Documentation/security/keys.txt

72      are used to control what a process may do to a key from userspace, and
140  (*) Each process subscribes to three keyrings: a thread-specific keyring, a
141      process-specific keyring, and a session-specific keyring.
147      The process-specific keyring is replaced with an empty one in the child on
149      shared. execve also discards the process's process keyring and creates a
154      process can, however, replace its current session keyring with a new one
165      When a process changes its real UID, if it used to have no session key, it
168      If a process attempts to access its session key when it doesn't have one,
179      Process-specific and thread-specific keyrings are not counted towards a
192      userspace to request a key that can't be found in a process's keyrings.
229      keyring to a key, a process must have Write permission on the keyring and
261 properly initialize keycreate during the login process.  Otherwise, they will
266 boot process, before root has a chance to log in.
269 their associated thread, and both session and process keyrings are handled
288      the reading process whether or not it possesses them.  Note that LSM
290      the current process is not authorised to view.
368 process making the call:
373 	KEY_SPEC_PROCESS_KEYRING	-2	process-specific keyring
394      type. The process must also have permission to write to the key to be able
400      to the keyring. In this case, an error will be generated if the process
421  (*) Search the process's keyrings for a key, potentially calling out to
428      This function searches all the process's keyrings in the order thread,
429      process, session for a matching key. This works very much like
442  (*) Map a special key ID to a real key ID for this process:
455  (*) Replace the session keyring this process subscribes to with a new one:
459      If name is NULL, an anonymous keyring is created attached to the process
462      If name is not NULL, if a keyring of that name exists, the process
468      the process's ownership.
480      type. The process must also have permission to write to the key to be able
505      group ID to something other than the calling process's group ID or one of
533      A process must have view permission on the key for this function to be
554      process must have write permission on the keyring, and it must be a
562      This function creates a link from the keyring to the key. The process must
583      ignored. The process must have write permission on the keyring.
599      The process must have search permission on the top level keyring, or else
600      error EACCES will result. Only keyrings that the process has search
602      a process has search permission can be matched. If the specified keyring
619      into the buffer. The process must have read permission on the key to
646      invoked process returns, or else the key will be marked negative
649      The process must have write access on the key to be able to instantiate
671      invoked process returns if it is unable to fulfil the request.
673      The process must have write access on the key to be able to instantiate
697 	KEY_REQKEY_DEFL_PROCESS_KEYRING		2	Process keyring
712      the process keyring if there is one, otherwise the session keyring if
724      The process must have attribute modification access on a key to set its
768      A process must have view permission on the key for this function to be
772  (*) Install the calling process's session keyring on its parent.
776      This functions attempts to install the calling process's session keyring
777      on to the calling process's parent, replacing the parent's current session
780      The calling process must have the same ownership as its parent, the
781      keyring must have the same ownership as the calling process, the calling
782      process must have LINK permission on the keyring and the active LSM module
788      The keyring will be replaced next time the parent process leaves the
989 keyring in a process's keyrings.  A keyring thus found can then be searched
1202      instantiation process, whether or not it succeeds, whether or not there's
1238 <key> is the key being constructed, and the three keyrings are the process
1239 keyrings from the process that caused the search to be issued. These are
1248 access any more keys. It may then look around for a user specific process to