1 files changed, 8 insertions, 7 deletions

diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
index 54339cfd6734..a58f712605d8 100644
--- a/security/keys/process_keys.c
+++ b/security/keys/process_keys.c
@@ -34,8 +34,7 @@ struct key_user root_key_user = {
         .lock           = __SPIN_LOCK_UNLOCKED(root_key_user.lock),
         .nkeys          = ATOMIC_INIT(2),
         .nikeys         = ATOMIC_INIT(2),
-        .uid            = 0,
-        .user_ns        = &init_user_ns,
+        .uid            = GLOBAL_ROOT_UID,
 };
 
 /*
@@ -48,11 +47,13 @@ int install_user_keyrings(void)
         struct key *uid_keyring, *session_keyring;
         char buf[20];
         int ret;
+        uid_t uid;
 
         cred = current_cred();
         user = cred->user;
+        uid = from_kuid(cred->user_ns, user->uid);
 
-        kenter("%p{%u}", user, user->uid);
+        kenter("%p{%u}", user, uid);
 
         if (user->uid_keyring) {
                 kleave(" = 0 [exist]");
@@ -67,11 +68,11 @@ int install_user_keyrings(void)
                  * - there may be one in existence already as it may have been
                  *   pinned by a session, but the user_struct pointing to it
                  *   may have been destroyed by setuid */
-                sprintf(buf, "_uid.%u", user->uid);
+                sprintf(buf, "_uid.%u", uid);
 
                 uid_keyring = find_keyring_by_name(buf, true);
                 if (IS_ERR(uid_keyring)) {
-                        uid_keyring = keyring_alloc(buf, user->uid, (gid_t) -1,
+                        uid_keyring = keyring_alloc(buf, user->uid, INVALID_GID,
                                                     cred, KEY_ALLOC_IN_QUOTA,
                                                     NULL);
                         if (IS_ERR(uid_keyring)) {
@@ -82,12 +83,12 @@ int install_user_keyrings(void)
 
                 /* get a default session keyring (which might also exist
                  * already) */
-                sprintf(buf, "_uid_ses.%u", user->uid);
+                sprintf(buf, "_uid_ses.%u", uid);
 
                 session_keyring = find_keyring_by_name(buf, true);
                 if (IS_ERR(session_keyring)) {
                         session_keyring =
-                                keyring_alloc(buf, user->uid, (gid_t) -1,
+                                keyring_alloc(buf, user->uid, INVALID_GID,
                                               cred, KEY_ALLOC_IN_QUOTA, NULL);
                         if (IS_ERR(session_keyring)) {
                                 ret = PTR_ERR(session_keyring);