Quoting Michael Halcrow (mhalcrow@us.ibm.com):
> On Tue, Apr 15, 2008 at 04:34:02PM -0500, Serge E. Hallyn wrote:
> > Quoting Andrew Morton (akpm@linux-foundation.org):
> > > On Tue, 15 Apr 2008 15:23:13 -0500
> > > Michael Halcrow <mhalcrow@us.ibm.com> wrote:
> > >
> > > > ...
> > > > +	rc = ecryptfs_find_daemon_by_euid(&daemon, current->euid);
> > > > +	if (daemon->pid != current->pid) {
> > > > +	rc = ecryptfs_find_daemon_by_euid(&daemon, current->euid);
> > > > +	BUG_ON(current->euid != daemon->euid);
> > > > +	BUG_ON(current->pid != daemon->pid);
> > > 
> > > This code uses pids and uids all over the place.  Will it operate
> > > correctly in a containerised environment?
> > 
> > Thanks Andrew.
> > 
> > Mike, the pid_t definately needs to be replaced with a struct pid.
> > 
> > As for the euid, it'd be best if you also compared the user_namespace *
> > to make sure we support one ecryptfs deamon per user namespace.
> 
> Make eCryptfs key module subsystem respect namespaces.
> 
> Since I will be removing the netlink interface in a future patch, I
> just made changes to the netlink.c code so that it will not break the
> build. With my recent patches, the kernel module currently defaults to
> the device handle interface rather than the netlink interface.
> 
> Signed-off-by: Michael Halcrow <mhalcrow@us.ibm.com>
> ---
>  fs/ecryptfs/ecryptfs_kernel.h |   25 +++++++++-----
>  fs/ecryptfs/messaging.c       |   71 +++++++++++++++++++++++++++++-----------
>  fs/ecryptfs/miscdev.c         |   68 +++++++++++++++++++++++++--------------
>  fs/ecryptfs/netlink.c         |   25 +++++++++-----
>  4 files changed, 126 insertions(+), 63 deletions(-)
> 
> diff --git a/fs/ecryptfs/ecryptfs_kernel.h b/fs/ecryptfs/ecryptfs_kernel.h
> index 88b85f7..dc11431 100644
> --- a/fs/ecryptfs/ecryptfs_kernel.h
> +++ b/fs/ecryptfs/ecryptfs_kernel.h
> @@ -34,6 +34,7 @@
>  #include <linux/namei.h>
>  #include <linux/scatterlist.h>
>  #include <linux/hash.h>
> +#include <linux/nsproxy.h>
> 
>  /* Version verification for shared data structures w/ userspace */
>  #define ECRYPTFS_VERSION_MAJOR 0x00
> @@ -410,8 +411,9 @@ struct ecryptfs_daemon {
>  #define ECRYPTFS_DAEMON_MISCDEV_OPEN 0x00000008
>  	u32 flags;
>  	u32 num_queued_msg_ctx;
> -	pid_t pid;
> +	struct pid *pid;
>  	uid_t euid;
> +	struct user_namespace *user_ns;
>  	struct task_struct *task;
>  	struct mutex mux;
>  	struct list_head msg_ctx_out_queue;
> @@ -610,10 +612,13 @@ int
>  ecryptfs_setxattr(struct dentry *dentry, const char *name, const void *value,
>  		  size_t size, int flags);
>  int ecryptfs_read_xattr_region(char *page_virt, struct inode *ecryptfs_inode);
> -int ecryptfs_process_helo(unsigned int transport, uid_t uid, pid_t pid);
> -int ecryptfs_process_quit(uid_t uid, pid_t pid);
> -int ecryptfs_process_response(struct ecryptfs_message *msg, uid_t uid,
> -			      pid_t pid, u32 seq);
> +int ecryptfs_process_helo(unsigned int transport, uid_t euid,
> +			  struct user_namespace *user_ns, struct pid *pid);
> +int ecryptfs_process_quit(uid_t euid, struct user_namespace *user_ns,
> +			  struct pid *pid);
> +int ecryptfs_process_response(struct ecryptfs_message *msg, uid_t euid,
> +			      struct user_namespace *user_ns, struct pid *pid,
> +			      u32 seq);
>  int ecryptfs_send_message(unsigned int transport, char *data, int data_len,
>  			  struct ecryptfs_msg_ctx **msg_ctx);
>  int ecryptfs_wait_for_response(struct ecryptfs_msg_ctx *msg_ctx,
> @@ -623,13 +628,13 @@ void ecryptfs_release_messaging(unsigned int transport);
> 
>  int ecryptfs_send_netlink(char *data, int data_len,
>  			  struct ecryptfs_msg_ctx *msg_ctx, u8 msg_type,
> -			  u16 msg_flags, pid_t daemon_pid);
> +			  u16 msg_flags, struct pid *daemon_pid);
>  int ecryptfs_init_netlink(void);
>  void ecryptfs_release_netlink(void);
> 
>  int ecryptfs_send_connector(char *data, int data_len,
>  			    struct ecryptfs_msg_ctx *msg_ctx, u8 msg_type,
> -			    u16 msg_flags, pid_t daemon_pid);
> +			    u16 msg_flags, struct pid *daemon_pid);
>  int ecryptfs_init_connector(void);
>  void ecryptfs_release_connector(void);
>  void
> @@ -672,7 +677,8 @@ int ecryptfs_read_lower_page_segment(struct page *page_for_ecryptfs,
>  				     struct inode *ecryptfs_inode);
>  struct page *ecryptfs_get_locked_page(struct file *file, loff_t index);
>  int ecryptfs_exorcise_daemon(struct ecryptfs_daemon *daemon);
> -int ecryptfs_find_daemon_by_euid(struct ecryptfs_daemon **daemon, uid_t euid);
> +int ecryptfs_find_daemon_by_euid(struct ecryptfs_daemon **daemon, uid_t euid,
> +				 struct user_namespace *user_ns);
>  int ecryptfs_parse_packet_length(unsigned char *data, size_t *size,
>  				 size_t *length_size);
>  int ecryptfs_write_packet_length(char *dest, size_t size,
> @@ -684,6 +690,7 @@ int ecryptfs_send_miscdev(char *data, size_t data_size,
>  			  u16 msg_flags, struct ecryptfs_daemon *daemon);
>  void ecryptfs_msg_ctx_alloc_to_free(struct ecryptfs_msg_ctx *msg_ctx);
>  int
> -ecryptfs_spawn_daemon(struct ecryptfs_daemon **daemon, uid_t euid, pid_t pid);
> +ecryptfs_spawn_daemon(struct ecryptfs_daemon **daemon, uid_t euid,
> +		      struct user_namespace *user_ns, struct pid *pid);
> 
>  #endif /* #ifndef ECRYPTFS_KERNEL_H */
> diff --git a/fs/ecryptfs/messaging.c b/fs/ecryptfs/messaging.c
> index e3f2e97..fad161b 100644
> --- a/fs/ecryptfs/messaging.c
> +++ b/fs/ecryptfs/messaging.c
> @@ -103,6 +103,7 @@ void ecryptfs_msg_ctx_alloc_to_free(struct ecryptfs_msg_ctx *msg_ctx)
>  /**
>   * ecryptfs_find_daemon_by_euid
>   * @euid: The effective user id which maps to the desired daemon id
> + * @user_ns: The namespace in which @euid applies
>   * @daemon: If return value is zero, points to the desired daemon pointer
>   *
>   * Must be called with ecryptfs_daemon_hash_mux held.
> @@ -111,7 +112,8 @@ void ecryptfs_msg_ctx_alloc_to_free(struct ecryptfs_msg_ctx *msg_ctx)
>   *
>   * Returns zero if the user id exists in the list; non-zero otherwise.
>   */
> -int ecryptfs_find_daemon_by_euid(struct ecryptfs_daemon **daemon, uid_t euid)
> +int ecryptfs_find_daemon_by_euid(struct ecryptfs_daemon **daemon, uid_t euid,
> +				 struct user_namespace *user_ns)
>  {
>  	struct hlist_node *elem;
>  	int rc;
> @@ -119,7 +121,7 @@ int ecryptfs_find_daemon_by_euid(struct ecryptfs_daemon **daemon, uid_t euid)
>  	hlist_for_each_entry(*daemon, elem,
>  			     &ecryptfs_daemon_hash[ecryptfs_uid_hash(euid)],
>  			     euid_chain) {
> -		if ((*daemon)->euid == euid) {
> +		if ((*daemon)->euid == euid && (*daemon)->user_ns == user_ns) {
>  			rc = 0;
>  			goto out;
>  		}
> @@ -186,6 +188,7 @@ out:
>   * ecryptfs_spawn_daemon - Create and initialize a new daemon struct
>   * @daemon: Pointer to set to newly allocated daemon struct
>   * @euid: Effective user id for the daemon
> + * @user_ns: The namespace in which @euid applies
>   * @pid: Process id for the daemon
>   *
>   * Must be called ceremoniously while in possession of
> @@ -194,7 +197,8 @@ out:
>   * Returns zero on success; non-zero otherwise
>   */
>  int
> -ecryptfs_spawn_daemon(struct ecryptfs_daemon **daemon, uid_t euid, pid_t pid)
> +ecryptfs_spawn_daemon(struct ecryptfs_daemon **daemon, uid_t euid,
> +		      struct user_namespace *user_ns, struct pid *pid)
>  {
>  	int rc = 0;
> 
> @@ -206,6 +210,7 @@ ecryptfs_spawn_daemon(struct ecryptfs_daemon **daemon, uid_t euid, pid_t pid)
>  		goto out;
>  	}
>  	(*daemon)->euid = euid;
> +	(*daemon)->user_ns = user_ns;
>  	(*daemon)->pid = pid;

You'll want to do a get_pid() here, no?

And get_user_ns().

It's not because you particulary need them to stick around, but just to
ensure no wraparound causes another daemon with the same struct pid or
user_namespace to be spawned.  Pretty gosh-darned unlikely, but still...

>  	(*daemon)->task = current;
>  	mutex_init(&(*daemon)->mux);
> @@ -222,6 +227,7 @@ out:
>   * ecryptfs_process_helo
>   * @transport: The underlying transport (netlink, etc.)
>   * @euid: The user ID owner of the message
> + * @user_ns: The namespace in which @euid applies
>   * @pid: The process ID for the userspace program that sent the
>   *       message
>   *
> @@ -231,32 +237,33 @@ out:
>   * Returns zero after adding a new daemon to the hash list;
>   * non-zero otherwise.
>   */
> -int ecryptfs_process_helo(unsigned int transport, uid_t euid, pid_t pid)
> +int ecryptfs_process_helo(unsigned int transport, uid_t euid,
> +			  struct user_namespace *user_ns, struct pid *pid)
>  {
>  	struct ecryptfs_daemon *new_daemon;
>  	struct ecryptfs_daemon *old_daemon;
>  	int rc;
> 
>  	mutex_lock(&ecryptfs_daemon_hash_mux);
> -	rc = ecryptfs_find_daemon_by_euid(&old_daemon, euid);
> +	rc = ecryptfs_find_daemon_by_euid(&old_daemon, euid, user_ns);
>  	if (rc != 0) {
>  		printk(KERN_WARNING "Received request from user [%d] "
> -		       "to register daemon [%d]; unregistering daemon "
> -		       "[%d]\n", euid, pid, old_daemon->pid);
> +		       "to register daemon [0x%p]; unregistering daemon "
> +		       "[0x%p]\n", euid, pid, old_daemon->pid);
>  		rc = ecryptfs_send_raw_message(transport, ECRYPTFS_MSG_QUIT,
>  					       o