Keyrings, user namespaces and the user_struct

[David Howells]

Jann Horn <jann at thejh.net> wrote:

> find_keyring_by_name() checks that the UID of the keyring's owner is mapped into
> the current user namespace. But that doesn't catch the scenario I described:
> The keyring is created in an attacker-created namespace and looked up from the
> init namespace, into which all kuids are mapped.

Ah - gotcha.

David