1REQUEST_KEY(2) Linux Key Management Calls REQUEST_KEY(2)
2
6 request_key - request a key from the kernel's key management facility
7
9 #include <sys/types.h>
10 #include <keyutils.h>
11 key_serial_t request_key(const char *type, const char *description,
13 const char *callout_info,
14 key_serial_t dest_keyring);
15 No glibc wrapper is provided for this system call; see NOTES.
17
19 request_key() attempts to find a key of the given type with a descrip‐
20 tion (name) that matches the specified description. If such a key
21 could not be found, then the key is optionally created. If the key is
22 found or created, request_key() attaches it to the keyring whose ID is
23 specified in dest_keyring and returns the key's serial number.
24 request_key() first recursively searches for a matching key in all of
26 the keyrings attached to the calling process. The keyrings are
27 searched in the order: thread-specific keyring, process-specific
28 keyring, and then session keyring.
29 If request_key() is called from a program invoked by request_key() on
31 behalf of some other process to generate a key, then the keyrings of
32 that other process will be searched next, using that other process's
33 user ID, group ID, supplementary group IDs, and security context to de‐
34 termine access.
35 The search of the keyring tree is breadth-first: the keys in each
37 keyring searched are checked for a match before any child keyrings are
38 recursed into. Only keys for which the caller has search permission be
39 found, and only keyrings for which the caller has search permission may
40 be searched.
41 If the key is not found and callout is NULL, then the call fails with
43 the error ENOKEY.
44 If the key is not found and callout is not NULL, then the kernel at‐
46 tempts to invoke a user-space program to instantiate the key. The de‐
47 tails are given below.
48 The dest_keyring serial number may be that of a valid keyring for which
50 the caller has write permission, or it may be one of the following spe‐
51 cial keyring IDs:
52 KEY_SPEC_THREAD_KEYRING
54 This specifies the caller's thread-specific keyring (see
55 thread-keyring(7)).
56 KEY_SPEC_PROCESS_KEYRING
58 This specifies the caller's process-specific keyring (see
59 process-keyring(7)).
60 KEY_SPEC_SESSION_KEYRING
62 This specifies the caller's session-specific keyring (see ses‐
63 sion-keyring(7)).
64 KEY_SPEC_USER_KEYRING
66 This specifies the caller's UID-specific keyring (see
67 user-keyring(7)).
68 KEY_SPEC_USER_SESSION_KEYRING
70 This specifies the caller's UID-session keyring (see user-ses‐
71 sion-keyring(7)).
72 When the dest_keyring is specified as 0 and no key construction has
74 been performed, then no additional linking is done.
75 Otherwise, if dest_keyring is 0 and a new key is constructed, the new
77 key will be linked to the "default" keyring. More precisely, when the
78 kernel tries to determine to which keyring the newly constructed key
79 should be linked, it tries the following keyrings, beginning with the
80 keyring set via the keyctl(2) KEYCTL_SET_REQKEY_KEYRING operation and
81 continuing in the order shown below until it finds the first keyring
82 that exists:
83 • The requestor keyring (KEY_REQKEY_DEFL_REQUESTOR_KEYRING, since
85 Linux 2.6.29).
86 • The thread-specific keyring (KEY_REQKEY_DEFL_THREAD_KEYRING; see
88 thread-keyring(7)).
89 • The process-specific keyring (KEY_REQKEY_DEFL_PROCESS_KEYRING; see
91 process-keyring(7)).
92 • The session-specific keyring (KEY_REQKEY_DEFL_SESSION_KEYRING; see
94 session-keyring(7)).
95 • The session keyring for the process's user ID (KEY_RE‐
97 QKEY_DEFL_USER_SESSION_KEYRING; see user-session-keyring(7)). This
98 keyring is expected to always exist.
99 • The UID-specific keyring (KEY_REQKEY_DEFL_USER_KEYRING; see
101 user-keyring(7)). This keyring is also expected to always exist.
102 If the keyctl(2) KEYCTL_SET_REQKEY_KEYRING operation specifies KEY_RE‐
104 QKEY_DEFL_DEFAULT (or no KEYCTL_SET_REQKEY_KEYRING operation is per‐
105 formed), then the kernel looks for a keyring starting from the begin‐
106 ning of the list.
107 Requesting user-space instantiation of a key
109 If the kernel cannot find a key matching type and description, and
110 callout is not NULL, then the kernel attempts to invoke a user-space
111 program to instantiate a key with the given type and description. In
112 this case, the following steps are performed:
113 a) The kernel creates an uninstantiated key, U, with the requested
115 type and description.
116 b) The kernel creates an authorization key, V, that refers to the key
118 U and records the facts that the caller of request_key() is:
119 (1) the context in which the key U should be instantiated and se‐
121 cured, and
122 (2) the context from which associated key requests may be satis‐
124 fied.
125 The authorization key is constructed as follows:
127 * The key type is ".request_key_auth".
129 * The key's UID and GID are the same as the corresponding filesys‐
131 tem IDs of the requesting process.
132 * The key grants view, read, and search permissions to the key
134 possessor as well as view permission for the key user.
135 * The description (name) of the key is the hexadecimal string rep‐
137 resenting the ID of the key that is to be instantiated in the
138 requesting program.
139 * The payload of the key is taken from the data specified in call‐
141 out_info.
142 * Internally, the kernel also records the PID of the process that
144 called request_key().
145 c) The kernel creates a process that executes a user-space service
147 such as request-key(8) with a new session keyring that contains a
148 link to the authorization key, V.
149 This program is supplied with the following command-line arguments:
151 [0] The string "/sbin/request-key".
153 [1] The string "create" (indicating that a key is to be created).
155 [2] The ID of the key that is to be instantiated.
157 [3] The filesystem UID of the caller of request_key().
159 [4] The filesystem GID of the caller of request_key().
161 [5] The ID of the thread keyring of the caller of request_key().
163 This may be zero if that keyring hasn't been created.
164 [6] The ID of the process keyring of the caller of request_key().
166 This may be zero if that keyring hasn't been created.
167 [7] The ID of the session keyring of the caller of request_key().
169 Note: each of the command-line arguments that is a key ID is en‐
171 coded in decimal (unlike the key IDs shown in /proc/keys, which are
172 shown as hexadecimal values).
173 d) The program spawned in the previous step:
175 * Assumes the authority to instantiate the key U using the
177 keyctl(2) KEYCTL_ASSUME_AUTHORITY operation (typically via the
178 keyctl_assume_authority(3) function).
179 * Obtains the callout data from the payload of the authorization
181 key V (using the keyctl(2) KEYCTL_READ operation (or, more com‐
182 monly, the keyctl_read(3) function) with a key ID value of
183 KEY_SPEC_REQKEY_AUTH_KEY).
184 * Instantiates the key (or execs another program that performs
186 that task), specifying the payload and destination keyring.
187 (The destination keyring that the requestor specified when call‐
188 ing request_key() can be accessed using the special key ID
189 KEY_SPEC_REQUESTOR_KEYRING.) Instantiation is performed using
190 the keyctl(2) KEYCTL_INSTANTIATE operation (or, more commonly,
191 the keyctl_instantiate(3) function). At this point, the re‐
192 quest_key() call completes, and the requesting program can con‐
193 tinue execution.
194 If these steps are unsuccessful, then an ENOKEY error will be returned
196 to the caller of request_key() and a temporary, negatively instantiated
197 key will be installed in the keyring specified by dest_keyring. This
198 will expire after a few seconds, but will cause subsequent calls to re‐
199 quest_key() to fail until it does. The purpose of this negatively in‐
200 stantiated key is to prevent (possibly different) processes making re‐
201 peated requests (that require expensive request-key(8) upcalls) for a
202 key that can't (at the moment) be positively instantiated.
203 Once the key has been instantiated, the authorization key (KEY_SPEC_RE‐
205 QKEY_AUTH_KEY) is revoked, and the destination keyring (KEY_SPEC_RE‐
206 QUESTOR_KEYRING) is no longer accessible from the request-key(8) pro‐
207 gram.
208 If a key is created, then—regardless of whether it is a valid key or a
210 negatively instantiated key—it will displace any other key with the
211 same type and description from the keyring specified in dest_keyring.
212
214 On success, request_key() returns the serial number of the key it found
215 or caused to be created. On error, -1 is returned and errno is set to
216 indicate the cause of the error.
217
219 EACCES The keyring wasn't available for modification by the user.
220 EDQUOT The key quota for this user would be exceeded by creating this
222 key or linking it to the keyring.
223 EFAULT One of type, description, or callout_info points outside the
225 process's accessible address space.
226 EINTR The request was interrupted by a signal; see signal(7).
228 EINVAL The size of the string (including the terminating null byte)
230 specified in type or description exceeded the limit (32 bytes
231 and 4096 bytes respectively).
232 EINVAL The size of the string (including the terminating null byte)
234 specified in callout_info exceeded the system page size.
235 EKEYEXPIRED
237 An expired key was found, but no replacement could be obtained.
238 EKEYREJECTED
240 The attempt to generate a new key was rejected.
241 EKEYREVOKED
243 A revoked key was found, but no replacement could be obtained.
244 ENOKEY No matching key was found.
246 ENOMEM Insufficient memory to create a key.
248 EPERM The type argument started with a period ('.').
250
252 This system call first appeared in Linux 2.6.10. The ability to in‐
253 stantiate keys upon request was added in Linux 2.6.13.
254
256 This system call is a nonstandard Linux extension.
257
259 No wrapper for this system call is provided in glibc. A wrapper is
260 provided in the libkeyutils package. When employing the wrapper in
261 that library, link with -lkeyutils.
262
264 The program below demonstrates the use of request_key(). The type, de‐
265 scription, and callout_info arguments for the system call are taken
266 from the values supplied in the command-line arguments. The call spec‐
267 ifies the session keyring as the target keyring.
268 In order to demonstrate this program, we first create a suitable entry
270 in the file /etc/request-key.conf.
271 $ sudo sh
273 # echo 'create user mtk:* * /bin/keyctl instantiate %k %c %S' \
274 > /etc/request-key.conf
275 # exit
276 This entry specifies that when a new "user" key with the prefix "mtk:"
278 must be instantiated, that task should be performed via the keyctl(1)
279 command's instantiate operation. The arguments supplied to the instan‐
280 tiate operation are: the ID of the uninstantiated key (%k); the callout
281 data supplied to the request_key() call (%c); and the session keyring
282 (%S) of the requestor (i.e., the caller of request_key()). See re‐
283 quest-key.conf(5) for details of these % specifiers.
284 Then we run the program and check the contents of /proc/keys to verify
286 that the requested key has been instantiated:
287 $ ./t_request_key user mtk:key1 "Payload data"
289 $ grep '2dddaf50' /proc/keys
290 2dddaf50 I--Q--- 1 perm 3f010000 1000 1000 user mtk:key1: 12
291 For another example of the use of this program, see keyctl(2).
293 Program source
295 /* t_request_key.c */
297 #include <sys/types.h>
299 #include <keyutils.h>
300 #include <stdint.h>
301 #include <stdio.h>
302 #include <stdlib.h>
303 #include <string.h>
304 int
306 main(int argc, char *argv[])
307 {
308 key_serial_t key;
309 if (argc != 4) {
311 fprintf(stderr, "Usage: %s type description callout-data\n",
312 argv[0]);
313 exit(EXIT_FAILURE);
314 }
315 key = request_key(argv[1], argv[2], argv[3],
317 KEY_SPEC_SESSION_KEYRING);
318 if (key == -1) {
319 perror("request_key");
320 exit(EXIT_FAILURE);
321 }
322 printf("Key ID is %jx\n", (uintmax_t) key);
324 exit(EXIT_SUCCESS);
326 }
327
329 keyctl(1), add_key(2), keyctl(2), keyctl(3), capabilities(7),
330 keyrings(7), keyutils(7), persistent-keyring(7), process-keyring(7),
331 session-keyring(7), thread-keyring(7), user-keyring(7),
332 user-session-keyring(7), request-key(8)
333 The kernel source files Documentation/security/keys/core.rst and
335 Documentation/keys/request-key.rst (or, before Linux 4.13, in the files
336 Documentation/security/keys.txt and
337 Documentation/security/keys-request-key.txt).
338
340 This page is part of release 5.10 of the Linux man-pages project. A
341 description of the project, information about reporting bugs, and the
342 latest version of this page, can be found at
343 https://www.kernel.org/doc/man-pages/.
344Linux 2020-11-01 REQUEST_KEY(2)