From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f175.google.com (mail-pl1-f175.google.com [209.85.214.175]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2EFA02C236B for ; Sun, 9 Aug 2026 11:02:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.175 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786273329; cv=none; b=VlhkaYGv0w+HtzIHZMQ/NEeH8A8y7RY6ZMv8EJ4h0SZTFgtgSgowxwLmPyk57XrR3JuepwwJ7+RMlYxX/jk3zJEFVjPtYJjdqPwoajZ3nww9PcnldVjhvFbqvnM/M4AnJIAORjLF9BVPTcVpjhuFwunPWOO0lP7NGKgxOIovmok= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786273329; c=relaxed/simple; bh=ywo2uPUsrXTAwO9InRinXm5M+tv6nKvz6B/hC03eifw=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=fpuTi2MHsqRw51t5tAPixDu4ikdjv7LL3tii7pIFZxBykD3z/ymMpcsqAYvlcO23Hb7GNzd7KDZHBcKeyv2SnSCx5NJW2aRZWXrKvw4O7gIup0emZdiEEDILNZp3ckg+REKRIPC8N4+/1zFv9kd9fLjFcwNKHdVE3Xc9OpO7Pdg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Xvz0xoIW; arc=none smtp.client-ip=209.85.214.175 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Xvz0xoIW" Received: by mail-pl1-f175.google.com with SMTP id d9443c01a7336-2d0407aedd6so10483775ad.0 for ; Sun, 09 Aug 2026 04:02:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786273327; x=1786878127; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=sc5V86l7BdE/6kSiloB+tbkV9FHRrzjo44RFbsUV2/g=; b=Xvz0xoIWRAL+Wc2Va+lLI7kmPCSQcPi7IioXYJh5jdLTS4OOGoLm4UOTEBvCeXWNE+ LNxNRYttMozn9H/5h1p3+8L05mremCxaqPeLCT7veIYzl3a4mArWw02iJUUgHP7ZgH/D J/CecEjkj8mNhf2rPRkmGiK2+yPJ7CwtA3DKncRkjmWBBK1Vcpx41UI6WIx36LopCph/ uZgUo9lrn8r+iZeEr8H3vyAWVTgvlX3+hxwFAAnVRTvX0zz0WvWbOhi8b/RtLEp33ICE 5B9Q0hhwmlZyW20CAcHv4+V9dJNEO/oCIha/WYGfaBWjrurJ5ZBI3MXGavpUTI0/Suvo 2Kjg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786273327; x=1786878127; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=sc5V86l7BdE/6kSiloB+tbkV9FHRrzjo44RFbsUV2/g=; b=J/G+Rl3BMKUt8KWMSllX5bZqwDJbStZjzouJHEMMVIO3qYRVlCHZK9SLQF1Ayea0Mg m+0kGbibluc3jqUWnmMzfwSY5w8hYEVjxfaEzJuZwDNYCONPjMrWirXwtXLUfCDVjjfa 0WawoLu5XzZk6InebQ9R8U/0J9wTtAIAVhmPjfnTXvapbjj87J9bYxCC/72k+JH2OYPa QMJLek4KCxBLV1JC0OZ3jZH/Icao1PSlf6znJHDgprYY9y1fX0w1CovEYUjcTwOCAoto Qzklo/hMoi5XG0EPrFzcqY6jLLn1zp4F3OwFpoCARxn20VqY5+xOYby+DwwQQqLQuPCD 501g== X-Forwarded-Encrypted: i=1; AHgh+RptSqETnlx5DAqconuLwlwaejFoaoc93lqKLCajgLWwyAg9aDVXrpJXyGR0UgLYtrIyrB51IdyCm7308Is=@vger.kernel.org X-Gm-Message-State: AOJu0YzZ+qzJzps5QQyFlc2piqun7BwVMFkbzsDWKSK97/YiY3bcoJj2 pOAneyQOVev0QXhZziEMlEr7015Mq809F+XGowDh28NTi1f+cY6ZqW3k X-Gm-Gg: AR+sD10UhziwP2za8b5+CY76YlPlM7d/d3RvTa1+KC8b96bXp0VQAdd0+LLFAIsOO8B rLQbovWmOd7ZfX2j3I6m2UvV2AQftrxakUcqIOvjsRzm4233bHJOHz4t0rqwUlHxu6P5rzazJ1U iM8CwmM997AyjL9z0wuyH0B5BmtilZFdngM2WoozjeB0ncYxC9VMciz7ewyMAX17IXrZK4Z7D8W jmxJqnfveceLBUyYXUQX8Rykj4CCtZ3/i2mSNBjz82pGSkeghDPmowtlUpYwM7W6XVYbdPedOzo LxdAxKNWImtz2UOtkAKQuRUkXjFU5Iu3qo4ze7NAlYIZI/KDPGDalU/9cQOI9bdAohZ+Oe+eAjY hBsE2br8y0ROEDw6dJVwD6ZfJPBwC+OwVmaGuUpoSFh0XVy3PXmSo00VysyGQLrqA4onQgQqNn+ cdiB8W2A8MRFXYls9lt7pk2TR99A6kOGjO05KZFVJe1Ha3s8d7oZZyruamOM2JkNz2aViEjHH3F qaMKrLKZ9uIEkR2QbpxL2A9 X-Received: by 2002:a17:90b:46:b0:38e:67e1:15b with SMTP id 98e67ed59e1d1-3903c5363a5mr39906893a91.6.1786273327417; Sun, 09 Aug 2026 04:02:07 -0700 (PDT) Received: from csl-conti-dell7858.ntu.edu.sg ([155.69.195.57]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-315beb88413sm50247194eec.18.2026.08.09.04.02.04 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 09 Aug 2026 04:02:06 -0700 (PDT) From: Maoyi Xie To: David Howells , Jarkko Sakkinen Cc: Paul Moore , James Morris , "Serge E . Hallyn" , keyrings@vger.kernel.org, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org Subject: keys: request_key_auth shows a global pid in /proc/keys across pid namespaces Date: Sun, 9 Aug 2026 19:02:02 +0800 Message-Id: <20260809110202.2180410-1-maoyixie.tju@gmail.com> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Hi all, I think request_key_auth leaks a global pid into /proc/keys. I would appreciate it if you could take a look. request_key_auth_describe() prints the requestor's pid: if (key_is_positive(key)) seq_printf(m, " pid:%d ci:%zu", rka->pid, rka->callout_len); rka->pid is current->pid, captured in request_key_auth_new() when the auth key is made. It is a raw pid_t in the init pid namespace. But /proc/keys is read by whoever opens it, and their pid namespace can differ. The uid and gid on that line already go through seq_user_ns(m). The pid does not. So a reader in another pid namespace gets a number that means nothing there, or worse lands on a different task. Not everyone can read the line. The owner uid must map into the reader's user namespace, and the reader needs VIEW on the key. The auth key gives VIEW to the requestor's own uid and to a possessor. So the reader has to be the requestor's uid, in a different pid namespace. That fits a sandbox at the same uid, made with unshare, systemd-nspawn or bubblewrap. A default Docker container does not hit it, since it hides /proc/keys. I found this with a static check for ids that reach userspace with no namespace translation. I reproduced it in a qemu VM on 7.1-rc1 as a normal user, no hardware or kernel changes needed. The reproducer calls request_key, then reads /proc/keys from a sibling pid namespace. Before the patch it reads the requestor's global pid, which does not exist in that namespace. After the patch it reads pid 0, since the requestor has no pid there. There is no keyrings selftest in the tree, so this is the only test. I am happy to send a patch. The raw pid_t cannot be translated later. So I stored a struct pid and print it with pid_nr_ns, the way the uid is already scoped. Thanks, Maoyi https://maoyixie.com/ --- diff --git a/include/keys/request_key_auth-type.h b/include/keys/request_key_auth-type.h index 01e42ee5f4099..464636278c4f8 100644 --- a/include/keys/request_key_auth-type.h +++ b/include/keys/request_key_auth-type.h @@ -22,7 +22,7 @@ struct request_key_auth { const struct cred *cred; void *callout_info; size_t callout_len; - pid_t pid; + struct pid *pid; char op[8]; } __randomize_layout; diff --git a/security/keys/request_key_auth.c b/security/keys/request_key_auth.c index 282e09d8fa46c..e8d1037526b19 100644 --- a/security/keys/request_key_auth.c +++ b/security/keys/request_key_auth.c @@ -13,6 +13,8 @@ #include #include #include "internal.h" +#include +#include #include static int request_key_auth_preparse(struct key_preparsed_payload *); @@ -73,7 +75,10 @@ static void request_key_auth_describe(const struct key *key, seq_puts(m, "key:"); seq_puts(m, key->description); if (key_is_positive(key)) - seq_printf(m, " pid:%d ci:%zu", rka->pid, rka->callout_len); + seq_printf(m, " pid:%d ci:%zu", + pid_nr_ns(rka->pid, + proc_pid_ns(file_inode(m->file)->i_sb)), + rka->callout_len); } /* @@ -113,6 +118,7 @@ static void free_request_key_auth(struct request_key_auth *rka) if (rka->cred) put_cred(rka->cred); kfree(rka->callout_info); + put_pid(rka->pid); kfree(rka); } @@ -226,14 +232,14 @@ struct key *request_key_auth_new(struct key *target, const char *op, irka = cred->request_key_auth->payload.data[0]; rka->cred = get_cred(irka->cred); - rka->pid = irka->pid; + rka->pid = get_pid(irka->pid); up_read(&cred->request_key_auth->sem); } else { /* it isn't - use this process as the context */ rka->cred = get_cred(cred); - rka->pid = current->pid; + rka->pid = get_pid(task_pid(current)); } rka->target_key = key_get(target);