keys: distinguish per-uid keys in different namespaces

per-uid keys were looked by uid only.  Use the user namespace
to distinguish the same uid in different namespaces.

This does not address key_permission.  So a task can for instance
try to join a keyring owned by the same uid in another namespace.
That will be handled by a separate patch.

Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>
Acked-by: David Howells <dhowells@redhat.com>
Signed-off-by: James Morris <jmorris@namei.org>

1 files changed, 3 insertions, 1 deletions

diff --git a/security/keys/internal.h b/security/keys/internal.h
index 81932abefe7..9fb679c66b8 100644
--- a/security/keys/internal.h
+++ b/security/keys/internal.h
@@ -53,6 +53,7 @@ struct key_user {
         atomic_t                nkeys;          /* number of keys */
         atomic_t                nikeys;         /* number of instantiated keys */
         uid_t                   uid;
+        struct user_namespace   *user_ns;
         int                     qnkeys;         /* number of keys allocated to this user */
         int                     qnbytes;        /* number of bytes allocated to this user */
 };
@@ -61,7 +62,8 @@ extern struct rb_root	key_user_tree;
 extern spinlock_t       key_user_lock;
 extern struct key_user  root_key_user;
 
-extern struct key_user *key_user_lookup(uid_t uid);
+extern struct key_user *key_user_lookup(uid_t uid,
+                                        struct user_namespace *user_ns);
 extern void key_user_put(struct key_user *user);
 
 /*