From 8ff3bc3138a400294ee9e126ac75fc9a9fae4e0b Mon Sep 17 00:00:00 2001 From: Serge E. Hallyn Date: Thu, 26 Feb 2009 18:27:47 -0600 Subject: keys: consider user namespace in key_permission If a key is owned by another user namespace, then treat the key as though it is owned by both another uid and gid. Signed-off-by: Serge E. Hallyn Acked-by: David Howells Signed-off-by: James Morris --- security/keys/permission.c | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'security') diff --git a/security/keys/permission.c b/security/keys/permission.c index 5d9fc7b93f2e..0ed802c9e698 100644 --- a/security/keys/permission.c +++ b/security/keys/permission.c @@ -35,6 +35,9 @@ int key_task_permission(const key_ref_t key_ref, const struct cred *cred, key = key_ref_to_ptr(key_ref); + if (key->user->user_ns != cred->user->user_ns) + goto use_other_perms; + /* use the second 8-bits of permissions for keys the caller owns */ if (key->uid == cred->fsuid) { kperm = key->perm >> 16; @@ -56,6 +59,8 @@ int key_task_permission(const key_ref_t key_ref, const struct cred *cred, } } +use_other_perms: + /* otherwise use the least-significant 8-bits */ kperm = key->perm; -- cgit v1.2.3