summaryrefslogtreecommitdiff
path: root/include/linux/sched/user.h
diff options
context:
space:
mode:
authorDavid Howells <dhowells@redhat.com>2019-06-26 23:02:32 +0300
committerDavid Howells <dhowells@redhat.com>2019-06-26 23:02:32 +0300
commit0f44e4d976f96c6439da0d6717238efa4b91196e (patch)
tree3cec4bc4ef3faa4e61058e3aff066a7bec1c9d37 /include/linux/sched/user.h
parentb206f281d0ee14969878469816a69db22d5838e8 (diff)
downloadlinux-0f44e4d976f96c6439da0d6717238efa4b91196e.tar.xz
keys: Move the user and user-session keyrings to the user_namespace
Move the user and user-session keyrings to the user_namespace struct rather than pinning them from the user_struct struct. This prevents these keyrings from propagating across user-namespaces boundaries with regard to the KEY_SPEC_* flags, thereby making them more useful in a containerised environment. The issue is that a single user_struct may be represent UIDs in several different namespaces. The way the patch does this is by attaching a 'register keyring' in each user_namespace and then sticking the user and user-session keyrings into that. It can then be searched to retrieve them. Signed-off-by: David Howells <dhowells@redhat.com> cc: Jann Horn <jannh@google.com>
Diffstat (limited to 'include/linux/sched/user.h')
-rw-r--r--include/linux/sched/user.h14
1 files changed, 0 insertions, 14 deletions
diff --git a/include/linux/sched/user.h b/include/linux/sched/user.h
index 468d2565a9fe..917d88edb7b9 100644
--- a/include/linux/sched/user.h
+++ b/include/linux/sched/user.h
@@ -7,8 +7,6 @@
#include <linux/refcount.h>
#include <linux/ratelimit.h>
-struct key;
-
/*
* Some day this will be a full-fledged user tracking system..
*/
@@ -30,18 +28,6 @@ struct user_struct {
unsigned long unix_inflight; /* How many files in flight in unix sockets */
atomic_long_t pipe_bufs; /* how many pages are allocated in pipe buffers */
-#ifdef CONFIG_KEYS
- /*
- * These pointers can only change from NULL to a non-NULL value once.
- * Writes are protected by key_user_keyring_mutex.
- * Unlocked readers should use READ_ONCE() unless they know that
- * install_user_keyrings() has been called successfully (which sets
- * these members to non-NULL values, preventing further modifications).
- */
- struct key *uid_keyring; /* UID specific keyring */
- struct key *session_keyring; /* UID's default session keyring */
-#endif
-
/* Hash table maintenance information */
struct hlist_node uidhash_node;
kuid_t uid;