diff options
author | 2019-06-26 21:02:32 +0100 | |
---|---|---|
committer | 2019-06-26 21:02:32 +0100 | |
commit | 0f44e4d976f96c6439da0d6717238efa4b91196e (patch) | |
tree | 3cec4bc4ef3faa4e61058e3aff066a7bec1c9d37 /include/linux/sched | |
parent | keys: Namespace keyring names (diff) | |
download | linux-0f44e4d976f96c6439da0d6717238efa4b91196e.tar.gz linux-0f44e4d976f96c6439da0d6717238efa4b91196e.tar.bz2 linux-0f44e4d976f96c6439da0d6717238efa4b91196e.zip |
keys: Move the user and user-session keyrings to the user_namespace
Move the user and user-session keyrings to the user_namespace struct rather
than pinning them from the user_struct struct. This prevents these
keyrings from propagating across user-namespaces boundaries with regard to
the KEY_SPEC_* flags, thereby making them more useful in a containerised
environment.
The issue is that a single user_struct may be represent UIDs in several
different namespaces.
The way the patch does this is by attaching a 'register keyring' in each
user_namespace and then sticking the user and user-session keyrings into
that. It can then be searched to retrieve them.
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Jann Horn <jannh@google.com>
Diffstat (limited to 'include/linux/sched')
-rw-r--r-- | include/linux/sched/user.h | 14 |
1 files changed, 0 insertions, 14 deletions
diff --git a/include/linux/sched/user.h b/include/linux/sched/user.h index 468d2565a9fe..917d88edb7b9 100644 --- a/include/linux/sched/user.h +++ b/include/linux/sched/user.h @@ -7,8 +7,6 @@ #include <linux/refcount.h> #include <linux/ratelimit.h> -struct key; - /* * Some day this will be a full-fledged user tracking system.. */ @@ -30,18 +28,6 @@ struct user_struct { unsigned long unix_inflight; /* How many files in flight in unix sockets */ atomic_long_t pipe_bufs; /* how many pages are allocated in pipe buffers */ -#ifdef CONFIG_KEYS - /* - * These pointers can only change from NULL to a non-NULL value once. - * Writes are protected by key_user_keyring_mutex. - * Unlocked readers should use READ_ONCE() unless they know that - * install_user_keyrings() has been called successfully (which sets - * these members to non-NULL values, preventing further modifications). - */ - struct key *uid_keyring; /* UID specific keyring */ - struct key *session_keyring; /* UID's default session keyring */ -#endif - /* Hash table maintenance information */ struct hlist_node uidhash_node; kuid_t uid; |