Re: Keyrings, user namespaces and the user_struct

From: James Bottomley <James.Bottomley-d9PhHud1JfjCXq6kfMZ53/egYHeGw8Jk@public.gmane.org>
To: David Howells <dhowells-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>,
	eparis-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org,
	ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org,
	serge-A9i7LUbDfNHQT0dZR+AlfA@public.gmane.org,
	oleg-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org,
	luto-kltTT9wpgjJwATOyAt5JVQ@public.gmane.org
Cc: linux-security-module-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
	keyrings-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
	containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org,
	simo-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org
Subject: Re: Keyrings, user namespaces and the user_struct
Date: Tue, 25 Oct 2016 09:56:45 -0700	[thread overview]
Message-ID: <1477414605.3079.40.camel__14877.9985066087$1477414628$gmane$org@HansenPartnership.com> (raw)
In-Reply-To: <18335.1477414412-S6HVgzuS8uM4Awkfq6JHfwNdhmdF6hFW@public.gmane.org>

On Tue, 2016-10-25 at 17:53 +0100, David Howells wrote:
> David Howells <dhowells-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org> wrote:
> 
> >  (2) If a process's user_namespace doesn't match that recorded in a
> > key then
> >      it gets ENOKEY if it tries to refer to it or access it and
> > can't see it
> >      in /proc/keys.
> 
> There's another possibility here - since user_namespaces are 
> hierarchical, does it make sense to let a process see keys that are 
> in an ancestral namespace?

I think that should be the decision of the owner.  If you're creating a
userns to de-privilege the next user, likely you don't want this, but
if you're creating a userns to enhance it, then you do.

I think you want to behave exactly as the mount namespace does: on
initial clone, you get a fully cloned mount tree and then you customise
it by unmounting pieces.

James