Re: [PATCH 0/3] keys: play nicely with user namespaces

["Serge E. Hallyn" <serue-r/Jw6+rmf7HQT0dZR+AlfA@public.gmane.org>]

Quoting David Howells (dhowells-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org):
> Serge E. Hallyn <serue-r/Jw6+rmf7HQT0dZR+AlfA@public.gmane.org> wrote:
> 
> > Cool, thanks.  I needed the following change to toolbox.inc.sh.orig in
> > order to be able to run with >1 user namespaces:
> > 
> > 36c36
> > < maxsquota=`grep '^ *0': /proc/key-users | sed s@.*/@@`
> > ---
> > > maxsquota=`grep '^ *0': /proc/key-users | sed s@.*/@@ | head -1`
> > 
> > since /proc/key-users then lists multiple entries.  Otherwise,
> > all tests pass when running the testsuite in a child-user-ns.
> 
> Should you only get key-users from the set of users in your namespace, I
> wonder?
> 
> David

Yup - patch coming (probably next week) for that, but there's the
question, given that user namespaces are hierarchical, of whether,
if pidns B is a child of pidns A created by userid 500, a task in
pidns A should see keys in userns B (listed as belonging to userid
500).

-serge