KEYCTL(1) KEYCTL(1) (NAME) keyctl - (SYNOPSIS) keyctl [ ... ] (DESCRIPTION) keyctl (Kernel Keyring Facility) . (KEY IDENTIFIERS) keyctl . : : 0 (Thread keyring): @t -1 (Thread) . . (v)fork exec clone . (Process keyring): @p -2 ( ) . . (v)fork exec . (Session keyring): @s -3 (v)fork exec clone . . . (User specific keyring): @u -4 . (link) . (User default session keyring): @us -5 . . (Group specific keyring): @g -6 . request_key: @a -7 request_key() (instantiate) . : %: . /proc/keys . : %: . /proc/keys . (COMMAND SYNTAX) . . keyctl --version : $ keyctl --version keyctl from keyutils-1.5.3 (Built 2011-08-24) keyctl supports keyctl supports --raw keyctl supports : $ keyctl supports have_capabilities=0 have_persistent_keyrings=1 have_dh_compute=1 have_public_key=1 : $ keyctl supports --raw ff0f : $ keyctl supports pkey echo $? 0 . : capabilities . libkeyutils . persistent_keyrings (persistent keyrings) . dh_compute - . public_key . big_key_type big_key . key_invalidate . restrict_keyring . move_key . ns_keyring_name (user- namespace) . ns_key_tag . . keyctl id [] "@s" ( ) "%type:desc" . . keyctl show [-x] [] . . -x . keyctl add [-x] keyctl padd [-x] . : $ keyctl add user mykey stuff @u 26 padd (stdin) : $ echo -n stuff | keyctl padd user mykey @u 26 -x . keyctl request [] keyctl request2 [] keyctl prequest2 [] . . ENOKEY . /sbin/request-key . . . . ( ) "Requested key not available" . $ keyctl request2 user debug:hello wibble 23 $ echo -n wibble | keyctl prequest2 user debug:hello 23 $ keyctl request user debug:hello 23 keyctl update [-x] keyctl pupdate [-x] . "Operation not supported" . $ keyctl update 23 zebra pupdate : $ echo -n zebra | keyctl pupdate 23 $ echo 616263313233 | keyctl pupdate -x 23 -x . keyctl newring . . $ keyctl newring squelch @us 27 keyctl revoke (revoked) . ( ) "Key has been revoked" . $ keyctl revoke 26 $ keyctl describe 26 keyctl_describe: Key has been revoked keyctl clear (unlink). "Not a directory" . $ keyctl clear 27 keyctl link . "Not a directory" link write "Permission denied" "File table overflow" "Resource deadlock avoided" . $ keyctl link 23 27 $ keyctl link 27 27 keyctl_link: Resource deadlock avoided keyctl unlink [] . "Not a directory" "Permission denied" "No such file or directory" . . . $ keyctl unlink 23 27 keyctl move [-f] "keyctl unlink " "keyctl link " . -f (to_keyring) "File exists" . $ keyctl move 23 27 29 $ keyctl move -f 71 @u @s keyctl search [] . ( ) . "Requested key not available" . $ keyctl search @us user debug:hello 23 $ keyctl search @us user debug:bye keyctl_search: Requested key not available keyctl restrict_keyring [ []] . . . . $ keyctl restrict_keyring $1 asymmetric builtin_trusted keyctl read keyctl pipe keyctl print (payload) . "read" (hex dump) "pipe" "print" ":hex:" . "Operation not supported" . $ keyctl read 26 1 bytes of data in key: 62 $ keyctl print 26 b $ keyctl pipe 26 b$ keyctl list keyctl rlist . "list" "rlist" . . $ keyctl list @us 2 keys in keyring: 22: vrwsl---------- 4043 -1 keyring: _uid.4043 23: vrwsl---------- 4043 4043 user: debug:hello $ keyctl rlist @us 22 23 keyctl describe keyctl rdescribe [sep] . "describe" "list" "rdescribe" . $ keyctl describe @us -5: vrwsl---------- 4043 -1 keyring: _uid_ses.4043 $ keyctl rdescribe @us keyring;4043;-1;3f1f0000;_uid_ses.4043 ";;;;" uid gid perms (hex) type description ( ). keyctl chown keyctl chgrp UID GID . UID (quota) . chown "Operation not supported" . ( ) GID GID GID . () GID . $ sudo keyctl chown 27 0 keyctl_chown: Operation not supported $ sudo keyctl chgrp 27 0 keyctl setperm . "0x" (hex) "0" (octal) (decimal) . : Possessor UID GID Other Permission Granted ======== ======== ======== ======== ================== 01000000 00010000 00000100 00000001 View 02000000 00020000 00000200 00000002 Read 04000000 00040000 00000400 00000004 Write 08000000 00080000 00000800 00000008 Search 10000000 00100000 00001000 00000010 Link 20000000 00200000 00002000 00000020 Set Attribute 3f000000 003f0000 00003f00 0000003f All View . Read ( ) . Write ( ) . Search . Link . Set Attribute . $ keyctl setperm 27 0x1f1f1f00 keyctl session keyctl session - [ ...] keyctl session [ ...] . SHELL$ . ( SHELL$) . ( SHELL$) . $ keyctl rdescribe @s keyring;4043;-1;3f1f0000;_uid_ses.4043 $ keyctl session Joined session keyring: 28 $ keyctl rdescribe @s keyring;4043;4043;3f1f0000;_ses.24082 $ keyctl session - Joined session keyring: 29 $ keyctl rdescribe @s keyring;4043;4043;3f1f0000;_ses.24139 $ keyctl session - keyctl rdescribe @s Joined session keyring: 30 keyring;4043;4043;3f1f0000;_ses.24185 $ keyctl session fish Joined session keyring: 34 $ keyctl rdescribe @s keyring;4043;4043;3f1f0000;fish $ keyctl session fish keyctl rdesc @s Joined session keyring: 35 keyring;4043;4043;3f1f0000;fish keyctl instantiate [-x] keyctl pinstantiate [-x] keyctl negate keyctl reject ( /sbin/request-key ) . "instantiate" . "negate" "reject" . "Requested key not found" ( negate) ( reject) . reject 'rejected', 'expired' 'revoked' . . request-key request-key . . $ keyctl instantiate $1 "Debug $3" $4 $ keyctl negate $1 30 $4 $ keyctl reject $1 30 64 $4 pinstantiate : $ echo -n "Debug $3" | keyctl pinstantiate $1 $4 -x : $ echo 01 02 03 04 | keyctl pinstantiate -x $1 $4 keyctl timeout ( ) . . $ keyctl timeout $1 45 keyctl security LSM . . $ keyctl security @s unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 keyctl new_session [] ( ) . "_ses" . $ keyctl session foo Joined session keyring: 723488146 $ keyctl show Session Keyring -3 --alswrv 0 0 keyring: foo $ keyctl new_session 490511412 $ keyctl show Session Keyring -3 --alswrv 0 0 keyring: _ses (parent) . ( wait()) . keyctl reap . . (Write) (Search) . . -v . keyctl purge keyctl purge [-i] [-p] keyctl purge -s . . Read View View . Write . . . -i -p . . keyctl get_persistent [] UID UID . . : /proc/sys/kernel/keys/persistent_keyring_expiry ( ) . . UID CAP_SETUID . - keyctl dh_compute - : base ^ private (mod prime) . . . . $ keyctl dh_compute $1 $2 $3 8 bytes of data in result: 00010203 04050607 - keyctl dh_compute_kdf - (KDF) . KDF . crypto API . . SP800-56A . . - KDF keyctl dh_compute_kdf_oi [-x] dh_compute_kdf - . ( OI) SP800-56A (stdin) . -x stdin . keyctl pkey_query [k=v]* keyctl pkey_encrypt [k=v]* > keyctl pkey_decrypt [k=v]* > keyctl pkey_sign [k=v]* > keyctl pkey_verify [k=v]* . encrypt decrypt sign stdout verify . [!] . (digest) datafile . "hash=" . key pass "0" datafile encfile sigfile . "[key[=val" ("hash=") ("enc=") . k=`keyctl padd asymmetric "" @s foo.enc keyctl pkey_decrypt $k 0 foo.enc enc=pkcs1 >foo.hash keyctl pkey_sign $k 0 foo.hash enc=pkcs1 hash=sha256 >foo.sig keyctl pkey_verify $k 0 foo.hash foo.sig enc=pkcs1 hash=sha256 asymmetric-key(7) . (Change notifications) keyctl watch [-f] keyctl watch_session [-f ] [-n ] \ [ ...] keyctl watch_add keyctl watch_rm watch stdout . . filter : i - (instantiated) p - (updated) l - (link added) n - (link removed) c - (cleared) r - (revoked) v - (invalidated) s - (attributes changed) : [] keyid event aux ( ) ( link ). : 255913279 link 340681059 255913279 clr (garbage collection) : 255913279 gc watch_session name ( ) prog . . notifylog gclog . watch_queue(7) fd . watch_add key watch_queue fd watch_rm . watch_queue . (ERRORS) : "Not a directory" - . "Requested key not found" - . "Key has been revoked" - . "Key has expired" - . "Permission denied" - UID/GID/mask . (SEE ALSO) keyctl(1), keyctl(2), request_key(2), keyctl(3), request-key.conf(5), keyrings(7), request-key(8) keyutils KEYCTL(1)