From mboxrd@z Thu Jan 1 00:00:00 1970 From: ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org (Eric W. Biederman) Subject: Re: Keyrings, user namespaces and the user_struct Date: Wed, 26 Oct 2016 13:10:20 -0500 Message-ID: <87mvhrrng3.fsf@xmission.com> References: <20161026143856.GL3334@pc.thejh.net> <17576.1477412418@warthog.procyon.org.uk> <18335.1477414412@warthog.procyon.org.uk> <1477414605.3079.40.camel@HansenPartnership.com> <20161025170602.GB24481@laptop.thejh.net> <1477418708.3079.52.camel@HansenPartnership.com> <20161025181735.GC24481@laptop.thejh.net> <9243.1477492490@warthog.procyon.org.uk> <9610.1477493338@warthog.procyon.org.uk> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <9610.1477493338-S6HVgzuS8uM4Awkfq6JHfwNdhmdF6hFW@public.gmane.org> (David Howells's message of "Wed, 26 Oct 2016 15:48:58 +0100") List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org Errors-To: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org To: David Howells Cc: Linux Containers , Oleg Nesterov , Eric Paris , Andy Lutomirski , James Bottomley , LSM List , keyrings-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, simo-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org List-Id: containers.vger.kernel.org David Howells writes: > Jann Horn wrote: > >> find_keyring_by_name() checks that the UID of the keyring's owner is mapped into >> the current user namespace. But that doesn't catch the scenario I described: >> The keyring is created in an attacker-created namespace and looked up from the >> init namespace, into which all kuids are mapped. > > Ah - gotcha. Unless I am misreading something it actually gets worse. You don't even need a user namespace. You can just call keyctl_join_session_keyring and the named keyring of your choice will be created. Plus there are various really weird things in their where the keyring names of _tid, _pid, _ses, get reused over and over again. So it looks like there are some significant things to fix. Eric