{"action":"created","issue":{"url":"https://api.github.com/repos/opencontainers/runc/issues/488","repository_url":"https://api.github.com/repos/opencontainers/runc","labels_url":"https://api.github.com/repos/opencontainers/runc/issues/488/labels{/name}","comments_url":"https://api.github.com/repos/opencontainers/runc/issues/488/comments","events_url":"https://api.github.com/repos/opencontainers/runc/issues/488/events","html_url":"https://github.com/opencontainers/runc/pull/488","id":127811913,"number":488,"title":"Create a new session key for every container","user":{"login":"stefanberger","id":1873348,"avatar_url":"https://avatars.githubusercontent.com/u/1873348?v=3","gravatar_id":"","url":"https://api.github.com/users/stefanberger","html_url":"https://github.com/stefanberger","followers_url":"https://api.github.com/users/stefanberger/followers","following_url":"https://api.github.com/users/stefanberger/following{/other_user}","gists_url":"https://api.github.com/users/stefanberger/gists{/gist_id}","starred_url":"https://api.github.com/users/stefanberger/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stefanberger/subscriptions","organizations_url":"https://api.github.com/users/stefanberger/orgs","repos_url":"https://api.github.com/users/stefanberger/repos","events_url":"https://api.github.com/users/stefanberger/events{/privacy}","received_events_url":"https://api.github.com/users/stefanberger/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/opencontainers/runc/labels/status/0-triage","name":"status/0-triage","color":"ededed"}],"state":"closed","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/opencontainers/runc/milestones/1","html_url":"https://github.com/opencontainers/runc/milestones/0.0.8","labels_url":"https://api.github.com/repos/opencontainers/runc/milestones/1/labels","id":1564594,"number":1,"title":"0.0.8","description":"","creator":{"login":"crosbymichael","id":749551,"avatar_url":"https://avatars.githubusercontent.com/u/749551?v=3","gravatar_id":"","url":"https://api.github.com/users/crosbymichael","html_url":"https://github.com/crosbymichael","followers_url":"https://api.github.com/users/crosbymichael/followers","following_url":"https://api.github.com/users/crosbymichael/following{/other_user}","gists_url":"https://api.github.com/users/crosbymichael/gists{/gist_id}","starred_url":"https://api.github.com/users/crosbymichael/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/crosbymichael/subscriptions","organizations_url":"https://api.github.com/users/crosbymichael/orgs","repos_url":"https://api.github.com/users/crosbymichael/repos","events_url":"https://api.github.com/users/crosbymichael/events{/privacy}","received_events_url":"https://api.github.com/users/crosbymichael/received_events","type":"User","site_admin":false},"open_issues":0,"closed_issues":19,"state":"closed","created_at":"2016-02-04T22:55:11Z","updated_at":"2016-02-10T22:44:12Z","due_on":"2016-02-11T08:00:00Z","closed_at":"2016-02-10T22:44:12Z"},"comments":30,"created_at":"2016-01-20T23:42:53Z","updated_at":"2016-02-22T18:22:20Z","closed_at":"2016-02-05T18:48:26Z","pull_request":{"url":"https://api.github.com/repos/opencontainers/runc/pulls/488","html_url":"https://github.com/opencontainers/runc/pull/488","diff_url":"https://github.com/opencontainers/runc/pull/488.diff","patch_url":"https://github.com/opencontainers/runc/pull/488.patch"},"body":"Create a new session key for every container to avoid sharing the key\r\nstructure of the process that created the container and the container\r\ninherits from.\r\n\r\nFixes #453\r\n\r\nSigned-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>"},"comment":{"url":"https://api.github.com/repos/opencontainers/runc/issues/comments/187304766","html_url":"https://github.com/opencontainers/runc/pull/488#issuecomment-187304766","issue_url":"https://api.github.com/repos/opencontainers/runc/issues/488","id":187304766,"user":{"login":"stefanberger","id":1873348,"avatar_url":"https://avatars.githubusercontent.com/u/1873348?v=3","gravatar_id":"","url":"https://api.github.com/users/stefanberger","html_url":"https://github.com/stefanberger","followers_url":"https://api.github.com/users/stefanberger/followers","following_url":"https://api.github.com/users/stefanberger/following{/other_user}","gists_url":"https://api.github.com/users/stefanberger/gists{/gist_id}","starred_url":"https://api.github.com/users/stefanberger/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stefanberger/subscriptions","organizations_url":"https://api.github.com/users/stefanberger/orgs","repos_url":"https://api.github.com/users/stefanberger/repos","events_url":"https://api.github.com/users/stefanberger/events{/privacy}","received_events_url":"https://api.github.com/users/stefanberger/received_events","type":"User","site_admin":false},"created_at":"2016-02-22T18:22:19Z","updated_at":"2016-02-22T18:22:19Z","body":"@LK4D4 I'll send another pull request shortly. Though it looks like without user namespaces we cannot really isolate the session keyrings.We can have unique names for the session keyrings and have the container join them upon 'exec' but using the command 'keyctl session <session keyring name>' one container can then switch to the session keyring of another container. With user namespaces enabled, the switching of the session keyring is not possible."}}