Linux-2.6.12-rc2

Initial git repository build. I'm not bothering with the full history,
even though we have it. We can create a separate "historical" git
archive of that later if we want to, and in the meantime it's about
3.2GB when imported into git - space that would just make the early
git days unnecessarily complicated, when we don't have a lot of good
infrastructure for it.

Let it rip!

1 files changed, 987 insertions, 0 deletions

diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
new file mode 100644
index 000000000000..dc0011b3fac9
--- /dev/null
+++ b/security/keys/keyctl.c
@@ -0,0 +1,987 @@
+/* keyctl.c: userspace keyctl operations
+ *
+ * Copyright (C) 2004 Red Hat, Inc. All Rights Reserved.
+ * Written by David Howells (dhowells@redhat.com)
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version
+ * 2 of the License, or (at your option) any later version.
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/sched.h>
+#include <linux/slab.h>
+#include <linux/syscalls.h>
+#include <linux/keyctl.h>
+#include <linux/fs.h>
+#include <linux/err.h>
+#include <asm/uaccess.h>
+#include "internal.h"
+
+/*****************************************************************************/
+/*
+ * extract the description of a new key from userspace and either add it as a
+ * new key to the specified keyring or update a matching key in that keyring
+ * - the keyring must be writable
+ * - returns the new key's serial number
+ * - implements add_key()
+ */
+asmlinkage long sys_add_key(const char __user *_type,
+			    const char __user *_description,
+			    const void __user *_payload,
+			    size_t plen,
+			    key_serial_t ringid)
+{
+	struct key *keyring, *key;
+	char type[32], *description;
+	void *payload;
+	long dlen, ret;
+
+	ret = -EINVAL;
+	if (plen > 32767)
+		goto error;
+
+	/* draw all the data into kernel space */
+	ret = strncpy_from_user(type, _type, sizeof(type) - 1);
+	if (ret < 0)
+		goto error;
+	type[31] = '\0';
+
+	ret = -EFAULT;
+	dlen = strnlen_user(_description, PAGE_SIZE - 1);
+	if (dlen <= 0)
+		goto error;
+
+	ret = -EINVAL;
+	if (dlen > PAGE_SIZE - 1)
+		goto error;
+
+	ret = -ENOMEM;
+	description = kmalloc(dlen + 1, GFP_KERNEL);
+	if (!description)
+		goto error;
+
+	ret = -EFAULT;
+	if (copy_from_user(description, _description, dlen + 1) != 0)
+		goto error2;
+
+	/* pull the payload in if one was supplied */
+	payload = NULL;
+
+	if (_payload) {
+		ret = -ENOMEM;
+		payload = kmalloc(plen, GFP_KERNEL);
+		if (!payload)
+			goto error2;
+
+		ret = -EFAULT;
+		if (copy_from_user(payload, _payload, plen) != 0)
+			goto error3;
+	}
+
+	/* find the target keyring (which must be writable) */
+	keyring = lookup_user_key(ringid, 1, 0, KEY_WRITE);
+	if (IS_ERR(keyring)) {
+		ret = PTR_ERR(keyring);
+		goto error3;
+	}
+
+	/* create or update the requested key and add it to the target
+	 * keyring */
+	key = key_create_or_update(keyring, type, description,
+				   payload, plen, 0);
+	if (!IS_ERR(key)) {
+		ret = key->serial;
+		key_put(key);
+	}
+	else {
+		ret = PTR_ERR(key);
+	}
+
+	key_put(keyring);
+ error3:
+	kfree(payload);
+ error2:
+	kfree(description);
+ error:
+	return ret;
+
+} /* end sys_add_key() */
+
+/*****************************************************************************/
+/*
+ * search the process keyrings for a matching key
+ * - nested keyrings may also be searched if they have Search permission
+ * - if a key is found, it will be attached to the destination keyring if
+ *   there's one specified
+ * - /sbin/request-key will be invoked if _callout_info is non-NULL
+ *   - the _callout_info string will be passed to /sbin/request-key
+ *   - if the _callout_info string is empty, it will be rendered as "-"
+ * - implements request_key()
+ */
+asmlinkage long sys_request_key(const char __user *_type,
+				const char __user *_description,
+				const char __user *_callout_info,
+				key_serial_t destringid)
+{
+	struct key_type *ktype;
+	struct key *key, *dest;
+	char type[32], *description, *callout_info;
+	long dlen, ret;
+
+	/* pull the type into kernel space */
+	ret = strncpy_from_user(type, _type, sizeof(type) - 1);
+	if (ret < 0)
+		goto error;
+	type[31] = '\0';
+
+	/* pull the description into kernel space */
+	ret = -EFAULT;
+	dlen = strnlen_user(_description, PAGE_SIZE - 1);
+	if (dlen <= 0)
+		goto error;
+
+	ret = -EINVAL;
+	if (dlen > PAGE_SIZE - 1)
+		goto error;
+
+	ret = -ENOMEM;
+	description = kmalloc(dlen + 1, GFP_KERNEL);
+	if (!description)
+		goto error;
+
+	ret = -EFAULT;
+	if (copy_from_user(description, _description, dlen + 1) != 0)
+		goto error2;
+
+	/* pull the callout info into kernel space */
+	callout_info = NULL;
+	if (_callout_info) {
+		ret = -EFAULT;
+		dlen = strnlen_user(_callout_info, PAGE_SIZE - 1);
+		if (dlen <= 0)
+			goto error2;
+
+		ret = -EINVAL;
+		if (dlen > PAGE_SIZE - 1)
+			goto error2;
+
+		ret = -ENOMEM;
+		callout_info = kmalloc(dlen + 1, GFP_KERNEL);
+		if (!callout_info)
+			goto error2;
+
+		ret = -EFAULT;
+		if (copy_from_user(callout_info, _callout_info, dlen + 1) != 0)
+			goto error3;
+	}
+
+	/* get the destination keyring if specified */
+	dest = NULL;
+	if (destringid) {
+		dest = lookup_user_key(destringid, 1, 0, KEY_WRITE);
+		if (IS_ERR(dest)) {
+			ret = PTR_ERR(dest);
+			goto error3;
+		}
+	}
+
+	/* find the key type */
+	ktype = key_type_lookup(type);
+	if (IS_ERR(ktype)) {
+		ret = PTR_ERR(ktype);
+		goto error4;
+	}
+
+	/* do the search */
+	key = request_key(ktype, description, callout_info);
+	if (IS_ERR(key)) {
+		ret = PTR_ERR(key);
+		goto error5;
+	}
+
+	/* link the resulting key to the destination keyring */
+	if (dest) {
+		ret = key_link(dest, key);
+		if (ret < 0)
+			goto error6;
+	}
+
+	ret = key->serial;
+
+ error6:
+	key_put(key);
+ error5:
+	key_type_put(ktype);
+ error4:
+	key_put(dest);
+ error3:
+	kfree(callout_info);
+ error2:
+	kfree(description);
+ error:
+	return ret;
+
+} /* end sys_request_key() */
+
+/*****************************************************************************/
+/*
+ * get the ID of the specified process keyring
+ * - the keyring must have search permission to be found
+ * - implements keyctl(KEYCTL_GET_KEYRING_ID)
+ */
+long keyctl_get_keyring_ID(key_serial_t id, int create)
+{
+	struct key *key;
+	long ret;
+
+	key = lookup_user_key(id, create, 0, KEY_SEARCH);
+	if (IS_ERR(key)) {
+		ret = PTR_ERR(key);
+		goto error;
+	}
+
+	ret = key->serial;
+	key_put(key);
+ error:
+	return ret;
+
+} /* end keyctl_get_keyring_ID() */
+
+/*****************************************************************************/
+/*
+ * join the session keyring
+ * - implements keyctl(KEYCTL_JOIN_SESSION_KEYRING)
+ */
+long keyctl_join_session_keyring(const char __user *_name)
+{
+	char *name;
+	long nlen, ret;
+
+	/* fetch the name from userspace */
+	name = NULL;
+	if (_name) {
+		ret = -EFAULT;
+		nlen = strnlen_user(_name, PAGE_SIZE - 1);
+		if (nlen <= 0)
+			goto error;
+
+		ret = -EINVAL;
+		if (nlen > PAGE_SIZE - 1)
+			goto error;
+
+		ret = -ENOMEM;
+		name = kmalloc(nlen + 1, GFP_KERNEL);
+		if (!name)
+			goto error;
+
+		ret = -EFAULT;
+		if (copy_from_user(name, _name, nlen + 1) != 0)
+			goto error2;
+	}
+
+	/* join the session */
+	ret = join_session_keyring(name);
+
+ error2:
+	kfree(name);
+ error:
+	return ret;
+
+} /* end keyctl_join_session_keyring() */
+
+/*****************************************************************************/
+/*
+ * update a key's data payload
+ * - the key must be writable
+ * - implements keyctl(KEYCTL_UPDATE)
+ */
+long keyctl_update_key(key_serial_t id,
+		       const void __user *_payload,
+		       size_t plen)
+{
+	struct key *key;
+	void *payload;
+	long ret;
+
+	ret = -EINVAL;
+	if (plen > PAGE_SIZE)
+		goto error;
+
+	/* pull the payload in if one was supplied */
+	payload = NULL;
+	if (_payload) {
+		ret = -ENOMEM;
+		payload = kmalloc(plen, GFP_KERNEL);
+		if (!payload)
+			goto error;
+
+		ret = -EFAULT;
+		if (copy_from_user(payload, _payload, plen) != 0)
+			goto error2;
+	}
+
+	/* find the target key (which must be writable) */
+	key = lookup_user_key(id, 0, 0, KEY_WRITE);
+	if (IS_ERR(key)) {
+		ret = PTR_ERR(key);
+		goto error2;
+	}
+
+	/* update the key */
+	ret = key_update(key, payload, plen);
+
+	key_put(key);
+ error2:
+	kfree(payload);
+ error:
+	return ret;
+
+} /* end keyctl_update_key() */
+
+/*****************************************************************************/
+/*
+ * revoke a key
+ * - the key must be writable
+ * - implements keyctl(KEYCTL_REVOKE)
+ */
+long keyctl_revoke_key(key_serial_t id)
+{
+	struct key *key;
+	long ret;
+
+	key = lookup_user_key(id, 0, 0, KEY_WRITE);
+	if (IS_ERR(key)) {
+		ret = PTR_ERR(key);
+		goto error;
+	}
+
+	key_revoke(key);
+	ret = 0;
+
+	key_put(key);
+ error:
+	return 0;
+
+} /* end keyctl_revoke_key() */
+
+/*****************************************************************************/
+/*
+ * clear the specified process keyring
+ * - the keyring must be writable
+ * - implements keyctl(KEYCTL_CLEAR)
+ */
+long keyctl_keyring_clear(key_serial_t ringid)
+{
+	struct key *keyring;
+	long ret;
+
+	keyring = lookup_user_key(ringid, 1, 0, KEY_WRITE);
+	if (IS_ERR(keyring)) {
+		ret = PTR_ERR(keyring);
+		goto error;
+	}
+
+	ret = keyring_clear(keyring);
+
+	key_put(keyring);
+ error:
+	return ret;
+
+} /* end keyctl_keyring_clear() */
+
+/*****************************************************************************/
+/*
+ * link a key into a keyring
+ * - the keyring must be writable
+ * - the key must be linkable
+ * - implements keyctl(KEYCTL_LINK)
+ */
+long keyctl_keyring_link(key_serial_t id, key_serial_t ringid)
+{
+	struct key *keyring, *key;
+	long ret;
+
+	keyring = lookup_user_key(ringid, 1, 0, KEY_WRITE);
+	if (IS_ERR(keyring)) {
+		ret = PTR_ERR(keyring);
+		goto error;
+	}
+
+	key = lookup_user_key(id, 1, 0, KEY_LINK);
+	if (IS_ERR(key)) {
+		ret = PTR_ERR(key);
+		goto error2;
+	}
+
+	ret = key_link(keyring, key);
+
+	key_put(key);
+ error2:
+	key_put(keyring);
+ error:
+	return ret;
+
+} /* end keyctl_keyring_link() */
+
+/*****************************************************************************/
+/*
+ * unlink the first attachment of a key from a keyring
+ * - the keyring must be writable
+ * - we don't need any permissions on the key
+ * - implements keyctl(KEYCTL_UNLINK)
+ */
+long keyctl_keyring_unlink(key_serial_t id, key_serial_t ringid)
+{
+	struct key *keyring, *key;
+	long ret;
+
+	keyring = lookup_user_key(ringid, 0, 0, KEY_WRITE);
+	if (IS_ERR(keyring)) {
+		ret = PTR_ERR(keyring);
+		goto error;
+	}
+
+	key = lookup_user_key(id, 0, 0, 0);
+	if (IS_ERR(key)) {
+		ret = PTR_ERR(key);
+		goto error2;
+	}
+
+	ret = key_unlink(keyring, key);
+
+	key_put(key);
+ error2:
+	key_put(keyring);
+ error:
+	return ret;
+
+} /* end keyctl_keyring_unlink() */
+
+/*****************************************************************************/
+/*
+ * describe a user key
+ * - the key must have view permission
+ * - if there's a buffer, we place up to buflen bytes of data into it
+ * - unless there's an error, we return the amount of description available,
+ *   irrespective of how much we may have copied
+ * - the description is formatted thus:
+ *	type;uid;gid;perm;description<NUL>
+ * - implements keyctl(KEYCTL_DESCRIBE)
+ */
+long keyctl_describe_key(key_serial_t keyid,
+			 char __user *buffer,
+			 size_t buflen)
+{
+	struct key *key;
+	char *tmpbuf;
+	long ret;
+
+	key = lookup_user_key(keyid, 0, 1, KEY_VIEW);
+	if (IS_ERR(key)) {
+		ret = PTR_ERR(key);
+		goto error;
+	}
+
+	/* calculate how much description we're going to return */
+	ret = -ENOMEM;
+	tmpbuf = kmalloc(PAGE_SIZE, GFP_KERNEL);
+	if (!tmpbuf)
+		goto error2;
+
+	ret = snprintf(tmpbuf, PAGE_SIZE - 1,
+		       "%s;%d;%d;%06x;%s",
+		       key->type->name,
+		       key->uid,
+		       key->gid,
+		       key->perm,
+		       key->description ? key->description :""
+		       );
+
+	/* include a NUL char at the end of the data */
+	if (ret > PAGE_SIZE - 1)
+		ret = PAGE_SIZE - 1;
+	tmpbuf[ret] = 0;
+	ret++;
+
+	/* consider returning the data */
+	if (buffer && buflen > 0) {
+		if (buflen > ret)
+			buflen = ret;
+
+		if (copy_to_user(buffer, tmpbuf, buflen) != 0)
+			ret = -EFAULT;
+	}
+
+	kfree(tmpbuf);
+ error2:
+	key_put(key);
+ error:
+	return ret;
+
+} /* end keyctl_describe_key() */
+
+/*****************************************************************************/
+/*
+ * search the specified keyring for a matching key
+ * - the start keyring must be searchable
+ * - nested keyrings may also be searched if they are searchable
+ * - only keys with search permission may be found
+ * - if a key is found, it will be attached to the destination keyring if
+ *   there's one specified
+ * - implements keyctl(KEYCTL_SEARCH)
+ */
+long keyctl_keyring_search(key_serial_t ringid,
+			   const char __user *_type,
+			   const char __user *_description,
+			   key_serial_t destringid)
+{
+	struct key_type *ktype;
+	struct key *keyring, *key, *dest;
+	char type[32], *description;
+	long dlen, ret;
+
+	/* pull the type and description into kernel space */
+	ret = strncpy_from_user(type, _type, sizeof(type) - 1);
+	if (ret < 0)
+		goto error;
+	type[31] = '\0';
+
+	ret = -EFAULT;
+	dlen = strnlen_user(_description, PAGE_SIZE - 1);
+	if (dlen <= 0)
+		goto error;
+
+	ret = -EINVAL;
+	if (dlen > PAGE_SIZE - 1)
+		goto error;
+
+	ret = -ENOMEM;
+	description = kmalloc(dlen + 1, GFP_KERNEL);
+	if (!description)
+		goto error;
+
+	ret = -EFAULT;
+	if (copy_from_user(description, _description, dlen + 1) != 0)
+		goto error2;
+
+	/* get the keyring at which to begin the search */
+	keyring = lookup_user_key(ringid, 0, 0, KEY_SEARCH);
+	if (IS_ERR(keyring)) {
+		ret = PTR_ERR(keyring);
+		goto error2;
+	}
+
+	/* get the destination keyring if specified */
+	dest = NULL;
+	if (destringid) {
+		dest = lookup_user_key(destringid, 1, 0, KEY_WRITE);
+		if (IS_ERR(dest)) {
+			ret = PTR_ERR(dest);
+			goto error3;
+		}
+	}
+
+	/* find the key type */
+	ktype = key_type_lookup(type);
+	if (IS_ERR(ktype)) {
+		ret = PTR_ERR(ktype);
+		goto error4;
+	}
+
+	/* do the search */
+	key = keyring_search(keyring, ktype, description);
+	if (IS_ERR(key)) {
+		ret = PTR_ERR(key);
+
+		/* treat lack or presence of a negative key the same */
+		if (ret == -EAGAIN)
+			ret = -ENOKEY;
+		goto error5;
+	}
+
+	/* link the resulting key to the destination keyring if we can */
+	if (dest) {
+		ret = -EACCES;
+		if (!key_permission(key, KEY_LINK))
+			goto error6;
+
+		ret = key_link(dest, key);
+		if (ret < 0)
+			goto error6;
+	}
+
+	ret = key->serial;
+
+ error6:
+	key_put(key);
+ error5:
+	key_type_put(ktype);
+ error4:
+	key_put(dest);
+ error3:
+	key_put(keyring);
+ error2:
+	kfree(description);
+ error:
+	return ret;
+
+} /* end keyctl_keyring_search() */
+
+/*****************************************************************************/
+/*
+ * see if the key we're looking at is the target key
+ */
+static int keyctl_read_key_same(const struct key *key, const void *target)
+{
+	return key == target;
+
+} /* end keyctl_read_key_same() */
+
+/*****************************************************************************/
+/*
+ * read a user key's payload
+ * - the keyring must be readable or the key must be searchable from the
+ *   process's keyrings
+ * - if there's a buffer, we place up to buflen bytes of data into it
+ * - unless there's an error, we return the amount of data in the key,
+ *   irrespective of how much we may have copied
+ * - implements keyctl(KEYCTL_READ)
+ */
+long keyctl_read_key(key_serial_t keyid, char __user *buffer, size_t buflen)
+{
+	struct key *key, *skey;
+	long ret;
+
+	/* find the key first */
+	key = lookup_user_key(keyid, 0, 0, 0);
+	if (!IS_ERR(key)) {
+		/* see if we can read it directly */
+		if (key_permission(key, KEY_READ))
+			goto can_read_key;
+
+		/* can't; see if it's searchable from this process's
+		 * keyrings */
+		ret = -ENOKEY;
+		if (key_permission(key, KEY_SEARCH)) {
+			/* okay - we do have search permission on the key
+			 * itself, but do we have the key? */
+			skey = search_process_keyrings_aux(key->type, key,
+							   keyctl_read_key_same);
+			if (!IS_ERR(skey))
+				goto can_read_key2;
+		}
+
+		goto error2;
+	}
+
+	ret = -ENOKEY;
+	goto error;
+
+	/* the key is probably readable - now try to read it */
+ can_read_key2:
+	key_put(skey);
+ can_read_key:
+	ret = key_validate(key);
+	if (ret == 0) {
+		ret = -EOPNOTSUPP;
+		if (key->type->read) {
+			/* read the data with the semaphore held (since we
+			 * might sleep) */
+			down_read(&key->sem);
+			ret = key->type->read(key, buffer, buflen);
+			up_read(&key->sem);
+		}
+	}
+
+ error2:
+	key_put(key);
+ error:
+	return ret;
+
+} /* end keyctl_read_key() */
+
+/*****************************************************************************/
+/*
+ * change the ownership of a key
+ * - the keyring owned by the changer
+ * - if the uid or gid is -1, then that parameter is not changed
+ * - implements keyctl(KEYCTL_CHOWN)
+ */
+long keyctl_chown_key(key_serial_t id, uid_t uid, gid_t gid)
+{
+	struct key *key;
+	long ret;
+
+	ret = 0;
+	if (uid == (uid_t) -1 && gid == (gid_t) -1)
+		goto error;
+
+	key = lookup_user_key(id, 1, 1, 0);
+	if (IS_ERR(key)) {
+		ret = PTR_ERR(key);
+		goto error;
+	}
+
+	/* make the changes with the locks held to prevent chown/chown races */
+	ret = -EACCES;
+	down_write(&key->sem);
+	write_lock(&key->lock);
+
+	if (!capable(CAP_SYS_ADMIN)) {
+		/* only the sysadmin can chown a key to some other UID */
+		if (uid != (uid_t) -1 && key->uid != uid)
+			goto no_access;
+
+		/* only the sysadmin can set the key's GID to a group other
+		 * than one of those that the current process subscribes to */
+		if (gid != (gid_t) -1 && gid != key->gid && !in_group_p(gid))
+			goto no_access;
+	}
+
+	/* change the UID (have to update the quotas) */
+	if (uid != (uid_t) -1 && uid != key->uid) {
+		/* don't support UID changing yet */
+		ret = -EOPNOTSUPP;
+		goto no_access;
+	}
+
+	/* change the GID */
+	if (gid != (gid_t) -1)
+		key->gid = gid;
+
+	ret = 0;
+
+ no_access:
+	write_unlock(&key->lock);
+	up_write(&key->sem);
+	key_put(key);
+ error:
+	return ret;
+
+} /* end keyctl_chown_key() */
+
+/*****************************************************************************/
+/*
+ * change the permission mask on a key
+ * - the keyring owned by the changer
+ * - implements keyctl(KEYCTL_SETPERM)
+ */
+long keyctl_setperm_key(key_serial_t id, key_perm_t perm)
+{
+	struct key *key;
+	long ret;
+
+	ret = -EINVAL;
+	if (perm & ~(KEY_USR_ALL | KEY_GRP_ALL | KEY_OTH_ALL))
+		goto error;
+
+	key = lookup_user_key(id, 1, 1, 0);
+	if (IS_ERR(key)) {
+		ret = PTR_ERR(key);
+		goto error;
+	}
+
+	/* make the changes with the locks held to prevent chown/chmod
+	 * races */
+	ret = -EACCES;
+	down_write(&key->sem);
+	write_lock(&key->lock);
+
+	/* if we're not the sysadmin, we can only chmod a key that we
+	 * own */
+	if (!capable(CAP_SYS_ADMIN) && key->uid != current->fsuid)
+		goto no_access;
+
+	/* changing the permissions mask */
+	key->perm = perm;
+	ret = 0;
+
+ no_access:
+	write_unlock(&key->lock);
+	up_write(&key->sem);
+	key_put(key);
+ error:
+	return ret;
+
+} /* end keyctl_setperm_key() */
+
+/*****************************************************************************/
+/*
+ * instantiate the key with the specified payload, and, if one is given, link
+ * the key into the keyring
+ */
+long keyctl_instantiate_key(key_serial_t id,
+			    const void __user *_payload,
+			    size_t plen,
+			    key_serial_t ringid)
+{
+	struct key *key, *keyring;
+	void *payload;
+	long ret;
+
+	ret = -EINVAL;
+	if (plen > 32767)
+		goto error;
+
+	/* pull the payload in if one was supplied */
+	payload = NULL;
+
+	if (_payload) {
+		ret = -ENOMEM;
+		payload = kmalloc(plen, GFP_KERNEL);
+		if (!payload)
+			goto error;
+
+		ret = -EFAULT;
+		if (copy_from_user(payload, _payload, plen) != 0)
+			goto error2;
+	}
+
+	/* find the target key (which must be writable) */
+	key = lookup_user_key(id, 0, 1, KEY_WRITE);
+	if (IS_ERR(key)) {
+		ret = PTR_ERR(key);
+		goto error2;
+	}
+
+	/* find the destination keyring if present (which must also be
+	 * writable) */
+	keyring = NULL;
+	if (ringid) {
+		keyring = lookup_user_key(ringid, 1, 0, KEY_WRITE);
+		if (IS_ERR(keyring)) {
+			ret = PTR_ERR(keyring);
+			goto error3;
+		}
+	}
+
+	/* instantiate the key and link it into a keyring */
+	ret = key_instantiate_and_link(key, payload, plen, keyring);
+
+	key_put(keyring);
+ error3:
+	key_put(key);
+ error2:
+	kfree(payload);
+ error:
+	return ret;
+
+} /* end keyctl_instantiate_key() */
+
+/*****************************************************************************/
+/*
+ * negatively instantiate the key with the given timeout (in seconds), and, if
+ * one is given, link the key into the keyring
+ */
+long keyctl_negate_key(key_serial_t id, unsigned timeout, key_serial_t ringid)
+{
+	struct key *key, *keyring;
+	long ret;
+
+	/* find the target key (which must be writable) */
+	key = lookup_user_key(id, 0, 1, KEY_WRITE);
+	if (IS_ERR(key)) {
+		ret = PTR_ERR(key);
+		goto error;
+	}
+
+	/* find the destination keyring if present (which must also be
+	 * writable) */
+	keyring = NULL;
+	if (ringid) {
+		keyring = lookup_user_key(ringid, 1, 0, KEY_WRITE);
+		if (IS_ERR(keyring)) {
+			ret = PTR_ERR(keyring);
+			goto error2;
+		}
+	}
+
+	/* instantiate the key and link it into a keyring */
+	ret = key_negate_and_link(key, timeout, keyring);
+
+	key_put(keyring);
+ error2:
+	key_put(key);
+ error:
+	return ret;
+
+} /* end keyctl_negate_key() */
+
+/*****************************************************************************/
+/*
+ * the key control system call
+ */
+asmlinkage long sys_keyctl(int option, unsigned long arg2, unsigned long arg3,
+			   unsigned long arg4, unsigned long arg5)
+{
+	switch (option) {
+	case KEYCTL_GET_KEYRING_ID:
+		return keyctl_get_keyring_ID((key_serial_t) arg2,
+					     (int) arg3);
+
+	case KEYCTL_JOIN_SESSION_KEYRING:
+		return keyctl_join_session_keyring((const char __user *) arg2);
+
+	case KEYCTL_UPDATE:
+		return keyctl_update_key((key_serial_t) arg2,
+					 (const void __user *) arg3,
+					 (size_t) arg4);
+
+	case KEYCTL_REVOKE:
+		return keyctl_revoke_key((key_serial_t) arg2);
+
+	case KEYCTL_DESCRIBE:
+		return keyctl_describe_key((key_serial_t) arg2,
+					   (char __user *) arg3,
+					   (unsigned) arg4);
+
+	case KEYCTL_CLEAR:
+		return keyctl_keyring_clear((key_serial_t) arg2);
+
+	case KEYCTL_LINK:
+		return keyctl_keyring_link((key_serial_t) arg2,
+					   (key_serial_t) arg3);
+
+	case KEYCTL_UNLINK:
+		return keyctl_keyring_unlink((key_serial_t) arg2,
+					     (key_serial_t) arg3);
+
+	case KEYCTL_SEARCH:
+		return keyctl_keyring_search((key_serial_t) arg2,
+					     (const char __user *) arg3,
+					     (const char __user *) arg4,
+					     (key_serial_t) arg5);
+
+	case KEYCTL_READ:
+		return keyctl_read_key((key_serial_t) arg2,
+				       (char __user *) arg3,
+				       (size_t) arg4);
+
+	case KEYCTL_CHOWN:
+		return keyctl_chown_key((key_serial_t) arg2,
+					(uid_t) arg3,
+					(gid_t) arg4);
+
+	case KEYCTL_SETPERM:
+		return keyctl_setperm_key((key_serial_t) arg2,
+					  (key_perm_t) arg3);
+
+	case KEYCTL_INSTANTIATE:
+		return keyctl_instantiate_key((key_serial_t) arg2,
+					      (const void __user *) arg3,
+					      (size_t) arg4,
+					      (key_serial_t) arg5);
+
+	case KEYCTL_NEGATE:
+		return keyctl_negate_key((key_serial_t) arg2,
+					 (unsigned) arg3,
+					 (key_serial_t) arg4);
+
+	default:
+		return -EOPNOTSUPP;
+	}
+
+} /* end sys_keyctl() */