Documentation/security/keys-request-key.txt

47 does not need to link the key to a keyring to prevent it from being immediately
49 it's up to the caller to destroy the key.
80      a suitable key there.  If there is, it returns the key.  If there isn't,
84  (3) request_key() sees that A doesn't have the desired key yet, so it creates
102      Kerberos TGT key).  It just requests the appropriate key, and the keyring
105      This will permit it to then search the keyrings of process A with the
106      UID, GID, groups and security info of process A as if it was process A,
109  (8) The program then does what it must to get the data with which to
110      instantiate key U, using key W as a reference (perhaps it contacts a
113  (9) Upon instantiating key U, auth key V is automatically revoked so that it
122 context specified by auth key X will still be process A, as it was in auth key
127 of them, and (b) it requires the same UID/GID/Groups all the way through.
134 Rather than instantiating a key, it is possible for the possessor of an
137 the key whilst it exists to fail with error ENOKEY if negated or the specified
154  (1) When the key management code searches for a key (keyring_search_aux) it
155      firstly calls key_permission(SEARCH) on the keyring it's starting with,
156      if this denies permission, it doesn't search further.
158  (2) It considers all the non-keyring keys within that keyring and, if any key
159      matches the criteria specified, calls key_permission(SEARCH) on it to see
160      if the key is allowed to be found.  If it is, that key is returned; if
164  (3) It then considers all the keyring-type keys in the keyring it's currently
165      searching.  It calls key_permission(SEARCH) on each keyring, and if this
166      grants permission, it recurses, executing steps (2) and (3) on that
170 use it.  Any error from a previous match attempt is discarded and the key is
173 When search_process_keyrings() is invoked, it performs the following searches