Re: Keyrings, user namespaces and the user_struct

From: ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org (Eric W. Biederman)
To: David Howells <dhowells-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
Cc: Linux Containers
	<containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org>,
	Oleg Nesterov <oleg-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>,
	Eric Paris <eparis-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>,
	Andy Lutomirski <luto-kltTT9wpgjJwATOyAt5JVQ@public.gmane.org>,
	James Bottomley
	<James.Bottomley-JuX6DAaQMKPCXq6kfMZ53/egYHeGw8Jk@public.gmane.org>,
	LSM List
	<linux-security-module-u79uwXL29TY76Z2rM5mHXA@public.gmane.org>,
	keyrings-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
	simo-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org
Subject: Re: Keyrings, user namespaces and the user_struct
Date: Wed, 26 Oct 2016 13:10:20 -0500	[thread overview]
Message-ID: <87mvhrrng3.fsf@xmission.com> (raw)
In-Reply-To: <9610.1477493338-S6HVgzuS8uM4Awkfq6JHfwNdhmdF6hFW@public.gmane.org> (David Howells's message of "Wed, 26 Oct 2016 15:48:58 +0100")

David Howells <dhowells-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org> writes:

> Jann Horn <jann-XZ1E9jl8jIdeoWH0uzbU5w@public.gmane.org> wrote:
>
>> find_keyring_by_name() checks that the UID of the keyring's owner is mapped into
>> the current user namespace. But that doesn't catch the scenario I described:
>> The keyring is created in an attacker-created namespace and looked up from the
>> init namespace, into which all kuids are mapped.
>
> Ah - gotcha.

Unless I am misreading something it actually gets worse.  You don't even
need a user namespace.  You can just call keyctl_join_session_keyring
and the named keyring of your choice will be created.

Plus there are various really weird things in their where the keyring
names of _tid, _pid, _ses, get reused over and over again.

So it looks like there are some significant things to fix.

Eric