request_key — request a key from the kernel's key management facility
||const char *type,|
|const char *description,|
|const char *callout_info,|
request_key() asks the
kernel to find a key of the given
type that matches the specified
description and, if
successful, to attach it to the nominated
keyring and to return its
recursively searches all the keyrings attached to the calling
process in the order thread-specific keyring,
process-specific keyring and then session keyring for a
request_key() is called
from a program invoked by
request_key() on behalf of some other
process to generate a key, then the keyrings of that other
process will be searched next, using that other process's
UID, GID, groups, and security context to control access.
The keys in each keyring searched are checked for a match
before any child keyrings are recursed into. Only keys that
the caller may be found, and only
searchable keyrings may be
If the key is not found, then, if
callout_info is set, this
function will attempt to look further afield. In such a case,
passed to a user-space service such as
/sbin/request−key to generate the
If that is unsuccessful also, then an error will be
returned, and a temporary negative key will be installed in
keyring. This will expire after
a few seconds, but will cause subsequent calls to
request_key() to fail until it
number may be that of a valid keyring to which the caller has
write permission, or it may be a special keyring ID:
This specifies the caller's thread-specific keyring.
This specifies the caller's process-specific keyring.
This specifies the caller's session-specific keyring.
This specifies the caller's UID-specific keyring.
This specifies the caller's UID-session keyring.
If a key is created, no matter whether it's a valid key or
a negative key, it will displace any other key of the same
type and description from the destination
returns the serial number of the key it found. On error, the
value −1 will be returned and errno will have been set
to an appropriate error.
The keyring wasn't available for modification by the user.
The request was interrupted by a signal; see signal(7).
The key quota for this user would be exceeded by creating this key or linking it to the keyring.
An expired key was found, but no replacement could be obtained.
The attempt to generate a new key was rejected.
A revoked key was found, but no replacement could be obtained.
Insufficient memory to create a key.
No matching key was found.
Although this is a Linux system call, it is not present in
libc but can be
found rather in
libkeyutils. When linking,
−lkeyutils should be
specified to the linker.
This page is part of release 4.07 of the Linux
man-pages project. A
description of the project, information about reporting bugs,
and the latest version of this page, can be found at
Copyright (C) 2006 Red Hat, Inc. All Rights Reserved.
Written by David Howells (dhowellsredhat.com)
This program is free software; you can redistribute it and/or
modify it under the terms of the GNU General Public License
as published by the Free Software Foundation; either version
2 of the License, or (at your option) any later version.