diff options
| author | David Howells <dhowells@redhat.com> | 2019-06-26 21:02:32 +0100 |
|---|---|---|
| committer | David Howells <dhowells@redhat.com> | 2019-06-26 21:02:32 +0100 |
| commit | 0f44e4d976f96c6439da0d6717238efa4b91196e (patch) | |
| tree | 3cec4bc4ef3faa4e61058e3aff066a7bec1c9d37 /include/linux/user_namespace.h | |
| parent | b206f281d0ee14969878469816a69db22d5838e8 (diff) | |
keys: Move the user and user-session keyrings to the user_namespace
Move the user and user-session keyrings to the user_namespace struct rather
than pinning them from the user_struct struct. This prevents these
keyrings from propagating across user-namespaces boundaries with regard to
the KEY_SPEC_* flags, thereby making them more useful in a containerised
environment.
The issue is that a single user_struct may be represent UIDs in several
different namespaces.
The way the patch does this is by attaching a 'register keyring' in each
user_namespace and then sticking the user and user-session keyrings into
that. It can then be searched to retrieve them.
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Jann Horn <jannh@google.com>
Diffstat (limited to 'include/linux/user_namespace.h')
| -rw-r--r-- | include/linux/user_namespace.h | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h index 90457015fa3f..fb9f4f799554 100644 --- a/include/linux/user_namespace.h +++ b/include/linux/user_namespace.h @@ -65,14 +65,19 @@ struct user_namespace { unsigned long flags; #ifdef CONFIG_KEYS - /* List of joinable keyrings in this namespace */ + /* List of joinable keyrings in this namespace. Modification access of + * these pointers is controlled by keyring_sem. Once + * user_keyring_register is set, it won't be changed, so it can be + * accessed directly with READ_ONCE(). + */ struct list_head keyring_name_list; + struct key *user_keyring_register; + struct rw_semaphore keyring_sem; #endif /* Register of per-UID persistent keyrings for this namespace */ #ifdef CONFIG_PERSISTENT_KEYRINGS struct key *persistent_keyring_register; - struct rw_semaphore persistent_keyring_register_sem; #endif struct work_struct work; #ifdef CONFIG_SYSCTL |