Keyring names are held in a single global list that any process can pick from by means of keyctl_join_session_keyring (provided the keyring grants Search permission). This isn't very container friendly, however. Make the following changes: (1) Make default session, process and thread keyring names begin with a '.' instead of '_'. (2) Keyrings whose names begin with a '.' aren't added to the list. Such keyrings are system specials. (3) Replace the global list with per-user_namespace lists. A keyring adds its name to the list for the user_namespace that it is currently in. (4) When a user_namespace is deleted, it just removes itself from the keyring name list. The global keyring_name_lock is retained for accessing the name lists. This allows (4) to work. This can be tested by: # keyctl newring foo @s 995906392 # unshare -U $ keyctl show ... 995906392 --alswrv 65534 65534 \_ keyring: foo ... $ keyctl session foo Joined session keyring: 935622349 As can be seen, a new session keyring was created. The capability bit KEYCTL_CAPS1_NS_KEYRING_NAME is set if the kernel is employing this feature.
Showing the changes to include/linux (2 of 7 files). Show all
Unified · Split
| @@ -361,6 +361,7 @@ extern void key_set_timeout(struct key *, unsigned); · 360 unmodified lines | |||
| 361 | 361 | ||
| 362 | extern key_ref_t lookup_user_key(key_serial_t id, unsigned long flags, | 362 | extern key_ref_t lookup_user_key(key_serial_t id, unsigned long flags, |
| 363 | key_perm_t perm); | 363 | key_perm_t perm); |
| 364 | extern void key_free_user_ns(struct user_namespace *); | ||
| 364 | 365 | ||
| 365 | /* | 366 | /* |
| 366 | * The permissions required on a key that we're looking up. | 367 | * The permissions required on a key that we're looking up. |
| @@ -434,6 +435,7 @@ extern void key_init(void); · 67 unmodified lines | |||
| 434 | #define key_fsuid_changed(c) do { } while(0) | 435 | #define key_fsuid_changed(c) do { } while(0) |
| 435 | #define key_fsgid_changed(c) do { } while(0) | 436 | #define key_fsgid_changed(c) do { } while(0) |
| 436 | #define key_init() do { } while(0) | 437 | #define key_init() do { } while(0) |
| 438 | #define key_free_user_ns(ns) do { } while(0) | ||
| 437 | 439 | ||
| 438 | #endif /* CONFIG_KEYS */ | 440 | #endif /* CONFIG_KEYS */ |
| 439 | #endif /* __KERNEL__ */ | 441 | #endif /* __KERNEL__ */ |
| @@ -64,6 +64,11 @@ struct user_namespace { · 63 unmodified lines | |||
| 64 | struct ns_common ns; | 64 | struct ns_common ns; |
| 65 | unsigned long flags; | 65 | unsigned long flags; |
| 66 | 66 | ||
| 67 | #ifdef CONFIG_KEYS | ||
| 68 | /* List of joinable keyrings in this namespace */ | ||
| 69 | struct list_head keyring_name_list; | ||
| 70 | #endif | ||
| 71 | |||
| 67 | /* Register of per-UID persistent keyrings for this namespace */ | 72 | /* Register of per-UID persistent keyrings for this namespace */ |
| 68 | #ifdef CONFIG_PERSISTENT_KEYRINGS | 73 | #ifdef CONFIG_PERSISTENT_KEYRINGS |
| 69 | struct key *persistent_keyring_register; | 74 | struct key *persistent_keyring_register; |