[PATCH] keys: translate request_key_auth pid for the reading procfs instance

[Jarkko Sakkinen]

On Fri, Aug 21, 2026 at 05:59:35PM +0800, Maoyi Xie wrote:
> request_key_auth_describe() prints rka->pid into /proc/keys as a raw
> pid_t in the initial pid namespace. A reader can open /proc/keys through
> a mount in another pid namespace. That reader sees a number with no
> meaning there. The number can even name an unrelated task. The line
> needs VIEW on the key. So the reader either shares the key owner's uid
> or possesses the key.
> 
> The fix keeps a struct pid. Commit 4f82f45730c6 ("net ip6 flowlabel:
> Make owner a union of struct pid * and kuid_t") gave
> /proc/net/ip6_flowlabel the same storage. The print goes through
> pid_nr_ns(). It renders against the pid namespace of the procfs instance
> the line is read through. Commit ad08978ab41c ("ipv6/flowlabel: simplify
> pid namespace lookup") moved that print to the same anchor. Output
> through an initial namespace /proc does not change. The line shows 0 for
> a requestor with no number in that namespace.
> 
> Translating at read time was the alternative. find_pid_ns() can resolve
> a recycled number. The line would then name a live task with no
> connection to the key. A stored struct pid gives 0 instead when the
> requestor has no number there.
> 
> Link: https://lore.kernel.org/keyrings/20260809110202.2180410-1-maoyixie.tju@gmail.com/
> Fixes: 78b7280cce23 ("KEYS: Improve /proc/keys")
> Cc: stable at vger.kernel.org # v5.10+
> Assisted-by: Claude:claude-opus-5 codeql
> Signed-off-by: Maoyi Xie <maoyixie.tju at gmail.com>
> ---
> 
>  include/keys/request_key_auth-type.h |  2 +-
>  security/keys/request_key_auth.c     | 12 +++++++++---
>  2 files changed, 10 insertions(+), 4 deletions(-)
> 
> diff --git a/include/keys/request_key_auth-type.h b/include/keys/request_key_auth-type.h
> index 01e42ee5f4099..464636278c4f8 100644
> --- a/include/keys/request_key_auth-type.h
> +++ b/include/keys/request_key_auth-type.h
> @@ -22,7 +22,7 @@ struct request_key_auth {
>  	const struct cred	*cred;
>  	void			*callout_info;
>  	size_t			callout_len;
> -	pid_t			pid;
> +	struct pid		*pid;
>  	char			op[8];
>  } __randomize_layout;
>  
> diff --git a/security/keys/request_key_auth.c b/security/keys/request_key_auth.c
> index 282e09d8fa46c..ed6f55b9cdd93 100644
> --- a/security/keys/request_key_auth.c
> +++ b/security/keys/request_key_auth.c
> @@ -9,6 +9,8 @@
>  
>  #include <linux/sched.h>
>  #include <linux/err.h>
> +#include <linux/pid.h>
> +#include <linux/proc_fs.h>
>  #include <linux/seq_file.h>
>  #include <linux/slab.h>
>  #include <linux/uaccess.h>
> @@ -73,7 +75,10 @@ static void request_key_auth_describe(const struct key *key,
>  	seq_puts(m, "key:");
>  	seq_puts(m, key->description);
>  	if (key_is_positive(key))
> -		seq_printf(m, " pid:%d ci:%zu", rka->pid, rka->callout_len);
> +		seq_printf(m, " pid:%d ci:%zu",
> +			   pid_nr_ns(rka->pid,
> +				     proc_pid_ns(file_inode(m->file)->i_sb)),
> +			   rka->callout_len);
>  }
>  
>  /*
> @@ -113,6 +118,7 @@ static void free_request_key_auth(struct request_key_auth *rka)
>  	if (rka->cred)
>  		put_cred(rka->cred);
>  	kfree(rka->callout_info);
> +	put_pid(rka->pid);
>  	kfree(rka);
>  }
>  
> @@ -226,14 +232,14 @@ struct key *request_key_auth_new(struct key *target, const char *op,
>  
>  		irka = cred->request_key_auth->payload.data[0];
>  		rka->cred = get_cred(irka->cred);
> -		rka->pid = irka->pid;
> +		rka->pid = get_pid(irka->pid);
>  
>  		up_read(&cred->request_key_auth->sem);
>  	}
>  	else {
>  		/* it isn't - use this process as the context */
>  		rka->cred = get_cred(cred);
> -		rka->pid = current->pid;
> +		rka->pid = get_pid(task_pid(current));
>  	}
>  
>  	rka->target_key = key_get(target);
> -- 
> 2.34.1
> 


Reviewed-by: Jarkko Sakkinen <jarkko at kernel.org>

BR, Jarkko