From 01fdc78b7f807227785fe6bad333e4520aa0b21f Mon Sep 17 00:00:00 2001
From: "Serge E. Hallyn" <serue@us.ibm.com>
Date: Thu, 26 Feb 2009 18:27:47 -0600
Subject: [PATCH] --- yaml --- r: 132637 b: refs/heads/master c:
 8ff3bc3138a400294ee9e126ac75fc9a9fae4e0b h: refs/heads/master i:   132635:
 38c432f5821ec1037e19a7bbca0821e3454852dd v: v3

---
 [refs]                           | 2 +-
 trunk/security/keys/permission.c | 5 +++++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/[refs] b/[refs]
index ca8e7df0efaf..1f96c1b58e18 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 1d1e97562e5e2ac60fb7b25437ba619f95f67fab
+refs/heads/master: 8ff3bc3138a400294ee9e126ac75fc9a9fae4e0b
diff --git a/trunk/security/keys/permission.c b/trunk/security/keys/permission.c
index 5d9fc7b93f2e..0ed802c9e698 100644
--- a/trunk/security/keys/permission.c
+++ b/trunk/security/keys/permission.c
@@ -35,6 +35,9 @@ int key_task_permission(const key_ref_t key_ref, const struct cred *cred,
 
 	key = key_ref_to_ptr(key_ref);
 
+	if (key->user->user_ns != cred->user->user_ns)
+		goto use_other_perms;
+
 	/* use the second 8-bits of permissions for keys the caller owns */
 	if (key->uid == cred->fsuid) {
 		kperm = key->perm >> 16;
@@ -56,6 +59,8 @@ int key_task_permission(const key_ref_t key_ref, const struct cred *cred,
 		}
 	}
 
+use_other_perms:
+
 	/* otherwise use the least-significant 8-bits */
 	kperm = key->perm;