diff options
| author | David Howells <dhowells@redhat.com> | 2019-06-26 22:02:32 +0200 |
|---|---|---|
| committer | David Howells <dhowells@redhat.com> | 2019-06-26 22:02:32 +0200 |
| commit | b206f281d0ee14969878469816a69db22d5838e8 (patch) | |
| tree | 56828bdaec25c05d6b4126196276bf969d056929 /kernel/user.c | |
| parent | keys: Add a 'recurse' flag for keyring searches (diff) | |
| download | linux-b206f281d0ee14969878469816a69db22d5838e8.tar.xz linux-b206f281d0ee14969878469816a69db22d5838e8.zip | |
keys: Namespace keyring names
Keyring names are held in a single global list that any process can pick
from by means of keyctl_join_session_keyring (provided the keyring grants
Search permission). This isn't very container friendly, however.
Make the following changes:
(1) Make default session, process and thread keyring names begin with a
'.' instead of '_'.
(2) Keyrings whose names begin with a '.' aren't added to the list. Such
keyrings are system specials.
(3) Replace the global list with per-user_namespace lists. A keyring adds
its name to the list for the user_namespace that it is currently in.
(4) When a user_namespace is deleted, it just removes itself from the
keyring name list.
The global keyring_name_lock is retained for accessing the name lists.
This allows (4) to work.
This can be tested by:
# keyctl newring foo @s
995906392
# unshare -U
$ keyctl show
...
995906392 --alswrv 65534 65534 \_ keyring: foo
...
$ keyctl session foo
Joined session keyring: 935622349
As can be seen, a new session keyring was created.
The capability bit KEYCTL_CAPS1_NS_KEYRING_NAME is set if the kernel is
employing this feature.
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Eric W. Biederman <ebiederm@xmission.com>
Diffstat (limited to 'kernel/user.c')
| -rw-r--r-- | kernel/user.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/kernel/user.c b/kernel/user.c index 88b834f0eebc..50979fd1b7aa 100644 --- a/kernel/user.c +++ b/kernel/user.c @@ -62,6 +62,9 @@ struct user_namespace init_user_ns = { .ns.ops = &userns_operations, #endif .flags = USERNS_INIT_FLAGS, +#ifdef CONFIG_KEYS + .keyring_name_list = LIST_HEAD_INIT(init_user_ns.keyring_name_list), +#endif #ifdef CONFIG_PERSISTENT_KEYRINGS .persistent_keyring_register_sem = __RWSEM_INITIALIZER(init_user_ns.persistent_keyring_register_sem), |