Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8ff3bc31 authored by Serge E. Hallyn's avatar Serge E. Hallyn Committed by James Morris
Browse files

keys: consider user namespace in key_permission 



If a key is owned by another user namespace, then treat the
key as though it is owned by both another uid and gid.

Signed-off-by: default avatarSerge E. Hallyn <serue@us.ibm.com>
Acked-by: default avatarDavid Howells <dhowells@redhat.com>
Signed-off-by: default avatarJames Morris <jmorris@namei.org>
parent 1d1e9756

security/keys/permission.c

+5 −0
Original line number Diff line number Diff line
@@ -35,6 +35,9 @@ int key_task_permission(const key_ref_t key_ref, const struct cred *cred, 


	key = key_ref_to_ptr(key_ref);



	if (key->user->user_ns != cred->user->user_ns)

		goto use_other_perms;



	/* use the second 8-bits of permissions for keys the caller owns */

	if (key->uid == cred->fsuid) {

		kperm = key->perm >> 16;
@@ -56,6 +59,8 @@ int key_task_permission(const key_ref_t key_ref, const struct cred *cred, 
		}

	}



use_other_perms:



	/* otherwise use the least-significant 8-bits */

	kperm = key->perm;