Jann Horn <jann@xxxxxxxxx> wrote: > find_keyring_by_name() checks that the UID of the keyring's owner is mapped into > the current user namespace. But that doesn't catch the scenario I described: > The keyring is created in an attacker-created namespace and looked up from the > init namespace, into which all kuids are mapped. Ah - gotcha. David _______________________________________________ Containers mailing list Containers@xxxxxxxxxxxxxxxxxxxxxxxxxx https://lists.linuxfoundation.org/mailman/listinfo/containers
