 0f44e4d976f96c6439da0d6717238efa4b91196e (patch) | |
| tree | 3cec4bc4ef3faa4e61058e3aff066a7bec1c9d37 /security/keys/persistent.c | |
| parent | b206f281d0ee14969878469816a69db22d5838e8 (diff) | |
| download | linux-0f44e4d976f96c6439da0d6717238efa4b91196e.tar.xz | |
keys: Move the user and user-session keyrings to the user_namespace
Move the user and user-session keyrings to the user_namespace struct rather
than pinning them from the user_struct struct. This prevents these
keyrings from propagating across user-namespaces boundaries with regard to
the KEY_SPEC_* flags, thereby making them more useful in a containerised
environment.
The issue is that a single user_struct may be represent UIDs in several
different namespaces.
The way the patch does this is by attaching a 'register keyring' in each
user_namespace and then sticking the user and user-session keyrings into
that. It can then be searched to retrieve them.
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Jann Horn <jannh@google.com>
Diffstat (limited to 'security/keys/persistent.c')
| -rw-r--r-- | security/keys/persistent.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/security/keys/persistent.c b/security/keys/persistent.c index fc29ec59efa7..90303fe4a394 100644 --- a/security/keys/persistent.c +++ b/security/keys/persistent.c @@ -91,9 +91,9 @@ static long key_get_persistent(struct user_namespace *ns, kuid_t uid, if (ns->persistent_keyring_register) { reg_ref = make_key_ref(ns->persistent_keyring_register, true); - down_read(&ns->persistent_keyring_register_sem); + down_read(&ns->keyring_sem); persistent_ref = find_key_to_update(reg_ref, &index_key); - up_read(&ns->persistent_keyring_register_sem); + up_read(&ns->keyring_sem); if (persistent_ref) goto found; @@ -102,9 +102,9 @@ static long key_get_persistent(struct user_namespace *ns, kuid_t uid, /* It wasn't in the register, so we'll need to create it. We might * also need to create the register. */ - down_write(&ns->persistent_keyring_register_sem); + down_write(&ns->keyring_sem); persistent_ref = key_create_persistent(ns, uid, &index_key); - up_write(&ns->persistent_keyring_register_sem); + up_write(&ns->keyring_sem); if (!IS_ERR(persistent_ref)) goto found; |