If a key is owned by another user namespace, then treat the key as though it is owned by both another uid and gid.
Signed-off-by: Serge E. Hallyn <[email protected]> --- security/keys/permission.c | 5 +++++ 1 files changed, 5 insertions(+), 0 deletions(-) diff --git a/security/keys/permission.c b/security/keys/permission.c index 5d9fc7b..0ed802c 100644 --- a/security/keys/permission.c +++ b/security/keys/permission.c @@ -35,6 +35,9 @@ int key_task_permission(const key_ref_t key_ref, const struct cred *cred, key = key_ref_to_ptr(key_ref); + if (key->user->user_ns != cred->user->user_ns) + goto use_other_perms; + /* use the second 8-bits of permissions for keys the caller owns */ if (key->uid == cred->fsuid) { kperm = key->perm >> 16; @@ -56,6 +59,8 @@ int key_task_permission(const key_ref_t key_ref, const struct cred *cred, } } +use_other_perms: + /* otherwise use the least-significant 8-bits */ kperm = key->perm; -- 1.5.4.3 _______________________________________________ Containers mailing list [email protected] https://lists.linux-foundation.org/mailman/listinfo/containers _______________________________________________ Devel mailing list [email protected] https://openvz.org/mailman/listinfo/devel
