NAME¶

SYNOPSIS¶

#include <sys/types.h>
#include <keyutils.h>

key_serial_t request_key(const char *type, const char *description,
                         const char *callout_info,
                         key_serial_t dest_keyring);

No glibc wrapper is provided for this system call; see NOTES.

DESCRIPTION¶

request_key() first recursively searches for a matching key in all of the keyrings attached to the calling process. The keyrings are searched in the order: thread-specific keyring, process-specific keyring, and then session keyring.

If request_key() is called from a program invoked by request_key() on behalf of some other process to generate a key, then the keyrings of that other process will be searched next, using that other process's user ID, group ID, supplementary group IDs, and security context to determine access.

The search of the keyring tree is breadth-first: the keys in each keyring searched are checked for a match before any child keyrings are recursed into. Only keys for which the caller has search permission be found, and only keyrings for which the caller has search permission may be searched.

If the key is not found and callout is NULL, then the call fails with the error ENOKEY.

If the key is not found and callout is not NULL, then the kernel attempts to invoke a user-space program to instantiate the key. The details are given below.

The dest_keyring serial number may be that of a valid keyring for which the caller has write permission, or it may be one of the following special keyring IDs:

KEY_SPEC_THREAD_KEYRING

This specifies the caller's thread-specific keyring (see thread-keyring(7)).

KEY_SPEC_PROCESS_KEYRING

This specifies the caller's process-specific keyring (see process-keyring(7)).

KEY_SPEC_SESSION_KEYRING

This specifies the caller's session-specific keyring (see session-keyring(7)).

KEY_SPEC_USER_KEYRING

This specifies the caller's UID-specific keyring (see user-keyring(7)).

KEY_SPEC_USER_SESSION_KEYRING

This specifies the caller's UID-session keyring (see user-session-keyring(7)).

When the dest_keyring is specified as 0 and no key construction has been performed, then no additional linking is done.

Otherwise, if dest_keyring is 0 and a new key is constructed, the new key will be linked to the "default" keyring. More precisely, when the kernel tries to determine to which keyring the newly constructed key should be linked, it tries the following keyrings, beginning with the keyring set via the keyctl(2) KEYCTL_SET_REQKEY_KEYRING operation and continuing in the order shown below until it finds the first keyring that exists:

• The requestor keyring (KEY_REQKEY_DEFL_REQUESTOR_KEYRING, since Linux 2.6.29).
• The thread-specific keyring (KEY_REQKEY_DEFL_THREAD_KEYRING; see thread-keyring(7)).
• The process-specific keyring (KEY_REQKEY_DEFL_PROCESS_KEYRING; see process-keyring(7)).
• The session-specific keyring (KEY_REQKEY_DEFL_SESSION_KEYRING; see session-keyring(7)).
• The session keyring for the process's user ID (KEY_REQKEY_DEFL_USER_SESSION_KEYRING; see user-session-keyring(7)). This keyring is expected to always exist.
• The UID-specific keyring (KEY_REQKEY_DEFL_USER_KEYRING; see user-keyring(7)). This keyring is also expected to always exist.

If the keyctl(2) KEYCTL_SET_REQKEY_KEYRING operation specifies KEY_REQKEY_DEFL_DEFAULT (or no KEYCTL_SET_REQKEY_KEYRING operation is performed), then the kernel looks for a keyring starting from the beginning of the list.

RETURN VALUE¶

ERRORS¶

EACCES

The keyring wasn't available for modification by the user.

EDQUOT

The key quota for this user would be exceeded by creating this key or linking it to the keyring.

EFAULT

One of type, description, or callout_info points outside the process's accessible address space.

EINTR

The request was interrupted by a signal; see signal(7).

EINVAL

The size of the string (including the terminating null byte) specified in type or description exceeded the limit (32 bytes and 4096 bytes respectively).

EINVAL

The size of the string (including the terminating null byte) specified in callout_info exceeded the system page size.

EKEYEXPIRED

An expired key was found, but no replacement could be obtained.

EKEYREJECTED

The attempt to generate a new key was rejected.

EKEYREVOKED

A revoked key was found, but no replacement could be obtained.

ENOKEY

No matching key was found.

ENOMEM

Insufficient memory to create a key.

EPERM

The type argument started with a period ('.').

VERSIONS¶

CONFORMING TO¶

NOTES¶

EXAMPLE¶

In order to demonstrate this program, we first create a suitable entry in the file /etc/request-key.conf.

$ sudo sh
# echo 'create user mtk:* *   /bin/keyctl instantiate %k %c %S' \
          > /etc/request-key.conf
# exit

This entry specifies that when a new "user" key with the prefix "mtk:" must be instantiated, that task should be performed via the keyctl(1) command's instantiate operation. The arguments supplied to the instantiate operation are: the ID of the uninstantiated key (%k); the callout data supplied to the request_key() call (%c); and the session keyring (%S) of the requestor (i.e., the caller of request_key()). See request-key.conf(5) for details of these % specifiers.

Then we run the program and check the contents of /proc/keys to verify that the requested key has been instantiated:

$ ./t_request_key user mtk:key1 "Payload data"
$ grep '2dddaf50' /proc/keys
2dddaf50 I--Q---  1 perm 3f010000  1000  1000 user  mtk:key1: 12

For another example of the use of this program, see keyctl(2).

/* t_request_key.c */
#include <sys/types.h>
#include <keyutils.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
int
main(int argc, char *argv[])
{
    key_serial_t key;
    if (argc != 4) {
        fprintf(stderr, "Usage: %s type description callout-data\n",
                argv[0]);
        exit(EXIT_FAILURE);
    }
    key = request_key(argv[1], argv[2], argv[3],
                      KEY_SPEC_SESSION_KEYRING);
    if (key == -1) {
        perror("request_key");
        exit(EXIT_FAILURE);
    }
    printf("Key ID is %lx\n", (long) key);
    exit(EXIT_SUCCESS);
}

SEE ALSO¶

The kernel source files Documentation/security/keys/core.rst and Documentation/keys/request-key.rst (or, before Linux 4.13, in the files Documentation/security/keys.txt and Documentation/security/keys-request-key.txt).

COLOPHON¶