Messages in this thread Patch in this message | | | Date | Fri, 9 Jan 2009 16:52:36 -0600 | From | "Serge E. Hallyn" <> | Subject | [PATCH 2/4] keys: consider user namespace in key_permission |
| |
If a key is owned by another user namespace, then treat the key as though it is owned by both another uid and gid.
Signed-off-by: Serge E. Hallyn <serue@us.ibm.com> --- security/keys/permission.c | 5 +++++ 1 files changed, 5 insertions(+), 0 deletions(-)
diff --git a/security/keys/permission.c b/security/keys/permission.c index 5d9fc7b..0ed802c 100644 --- a/security/keys/permission.c +++ b/security/keys/permission.c @@ -35,6 +35,9 @@ int key_task_permission(const key_ref_t key_ref, const struct cred *cred, key = key_ref_to_ptr(key_ref); + if (key->user->user_ns != cred->user->user_ns) + goto use_other_perms; + /* use the second 8-bits of permissions for keys the caller owns */ if (key->uid == cred->fsuid) { kperm = key->perm >> 16; @@ -56,6 +59,8 @@ int key_task_permission(const key_ref_t key_ref, const struct cred *cred, } } +use_other_perms: + /* otherwise use the least-significant 8-bits */ kperm = key->perm; -- 1.5.4.3
| |