keyctl(2) System Calls Manual keyctl(2) keyctl - (libc -lc) #include /* KEY* */ #include /* SYS_* */ #include long syscall(SYS_keyctl, int op, ...); keyctl() . keyctl() op. libkeyutils ( keyutils) ( keyctl(3)) . op : KEYCTL_GET_KEYRING_ID(2const) KEYCTL_JOIN_SESSION_KEYRING(2const) KEYCTL_UPDATE(2const) KEYCTL_REVOKE(2const) KEYCTL_CHOWN(2const) KEYCTL_SETPERM(2const) KEYCTL_DESCRIBE(2const) KEYCTL_CLEAR(2const) KEYCTL_LINK(2const) KEYCTL_UNLINK(2const) KEYCTL_SEARCH(2const) KEYCTL_READ(2const) KEYCTL_INSTANTIATE(2const) KEYCTL_INSTANTIATE_IOV(2const) KEYCTL_NEGATE(2const) KEYCTL_REJECT(2const) KEYCTL_SET_REQKEY_KEYRING(2const) KEYCTL_SET_TIMEOUT(2const) KEYCTL_ASSUME_AUTHORITY(2const) KEYCTL_GET_SECURITY(2const) KEYCTL_SESSION_TO_PARENT(2const) KEYCTL_INVALIDATE(2const) KEYCTL_GET_PERSISTENT(2const) KEYCTL_DH_COMPUTE(2const) KEYCTL_RESTRICT_KEYRING(2const) . -1 errno . EACCES . EDQUOT . EINVAL ( ) arg3 ( ) arg4 ( ) (32 4096 ). EKEYEXPIRED . EKEYREJECTED . EKEYREVOKED . ENOKEY . ENOMEM . ENOTDIR . libkeyutils. ( ). . . 2.6.10. request-key(8) keyutils. . request_key(2) request-key(8) . . . . request-key(8) . ( request-key(8) ). request_key(2) . $ cc -o key_instantiate key_instantiate.c -lkeyutils; $ sudo mv /sbin/request-key /sbin/request-key.backup; $ sudo cp key_instantiate /sbin/request-key; $ ./t_request_key user mykey somepayloaddata; Key ID is 20d035bf $ sudo mv /sbin/request-key.backup /sbin/request-key; : $ cat /tmp/key_instantiate.log; Time: Mon Nov 7 13:06:47 2016 Command line arguments: argv[0]: /sbin/request-key operation: create key_to_instantiate: 20d035bf UID: 1000 GID: 1000 thread_keyring: 0 process_keyring: 0 session_keyring: 256e6a6 Key description: user;1000;1000;3f010000;mykey Auth key payload: somepayloaddata Destination keyring: 256e6a6 Auth key description: .request_key_auth;1000;1000;0b010000;20d035bf : o (mykey) o (somepayloaddata) request_key(2) o request_key(2) o (20d035bf). request_key(2) KEY_SPEC_SESSION_KEYRING. /proc/keys (0256e6a6) mykey 20d035bf. $ cat /proc/keys | egrep 'mykey|256e6a6'; 0256e6a6 I--Q--- 194 perm 3f030000 1000 1000 keyring _ses: 3 20d035bf I--Q--- 1 perm 3f010000 1000 1000 user mykey: 16 /* key_instantiate.c */ #include #include #include #include #include #include #include #include #ifndef KEY_SPEC_REQUESTOR_KEYRING #define KEY_SPEC_REQUESTOR_KEYRING (-8) #endif int main(int argc, char *argv[]) { int akp_size; /* */ int auth_key; char dbuf[256]; char auth_key_payload[256]; char *operation; FILE *fp; gid_t gid; uid_t uid; time_t t; key_serial_t key_to_instantiate, dest_keyring; key_serial_t thread_keyring, process_keyring, session_keyring; if (argc != 8) { fprintf(stderr, ": %s op key uid gid thread_keyring " "process_keyring session_keyring\n", argv[0]); exit(EXIT_FAILURE); } fp = fopen("/tmp/key_instantiate.log", "w"); if (fp == NULL) exit(EXIT_FAILURE); setbuf(fp, NULL); t = time(NULL); fprintf(fp, ": %s\n", ctime(&t)); /* * * . */ operation = argv[1]; key_to_instantiate = atoi(argv[2]); uid = atoi(argv[3]); gid = atoi(argv[4]); thread_keyring = atoi(argv[5]); process_keyring = atoi(argv[6]); session_keyring = argv[7]; fprintf(fp, " :\n"); fprintf(fp, " argv[0]: %s\n", argv[0]); fprintf(fp, " : %s\n", operation); fprintf(fp, " : %jx\n", (uintmax_t) key_to_instantiate); fprintf(fp, " UID: %jd\n", (intmax_t) uid); fprintf(fp, " GID: %jd\n", (intmax_t) gid); fprintf(fp, " : %jx\n", (uintmax_t) thread_keyring); fprintf(fp, " : %jx\n", (uintmax_t) process_keyring); fprintf(fp, " : %jx\n", (uintmax_t) session_keyring); fprintf(fp, "\n"); /* * argv[2]. */ if (keyctl(KEYCTL_ASSUME_AUTHORITY, key_to_instantiate) == -1) { fprintf(fp, " KEYCTL_ASSUME_AUTHORITY: %s\n", strerror(errno)); exit(EXIT_FAILURE); } /* * . */ if (keyctl(KEYCTL_DESCRIBE, key_to_instantiate, dbuf, sizeof(dbuf)) == -1) { fprintf(fp, " KEYCTL_DESCRIBE: %s\n", strerror(errno)); exit(EXIT_FAILURE); } fprintf(fp, " : %s\n", dbuf); /* * * request_key(). */ akp_size = keyctl(KEYCTL_READ, KEY_SPEC_REQKEY_AUTH_KEY, auth_key_payload, sizeof(auth_key_payload)); if (akp_size == -1) { fprintf(fp, " KEYCTL_READ: %s\n", strerror(errno)); exit(EXIT_FAILURE); } auth_key_payload[akp_size] = '\0'; fprintf(fp, " : %s\n", auth_key_payload); /* * * . */ auth_key = keyctl(KEYCTL_GET_KEYRING_ID, KEY_SPEC_REQKEY_AUTH_KEY); if (auth_key == -1) { fprintf(fp, " KEYCTL_GET_KEYRING_ID: %s\n", strerror(errno)); exit(EXIT_FAILURE); } fprintf(fp, " : %jx\n", (uintmax_t) auth_key); /* * request_key(2). */ dest_keyring = keyctl(KEYCTL_GET_KEYRING_ID, KEY_SPEC_REQUESTOR_KEYRING); if (dest_keyring == -1) { fprintf(fp, " KEYCTL_GET_KEYRING_ID: %s\n", strerror(errno)); exit(EXIT_FAILURE); } fprintf(fp, " : %jx\n", (uintmax_t) dest_keyring); /* * . * * () . * * . */ if (keyctl(KEYCTL_DESCRIBE, KEY_SPEC_REQKEY_AUTH_KEY, dbuf, sizeof(dbuf)) == -1) { fprintf(fp, " KEYCTL_DESCRIBE: %s\n", strerror(errno)); exit(EXIT_FAILURE); } fprintf(fp, " : %s\n", dbuf); /* * * . */ if (keyctl(KEYCTL_INSTANTIATE, key_to_instantiate, auth_key_payload, akp_size + 1, dest_keyring) == -1) { fprintf(fp, " KEYCTL_INSTANTIATE: %s\n", strerror(errno)); exit(EXIT_FAILURE); } exit(EXIT_SUCCESS); } keyctl(1), add_key(2), request_key(2), keyctl(3), recursive_key_scan(3), recursive_session_key_scan(3), capabilities(7), credentials(7), keyrings(7), keyutils(7), persistent-keyring(7), process-keyring(7), session-keyring(7), thread-keyring(7), user-keyring(7), user_namespaces(7), user-session-keyring(7), request-key(8) Documentation/security/keys/. 3 . . : . 6.18 8 2026 keyctl(2)