diff --git a/LICENCE.GPL b/LICENCE.GPL
new file mode 100644
index 0000000..4505352
--- /dev/null
+++ b/LICENCE.GPL
@@ -0,0 +1,339 @@
+		    GNU GENERAL PUBLIC LICENSE
+		       Version 2, June 1991
+
+ Copyright (C) 1989, 1991 Free Software Foundation, Inc. <http://fsf.org/>
+     51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+			    Preamble
+
+  The licenses for most software are designed to take away your
+freedom to share and change it.  By contrast, the GNU General Public
+License is intended to guarantee your freedom to share and change free
+software--to make sure the software is free for all its users.  This
+General Public License applies to most of the Free Software
+Foundation's software and to any other program whose authors commit to
+using it.  (Some other Free Software Foundation software is covered by
+the GNU Library General Public License instead.)  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+this service if you wish), that you receive source code or can get it
+if you want it, that you can change the software or use pieces of it
+in new free programs; and that you know you can do these things.
+
+  To protect your rights, we need to make restrictions that forbid
+anyone to deny you these rights or to ask you to surrender the rights.
+These restrictions translate to certain responsibilities for you if you
+distribute copies of the software, or if you modify it.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must give the recipients all the rights that
+you have.  You must make sure that they, too, receive or can get the
+source code.  And you must show them these terms so they know their
+rights.
+
+  We protect your rights with two steps: (1) copyright the software, and
+(2) offer you this license which gives you legal permission to copy,
+distribute and/or modify the software.
+
+  Also, for each author's protection and ours, we want to make certain
+that everyone understands that there is no warranty for this free
+software.  If the software is modified by someone else and passed on, we
+want its recipients to know that what they have is not the original, so
+that any problems introduced by others will not reflect on the original
+authors' reputations.
+
+  Finally, any free program is threatened constantly by software
+patents.  We wish to avoid the danger that redistributors of a free
+program will individually obtain patent licenses, in effect making the
+program proprietary.  To prevent this, we have made it clear that any
+patent must be licensed for everyone's free use or not licensed at all.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+		    GNU GENERAL PUBLIC LICENSE
+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+  0. This License applies to any program or other work which contains
+a notice placed by the copyright holder saying it may be distributed
+under the terms of this General Public License.  The "Program", below,
+refers to any such program or work, and a "work based on the Program"
+means either the Program or any derivative work under copyright law:
+that is to say, a work containing the Program or a portion of it,
+either verbatim or with modifications and/or translated into another
+language.  (Hereinafter, translation is included without limitation in
+the term "modification".)  Each licensee is addressed as "you".
+
+Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope.  The act of
+running the Program is not restricted, and the output from the Program
+is covered only if its contents constitute a work based on the
+Program (independent of having been made by running the Program).
+Whether that is true depends on what the Program does.
+
+  1. You may copy and distribute verbatim copies of the Program's
+source code as you receive it, in any medium, provided that you
+conspicuously and appropriately publish on each copy an appropriate
+copyright notice and disclaimer of warranty; keep intact all the
+notices that refer to this License and to the absence of any warranty;
+and give any other recipients of the Program a copy of this License
+along with the Program.
+
+You may charge a fee for the physical act of transferring a copy, and
+you may at your option offer warranty protection in exchange for a fee.
+
+  2. You may modify your copy or copies of the Program or any portion
+of it, thus forming a work based on the Program, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+    a) You must cause the modified files to carry prominent notices
+    stating that you changed the files and the date of any change.
+
+    b) You must cause any work that you distribute or publish, that in
+    whole or in part contains or is derived from the Program or any
+    part thereof, to be licensed as a whole at no charge to all third
+    parties under the terms of this License.
+
+    c) If the modified program normally reads commands interactively
+    when run, you must cause it, when started running for such
+    interactive use in the most ordinary way, to print or display an
+    announcement including an appropriate copyright notice and a
+    notice that there is no warranty (or else, saying that you provide
+    a warranty) and that users may redistribute the program under
+    these conditions, and telling the user how to view a copy of this
+    License.  (Exception: if the Program itself is interactive but
+    does not normally print such an announcement, your work based on
+    the Program is not required to print an announcement.)
+
+These requirements apply to the modified work as a whole.  If
+identifiable sections of that work are not derived from the Program,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works.  But when you
+distribute the same sections as part of a whole which is a work based
+on the Program, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Program.
+
+In addition, mere aggregation of another work not based on the Program
+with the Program (or with a work based on the Program) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+  3. You may copy and distribute the Program (or a work based on it,
+under Section 2) in object code or executable form under the terms of
+Sections 1 and 2 above provided that you also do one of the following:
+
+    a) Accompany it with the complete corresponding machine-readable
+    source code, which must be distributed under the terms of Sections
+    1 and 2 above on a medium customarily used for software interchange; or,
+
+    b) Accompany it with a written offer, valid for at least three
+    years, to give any third party, for a charge no more than your
+    cost of physically performing source distribution, a complete
+    machine-readable copy of the corresponding source code, to be
+    distributed under the terms of Sections 1 and 2 above on a medium
+    customarily used for software interchange; or,
+
+    c) Accompany it with the information you received as to the offer
+    to distribute corresponding source code.  (This alternative is
+    allowed only for noncommercial distribution and only if you
+    received the program in object code or executable form with such
+    an offer, in accord with Subsection b above.)
+
+The source code for a work means the preferred form of the work for
+making modifications to it.  For an executable work, complete source
+code means all the source code for all modules it contains, plus any
+associated interface definition files, plus the scripts used to
+control compilation and installation of the executable.  However, as a
+special exception, the source code distributed need not include
+anything that is normally distributed (in either source or binary
+form) with the major components (compiler, kernel, and so on) of the
+operating system on which the executable runs, unless that component
+itself accompanies the executable.
+
+If distribution of executable or object code is made by offering
+access to copy from a designated place, then offering equivalent
+access to copy the source code from the same place counts as
+distribution of the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+  4. You may not copy, modify, sublicense, or distribute the Program
+except as expressly provided under this License.  Any attempt
+otherwise to copy, modify, sublicense or distribute the Program is
+void, and will automatically terminate your rights under this License.
+However, parties who have received copies, or rights, from you under
+this License will not have their licenses terminated so long as such
+parties remain in full compliance.
+
+  5. You are not required to accept this License, since you have not
+signed it.  However, nothing else grants you permission to modify or
+distribute the Program or its derivative works.  These actions are
+prohibited by law if you do not accept this License.  Therefore, by
+modifying or distributing the Program (or any work based on the
+Program), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Program or works based on it.
+
+  6. Each time you redistribute the Program (or any work based on the
+Program), the recipient automatically receives a license from the
+original licensor to copy, distribute or modify the Program subject to
+these terms and conditions.  You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties to
+this License.
+
+  7. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Program at all.  For example, if a patent
+license would not permit royalty-free redistribution of the Program by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Program.
+
+If any portion of this section is held invalid or unenforceable under
+any particular circumstance, the balance of the section is intended to
+apply and the section as a whole is intended to apply in other
+circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system, which is
+implemented by public license practices.  Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+  8. If the distribution and/or use of the Program is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Program under this License
+may add an explicit geographical distribution limitation excluding
+those countries, so that distribution is permitted only in or among
+countries not thus excluded.  In such case, this License incorporates
+the limitation as if written in the body of this License.
+
+  9. The Free Software Foundation may publish revised and/or new versions
+of the General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+Each version is given a distinguishing version number.  If the Program
+specifies a version number of this License which applies to it and "any
+later version", you have the option of following the terms and conditions
+either of that version or of any later version published by the Free
+Software Foundation.  If the Program does not specify a version number of
+this License, you may choose any version ever published by the Free Software
+Foundation.
+
+  10. If you wish to incorporate parts of the Program into other free
+programs whose distribution conditions are different, write to the author
+to ask for permission.  For software which is copyrighted by the Free
+Software Foundation, write to the Free Software Foundation; we sometimes
+make exceptions for this.  Our decision will be guided by the two goals
+of preserving the free status of all derivatives of our free software and
+of promoting the sharing and reuse of software generally.
+
+			    NO WARRANTY
+
+  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
+FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
+OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
+PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
+OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
+TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
+PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
+REPAIR OR CORRECTION.
+
+  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
+REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
+INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
+OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
+TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
+YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
+PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGES.
+
+		     END OF TERMS AND CONDITIONS
+
+	Appendix: How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+convey the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) 19yy  <name of author>
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program; if not, write to the Free Software
+    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+
+Also add information on how to contact you by electronic and paper mail.
+
+If the program is interactive, make it output a short notice like this
+when it starts in an interactive mode:
+
+    Gnomovision version 69, Copyright (C) 19yy name of author
+    Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, the commands you use may
+be called something other than `show w' and `show c'; they could even be
+mouse-clicks or menu items--whatever suits your program.
+
+You should also get your employer (if you work as a programmer) or your
+school, if any, to sign a "copyright disclaimer" for the program, if
+necessary.  Here is a sample; alter the names:
+
+  Yoyodyne, Inc., hereby disclaims all copyright interest in the program
+  `Gnomovision' (which makes passes at compilers) written by James Hacker.
+
+  <signature of Ty Coon>, 1 April 1989
+  Ty Coon, President of Vice
+
+This General Public License does not permit incorporating your program into
+proprietary programs.  If your program is a subroutine library, you may
+consider it more useful to permit linking proprietary applications with the
+library.  If this is what you want to do, use the GNU Library General
+Public License instead of this License.
diff --git a/LICENCE.LGPL b/LICENCE.LGPL
new file mode 100644
index 0000000..519334a
--- /dev/null
+++ b/LICENCE.LGPL
@@ -0,0 +1,504 @@
+		  GNU LESSER GENERAL PUBLIC LICENSE
+		       Version 2.1, February 1999
+
+ Copyright (C) 1991, 1999 Free Software Foundation, Inc. <http://fsf.org/>
+     51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+[This is the first released version of the Lesser GPL.  It also counts
+ as the successor of the GNU Library Public License, version 2, hence
+ the version number 2.1.]
+
+			    Preamble
+
+  The licenses for most software are designed to take away your
+freedom to share and change it.  By contrast, the GNU General Public
+Licenses are intended to guarantee your freedom to share and change
+free software--to make sure the software is free for all its users.
+
+  This license, the Lesser General Public License, applies to some
+specially designated software packages--typically libraries--of the
+Free Software Foundation and other authors who decide to use it.  You
+can use it too, but we suggest you first think carefully about whether
+this license or the ordinary General Public License is the better
+strategy to use in any particular case, based on the explanations below.
+
+  When we speak of free software, we are referring to freedom of use,
+not price.  Our General Public Licenses are designed to make sure that
+you have the freedom to distribute copies of free software (and charge
+for this service if you wish); that you receive source code or can get
+it if you want it; that you can change the software and use pieces of
+it in new free programs; and that you are informed that you can do
+these things.
+
+  To protect your rights, we need to make restrictions that forbid
+distributors to deny you these rights or to ask you to surrender these
+rights.  These restrictions translate to certain responsibilities for
+you if you distribute copies of the library or if you modify it.
+
+  For example, if you distribute copies of the library, whether gratis
+or for a fee, you must give the recipients all the rights that we gave
+you.  You must make sure that they, too, receive or can get the source
+code.  If you link other code with the library, you must provide
+complete object files to the recipients, so that they can relink them
+with the library after making changes to the library and recompiling
+it.  And you must show them these terms so they know their rights.
+
+  We protect your rights with a two-step method: (1) we copyright the
+library, and (2) we offer you this license, which gives you legal
+permission to copy, distribute and/or modify the library.
+
+  To protect each distributor, we want to make it very clear that
+there is no warranty for the free library.  Also, if the library is
+modified by someone else and passed on, the recipients should know
+that what they have is not the original version, so that the original
+author's reputation will not be affected by problems that might be
+introduced by others.
+
+  Finally, software patents pose a constant threat to the existence of
+any free program.  We wish to make sure that a company cannot
+effectively restrict the users of a free program by obtaining a
+restrictive license from a patent holder.  Therefore, we insist that
+any patent license obtained for a version of the library must be
+consistent with the full freedom of use specified in this license.
+
+  Most GNU software, including some libraries, is covered by the
+ordinary GNU General Public License.  This license, the GNU Lesser
+General Public License, applies to certain designated libraries, and
+is quite different from the ordinary General Public License.  We use
+this license for certain libraries in order to permit linking those
+libraries into non-free programs.
+
+  When a program is linked with a library, whether statically or using
+a shared library, the combination of the two is legally speaking a
+combined work, a derivative of the original library.  The ordinary
+General Public License therefore permits such linking only if the
+entire combination fits its criteria of freedom.  The Lesser General
+Public License permits more lax criteria for linking other code with
+the library.
+
+  We call this license the "Lesser" General Public License because it
+does Less to protect the user's freedom than the ordinary General
+Public License.  It also provides other free software developers Less
+of an advantage over competing non-free programs.  These disadvantages
+are the reason we use the ordinary General Public License for many
+libraries.  However, the Lesser license provides advantages in certain
+special circumstances.
+
+  For example, on rare occasions, there may be a special need to
+encourage the widest possible use of a certain library, so that it becomes
+a de-facto standard.  To achieve this, non-free programs must be
+allowed to use the library.  A more frequent case is that a free
+library does the same job as widely used non-free libraries.  In this
+case, there is little to gain by limiting the free library to free
+software only, so we use the Lesser General Public License.
+
+  In other cases, permission to use a particular library in non-free
+programs enables a greater number of people to use a large body of
+free software.  For example, permission to use the GNU C Library in
+non-free programs enables many more people to use the whole GNU
+operating system, as well as its variant, the GNU/Linux operating
+system.
+
+  Although the Lesser General Public License is Less protective of the
+users' freedom, it does ensure that the user of a program that is
+linked with the Library has the freedom and the wherewithal to run
+that program using a modified version of the Library.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.  Pay close attention to the difference between a
+"work based on the library" and a "work that uses the library".  The
+former contains code derived from the library, whereas the latter must
+be combined with the library in order to run.
+
+		  GNU LESSER GENERAL PUBLIC LICENSE
+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+  0. This License Agreement applies to any software library or other
+program which contains a notice placed by the copyright holder or
+other authorized party saying it may be distributed under the terms of
+this Lesser General Public License (also called "this License").
+Each licensee is addressed as "you".
+
+  A "library" means a collection of software functions and/or data
+prepared so as to be conveniently linked with application programs
+(which use some of those functions and data) to form executables.
+
+  The "Library", below, refers to any such software library or work
+which has been distributed under these terms.  A "work based on the
+Library" means either the Library or any derivative work under
+copyright law: that is to say, a work containing the Library or a
+portion of it, either verbatim or with modifications and/or translated
+straightforwardly into another language.  (Hereinafter, translation is
+included without limitation in the term "modification".)
+
+  "Source code" for a work means the preferred form of the work for
+making modifications to it.  For a library, complete source code means
+all the source code for all modules it contains, plus any associated
+interface definition files, plus the scripts used to control compilation
+and installation of the library.
+
+  Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope.  The act of
+running a program using the Library is not restricted, and output from
+such a program is covered only if its contents constitute a work based
+on the Library (independent of the use of the Library in a tool for
+writing it).  Whether that is true depends on what the Library does
+and what the program that uses the Library does.
+  
+  1. You may copy and distribute verbatim copies of the Library's
+complete source code as you receive it, in any medium, provided that
+you conspicuously and appropriately publish on each copy an
+appropriate copyright notice and disclaimer of warranty; keep intact
+all the notices that refer to this License and to the absence of any
+warranty; and distribute a copy of this License along with the
+Library.
+
+  You may charge a fee for the physical act of transferring a copy,
+and you may at your option offer warranty protection in exchange for a
+fee.
+
+  2. You may modify your copy or copies of the Library or any portion
+of it, thus forming a work based on the Library, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+    a) The modified work must itself be a software library.
+
+    b) You must cause the files modified to carry prominent notices
+    stating that you changed the files and the date of any change.
+
+    c) You must cause the whole of the work to be licensed at no
+    charge to all third parties under the terms of this License.
+
+    d) If a facility in the modified Library refers to a function or a
+    table of data to be supplied by an application program that uses
+    the facility, other than as an argument passed when the facility
+    is invoked, then you must make a good faith effort to ensure that,
+    in the event an application does not supply such function or
+    table, the facility still operates, and performs whatever part of
+    its purpose remains meaningful.
+
+    (For example, a function in a library to compute square roots has
+    a purpose that is entirely well-defined independent of the
+    application.  Therefore, Subsection 2d requires that any
+    application-supplied function or table used by this function must
+    be optional: if the application does not supply it, the square
+    root function must still compute square roots.)
+
+These requirements apply to the modified work as a whole.  If
+identifiable sections of that work are not derived from the Library,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works.  But when you
+distribute the same sections as part of a whole which is a work based
+on the Library, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote
+it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Library.
+
+In addition, mere aggregation of another work not based on the Library
+with the Library (or with a work based on the Library) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+  3. You may opt to apply the terms of the ordinary GNU General Public
+License instead of this License to a given copy of the Library.  To do
+this, you must alter all the notices that refer to this License, so
+that they refer to the ordinary GNU General Public License, version 2,
+instead of to this License.  (If a newer version than version 2 of the
+ordinary GNU General Public License has appeared, then you can specify
+that version instead if you wish.)  Do not make any other change in
+these notices.
+
+  Once this change is made in a given copy, it is irreversible for
+that copy, so the ordinary GNU General Public License applies to all
+subsequent copies and derivative works made from that copy.
+
+  This option is useful when you wish to copy part of the code of
+the Library into a program that is not a library.
+
+  4. You may copy and distribute the Library (or a portion or
+derivative of it, under Section 2) in object code or executable form
+under the terms of Sections 1 and 2 above provided that you accompany
+it with the complete corresponding machine-readable source code, which
+must be distributed under the terms of Sections 1 and 2 above on a
+medium customarily used for software interchange.
+
+  If distribution of object code is made by offering access to copy
+from a designated place, then offering equivalent access to copy the
+source code from the same place satisfies the requirement to
+distribute the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+  5. A program that contains no derivative of any portion of the
+Library, but is designed to work with the Library by being compiled or
+linked with it, is called a "work that uses the Library".  Such a
+work, in isolation, is not a derivative work of the Library, and
+therefore falls outside the scope of this License.
+
+  However, linking a "work that uses the Library" with the Library
+creates an executable that is a derivative of the Library (because it
+contains portions of the Library), rather than a "work that uses the
+library".  The executable is therefore covered by this License.
+Section 6 states terms for distribution of such executables.
+
+  When a "work that uses the Library" uses material from a header file
+that is part of the Library, the object code for the work may be a
+derivative work of the Library even though the source code is not.
+Whether this is true is especially significant if the work can be
+linked without the Library, or if the work is itself a library.  The
+threshold for this to be true is not precisely defined by law.
+
+  If such an object file uses only numerical parameters, data
+structure layouts and accessors, and small macros and small inline
+functions (ten lines or less in length), then the use of the object
+file is unrestricted, regardless of whether it is legally a derivative
+work.  (Executables containing this object code plus portions of the
+Library will still fall under Section 6.)
+
+  Otherwise, if the work is a derivative of the Library, you may
+distribute the object code for the work under the terms of Section 6.
+Any executables containing that work also fall under Section 6,
+whether or not they are linked directly with the Library itself.
+
+  6. As an exception to the Sections above, you may also combine or
+link a "work that uses the Library" with the Library to produce a
+work containing portions of the Library, and distribute that work
+under terms of your choice, provided that the terms permit
+modification of the work for the customer's own use and reverse
+engineering for debugging such modifications.
+
+  You must give prominent notice with each copy of the work that the
+Library is used in it and that the Library and its use are covered by
+this License.  You must supply a copy of this License.  If the work
+during execution displays copyright notices, you must include the
+copyright notice for the Library among them, as well as a reference
+directing the user to the copy of this License.  Also, you must do one
+of these things:
+
+    a) Accompany the work with the complete corresponding
+    machine-readable source code for the Library including whatever
+    changes were used in the work (which must be distributed under
+    Sections 1 and 2 above); and, if the work is an executable linked
+    with the Library, with the complete machine-readable "work that
+    uses the Library", as object code and/or source code, so that the
+    user can modify the Library and then relink to produce a modified
+    executable containing the modified Library.  (It is understood
+    that the user who changes the contents of definitions files in the
+    Library will not necessarily be able to recompile the application
+    to use the modified definitions.)
+
+    b) Use a suitable shared library mechanism for linking with the
+    Library.  A suitable mechanism is one that (1) uses at run time a
+    copy of the library already present on the user's computer system,
+    rather than copying library functions into the executable, and (2)
+    will operate properly with a modified version of the library, if
+    the user installs one, as long as the modified version is
+    interface-compatible with the version that the work was made with.
+
+    c) Accompany the work with a written offer, valid for at
+    least three years, to give the same user the materials
+    specified in Subsection 6a, above, for a charge no more
+    than the cost of performing this distribution.
+
+    d) If distribution of the work is made by offering access to copy
+    from a designated place, offer equivalent access to copy the above
+    specified materials from the same place.
+
+    e) Verify that the user has already received a copy of these
+    materials or that you have already sent this user a copy.
+
+  For an executable, the required form of the "work that uses the
+Library" must include any data and utility programs needed for
+reproducing the executable from it.  However, as a special exception,
+the materials to be distributed need not include anything that is
+normally distributed (in either source or binary form) with the major
+components (compiler, kernel, and so on) of the operating system on
+which the executable runs, unless that component itself accompanies
+the executable.
+
+  It may happen that this requirement contradicts the license
+restrictions of other proprietary libraries that do not normally
+accompany the operating system.  Such a contradiction means you cannot
+use both them and the Library together in an executable that you
+distribute.
+
+  7. You may place library facilities that are a work based on the
+Library side-by-side in a single library together with other library
+facilities not covered by this License, and distribute such a combined
+library, provided that the separate distribution of the work based on
+the Library and of the other library facilities is otherwise
+permitted, and provided that you do these two things:
+
+    a) Accompany the combined library with a copy of the same work
+    based on the Library, uncombined with any other library
+    facilities.  This must be distributed under the terms of the
+    Sections above.
+
+    b) Give prominent notice with the combined library of the fact
+    that part of it is a work based on the Library, and explaining
+    where to find the accompanying uncombined form of the same work.
+
+  8. You may not copy, modify, sublicense, link with, or distribute
+the Library except as expressly provided under this License.  Any
+attempt otherwise to copy, modify, sublicense, link with, or
+distribute the Library is void, and will automatically terminate your
+rights under this License.  However, parties who have received copies,
+or rights, from you under this License will not have their licenses
+terminated so long as such parties remain in full compliance.
+
+  9. You are not required to accept this License, since you have not
+signed it.  However, nothing else grants you permission to modify or
+distribute the Library or its derivative works.  These actions are
+prohibited by law if you do not accept this License.  Therefore, by
+modifying or distributing the Library (or any work based on the
+Library), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Library or works based on it.
+
+  10. Each time you redistribute the Library (or any work based on the
+Library), the recipient automatically receives a license from the
+original licensor to copy, distribute, link with or modify the Library
+subject to these terms and conditions.  You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties with
+this License.
+
+  11. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Library at all.  For example, if a patent
+license would not permit royalty-free redistribution of the Library by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Library.
+
+If any portion of this section is held invalid or unenforceable under any
+particular circumstance, the balance of the section is intended to apply,
+and the section as a whole is intended to apply in other circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system which is
+implemented by public license practices.  Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+  12. If the distribution and/or use of the Library is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Library under this License may add
+an explicit geographical distribution limitation excluding those countries,
+so that distribution is permitted only in or among countries not thus
+excluded.  In such case, this License incorporates the limitation as if
+written in the body of this License.
+
+  13. The Free Software Foundation may publish revised and/or new
+versions of the Lesser General Public License from time to time.
+Such new versions will be similar in spirit to the present version,
+but may differ in detail to address new problems or concerns.
+
+Each version is given a distinguishing version number.  If the Library
+specifies a version number of this License which applies to it and
+"any later version", you have the option of following the terms and
+conditions either of that version or of any later version published by
+the Free Software Foundation.  If the Library does not specify a
+license version number, you may choose any version ever published by
+the Free Software Foundation.
+
+  14. If you wish to incorporate parts of the Library into other free
+programs whose distribution conditions are incompatible with these,
+write to the author to ask for permission.  For software which is
+copyrighted by the Free Software Foundation, write to the Free
+Software Foundation; we sometimes make exceptions for this.  Our
+decision will be guided by the two goals of preserving the free status
+of all derivatives of our free software and of promoting the sharing
+and reuse of software generally.
+
+			    NO WARRANTY
+
+  15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO
+WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW.
+EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR
+OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY
+KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE
+LIBRARY IS WITH YOU.  SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME
+THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN
+WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY
+AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU
+FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR
+CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE
+LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING
+RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A
+FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF
+SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH
+DAMAGES.
+
+		     END OF TERMS AND CONDITIONS
+
+           How to Apply These Terms to Your New Libraries
+
+  If you develop a new library, and you want it to be of the greatest
+possible use to the public, we recommend making it free software that
+everyone can redistribute and change.  You can do so by permitting
+redistribution under these terms (or, alternatively, under the terms of the
+ordinary General Public License).
+
+  To apply these terms, attach the following notices to the library.  It is
+safest to attach them to the start of each source file to most effectively
+convey the exclusion of warranty; and each file should have at least the
+"copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the library's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Lesser General Public
+    License as published by the Free Software Foundation; either
+    version 2.1 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Lesser General Public License for more details.
+
+    You should have received a copy of the GNU Lesser General Public
+    License along with this library; if not, write to the Free Software
+    Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+
+Also add information on how to contact you by electronic and paper mail.
+
+You should also get your employer (if you work as a programmer) or your
+school, if any, to sign a "copyright disclaimer" for the library, if
+necessary.  Here is a sample; alter the names:
+
+  Yoyodyne, Inc., hereby disclaims all copyright interest in the
+  library `Frob' (a library for tweaking knobs) written by James Random Hacker.
+
+  <signature of Ty Coon>, 1 April 1990
+  Ty Coon, President of Vice
+
+That's all there is to it!
+
+
diff --git a/Makefile b/Makefile
new file mode 100644
index 0000000..824bbbf
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,285 @@
+CPPFLAGS	:= -I.
+CFLAGS		:= -g -Wall -Werror
+INSTALL		:= install
+DESTDIR		:=
+SPECFILE	:= keyutils.spec
+NO_GLIBC_KEYERR	:= 0
+NO_ARLIB	:= 0
+NO_SOLIB	:= 0
+ETCDIR		:= /etc
+BINDIR		:= /bin
+SBINDIR		:= /sbin
+SHAREDIR	:= /usr/share/keyutils
+MANDIR		:= /usr/share/man
+MAN1		:= $(MANDIR)/man1
+MAN3		:= $(MANDIR)/man3
+MAN5		:= $(MANDIR)/man5
+MAN7		:= $(MANDIR)/man7
+MAN8		:= $(MANDIR)/man8
+INCLUDEDIR	:= /usr/include
+LN		:= ln
+LNS		:= $(LN) -sf
+
+###############################################################################
+#
+# Determine the current package version from the specfile
+#
+###############################################################################
+vermajor	:= $(shell grep "%define vermajor" $(SPECFILE))
+verminor	:= $(shell grep "%define verminor" $(SPECFILE))
+MAJOR		:= $(word 3,$(vermajor))
+MINOR		:= $(word 3,$(verminor))
+VERSION		:= $(MAJOR).$(MINOR)
+
+TARBALL		:= keyutils-$(VERSION).tar
+ZTARBALL	:= $(TARBALL).bz2
+
+###############################################################################
+#
+# Determine the current library version from the version script
+#
+###############################################################################
+libversion	:= $(filter KEYUTILS_%,$(shell grep ^KEYUTILS_ version.lds))
+libversion	:= $(lastword $(libversion))
+libversion	:= $(lastword $(libversion))
+APIVERSION	:= $(subst KEYUTILS_,,$(libversion))
+vernumbers	:= $(subst ., ,$(APIVERSION))
+APIMAJOR	:= $(firstword $(vernumbers))
+
+ARLIB		:= libkeyutils.a
+DEVELLIB	:= libkeyutils.so
+SONAME		:= libkeyutils.so.$(APIMAJOR)
+LIBNAME		:= libkeyutils.so.$(APIVERSION)
+
+###############################################################################
+#
+# Guess at the appropriate lib directory and word size
+#
+###############################################################################
+ifeq ($(origin LIBDIR),undefined)
+LIBDIR		:= $(shell ldd /usr/bin/make | grep '\(/libc\)' | sed -e 's!.*\(/.*\)/libc[.].*!\1!')
+endif
+ifeq ($(origin USRLIBDIR),undefined)
+USRLIBDIR	:= $(patsubst /lib/%,/usr/lib/%,$(LIBDIR))
+endif
+BUILDFOR	:= $(shell file /usr/bin/make | sed -e 's!.*ELF \(32\|64\)-bit.*!\1!')-bit
+
+ifeq ($(origin CFLAGS),undefined)
+ifeq ($(BUILDFOR),32-bit)
+CFLAGS		+= -m32
+LIBDIR		:= /lib
+USRLIBDIR	:= /usr/lib
+else
+ifeq ($(BUILDFOR),64-bit)
+CFLAGS		+= -m64
+LIBDIR		:= /lib64
+USRLIBDIR	:= /usr/lib64
+endif
+endif
+endif
+
+###############################################################################
+#
+# This is necessary if glibc doesn't know about the key management error codes
+#
+###############################################################################
+ifeq ($(NO_GLIBC_KEYERR),1)
+CFLAGS	+= -DNO_GLIBC_KEYERR
+LIBLIBS	:= -ldl -lc
+else
+LIBLIBS	:=
+endif
+
+###############################################################################
+#
+# Normal build rule
+#
+###############################################################################
+all: keyctl request-key key.dns_resolver
+
+###############################################################################
+#
+# Build the libraries
+#
+###############################################################################
+#RPATH = -Wl,-rpath,$(LIBDIR)
+
+VCPPFLAGS	:= -DPKGBUILD="\"$(shell date -u +%F)\""
+VCPPFLAGS	+= -DPKGVERSION="\"keyutils-$(VERSION)\""
+VCPPFLAGS	+= -DAPIVERSION="\"libkeyutils-$(APIVERSION)\""
+
+ifeq ($(NO_ARLIB),0)
+all: $(ARLIB)
+$(ARLIB): keyutils.o
+	$(AR) rcs $@ $<
+
+keyutils.o: keyutils.c keyutils.h Makefile
+	$(CC) $(CPPFLAGS) $(VCPPFLAGS) $(CFLAGS) -UNO_GLIBC_KEYERR -o $@ -c $<
+LIB_DEPENDENCY	:= libkeyutils.a
+endif
+
+
+ifeq ($(NO_SOLIB),0)
+all: $(DEVELLIB)
+$(DEVELLIB): $(SONAME)
+	$(LNS) $< $@
+
+$(SONAME): $(LIBNAME)
+	$(LNS) $< $@
+
+LIBVERS := -shared -Wl,-soname,$(SONAME) -Wl,--version-script,version.lds
+
+$(LIBNAME): keyutils.os version.lds Makefile
+	$(CC) $(CFLAGS) -fPIC $(LDFLAGS) $(LIBVERS) -o $@ keyutils.os $(LIBLIBS)
+
+keyutils.os: keyutils.c keyutils.h Makefile
+	$(CC) $(CPPFLAGS) $(VCPPFLAGS) $(CFLAGS) -fPIC -o $@ -c $<
+LIB_DEPENDENCY	:= $(DEVELLIB)
+endif
+
+###############################################################################
+#
+# Build the programs
+#
+###############################################################################
+%.o: %.c keyutils.h Makefile
+	$(CC) $(CPPFLAGS) $(CFLAGS) -o $@ -c $<
+
+keyctl: keyctl.o $(LIB_DEPENDENCY)
+	$(CC) -L. $(CFLAGS) $(LDFLAGS) $(RPATH) -o $@ $< -lkeyutils
+
+request-key: request-key.o $(LIB_DEPENDENCY)
+	$(CC) -L. $(CFLAGS) $(LDFLAGS) $(RPATH) -o $@ $< -lkeyutils
+
+key.dns_resolver: key.dns_resolver.o $(LIB_DEPENDENCY)
+	$(CC) -L. $(CFLAGS) $(LDFLAGS) $(RPATH) -o $@ $< -lkeyutils -lresolv
+
+###############################################################################
+#
+# Install everything
+#
+###############################################################################
+install: all
+ifeq ($(NO_ARLIB),0)
+	$(INSTALL) -D -m 0644 $(ARLIB) $(DESTDIR)$(USRLIBDIR)/$(ARLIB)
+endif
+ifeq ($(NO_SOLIB),0)
+	$(INSTALL) -D $(LIBNAME) $(DESTDIR)$(LIBDIR)/$(LIBNAME)
+	$(LNS) $(LIBNAME) $(DESTDIR)$(LIBDIR)/$(SONAME)
+	mkdir -p $(DESTDIR)$(USRLIBDIR)
+	$(LNS) $(LIBDIR)/$(SONAME) $(DESTDIR)$(USRLIBDIR)/$(DEVELLIB)
+endif
+	$(INSTALL) -D keyctl $(DESTDIR)$(BINDIR)/keyctl
+	$(INSTALL) -D request-key $(DESTDIR)$(SBINDIR)/request-key
+	$(INSTALL) -D request-key-debug.sh $(DESTDIR)$(SHAREDIR)/request-key-debug.sh
+	$(INSTALL) -D key.dns_resolver $(DESTDIR)$(SBINDIR)/key.dns_resolver
+	$(INSTALL) -D -m 0644 request-key.conf $(DESTDIR)$(ETCDIR)/request-key.conf
+	mkdir -p $(DESTDIR)$(ETCDIR)/request-key.d
+	mkdir -p $(DESTDIR)$(MAN1)
+	$(INSTALL) -m 0644 $(wildcard man/*.1) $(DESTDIR)$(MAN1)
+	mkdir -p $(DESTDIR)$(MAN3)
+	$(INSTALL) -m 0644 $(wildcard man/*.3) $(DESTDIR)$(MAN3)
+	mkdir -p $(DESTDIR)$(MAN5)
+	$(INSTALL) -m 0644 $(wildcard man/*.5) $(DESTDIR)$(MAN5)
+	mkdir -p $(DESTDIR)$(MAN7)
+	$(INSTALL) -m 0644 $(wildcard man/*.7) $(DESTDIR)$(MAN7)
+	mkdir -p $(DESTDIR)$(MAN8)
+	$(INSTALL) -m 0644 $(wildcard man/*.8) $(DESTDIR)$(MAN8)
+	$(LNS) keyctl_describe.3 $(DESTDIR)$(MAN3)/keyctl_describe_alloc.3
+	$(LNS) keyctl_get_security.3 $(DESTDIR)$(MAN3)/keyctl_get_security_alloc.3
+	$(LNS) keyctl_instantiate.3 $(DESTDIR)$(MAN3)/keyctl_instantiate_iov.3
+	$(LNS) keyctl_instantiate.3 $(DESTDIR)$(MAN3)/keyctl_reject.3
+	$(LNS) keyctl_instantiate.3 $(DESTDIR)$(MAN3)/keyctl_negate.3
+	$(LNS) keyctl_instantiate.3 $(DESTDIR)$(MAN3)/keyctl_assume_authority.3
+	$(LNS) keyctl_link.3 $(DESTDIR)$(MAN3)/keyctl_unlink.3
+	$(LNS) keyctl_read.3 $(DESTDIR)$(MAN3)/keyctl_read_alloc.3
+	$(LNS) recursive_key_scan.3 $(DESTDIR)$(MAN3)/recursive_session_key_scan.3
+	$(LNS) keyctl_dh_compute.3 $(DESTDIR)$(MAN3)/keyctl_dh_compute_alloc.3
+	$(INSTALL) -D -m 0644 keyutils.h $(DESTDIR)$(INCLUDEDIR)/keyutils.h
+
+###############################################################################
+#
+# Run tests
+#
+###############################################################################
+test:
+	$(MAKE) -C tests run
+
+###############################################################################
+#
+# Clean up
+#
+###############################################################################
+clean:
+	$(MAKE) -C tests clean
+	$(RM) libkeyutils*
+	$(RM) keyctl request-key key.dns_resolver
+	$(RM) *.o *.os *~
+	$(RM) debugfiles.list debugsources.list
+
+distclean: clean
+	$(RM) -r rpmbuild $(TARBALL)
+
+###############################################################################
+#
+# Generate a tarball
+#
+###############################################################################
+$(ZTARBALL):
+	git archive --prefix=keyutils-$(VERSION)/ --format tar -o $(TARBALL) HEAD
+	bzip2 -9 <$(TARBALL) >$(ZTARBALL)
+
+tarball: $(ZTARBALL)
+
+###############################################################################
+#
+# Generate an RPM
+#
+###############################################################################
+SRCBALL	:= rpmbuild/SOURCES/$(TARBALL)
+ZSRCBALL := rpmbuild/SOURCES/$(ZTARBALL)
+
+BUILDID	:= .local
+dist	:= $(word 2,$(shell grep -r "^%dist" /etc/rpm /usr/lib/rpm))
+release	:= $(word 2,$(shell grep ^Release: $(SPECFILE)))
+release	:= $(subst %{?dist},$(dist),$(release))
+release	:= $(subst %{?buildid},$(BUILDID),$(release))
+rpmver	:= $(VERSION)-$(release)
+SRPM	:= rpmbuild/SRPMS/keyutils-$(rpmver).src.rpm
+
+RPMBUILDDIRS := \
+	--define "_srcrpmdir $(CURDIR)/rpmbuild/SRPMS" \
+	--define "_rpmdir $(CURDIR)/rpmbuild/RPMS" \
+	--define "_sourcedir $(CURDIR)/rpmbuild/SOURCES" \
+	--define "_specdir $(CURDIR)/rpmbuild/SPECS" \
+	--define "_builddir $(CURDIR)/rpmbuild/BUILD" \
+	--define "_buildrootdir $(CURDIR)/rpmbuild/BUILDROOT"
+
+RPMFLAGS := \
+	--define "buildid $(BUILDID)"
+
+rpm:
+	mkdir -p rpmbuild
+	chmod ug-s rpmbuild
+	mkdir -p rpmbuild/{SPECS,SOURCES,BUILD,BUILDROOT,RPMS,SRPMS}
+	git archive --prefix=keyutils-$(VERSION)/ --format tar -o $(SRCBALL) HEAD
+	bzip2 -9 <$(SRCBALL) >$(ZSRCBALL)
+	rpmbuild -ts $(ZSRCBALL) --define "_srcrpmdir rpmbuild/SRPMS" $(RPMFLAGS)
+	rpmbuild --rebuild $(SRPM) $(RPMBUILDDIRS) $(RPMFLAGS)
+
+rpmlint: rpm
+	rpmlint $(SRPM) $(CURDIR)/rpmbuild/RPMS/*/keyutils-{,libs-,libs-devel-,debuginfo-}$(rpmver).*.rpm
+
+###############################################################################
+#
+# Build debugging
+#
+###############################################################################
+show_vars:
+	@echo VERSION=$(VERSION)
+	@echo APIVERSION=$(APIVERSION)
+	@echo LIBDIR=$(LIBDIR)
+	@echo USRLIBDIR=$(USRLIBDIR)
+	@echo BUILDFOR=$(BUILDFOR)
+	@echo SONAME=$(SONAME)
+	@echo LIBNAME=$(LIBNAME)
diff --git a/README b/README
new file mode 100644
index 0000000..5c3d94d
--- /dev/null
+++ b/README
@@ -0,0 +1,15 @@
+These tools are used to control the key management system built into the Linux
+kernel.
+
+To build and install the tools and manual pages, run:
+
+	make
+	make install
+
+If your glibc does not contain definitions for the new error codes and system
+calls, then try:
+
+	make NO_GLIBC_KEYERR=1
+
+The tools are licensed under the GPL and the utility library under the LGPL.
+Copies of these are included in this tarball.
diff --git a/SUBMITTING_PATCHES b/SUBMITTING_PATCHES
new file mode 100644
index 0000000..c5ba909
--- /dev/null
+++ b/SUBMITTING_PATCHES
@@ -0,0 +1,45 @@
+			      ==================
+			      SUBMITTING PATCHES
+			      ==================
+
+Patches can be sent to the keyrings@vger.kernel.org mailing list or directly to
+David Howells <dhowells@redhat.com>, the author, in a private email.
+
+When sending patches to be included in keyutils, please certify that your patch
+meets the criteria below by including include a sign-off line in your email
+which looks like this:
+
+	Signed-off-by: Random J Developer <random@developer.example.org>
+
+This confirms that you are permitted to submit the patch for inclusion in
+keyutils under the GPLv2 licence (utilities and documentation) or the LGPLv2.1
+licence (library).  The full text of the certificate is as follows:
+
+	Developer's Certificate of Origin v1.1
+	======================================
+
+	By making a contribution to this project, I certify that:
+
+	 (a) The contribution was created in whole or in part by me and I
+	     have the right to submit it under the open source licences
+	     indicated in the file; or
+
+	 (b) The contribution is based upon previous work that, to the best
+	     of my knowledge, is covered under an appropriate open source
+	     licence and I have the right under that licence to submit that
+	     work with modifications, whether created in whole or in part
+	     by me, under the same open source licence (unless I am
+	     permitted to submit under a different licence), as indicated
+	     in the file; or
+
+	 (c) The contribution was provided directly to me by some other
+	     person who certified (a), (b) or (c) and I have not modified
+	     it.
+
+	and also that:
+
+	 (d) I understand and agree that this project and the contribution are
+	     public and that a record of the contribution (including all
+	     personal information I submit with it, including my sign-off) is
+	     maintained indefinitely and may be redistributed consistent with
+	     this project or the open source licence(s) involved.
diff --git a/key.dns_resolver.c b/key.dns_resolver.c
new file mode 100644
index 0000000..9c9d458
--- /dev/null
+++ b/key.dns_resolver.c
@@ -0,0 +1,735 @@
+/*
+ * DNS Resolver Module User-space Helper for AFSDB records
+ *
+ * Copyright (C) Wang Lei (wang840925@gmail.com) 2010
+ * Authors: Wang Lei (wang840925@gmail.com)
+ *          David Howells (dhowells@redhat.com)
+ *
+ * This is a userspace tool for querying AFSDB RR records in the DNS on behalf
+ * of the kernel, and converting the VL server addresses to IPv4 format so that
+ * they can be used by the kAFS filesystem.
+ *
+ * Compile with:
+ *
+ * 	cc -o key.dns_resolver key.dns_resolver.c -lresolv -lkeyutils
+ *
+ * As some function like res_init() should use the static liberary, which is a
+ * bug of libresolv, that is the reason for cifs.upcall to reimplement.
+ *
+ * To use this program, you must tell /sbin/request-key how to invoke it.  You
+ * need to have the keyutils package installed and something like the following
+ * lines added to your /etc/request-key.conf file:
+ *
+ * 	#OP    TYPE         DESCRIPTION CALLOUT INFO PROGRAM ARG1 ARG2 ARG3 ...
+ * 	====== ============ =========== ============ ==========================
+ * 	create dns_resolver afsdb:*     *            /sbin/key.dns_resolver %k
+ *
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+#define _GNU_SOURCE
+#include <netinet/in.h>
+#include <arpa/nameser.h>
+#include <arpa/inet.h>
+#include <limits.h>
+#include <resolv.h>
+#include <getopt.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <netdb.h>
+#include <syslog.h>
+#include <errno.h>
+#include <string.h>
+#include <stdio.h>
+#include <stdarg.h>
+#include <keyutils.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <time.h>
+
+static const char *DNS_PARSE_VERSION = "1.0";
+static const char prog[] = "key.dns_resolver";
+static const char key_type[] = "dns_resolver";
+static const char a_query_type[] = "a";
+static const char aaaa_query_type[] = "aaaa";
+static const char afsdb_query_type[] = "afsdb";
+static key_serial_t key;
+static int verbose;
+static int debug_mode;
+
+
+#define	MAX_VLS			15	/* Max Volume Location Servers Per-Cell */
+#define	INET_IP4_ONLY		0x1
+#define	INET_IP6_ONLY		0x2
+#define	INET_ALL		0xFF
+#define ONE_ADDR_ONLY		0x100
+
+/*
+ * segmental payload
+ */
+#define N_PAYLOAD 256
+struct iovec payload[N_PAYLOAD];
+int payload_index;
+
+/*
+ * Print an error to stderr or the syslog, negate the key being created and
+ * exit
+ */
+static __attribute__((format(printf, 1, 2), noreturn))
+void error(const char *fmt, ...)
+{
+	va_list va;
+
+	va_start(va, fmt);
+	if (isatty(2)) {
+		vfprintf(stderr, fmt, va);
+		fputc('\n', stderr);
+	} else {
+		vsyslog(LOG_ERR, fmt, va);
+	}
+	va_end(va);
+
+	/*
+	 * on error, negatively instantiate the key ourselves so that we can
+	 * make sure the kernel doesn't hang it off of a searchable keyring
+	 * and interfere with the next attempt to instantiate the key.
+	 */
+	if (!debug_mode)
+		keyctl_negate(key, 1, KEY_REQKEY_DEFL_DEFAULT);
+
+	exit(1);
+}
+
+#define error(FMT, ...) error("Error: " FMT, ##__VA_ARGS__);
+
+/*
+ * Just print an error to stderr or the syslog
+ */
+static __attribute__((format(printf, 1, 2)))
+void _error(const char *fmt, ...)
+{
+	va_list va;
+
+	va_start(va, fmt);
+	if (isatty(2)) {
+		vfprintf(stderr, fmt, va);
+		fputc('\n', stderr);
+	} else {
+		vsyslog(LOG_ERR, fmt, va);
+	}
+	va_end(va);
+}
+
+/*
+ * Print status information
+ */
+static __attribute__((format(printf, 1, 2)))
+void info(const char *fmt, ...)
+{
+	va_list va;
+
+	if (verbose < 1)
+		return;
+
+	va_start(va, fmt);
+	if (isatty(1)) {
+		fputs("I: ", stdout);
+		vfprintf(stdout, fmt, va);
+		fputc('\n', stdout);
+	} else {
+		vsyslog(LOG_INFO, fmt, va);
+	}
+	va_end(va);
+}
+
+/*
+ * Print a nameserver error and exit
+ */
+static const int ns_errno_map[] = {
+	[0]			= ECONNREFUSED,
+	[HOST_NOT_FOUND]	= ENODATA,
+	[TRY_AGAIN]		= EAGAIN,
+	[NO_RECOVERY]		= ECONNREFUSED,
+	[NO_DATA]		= ENODATA,
+};
+
+static __attribute__((noreturn))
+void nsError(int err, const char *domain)
+{
+	unsigned timeout = 1 * 60;
+	int ret;
+
+	if (isatty(2))
+		fprintf(stderr, "%s: %s.\n", domain, hstrerror(err));
+	else
+		syslog(LOG_INFO, "%s: %s", domain, hstrerror(err));
+
+	if (err >= sizeof(ns_errno_map) / sizeof(ns_errno_map[0]))
+		err = ECONNREFUSED;
+	else
+		err = ns_errno_map[err];
+
+	info("Reject the key with error %d", err);
+
+	if (err == EAGAIN)
+		timeout = 1;
+	else if (err == ECONNREFUSED)
+		timeout = 10;
+
+	if (!debug_mode) {
+		ret = keyctl_reject(key, timeout, err, KEY_REQKEY_DEFL_DEFAULT);
+		if (ret == -1)
+			error("%s: keyctl_reject: %m", __func__);
+	}
+	exit(0);
+}
+
+/*
+ * Print debugging information
+ */
+static __attribute__((format(printf, 1, 2)))
+void debug(const char *fmt, ...)
+{
+	va_list va;
+
+	if (verbose < 2)
+		return;
+
+	va_start(va, fmt);
+	if (isatty(1)) {
+		fputs("D: ", stdout);
+		vfprintf(stdout, fmt, va);
+		fputc('\n', stdout);
+	} else {
+		vsyslog(LOG_DEBUG, fmt, va);
+	}
+	va_end(va);
+}
+
+/*
+ * Append an address to the payload segment list
+ */
+static void append_address_to_payload(const char *addr)
+{
+	size_t sz = strlen(addr);
+	char *copy;
+	int loop;
+
+	debug("append '%s'", addr);
+
+	if (payload_index + 2 > N_PAYLOAD - 1)
+		return;
+
+	/* discard duplicates */
+	for (loop = 0; loop < payload_index; loop++)
+		if (payload[loop].iov_len == sz &&
+		    memcmp(payload[loop].iov_base, addr, sz) == 0)
+			return;
+
+	copy = malloc(sz);
+	if (!copy)
+		error("%s: malloc: %m", __func__);
+	memcpy(copy, addr, sz);
+
+	if (payload_index != 0) {
+		payload[payload_index  ].iov_base = ",";
+		payload[payload_index++].iov_len = 1;
+	}
+	payload[payload_index  ].iov_base = copy;
+	payload[payload_index++].iov_len = sz;
+}
+
+/*
+ * Dump the payload when debugging
+ */
+static void dump_payload(void)
+{
+	size_t plen, n;
+	char *buf, *p;
+	int loop;
+
+	if (debug_mode)
+		verbose = 1;
+	if (verbose < 1)
+		return;
+
+	plen = 0;
+	for (loop = 0; loop < payload_index; loop++) {
+		n = payload[loop].iov_len;
+		debug("seg[%d]: %zu", loop, n);
+		plen += n;
+	}
+	if (plen == 0) {
+		info("The key instantiation data is empty");
+		return;
+	}
+
+	debug("total: %zu", plen);
+	buf = malloc(plen + 1);
+	if (!buf)
+		return;
+
+	p = buf;
+	for (loop = 0; loop < payload_index; loop++) {
+		n = payload[loop].iov_len;
+		memcpy(p, payload[loop].iov_base, n);
+		p += n;
+	}
+
+	info("The key instantiation data is '%s'", buf);
+	free(buf);
+}
+
+/*
+ * Perform address resolution on a hostname and add the resulting address as a
+ * string to the list of payload segments.
+ */
+static int
+dns_resolver(const char *server_name, unsigned mask)
+{
+	struct addrinfo hints, *addr, *ai;
+	char buf[INET6_ADDRSTRLEN + 1];
+	int ret, len;
+	void *sa;
+
+	debug("Resolve '%s' with %x", server_name, mask);
+
+	memset(&hints, 0, sizeof(hints));
+	switch (mask & INET_ALL) {
+	case INET_IP4_ONLY:	hints.ai_family = AF_INET;	debug("IPv4"); break;
+	case INET_IP6_ONLY:	hints.ai_family = AF_INET6;	debug("IPv6"); break;
+	default: break;
+	}
+
+	/* resolve name to ip */
+	ret = getaddrinfo(server_name, NULL, &hints, &addr);
+	if (ret) {
+		info("unable to resolve hostname: %s [%s]",
+		     server_name, gai_strerror(ret));
+		return -1;
+	}
+
+	debug("getaddrinfo = %d", ret);
+
+	for (ai = addr; ai; ai = ai->ai_next) {
+		debug("RR: %x,%x,%x,%x,%x,%s",
+		      ai->ai_flags, ai->ai_family,
+		      ai->ai_socktype, ai->ai_protocol,
+		      ai->ai_addrlen, ai->ai_canonname);
+
+		/* convert address to string */
+		switch (ai->ai_family) {
+		case AF_INET:
+			if (!(mask & INET_IP4_ONLY))
+				continue;
+			sa = &(((struct sockaddr_in *)ai->ai_addr)->sin_addr);
+			len = INET_ADDRSTRLEN;
+			break;
+		case AF_INET6:
+			if (!(mask & INET_IP6_ONLY))
+				continue;
+			sa = &(((struct sockaddr_in6 *)ai->ai_addr)->sin6_addr);
+			len = INET6_ADDRSTRLEN;
+			break;
+		default:
+			debug("Address of unknown family %u", addr->ai_family);
+			continue;
+		}
+
+		if (!inet_ntop(ai->ai_family, sa, buf, len))
+			error("%s: inet_ntop: %m", __func__);
+
+		append_address_to_payload(buf);
+		if (mask & ONE_ADDR_ONLY)
+			break;
+	}
+
+	freeaddrinfo(addr);
+	return 0;
+}
+
+/*
+ *
+ */
+static void afsdb_hosts_to_addrs(ns_msg handle,
+				 ns_sect section,
+				 unsigned mask,
+				 unsigned long *_ttl)
+{
+	char *vllist[MAX_VLS];	/* list of name servers	*/
+	int vlsnum = 0;		/* number of name servers in list */
+	int rrnum;
+	ns_rr rr;
+	int subtype, i, ret;
+	unsigned int ttl = UINT_MAX, rr_ttl;
+
+	debug("AFSDB RR count is %d", ns_msg_count(handle, section));
+
+	/* Look at all the resource records in this section. */
+	for (rrnum = 0; rrnum < ns_msg_count(handle, section); rrnum++) {
+		/* Expand the resource record number rrnum into rr. */
+		if (ns_parserr(&handle, section, rrnum, &rr)) {
+			_error("ns_parserr failed : %m");
+			continue;
+		}
+
+		/* We're only interested in AFSDB records */
+		if (ns_rr_type(rr) == ns_t_afsdb) {
+			vllist[vlsnum] = malloc(MAXDNAME);
+			if (!vllist[vlsnum])
+				error("Out of memory");
+
+			subtype = ns_get16(ns_rr_rdata(rr));
+
+			/* Expand the name server's domain name */
+			if (ns_name_uncompress(ns_msg_base(handle),
+					       ns_msg_end(handle),
+					       ns_rr_rdata(rr) + 2,
+					       vllist[vlsnum],
+					       MAXDNAME) < 0)
+				error("ns_name_uncompress failed");
+
+			rr_ttl = ns_rr_ttl(rr);
+			if (ttl > rr_ttl)
+				ttl = rr_ttl;
+
+			/* Check the domain name we've just unpacked and add it to
+			 * the list of VL servers if it is not a duplicate.
+			 * If it is a duplicate, just ignore it.
+			 */
+			for (i = 0; i < vlsnum; i++)
+				if (strcasecmp(vllist[i], vllist[vlsnum]) == 0)
+					goto next_one;
+
+			/* Turn the hostname into IP addresses */
+			ret = dns_resolver(vllist[vlsnum], mask);
+			if (ret) {
+				debug("AFSDB RR can't resolve."
+				      "subtype:%d, server name:%s, netmask:%u",
+				      subtype, vllist[vlsnum], mask);
+				goto next_one;
+			}
+
+			info("AFSDB RR subtype:%d, server name:%s, ip:%*.*s, ttl:%u",
+			     subtype, vllist[vlsnum],
+			     (int)payload[payload_index - 1].iov_len,
+			     (int)payload[payload_index - 1].iov_len,
+			     (char *)payload[payload_index - 1].iov_base,
+			     ttl);
+
+			/* prepare for the next record */
+			vlsnum++;
+			continue;
+
+		next_one:
+			free(vllist[vlsnum]);
+		}
+	}
+
+	*_ttl = ttl;
+	info("ttl: %u", ttl);
+}
+
+/*
+ * Look up an AFSDB record to get the VL server addresses.
+ *
+ * The callout_info is parsed for request options.  For instance, "ipv4" to
+ * request only IPv4 addresses and "ipv6" to request only IPv6 addresses.
+ */
+static __attribute__((noreturn))
+int dns_query_afsdb(const char *cell, char *options)
+{
+	int	ret;
+	unsigned mask = INET_ALL;
+	int	response_len;		/* buffer length */
+	ns_msg	handle;			/* handle for response message */
+	unsigned long ttl = ULONG_MAX;
+	union {
+		HEADER hdr;
+		u_char buf[NS_PACKETSZ];
+	} response;		/* response buffers */
+
+	debug("Get AFSDB RR for cell name:'%s', options:'%s'", cell, options);
+
+	/* query the dns for an AFSDB resource record */
+	response_len = res_query(cell,
+				 ns_c_in,
+				 ns_t_afsdb,
+				 response.buf,
+				 sizeof(response));
+
+	if (response_len < 0)
+		/* negative result */
+		nsError(h_errno, cell);
+
+	if (ns_initparse(response.buf, response_len, &handle) < 0)
+		error("ns_initparse: %m");
+
+	/* Is the IP address family limited? */
+	if (strcmp(options, "ipv4") == 0)
+		mask = INET_IP4_ONLY;
+	else if (strcmp(options, "ipv6") == 0)
+		mask = INET_IP6_ONLY;
+
+	/* look up the hostnames we've obtained to get the actual addresses */
+	afsdb_hosts_to_addrs(handle, ns_s_an, mask, &ttl);
+
+	info("DNS query AFSDB RR results:%u ttl:%lu", payload_index, ttl);
+
+	/* set the key's expiry time from the minimum TTL encountered */
+	if (!debug_mode) {
+		ret = keyctl_set_timeout(key, ttl);
+		if (ret == -1)
+			error("%s: keyctl_set_timeout: %m", __func__);
+	}
+
+	/* handle a lack of results */
+	if (payload_index == 0)
+		nsError(NO_DATA, cell);
+
+	/* must include a NUL char at the end of the payload */
+	payload[payload_index].iov_base = "";
+	payload[payload_index++].iov_len = 1;
+	dump_payload();
+
+	/* load the key with data key */
+	if (!debug_mode) {
+		ret = keyctl_instantiate_iov(key, payload, payload_index, 0);
+		if (ret == -1)
+			error("%s: keyctl_instantiate: %m", __func__);
+	}
+
+	exit(0);
+}
+
+/*
+ * Look up a A and/or AAAA records to get host addresses
+ *
+ * The callout_info is parsed for request options.  For instance, "ipv4" to
+ * request only IPv4 addresses, "ipv6" to request only IPv6 addresses and
+ * "list" to get multiple addresses.
+ */
+static __attribute__((noreturn))
+int dns_query_a_or_aaaa(const char *hostname, char *options)
+{
+	unsigned mask;
+	int ret;
+
+	debug("Get A/AAAA RR for hostname:'%s', options:'%s'",
+	      hostname, options);
+
+	if (!options[0]) {
+		/* legacy mode */
+		mask = INET_IP4_ONLY | ONE_ADDR_ONLY;
+	} else {
+		char *k, *val;
+
+		mask = INET_ALL | ONE_ADDR_ONLY;
+
+		do {
+			k = options;
+			options = strchr(options, ' ');
+			if (!options)
+				options = k + strlen(k);
+			else
+				*options++ = '\0';
+			if (!*k)
+				continue;
+			if (strchr(k, ','))
+				error("Option name '%s' contains a comma", k);
+
+			val = strchr(k, '=');
+			if (val)
+				*val++ = '\0';
+
+			debug("Opt %s", k);
+
+			if (strcmp(k, "ipv4") == 0) {
+				mask &= ~INET_ALL;
+				mask |= INET_IP4_ONLY;
+			} else if (strcmp(k, "ipv6") == 0) {
+				mask &= ~INET_ALL;
+				mask |= INET_IP6_ONLY;
+			} else if (strcmp(k, "list") == 0) {
+				mask &= ~ONE_ADDR_ONLY;
+			}
+
+		} while (*options);
+	}
+
+	/* Turn the hostname into IP addresses */
+	ret = dns_resolver(hostname, mask);
+	if (ret)
+		nsError(NO_DATA, hostname);
+
+	/* handle a lack of results */
+	if (payload_index == 0)
+		nsError(NO_DATA, hostname);
+
+	/* must include a NUL char at the end of the payload */
+	payload[payload_index].iov_base = "";
+	payload[payload_index++].iov_len = 1;
+	dump_payload();
+
+	/* load the key with data key */
+	if (!debug_mode) {
+		ret = keyctl_instantiate_iov(key, payload, payload_index, 0);
+		if (ret == -1)
+			error("%s: keyctl_instantiate: %m", __func__);
+	}
+
+	exit(0);
+}
+
+/*
+ * Print usage details,
+ */
+static __attribute__((noreturn))
+void usage(void)
+{
+	if (isatty(2)) {
+		fprintf(stderr,
+			"Usage: %s [-vv] key_serial\n",
+			prog);
+		fprintf(stderr,
+			"Usage: %s -D [-vv] <desc> <calloutinfo>\n",
+			prog);
+	} else {
+		info("Usage: %s [-vv] key_serial", prog);
+	}
+	exit(2);
+}
+
+const struct option long_options[] = {
+	{ "debug",	0, NULL, 'D' },
+	{ "verbose",	0, NULL, 'v' },
+	{ "version",	0, NULL, 'V' },
+	{ NULL,		0, NULL, 0 }
+};
+
+/*
+ *
+ */
+int main(int argc, char *argv[])
+{
+	int ktlen, qtlen, ret;
+	char *keyend, *p;
+	char *callout_info = NULL;
+	char *buf = NULL, *name;
+
+	openlog(prog, 0, LOG_DAEMON);
+
+	while ((ret = getopt_long(argc, argv, "vD", long_options, NULL)) != -1) {
+		switch (ret) {
+		case 'D':
+			debug_mode = 1;
+			continue;
+		case 'V':
+			printf("version: %s from %s (%s)\n",
+			       DNS_PARSE_VERSION,
+			       keyutils_version_string,
+			       keyutils_build_string);
+			exit(0);
+		case 'v':
+			verbose++;
+			continue;
+		default:
+			if (!isatty(2))
+				syslog(LOG_ERR, "unknown option: %c", ret);
+			usage();
+		}
+	}
+
+	argc -= optind;
+	argv += optind;
+
+	if (!debug_mode) {
+		if (argc != 1)
+			usage();
+
+		/* get the key ID */
+		if (!**argv)
+			error("Invalid blank key ID");
+		key = strtol(*argv, &p, 10);
+		if (*p)
+			error("Invalid key ID format");
+
+		/* get the key description (of the form "x;x;x;x;<query_type>:<name>") */
+		ret = keyctl_describe_alloc(key, &buf);
+		if (ret == -1)
+			error("keyctl_describe_alloc failed: %m");
+
+		/* get the callout_info (which can supply options) */
+		ret = keyctl_read_alloc(KEY_SPEC_REQKEY_AUTH_KEY, (void **)&callout_info);
+		if (ret == -1)
+			error("Invalid key callout_info read: %m");
+	} else {
+		if (argc != 2)
+			usage();
+
+		ret = asprintf(&buf, "%s;-1;-1;0;%s", key_type, argv[0]);
+		if (ret < 0)
+			error("Error %m");
+		callout_info = argv[1];
+	}
+
+	ret = 1;
+	info("Key description: '%s'", buf);
+	info("Callout info: '%s'", callout_info);
+
+	p = strchr(buf, ';');
+	if (!p)
+		error("Badly formatted key description '%s'", buf);
+	ktlen = p - buf;
+
+	/* make sure it's the type we are expecting */
+	if (ktlen != sizeof(key_type) - 1 ||
+	    memcmp(buf, key_type, ktlen) != 0)
+		error("Key type is not supported: '%*.*s'", ktlen, ktlen, buf);
+
+	keyend = buf + ktlen + 1;
+
+	/* the actual key description follows the last semicolon */
+	keyend = rindex(keyend, ';');
+	if (!keyend)
+		error("Invalid key description: %s", buf);
+	keyend++;
+
+	name = index(keyend, ':');
+	if (!name)
+		dns_query_a_or_aaaa(keyend, callout_info);
+
+	qtlen = name - keyend;
+	name++;
+
+	if ((qtlen == sizeof(a_query_type) - 1 &&
+	     memcmp(keyend, a_query_type, sizeof(a_query_type) - 1) == 0) ||
+	    (qtlen == sizeof(aaaa_query_type) - 1 &&
+	     memcmp(keyend, aaaa_query_type, sizeof(aaaa_query_type) - 1) == 0)
+	    ) {
+		info("Do DNS query of A/AAAA type for:'%s' mask:'%s'",
+		     name, callout_info);
+		dns_query_a_or_aaaa(name, callout_info);
+	}
+
+	if (qtlen == sizeof(afsdb_query_type) - 1 &&
+	    memcmp(keyend, afsdb_query_type, sizeof(afsdb_query_type) - 1) == 0
+	    ) {
+		info("Do DNS query of AFSDB type for:'%s' mask:'%s'",
+		     name, callout_info);
+		dns_query_afsdb(name, callout_info);
+	}
+
+	error("Query type: \"%*.*s\" is not supported", qtlen, qtlen, keyend);
+}
diff --git a/keyctl.c b/keyctl.c
new file mode 100644
index 0000000..801a864
--- /dev/null
+++ b/keyctl.c
@@ -0,0 +1,1884 @@
+/* keyctl.c: key control program
+ *
+ * Copyright (C) 2005, 2011 Red Hat, Inc. All Rights Reserved.
+ * Written by David Howells (dhowells@redhat.com)
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version
+ * 2 of the License, or (at your option) any later version.
+ */
+
+#define _GNU_SOURCE
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdint.h>
+#include <stdarg.h>
+#include <string.h>
+#include <unistd.h>
+#include <ctype.h>
+#include <errno.h>
+#include <asm/unistd.h>
+#include "keyutils.h"
+
+struct command {
+	void (*action)(int argc, char *argv[]) __attribute__((noreturn));
+	const char	*name;
+	const char	*format;
+};
+
+#define nr __attribute__((noreturn))
+
+static nr void act_keyctl___version(int argc, char *argv[]);
+static nr void act_keyctl_show(int argc, char *argv[]);
+static nr void act_keyctl_add(int argc, char *argv[]);
+static nr void act_keyctl_padd(int argc, char *argv[]);
+static nr void act_keyctl_request(int argc, char *argv[]);
+static nr void act_keyctl_request2(int argc, char *argv[]);
+static nr void act_keyctl_prequest2(int argc, char *argv[]);
+static nr void act_keyctl_update(int argc, char *argv[]);
+static nr void act_keyctl_pupdate(int argc, char *argv[]);
+static nr void act_keyctl_newring(int argc, char *argv[]);
+static nr void act_keyctl_revoke(int argc, char *argv[]);
+static nr void act_keyctl_clear(int argc, char *argv[]);
+static nr void act_keyctl_link(int argc, char *argv[]);
+static nr void act_keyctl_unlink(int argc, char *argv[]);
+static nr void act_keyctl_search(int argc, char *argv[]);
+static nr void act_keyctl_read(int argc, char *argv[]);
+static nr void act_keyctl_pipe(int argc, char *argv[]);
+static nr void act_keyctl_print(int argc, char *argv[]);
+static nr void act_keyctl_list(int argc, char *argv[]);
+static nr void act_keyctl_rlist(int argc, char *argv[]);
+static nr void act_keyctl_describe(int argc, char *argv[]);
+static nr void act_keyctl_rdescribe(int argc, char *argv[]);
+static nr void act_keyctl_chown(int argc, char *argv[]);
+static nr void act_keyctl_chgrp(int argc, char *argv[]);
+static nr void act_keyctl_setperm(int argc, char *argv[]);
+static nr void act_keyctl_session(int argc, char *argv[]);
+static nr void act_keyctl_instantiate(int argc, char *argv[]);
+static nr void act_keyctl_pinstantiate(int argc, char *argv[]);
+static nr void act_keyctl_negate(int argc, char *argv[]);
+static nr void act_keyctl_timeout(int argc, char *argv[]);
+static nr void act_keyctl_security(int argc, char *argv[]);
+static nr void act_keyctl_new_session(int argc, char *argv[]);
+static nr void act_keyctl_reject(int argc, char *argv[]);
+static nr void act_keyctl_reap(int argc, char *argv[]);
+static nr void act_keyctl_purge(int argc, char *argv[]);
+static nr void act_keyctl_invalidate(int argc, char *argv[]);
+static nr void act_keyctl_get_persistent(int argc, char *argv[]);
+static nr void act_keyctl_dh_compute(int argc, char *argv[]);
+
+const struct command commands[] = {
+	{ act_keyctl___version,	"--version",	"" },
+	{ act_keyctl_add,	"add",		"<type> <desc> <data> <keyring>" },
+	{ act_keyctl_chgrp,	"chgrp",	"<key> <gid>" },
+	{ act_keyctl_chown,	"chown",	"<key> <uid>" },
+	{ act_keyctl_clear,	"clear",	"<keyring>" },
+	{ act_keyctl_describe,	"describe",	"<keyring>" },
+	{ act_keyctl_dh_compute, "dh_compute",	"<private> <prime> <base>" },
+	{ act_keyctl_instantiate, "instantiate","<key> <data> <keyring>" },
+	{ act_keyctl_invalidate,"invalidate",	"<key>" },
+	{ act_keyctl_get_persistent, "get_persistent", "<keyring> [<uid>]" },
+	{ act_keyctl_link,	"link",		"<key> <keyring>" },
+	{ act_keyctl_list,	"list",		"<keyring>" },
+	{ act_keyctl_negate,	"negate",	"<key> <timeout> <keyring>" },
+	{ act_keyctl_new_session, "new_session",	"" },
+	{ act_keyctl_newring,	"newring",	"<name> <keyring>" },
+	{ act_keyctl_padd,	"padd",		"<type> <desc> <keyring>" },
+	{ act_keyctl_pinstantiate, "pinstantiate","<key> <keyring>" },
+	{ act_keyctl_pipe,	"pipe",		"<key>" },
+	{ act_keyctl_prequest2,	"prequest2",	"<type> <desc> [<dest_keyring>]" },
+	{ act_keyctl_print,	"print",	"<key>" },
+	{ act_keyctl_pupdate,	"pupdate",	"<key>" },
+	{ act_keyctl_purge,	"purge",	"<type>" },
+	{ NULL,			"purge",	"[-p] [-i] <type> <desc>" },
+	{ NULL,			"purge",	"-s <type> <desc>" },
+	{ act_keyctl_rdescribe,	"rdescribe",	"<keyring> [sep]" },
+	{ act_keyctl_read,	"read",		"<key>" },
+	{ act_keyctl_reap,	"reap",		"[-v]" },
+	{ act_keyctl_reject,	"reject",	"<key> <timeout> <error> <keyring>" },
+	{ act_keyctl_request,	"request",	"<type> <desc> [<dest_keyring>]" },
+	{ act_keyctl_request2,	"request2",	"<type> <desc> <info> [<dest_keyring>]" },
+	{ act_keyctl_revoke,	"revoke",	"<key>" },
+	{ act_keyctl_rlist,	"rlist",	"<keyring>" },
+	{ act_keyctl_search,	"search",	"<keyring> <type> <desc> [<dest_keyring>]" },
+	{ act_keyctl_security,	"security",	"<key>" },
+	{ act_keyctl_session,	"session",	"" },
+	{ NULL,			"session",	"- [<prog> <arg1> <arg2> ...]" },
+	{ NULL,			"session",	"<name> [<prog> <arg1> <arg2> ...]" },
+	{ act_keyctl_setperm,	"setperm",	"<key> <mask>" },
+	{ act_keyctl_show,	"show",		"[-x] [<keyring>]" },
+	{ act_keyctl_timeout,	"timeout",	"<key> <timeout>" },
+	{ act_keyctl_unlink,	"unlink",	"<key> [<keyring>]" },
+	{ act_keyctl_update,	"update",	"<key> <data>" },
+	{ NULL,			NULL,		NULL }
+};
+
+static int dump_key_tree(key_serial_t keyring, const char *name, int hex_key_IDs);
+static void format(void) __attribute__((noreturn));
+static void error(const char *msg) __attribute__((noreturn));
+static key_serial_t get_key_id(char *arg);
+
+static uid_t myuid;
+static gid_t mygid, *mygroups;
+static int myngroups;
+static int verbose;
+
+/*****************************************************************************/
+/*
+ * handle an error
+ */
+static inline void error(const char *msg)
+{
+	perror(msg);
+	exit(1);
+
+} /* end error() */
+
+/*****************************************************************************/
+/*
+ * execute the appropriate subcommand
+ */
+int main(int argc, char *argv[])
+{
+	const struct command *cmd, *best;
+	int n;
+
+	argv++;
+	argc--;
+
+	if (argc == 0)
+		format();
+
+	/* find the best fit command */
+	best = NULL;
+	n = strlen(*argv);
+
+	for (cmd = commands; cmd->name; cmd++) {
+		if (!cmd->action)
+			continue;
+		if (strlen(cmd->name) > n)
+			continue;
+		if (memcmp(cmd->name, *argv, n) != 0)
+			continue;
+
+		if (cmd->name[n] == 0) {
+			/* exact match */
+			best = cmd;
+			break;
+		}
+
+		/* partial match */
+		if (best) {
+			fprintf(stderr, "Ambiguous command\n");
+			exit(2);
+		}
+
+		best = cmd;
+	}
+
+	if (!best) {
+		fprintf(stderr, "Unknown command\n");
+		exit(2);
+	}
+
+	best->action(argc, argv);
+
+} /* end main() */
+
+/*****************************************************************************/
+/*
+ * display command format information
+ */
+static void format(void)
+{
+	const struct command *cmd;
+
+	fprintf(stderr, "Format:\n");
+
+	for (cmd = commands; cmd->name; cmd++)
+		fprintf(stderr, "  keyctl %s %s\n", cmd->name, cmd->format);
+
+	fprintf(stderr, "\n");
+	fprintf(stderr, "Key/keyring ID:\n");
+	fprintf(stderr, "  <nnn>   numeric keyring ID\n");
+	fprintf(stderr, "  @t      thread keyring\n");
+	fprintf(stderr, "  @p      process keyring\n");
+	fprintf(stderr, "  @s      session keyring\n");
+	fprintf(stderr, "  @u      user keyring\n");
+	fprintf(stderr, "  @us     user default session keyring\n");
+	fprintf(stderr, "  @g      group keyring\n");
+	fprintf(stderr, "  @a      assumed request_key authorisation key\n");
+	fprintf(stderr, "\n");
+	fprintf(stderr, "<type> can be \"user\" for a user-defined keyring\n");
+	fprintf(stderr, "If you do this, prefix the description with \"<subtype>:\"\n");
+
+	exit(2);
+
+} /* end format() */
+
+/*****************************************************************************/
+/*
+ * Display version information
+ */
+static void act_keyctl___version(int argc, char *argv[])
+{
+	printf("keyctl from %s (Built %s)\n",
+	       keyutils_version_string, keyutils_build_string);
+	exit(0);
+}
+
+/*****************************************************************************/
+/*
+ * grab data from stdin
+ */
+static char *grab_stdin(size_t *_size)
+{
+	static char input[1024 * 1024 + 1];
+	int n, tmp;
+
+	n = 0;
+	do {
+		tmp = read(0, input + n, sizeof(input) - 1 - n);
+		if (tmp < 0)
+			error("stdin");
+
+		if (tmp == 0)
+			break;
+
+		n += tmp;
+
+	} while (n < sizeof(input));
+
+	if (n >= sizeof(input)) {
+		fprintf(stderr, "Too much data read on stdin\n");
+		exit(1);
+	}
+
+	input[n] = '\0';
+	*_size = n;
+
+	return input;
+
+} /* end grab_stdin() */
+
+/*
+ * Load the groups list and grab the process's UID and GID.
+ */
+static void grab_creds(void)
+{
+	static int inited;
+
+	if (inited)
+		return;
+	inited = 1;
+
+	/* grab my UID, GID and groups */
+	myuid = geteuid();
+	mygid = getegid();
+	myngroups = getgroups(0, NULL);
+
+	if (myuid == -1 || mygid == -1 || myngroups == -1)
+		error("Unable to get UID/GID/#Groups\n");
+
+	mygroups = calloc(myngroups, sizeof(gid_t));
+	if (!mygroups)
+		error("calloc");
+
+	myngroups = getgroups(myngroups, mygroups);
+	if (myngroups < 0)
+		error("Unable to get Groups\n");
+}
+
+/*****************************************************************************/
+/*
+ * convert the permissions mask to a string representing the permissions we
+ * have actually been granted
+ */
+static void calc_perms(char *pretty, key_perm_t perm, uid_t uid, gid_t gid)
+{
+	unsigned perms;
+	gid_t *pg;
+	int loop;
+
+	grab_creds();
+
+	perms = (perm & KEY_POS_ALL) >> 24;
+
+	if (uid == myuid) {
+		perms |= (perm & KEY_USR_ALL) >> 16;
+		goto write_mask;
+	}
+
+	if (gid != -1) {
+		if (gid == mygid) {
+			perms |= (perm & KEY_GRP_ALL) >> 8;
+			goto write_mask;
+		}
+
+		pg = mygroups;
+		for (loop = myngroups; loop > 0; loop--, pg++) {
+			if (gid == *pg) {
+				perms |= (perm & KEY_GRP_ALL) >> 8;
+				goto write_mask;
+			}
+		}
+	}
+
+	perms |= (perm & KEY_OTH_ALL);
+
+write_mask:
+	sprintf(pretty, "--%c%c%c%c%c%c",
+		perms & KEY_OTH_SETATTR	? 'a' : '-',
+		perms & KEY_OTH_LINK	? 'l' : '-',
+		perms & KEY_OTH_SEARCH	? 's' : '-',
+		perms & KEY_OTH_WRITE	? 'w' : '-',
+		perms & KEY_OTH_READ	? 'r' : '-',
+		perms & KEY_OTH_VIEW	? 'v' : '-');
+
+} /* end calc_perms() */
+
+/*****************************************************************************/
+/*
+ * show the parent process's session keyring
+ */
+static void act_keyctl_show(int argc, char *argv[])
+{
+	key_serial_t keyring = KEY_SPEC_SESSION_KEYRING;
+	int hex_key_IDs = 0;
+
+	if (argc >= 2 && strcmp(argv[1], "-x") == 0) {
+		hex_key_IDs = 1;
+		argc--;
+		argv++;
+	}
+
+	if (argc > 2)
+		format();
+
+	if (argc == 2)
+		keyring = get_key_id(argv[1]);
+
+	dump_key_tree(keyring, argc == 2 ? "Keyring" : "Session Keyring", hex_key_IDs);
+	exit(0);
+
+} /* end act_keyctl_show() */
+
+/*****************************************************************************/
+/*
+ * add a key
+ */
+static void act_keyctl_add(int argc, char *argv[])
+{
+	key_serial_t dest;
+	int ret;
+
+	if (argc != 5)
+		format();
+
+	dest = get_key_id(argv[4]);
+
+	ret = add_key(argv[1], argv[2], argv[3], strlen(argv[3]), dest);
+	if (ret < 0)
+		error("add_key");
+
+	/* print the resulting key ID */
+	printf("%d\n", ret);
+	exit(0);
+
+} /* end act_keyctl_add() */
+
+/*****************************************************************************/
+/*
+ * add a key, reading from a pipe
+ */
+static void act_keyctl_padd(int argc, char *argv[])
+{
+	key_serial_t dest;
+	size_t datalen;
+	void *data;
+	int ret;
+
+
+	if (argc != 4)
+		format();
+
+	dest = get_key_id(argv[3]);
+
+	data = grab_stdin(&datalen);
+
+	ret = add_key(argv[1], argv[2], data, datalen, dest);
+	if (ret < 0)
+		error("add_key");
+
+	/* print the resulting key ID */
+	printf("%d\n", ret);
+	exit(0);
+
+} /* end act_keyctl_padd() */
+
+/*****************************************************************************/
+/*
+ * request a key
+ */
+static void act_keyctl_request(int argc, char *argv[])
+{
+	key_serial_t dest;
+	int ret;
+
+	if (argc != 3 && argc != 4)
+		format();
+
+	dest = 0;
+	if (argc == 4)
+		dest = get_key_id(argv[3]);
+
+	ret = request_key(argv[1], argv[2], NULL, dest);
+	if (ret < 0)
+		error("request_key");
+
+	/* print the resulting key ID */
+	printf("%d\n", ret);
+	exit(0);
+
+} /* end act_keyctl_request() */
+
+/*****************************************************************************/
+/*
+ * request a key, with recourse to /sbin/request-key
+ */
+static void act_keyctl_request2(int argc, char *argv[])
+{
+	key_serial_t dest;
+	int ret;
+
+	if (argc != 4 && argc != 5)
+		format();
+
+	dest = 0;
+	if (argc == 5)
+		dest = get_key_id(argv[4]);
+
+	ret = request_key(argv[1], argv[2], argv[3], dest);
+	if (ret < 0)
+		error("request_key");
+
+	/* print the resulting key ID */
+	printf("%d\n", ret);
+	exit(0);
+
+} /* end act_keyctl_request2() */
+
+/*****************************************************************************/
+/*
+ * request a key, with recourse to /sbin/request-key, reading the callout info
+ * from a pipe
+ */
+static void act_keyctl_prequest2(int argc, char *argv[])
+{
+	char *args[6];
+	size_t datalen;
+
+	if (argc != 3 && argc != 4)
+		format();
+
+	args[0] = argv[0];
+	args[1] = argv[1];
+	args[2] = argv[2];
+	args[3] = grab_stdin(&datalen);
+	args[4] = argv[3];
+	args[5] = NULL;
+
+	act_keyctl_request2(argc + 1, args);
+
+} /* end act_keyctl_prequest2() */
+
+/*****************************************************************************/
+/*
+ * update a key
+ */
+static void act_keyctl_update(int argc, char *argv[])
+{
+	key_serial_t key;
+
+	if (argc != 3)
+		format();
+
+	key = get_key_id(argv[1]);
+
+	if (keyctl_update(key, argv[2], strlen(argv[2])) < 0)
+		error("keyctl_update");
+
+	exit(0);
+
+} /* end act_keyctl_update() */
+
+/*****************************************************************************/
+/*
+ * update a key, reading from a pipe
+ */
+static void act_keyctl_pupdate(int argc, char *argv[])
+{
+	key_serial_t key;
+	size_t datalen;
+	void *data;
+
+	if (argc != 2)
+		format();
+
+	key = get_key_id(argv[1]);
+	data = grab_stdin(&datalen);
+
+	if (keyctl_update(key, data, datalen) < 0)
+		error("keyctl_update");
+
+	exit(0);
+
+} /* end act_keyctl_pupdate() */
+
+/*****************************************************************************/
+/*
+ * create a new keyring
+ */
+static void act_keyctl_newring(int argc, char *argv[])
+{
+	key_serial_t dest;
+	int ret;
+
+	if (argc != 3)
+		format();
+
+	dest = get_key_id(argv[2]);
+
+	ret = add_key("keyring", argv[1], NULL, 0, dest);
+	if (ret < 0)
+		error("add_key");
+
+	printf("%d\n", ret);
+	exit(0);
+
+} /* end act_keyctl_newring() */
+
+/*****************************************************************************/
+/*
+ * revoke a key
+ */
+static void act_keyctl_revoke(int argc, char *argv[])
+{
+	key_serial_t key;
+
+	if (argc != 2)
+		format();
+
+	key = get_key_id(argv[1]);
+
+	if (keyctl_revoke(key) < 0)
+		error("keyctl_revoke");
+
+	exit(0);
+
+} /* end act_keyctl_revoke() */
+
+/*****************************************************************************/
+/*
+ * clear a keyring
+ */
+static void act_keyctl_clear(int argc, char *argv[])
+{
+	key_serial_t keyring;
+
+	if (argc != 2)
+		format();
+
+	keyring = get_key_id(argv[1]);
+
+	if (keyctl_clear(keyring) < 0)
+		error("keyctl_clear");
+
+	exit(0);
+
+} /* end act_keyctl_clear() */
+
+/*****************************************************************************/
+/*
+ * link a key to a keyring
+ */
+static void act_keyctl_link(int argc, char *argv[])
+{
+	key_serial_t keyring, key;
+
+	if (argc != 3)
+		format();
+
+	key = get_key_id(argv[1]);
+	keyring = get_key_id(argv[2]);
+
+	if (keyctl_link(key, keyring) < 0)
+		error("keyctl_link");
+
+	exit(0);
+
+} /* end act_keyctl_link() */
+
+/*
+ * Attempt to unlink a key matching the ID
+ */
+static int act_keyctl_unlink_func(key_serial_t parent, key_serial_t key,
+				  char *desc, int desc_len, void *data)
+{
+	key_serial_t *target = data;
+
+	if (key == *target)
+		return keyctl_unlink(key, parent) < 0 ? 0 : 1;
+	return 0;
+}
+
+/*
+ * Unlink a key from a keyring or from the session keyring tree.
+ */
+static void act_keyctl_unlink(int argc, char *argv[])
+{
+	key_serial_t keyring, key;
+	int n;
+
+	if (argc != 2 && argc != 3)
+		format();
+
+	key = get_key_id(argv[1]);
+
+	if (argc == 3) {
+		keyring = get_key_id(argv[2]);
+		if (keyctl_unlink(key, keyring) < 0)
+			error("keyctl_unlink");
+	} else {
+		n = recursive_session_key_scan(act_keyctl_unlink_func, &key);
+		printf("%d links removed\n", n);
+	}
+
+	exit(0);
+}
+
+/*****************************************************************************/
+/*
+ * search a keyring for a key
+ */
+static void act_keyctl_search(int argc, char *argv[])
+{
+	key_serial_t keyring, dest;
+	int ret;
+
+	if (argc != 4 && argc != 5)
+		format();
+
+	keyring = get_key_id(argv[1]);
+
+	dest = 0;
+	if (argc == 5)
+		dest = get_key_id(argv[4]);
+
+	ret = keyctl_search(keyring, argv[2], argv[3], dest);
+	if (ret < 0)
+		error("keyctl_search");
+
+	/* print the ID of the key we found */
+	printf("%d\n", ret);
+	exit(0);
+
+} /* end act_keyctl_search() */
+
+/*****************************************************************************/
+/*
+ * read a key
+ */
+static void act_keyctl_read(int argc, char *argv[])
+{
+	key_serial_t key;
+	void *buffer;
+	char *p;
+	int ret, sep, col;
+
+	if (argc != 2)
+		format();
+
+	key = get_key_id(argv[1]);
+
+	/* read the key payload data */
+	ret = keyctl_read_alloc(key, &buffer);
+	if (ret < 0)
+		error("keyctl_read_alloc");
+
+	if (ret == 0) {
+		printf("No data in key\n");
+		exit(0);
+	}
+
+	/* hexdump the contents */
+	printf("%u bytes of data in key:\n", ret);
+
+	sep = 0;
+	col = 0;
+	p = buffer;
+
+	do {
+		if (sep) {
+			putchar(sep);
+			sep = 0;
+		}
+
+		printf("%02hhx", *p);
+		p++;
+
+		col++;
+		if (col % 32 == 0)
+			sep = '\n';
+		else if (col % 4 == 0)
+			sep = ' ';
+
+	} while (--ret > 0);
+
+	printf("\n");
+	exit(0);
+
+} /* end act_keyctl_read() */
+
+/*****************************************************************************/
+/*
+ * read a key and dump raw to stdout
+ */
+static void act_keyctl_pipe(int argc, char *argv[])
+{
+	key_serial_t key;
+	void *buffer;
+	int ret;
+
+	if (argc != 2)
+		format();
+
+	key = get_key_id(argv[1]);
+
+	/* read the key payload data */
+	ret = keyctl_read_alloc(key, &buffer);
+	if (ret < 0)
+		error("keyctl_read_alloc");
+
+	if (ret > 0 && write(1, buffer, ret) < 0)
+		error("write");
+	exit(0);
+
+} /* end act_keyctl_pipe() */
+
+/*****************************************************************************/
+/*
+ * read a key and dump to stdout in printable form
+ */
+static void act_keyctl_print(int argc, char *argv[])
+{
+	key_serial_t key;
+	void *buffer;
+	char *p;
+	int loop, ret;
+
+	if (argc != 2)
+		format();
+
+	key = get_key_id(argv[1]);
+
+	/* read the key payload data */
+	ret = keyctl_read_alloc(key, &buffer);
+	if (ret < 0)
+		error("keyctl_read_alloc");
+
+	/* see if it's printable */
+	p = buffer;
+	for (loop = ret; loop > 0; loop--, p++)
+		if (!isprint(*p))
+			goto not_printable;
+
+	/* it is */
+	printf("%s\n", (char *) buffer);
+	exit(0);
+
+not_printable:
+	/* it isn't */
+	printf(":hex:");
+	p = buffer;
+	for (loop = ret; loop > 0; loop--, p++)
+		printf("%02hhx", *p);
+	printf("\n");
+	exit(0);
+
+} /* end act_keyctl_print() */
+
+/*****************************************************************************/
+/*
+ * list a keyring
+ */
+static void act_keyctl_list(int argc, char *argv[])
+{
+	key_serial_t keyring, key, *pk;
+	key_perm_t perm;
+	void *keylist;
+	char *buffer, pretty_mask[9];
+	uid_t uid;
+	gid_t gid;
+	int count, tlen, dpos, n, ret;
+
+	if (argc != 2)
+		format();
+
+	keyring = get_key_id(argv[1]);
+
+	/* read the key payload data */
+	count = keyctl_read_alloc(keyring, &keylist);
+	if (count < 0)
+		error("keyctl_read_alloc");
+
+	count /= sizeof(key_serial_t);
+
+	if (count == 0) {
+		printf("keyring is empty\n");
+		exit(0);
+	}
+
+	/* list the keys in the keyring */
+	if (count == 1)
+		printf("1 key in keyring:\n");
+	else
+		printf("%u keys in keyring:\n", count);
+
+	pk = keylist;
+	do {
+		key = *pk++;
+
+		ret = keyctl_describe_alloc(key, &buffer);
+		if (ret < 0) {
+			printf("%9d: key inaccessible (%m)\n", key);
+			continue;
+		}
+
+		uid = 0;
+		gid = 0;
+		perm = 0;
+
+		tlen = -1;
+		dpos = -1;
+
+		n = sscanf((char *) buffer, "%*[^;]%n;%d;%d;%x;%n",
+			   &tlen, &uid, &gid, &perm, &dpos);
+		if (n != 3) {
+			fprintf(stderr, "Unparseable description obtained for key %d\n", key);
+			exit(3);
+		}
+
+		calc_perms(pretty_mask, perm, uid, gid);
+
+		printf("%9d: %s %5d %5d %*.*s: %s\n",
+		       key,
+		       pretty_mask,
+		       uid, gid,
+		       tlen, tlen, buffer,
+		       buffer + dpos);
+
+		free(buffer);
+
+	} while (--count);
+
+	exit(0);
+
+} /* end act_keyctl_list() */
+
+/*****************************************************************************/
+/*
+ * produce a raw list of a keyring
+ */
+static void act_keyctl_rlist(int argc, char *argv[])
+{
+	key_serial_t keyring, key, *pk;
+	void *keylist;
+	int count;
+
+	if (argc != 2)
+		format();
+
+	keyring = get_key_id(argv[1]);
+
+	/* read the key payload data */
+	count = keyctl_read_alloc(keyring, &keylist);
+	if (count < 0)
+		error("keyctl_read_alloc");
+
+	count /= sizeof(key_serial_t);
+
+	/* list the keys in the keyring */
+	if (count <= 0) {
+		printf("\n");
+	}
+	else {
+		pk = keylist;
+		for (; count > 0; count--) {
+			key = *pk++;
+			printf("%d%c", key, count == 1 ? '\n' : ' ');
+		}
+	}
+
+	exit(0);
+
+} /* end act_keyctl_rlist() */
+
+/*****************************************************************************/
+/*
+ * describe a key
+ */
+static void act_keyctl_describe(int argc, char *argv[])
+{
+	key_serial_t key;
+	key_perm_t perm;
+	char *buffer;
+	uid_t uid;
+	gid_t gid;
+	int tlen, dpos, n, ret;
+
+	if (argc != 2)
+		format();
+
+	key = get_key_id(argv[1]);
+
+	/* get key description */
+	ret = keyctl_describe_alloc(key, &buffer);
+	if (ret < 0)
+		error("keyctl_describe");
+
+	/* parse it */
+	uid = 0;
+	gid = 0;
+	perm = 0;
+
+	tlen = -1;
+	dpos = -1;
+
+	n = sscanf(buffer, "%*[^;]%n;%d;%d;%x;%n",
+		   &tlen, &uid, &gid, &perm, &dpos);
+	if (n != 3) {
+		fprintf(stderr, "Unparseable description obtained for key %d\n", key);
+		exit(3);
+	}
+
+	/* display it */
+	printf("%9d:"
+	       " %c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c"
+	       " %5d %5d %*.*s: %s\n",
+	       key,
+	       perm & KEY_POS_SETATTR	? 'a' : '-',
+	       perm & KEY_POS_LINK	? 'l' : '-',
+	       perm & KEY_POS_SEARCH	? 's' : '-',
+	       perm & KEY_POS_WRITE	? 'w' : '-',
+	       perm & KEY_POS_READ	? 'r' : '-',
+	       perm & KEY_POS_VIEW	? 'v' : '-',
+
+	       perm & KEY_USR_SETATTR	? 'a' : '-',
+	       perm & KEY_USR_LINK	? 'l' : '-',
+	       perm & KEY_USR_SEARCH	? 's' : '-',
+	       perm & KEY_USR_WRITE	? 'w' : '-',
+	       perm & KEY_USR_READ	? 'r' : '-',
+	       perm & KEY_USR_VIEW	? 'v' : '-',
+
+	       perm & KEY_GRP_SETATTR	? 'a' : '-',
+	       perm & KEY_GRP_LINK	? 'l' : '-',
+	       perm & KEY_GRP_SEARCH	? 's' : '-',
+	       perm & KEY_GRP_WRITE	? 'w' : '-',
+	       perm & KEY_GRP_READ	? 'r' : '-',
+	       perm & KEY_GRP_VIEW	? 'v' : '-',
+
+	       perm & KEY_OTH_SETATTR	? 'a' : '-',
+	       perm & KEY_OTH_LINK	? 'l' : '-',
+	       perm & KEY_OTH_SEARCH	? 's' : '-',
+	       perm & KEY_OTH_WRITE	? 'w' : '-',
+	       perm & KEY_OTH_READ	? 'r' : '-',
+	       perm & KEY_OTH_VIEW	? 'v' : '-',
+	       uid, gid,
+	       tlen, tlen, buffer,
+	       buffer + dpos);
+
+	exit(0);
+
+} /* end act_keyctl_describe() */
+
+/*****************************************************************************/
+/*
+ * get raw key description
+ */
+static void act_keyctl_rdescribe(int argc, char *argv[])
+{
+	key_serial_t key;
+	char *buffer, *q;
+	int ret;
+
+	if (argc != 2 && argc != 3)
+		format();
+	if (argc == 3 && !argv[2][0])
+		format();
+
+	key = get_key_id(argv[1]);
+
+	/* get key description */
+	ret = keyctl_describe_alloc(key, &buffer);
+	if (ret < 0)
+		error("keyctl_describe");
+
+	/* replace semicolon separators with requested alternative */
+	if (argc == 3) {
+		for (q = buffer; *q; q++)
+			if (*q == ';')
+				*q = argv[2][0];
+	}
+
+	/* display raw description */
+	printf("%s\n", buffer);
+	exit(0);
+
+} /* end act_keyctl_rdescribe() */
+
+/*****************************************************************************/
+/*
+ * change a key's ownership
+ */
+static void act_keyctl_chown(int argc, char *argv[])
+{
+	key_serial_t key;
+	uid_t uid;
+	char *q;
+
+	if (argc != 3)
+		format();
+
+	key = get_key_id(argv[1]);
+
+	uid = strtoul(argv[2], &q, 0);
+	if (*q) {
+		fprintf(stderr, "Unparsable uid: '%s'\n", argv[2]);
+		exit(2);
+	}
+
+	if (keyctl_chown(key, uid, -1) < 0)
+		error("keyctl_chown");
+
+	exit(0);
+
+} /* end act_keyctl_chown() */
+
+/*****************************************************************************/
+/*
+ * change a key's group ownership
+ */
+static void act_keyctl_chgrp(int argc, char *argv[])
+{
+	key_serial_t key;
+	gid_t gid;
+	char *q;
+
+	if (argc != 3)
+		format();
+
+	key = get_key_id(argv[1]);
+
+	gid = strtoul(argv[2], &q, 0);
+	if (*q) {
+		fprintf(stderr, "Unparsable gid: '%s'\n", argv[2]);
+		exit(2);
+	}
+
+	if (keyctl_chown(key, -1, gid) < 0)
+		error("keyctl_chown");
+
+	exit(0);
+
+} /* end act_keyctl_chgrp() */
+
+/*****************************************************************************/
+/*
+ * set the permissions on a key
+ */
+static void act_keyctl_setperm(int argc, char *argv[])
+{
+	key_serial_t key;
+	key_perm_t perm;
+	char *q;
+
+	if (argc != 3)
+		format();
+
+	key = get_key_id(argv[1]);
+	perm = strtoul(argv[2], &q, 0);
+	if (*q) {
+		fprintf(stderr, "Unparsable permissions: '%s'\n", argv[2]);
+		exit(2);
+	}
+
+	if (keyctl_setperm(key, perm) < 0)
+		error("keyctl_setperm");
+
+	exit(0);
+
+} /* end act_keyctl_setperm() */
+
+/*****************************************************************************/
+/*
+ * start a process in a new session
+ */
+static void act_keyctl_session(int argc, char *argv[])
+{
+	char *p, *q;
+	int ret;
+
+	argv++;
+	argc--;
+
+	/* no extra arguments signifies a standard shell in an anonymous
+	 * session */
+	p = NULL;
+	if (argc != 0) {
+		/* a dash signifies an anonymous session */
+		p = *argv;
+		if (strcmp(p, "-") == 0)
+			p = NULL;
+
+		argv++;
+		argc--;
+	}
+
+	/* create a new session keyring */
+	ret = keyctl_join_session_keyring(p);
+	if (ret < 0)
+		error("keyctl_join_session_keyring");
+
+	fprintf(stderr, "Joined session keyring: %d\n", ret);
+
+	/* run the standard shell if no arguments */
+	if (argc == 0) {
+		q = getenv("SHELL");
+		if (!q)
+			q = "/bin/sh";
+		execl(q, q, NULL);
+		error(q);
+	}
+
+	/* run the command specified */
+	execvp(argv[0], argv);
+	error(argv[0]);
+
+} /* end act_keyctl_session() */
+
+/*****************************************************************************/
+/*
+ * instantiate a key that's under construction
+ */
+static void act_keyctl_instantiate(int argc, char *argv[])
+{
+	key_serial_t key, dest;
+
+	if (argc != 4)
+		format();
+
+	key = get_key_id(argv[1]);
+	dest = get_key_id(argv[3]);
+
+	if (keyctl_instantiate(key, argv[2], strlen(argv[2]), dest) < 0)
+		error("keyctl_instantiate");
+
+	exit(0);
+
+} /* end act_keyctl_instantiate() */
+
+/*****************************************************************************/
+/*
+ * instantiate a key, reading from a pipe
+ */
+static void act_keyctl_pinstantiate(int argc, char *argv[])
+{
+	key_serial_t key, dest;
+	size_t datalen;
+	void *data;
+
+	if (argc != 3)
+		format();
+
+	key = get_key_id(argv[1]);
+	dest = get_key_id(argv[2]);
+	data = grab_stdin(&datalen);
+
+	if (keyctl_instantiate(key, data, datalen, dest) < 0)
+		error("keyctl_instantiate");
+
+	exit(0);
+
+} /* end act_keyctl_pinstantiate() */
+
+/*****************************************************************************/
+/*
+ * negate a key that's under construction
+ */
+static void act_keyctl_negate(int argc, char *argv[])
+{
+	unsigned long timeout;
+	key_serial_t key, dest;
+	char *q;
+
+	if (argc != 4)
+		format();
+
+	key = get_key_id(argv[1]);
+
+	timeout = strtoul(argv[2], &q, 10);
+	if (*q) {
+		fprintf(stderr, "Unparsable timeout: '%s'\n", argv[2]);
+		exit(2);
+	}
+
+	dest = get_key_id(argv[3]);
+
+	if (keyctl_negate(key, timeout, dest) < 0)
+		error("keyctl_negate");
+
+	exit(0);
+
+} /* end act_keyctl_negate() */
+
+/*****************************************************************************/
+/*
+ * set a key's timeout
+ */
+static void act_keyctl_timeout(int argc, char *argv[])
+{
+	unsigned long timeout;
+	key_serial_t key;
+	char *q;
+
+	if (argc != 3)
+		format();
+
+	key = get_key_id(argv[1]);
+
+	timeout = strtoul(argv[2], &q, 10);
+	if (*q) {
+		fprintf(stderr, "Unparsable timeout: '%s'\n", argv[2]);
+		exit(2);
+	}
+
+	if (keyctl_set_timeout(key, timeout) < 0)
+		error("keyctl_set_timeout");
+
+	exit(0);
+
+} /* end act_keyctl_timeout() */
+
+/*****************************************************************************/
+/*
+ * get a key's security label
+ */
+static void act_keyctl_security(int argc, char *argv[])
+{
+	key_serial_t key;
+	char *buffer;
+	int ret;
+
+	if (argc != 2)
+		format();
+
+	key = get_key_id(argv[1]);
+
+	/* get key description */
+	ret = keyctl_get_security_alloc(key, &buffer);
+	if (ret < 0)
+		error("keyctl_getsecurity");
+
+	printf("%s\n", buffer);
+	exit(0);
+}
+
+/*****************************************************************************/
+/*
+ * install a new session keyring on the parent process
+ */
+static void act_keyctl_new_session(int argc, char *argv[])
+{
+	key_serial_t keyring;
+
+	if (argc != 1)
+		format();
+
+	if (keyctl_join_session_keyring(NULL) < 0)
+		error("keyctl_join_session_keyring");
+
+	if (keyctl_session_to_parent() < 0)
+		error("keyctl_session_to_parent");
+
+	keyring = keyctl_get_keyring_ID(KEY_SPEC_SESSION_KEYRING, 0);
+	if (keyring < 0)
+		error("keyctl_get_keyring_ID");
+
+	/* print the resulting key ID */
+	printf("%d\n", keyring);
+	exit(0);
+}
+
+/*****************************************************************************/
+/*
+ * reject a key that's under construction
+ */
+static void act_keyctl_reject(int argc, char *argv[])
+{
+	unsigned long timeout;
+	key_serial_t key, dest;
+	unsigned long rejerr;
+	char *q;
+
+	if (argc != 5)
+		format();
+
+	key = get_key_id(argv[1]);
+
+	timeout = strtoul(argv[2], &q, 10);
+	if (*q) {
+		fprintf(stderr, "Unparsable timeout: '%s'\n", argv[2]);
+		exit(2);
+	}
+
+	if (strcmp(argv[3], "rejected") == 0) {
+		rejerr = EKEYREJECTED;
+	} else if (strcmp(argv[3], "revoked") == 0) {
+		rejerr = EKEYREVOKED;
+	} else if (strcmp(argv[3], "expired") == 0) {
+		rejerr = EKEYEXPIRED;
+	} else {
+		rejerr = strtoul(argv[3], &q, 10);
+		if (*q) {
+			fprintf(stderr, "Unparsable error: '%s'\n", argv[3]);
+			exit(2);
+		}
+	}
+
+	dest = get_key_id(argv[4]);
+
+	if (keyctl_reject(key, timeout, rejerr, dest) < 0)
+		error("keyctl_negate");
+
+	exit(0);
+}
+
+/*
+ * Attempt to unlink a key if we can't read it for reasons other than we don't
+ * have permission
+ */
+static int act_keyctl_reap_func(key_serial_t parent, key_serial_t key,
+				char *desc, int desc_len, void *data)
+{
+	if (desc_len < 0 && errno != EACCES) {
+		if (verbose)
+			printf("Reap %d", key);
+		if (keyctl_unlink(key, parent) < 0) {
+			if (verbose)
+				printf("... failed %m\n");
+			return 0;
+		} else {
+			if (verbose)
+				printf("\n");
+			return 1;
+		};
+	}
+	return 0;
+}
+
+/*
+ * Reap the dead keys from the session keyring tree
+ */
+static void act_keyctl_reap(int argc, char *argv[])
+{
+	int n;
+
+	if (argc > 1 && strcmp(argv[1], "-v") == 0) {
+		verbose = 1;
+		argc--;
+		argv++;
+	}
+
+	if (argc != 1)
+		format();
+
+	n = recursive_session_key_scan(act_keyctl_reap_func, NULL);
+	printf("%d keys reaped\n", n);
+	exit(0);
+}
+
+struct purge_data {
+	const char	*type;
+	const char	*desc;
+	size_t		desc_len;
+	size_t		type_len;
+	char		prefix_match;
+	char		case_indep;
+};
+
+/*
+ * Attempt to unlink a key matching the type
+ */
+static int act_keyctl_purge_type_func(key_serial_t parent, key_serial_t key,
+				      char *raw, int raw_len, void *data)
+{
+	const struct purge_data *purge = data;
+	char *p, *type;
+
+	if (parent == 0 || !raw)
+		return 0;
+
+	/* type is everything before the first semicolon */
+	type = raw;
+	p = memchr(raw, ';', raw_len);
+	if (!p)
+		return 0;
+	*p = 0;
+	if (strcmp(type, purge->type) != 0)
+		return 0;
+
+	return keyctl_unlink(key, parent) < 0 ? 0 : 1;
+}
+
+/*
+ * Attempt to unlink a key matching the type and description literally
+ */
+static int act_keyctl_purge_literal_func(key_serial_t parent, key_serial_t key,
+					 char *raw, int raw_len, void *data)
+{
+	const struct purge_data *purge = data;
+	size_t tlen;
+	char *p, *type, *desc;
+
+	if (parent == 0 || !raw)
+		return 0;
+
+	/* type is everything before the first semicolon */
+	type = raw;
+	p = memchr(type, ';', raw_len);
+	if (!p)
+		return 0;
+
+	tlen = p - type;
+	if (tlen != purge->type_len)
+		return 0;
+	if (memcmp(type, purge->type, tlen) != 0)
+		return 0;
+
+	/* description is everything after the last semicolon */
+	p++;
+	desc = memrchr(p, ';', raw + raw_len - p);
+	if (!desc)
+		return 0;
+	desc++;
+
+	if (purge->prefix_match) {
+		if (raw_len - (desc - raw) < purge->desc_len)
+			return 0;
+	} else {
+		if (raw_len - (desc - raw) != purge->desc_len)
+			return 0;
+	}
+
+	if (purge->case_indep) {
+		if (strncasecmp(purge->desc, desc, purge->desc_len) != 0)
+			return 0;
+	} else {
+		if (memcmp(purge->desc, desc, purge->desc_len) != 0)
+			return 0;
+	}
+
+	printf("%*.*s '%s'\n", (int)tlen, (int)tlen, type, desc);
+
+	return keyctl_unlink(key, parent) < 0 ? 0 : 1;
+}
+
+/*
+ * Attempt to unlink a key matching the type and description literally
+ */
+static int act_keyctl_purge_search_func(key_serial_t parent, key_serial_t keyring,
+					char *raw, int raw_len, void *data)
+{
+	const struct purge_data *purge = data;
+	key_serial_t key;
+	int kcount = 0;
+
+	if (!raw || memcmp(raw, "keyring;", 8) != 0)
+		return 0;
+
+	for (;;) {
+		key = keyctl_search(keyring, purge->type, purge->desc, 0);
+		if (keyctl_unlink(key, keyring) < 0)
+			return kcount;
+		kcount++;
+	}
+	return kcount;
+}
+
+/*
+ * Purge matching keys from a keyring
+ */
+static void act_keyctl_purge(int argc, char *argv[])
+{
+	recursive_key_scanner_t func;
+	struct purge_data purge = {
+		.prefix_match	= 0,
+		.case_indep	= 0,
+	};
+	int n = 0, search_mode = 0;
+
+	argc--;
+	argv++;
+	while (argc > 0 && argv[0][0] == '-') {
+		if (argv[0][1] == 's')
+			search_mode = 1;
+		else if (argv[0][1] == 'p')
+			purge.prefix_match = 1;
+		else if (argv[0][1] == 'i')
+			purge.case_indep = 1;
+		else
+			format();
+		argc--;
+		argv++;
+	}
+
+	if (argc < 1)
+		format();
+
+	purge.type	= argv[0];
+	purge.desc	= argv[1];
+	purge.type_len	= strlen(purge.type);
+	purge.desc_len	= purge.desc ? strlen(purge.desc) : 0;
+
+	if (search_mode == 1) {
+		if (argc != 2 || purge.prefix_match || purge.case_indep)
+			format();
+		/* purge all keys of a specific type and description, according
+		 * to the kernel's comparator */
+		func = act_keyctl_purge_search_func;
+	} else if (argc == 1) {
+		if (purge.prefix_match || purge.case_indep)
+			format();
+		/* purge all keys of a specific type */
+		func = act_keyctl_purge_type_func;
+	} else if (argc == 2) {
+		/* purge all keys of a specific type with literally matching
+		 * description */
+		func = act_keyctl_purge_literal_func;
+	} else {
+		format();
+	}
+
+	n = recursive_session_key_scan(func, &purge);
+	printf("purged %d keys\n", n);
+	exit(0);
+}
+
+/*****************************************************************************/
+/*
+ * Invalidate a key
+ */
+static void act_keyctl_invalidate(int argc, char *argv[])
+{
+	key_serial_t key;
+
+	if (argc != 2)
+		format();
+
+	key = get_key_id(argv[1]);
+
+	if (keyctl_invalidate(key) < 0)
+		error("keyctl_invalidate");
+
+	exit(0);
+}
+
+/*****************************************************************************/
+/*
+ * Get the per-UID persistent keyring
+ */
+static void act_keyctl_get_persistent(int argc, char *argv[])
+{
+	key_serial_t dest, ret;
+	uid_t uid = -1;
+	char *q;
+
+	if (argc != 2 && argc != 3)
+		format();
+
+	dest = get_key_id(argv[1]);
+
+	if (argc > 2) {
+		uid = strtoul(argv[2], &q, 0);
+		if (*q) {
+			fprintf(stderr, "Unparsable uid: '%s'\n", argv[2]);
+			exit(2);
+		}
+	}
+
+	ret = keyctl_get_persistent(uid, dest);
+	if (ret < 0)
+		error("keyctl_get_persistent");
+
+	/* print the resulting key ID */
+	printf("%d\n", ret);
+	exit(0);
+}
+
+/*****************************************************************************/
+/*
+ * Perform Diffie-Hellman computation
+ */
+static void act_keyctl_dh_compute(int argc, char *argv[])
+{
+	key_serial_t priv, prime, base;
+	void *buffer;
+	char *p;
+	int ret, sep, col;
+
+	if (argc != 4)
+		format();
+
+	priv = get_key_id(argv[1]);
+	prime = get_key_id(argv[2]);
+	base = get_key_id(argv[3]);
+
+	ret = keyctl_dh_compute_alloc(priv, prime, base, &buffer);
+	if (ret < 0)
+		error("keyctl_dh_compute_alloc");
+
+	/* hexdump the contents */
+	printf("%u bytes of data in result:\n", ret);
+
+	sep = 0;
+	col = 0;
+	p = buffer;
+
+	do {
+		if (sep) {
+			putchar(sep);
+			sep = 0;
+		}
+
+		printf("%02hhx", *p);
+		p++;
+
+		col++;
+		if (col % 32 == 0)
+			sep = '\n';
+		else if (col % 4 == 0)
+			sep = ' ';
+
+	} while (--ret > 0);
+
+	printf("\n");
+	exit(0);
+}
+
+/*****************************************************************************/
+/*
+ * parse a key identifier
+ */
+static key_serial_t get_key_id(char *arg)
+{
+	key_serial_t id;
+	char *end;
+
+	/* handle a special keyring name */
+	if (arg[0] == '@') {
+		if (strcmp(arg, "@t" ) == 0) return KEY_SPEC_THREAD_KEYRING;
+		if (strcmp(arg, "@p" ) == 0) return KEY_SPEC_PROCESS_KEYRING;
+		if (strcmp(arg, "@s" ) == 0) return KEY_SPEC_SESSION_KEYRING;
+		if (strcmp(arg, "@u" ) == 0) return KEY_SPEC_USER_KEYRING;
+		if (strcmp(arg, "@us") == 0) return KEY_SPEC_USER_SESSION_KEYRING;
+		if (strcmp(arg, "@g" ) == 0) return KEY_SPEC_GROUP_KEYRING;
+		if (strcmp(arg, "@a" ) == 0) return KEY_SPEC_REQKEY_AUTH_KEY;
+
+		fprintf(stderr, "Unknown special key: '%s'\n", arg);
+		exit(2);
+	}
+
+	/* handle a lookup-by-name request "%<type>:<desc>", eg: "%keyring:_ses" */
+	if (arg[0] == '%') {
+		char *type;
+
+		arg++;
+		if (!*arg)
+			goto incorrect_key_by_name_spec;
+
+		if (*arg == ':') {
+			type = "keyring";
+			arg++;
+		} else {
+			type = arg;
+			arg = strchr(arg, ':');
+			if (!arg)
+				goto incorrect_key_by_name_spec;
+			*(arg++) = '\0';
+		}
+
+		if (!*arg)
+			goto incorrect_key_by_name_spec;
+
+		id = find_key_by_type_and_desc(type, arg, 0);
+		if (id == -1) {
+			fprintf(stderr, "Can't find '%s:%s'\n", type, arg);
+			exit(1);
+		}
+		return id;
+	}
+
+	/* handle a numeric key ID */
+	id = strtoul(arg, &end, 0);
+	if (*end) {
+		fprintf(stderr, "Unparsable key: '%s'\n", arg);
+		exit(2);
+	}
+
+	return id;
+
+incorrect_key_by_name_spec:
+	fprintf(stderr, "Incorrect key-by-name spec\n");
+	exit(2);
+
+} /* end get_key_id() */
+
+/*****************************************************************************/
+/*
+ * recursively display a key/keyring tree
+ */
+static int dump_key_tree_aux(key_serial_t key, int depth, int more, int hex_key_IDs)
+{
+	static char dumpindent[64];
+	key_serial_t *pk;
+	key_perm_t perm;
+	size_t ringlen;
+	void *payload;
+	char *desc, type[255], pretty_mask[9];
+	int uid, gid, ret, n, dpos, rdepth, kcount = 0;
+
+	if (depth > 8 * 4)
+		return 0;
+
+	/* read the description */
+	ret = keyctl_describe_alloc(key, &desc);
+	if (ret < 0) {
+		printf("%d: key inaccessible (%m)\n", key);
+		return 0;
+	}
+
+	/* parse */
+	type[0] = 0;
+	uid = 0;
+	gid = 0;
+	perm = 0;
+
+	n = sscanf(desc, "%[^;];%d;%d;%x;%n",
+		   type, &uid, &gid, &perm, &dpos);
+
+	if (n != 4) {
+		fprintf(stderr, "Unparseable description obtained for key %d\n", key);
+		exit(3);
+	}
+
+	/* and print */
+	calc_perms(pretty_mask, perm, uid, gid);
+
+	if (hex_key_IDs)
+		printf("0x%08x %s  %5d %5d  %s%s%s: %s\n",
+		       key,
+		       pretty_mask,
+		       uid, gid,
+		       dumpindent,
+		       depth > 0 ? "\\_ " : "",
+		       type, desc + dpos);
+	else
+		printf("%10d %s  %5d %5d  %s%s%s: %s\n",
+		       key,
+		       pretty_mask,
+		       uid, gid,
+		       dumpindent,
+		       depth > 0 ? "\\_ " : "",
+		       type, desc + dpos);
+
+	free(desc);
+
+	/* if it's a keyring then we're going to want to recursively
+	 * display it if we can */
+	if (strcmp(type, "keyring") == 0) {
+		/* find out how big the keyring is */
+		ret = keyctl_read(key, NULL, 0);
+		if (ret < 0)
+			error("keyctl_read");
+		if (ret == 0)
+			return 0;
+		ringlen = ret;
+
+		/* read its contents */
+		payload = malloc(ringlen);
+		if (!payload)
+			error("malloc");
+
+		ret = keyctl_read(key, payload, ringlen);
+		if (ret < 0)
+			error("keyctl_read");
+
+		ringlen = ret < ringlen ? ret : ringlen;
+		kcount = ringlen / sizeof(key_serial_t);
+
+		/* walk the keyring */
+		pk = payload;
+		do {
+			key = *pk++;
+
+			/* recurse into nexted keyrings */
+			if (strcmp(type, "keyring") == 0) {
+				if (depth == 0) {
+					rdepth = depth;
+					dumpindent[rdepth++] = ' ';
+					dumpindent[rdepth] = 0;
+				}
+				else {
+					rdepth = depth;
+					dumpindent[rdepth++] = ' ';
+					dumpindent[rdepth++] = ' ';
+					dumpindent[rdepth++] = ' ';
+					dumpindent[rdepth++] = ' ';
+					dumpindent[rdepth] = 0;
+				}
+
+				if (more)
+					dumpindent[depth + 0] = '|';
+
+				kcount += dump_key_tree_aux(key,
+							    rdepth,
+							    ringlen - 4 >= sizeof(key_serial_t),
+							    hex_key_IDs);
+			}
+
+		} while (ringlen -= 4, ringlen >= sizeof(key_serial_t));
+
+		free(payload);
+	}
+
+	return kcount;
+
+} /* end dump_key_tree_aux() */
+
+/*****************************************************************************/
+/*
+ * recursively list a keyring's contents
+ */
+static int dump_key_tree(key_serial_t keyring, const char *name, int hex_key_IDs)
+{
+	printf("%s\n", name);
+
+	keyring = keyctl_get_keyring_ID(keyring, 0);
+	if (keyring == -1)
+		error("Unable to dump key");
+
+	return dump_key_tree_aux(keyring, 0, 0, hex_key_IDs);
+
+} /* end dump_key_tree() */
diff --git a/keyutils.c b/keyutils.c
new file mode 100644
index 0000000..a6325d0
--- /dev/null
+++ b/keyutils.c
@@ -0,0 +1,739 @@
+/* keyutils.c: key utility library
+ *
+ * Copyright (C) 2005,2011 Red Hat, Inc. All Rights Reserved.
+ * Written by David Howells (dhowells@redhat.com)
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version
+ * 2 of the License, or (at your option) any later version.
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdint.h>
+#include <stdarg.h>
+#include <string.h>
+#include <unistd.h>
+#include <dlfcn.h>
+#include <sys/uio.h>
+#include <errno.h>
+#include <asm/unistd.h>
+#include "keyutils.h"
+
+const char keyutils_version_string[] = PKGVERSION;
+const char keyutils_build_string[] = PKGBUILD;
+
+#ifdef NO_GLIBC_KEYERR
+static int error_inited;
+static void (*libc_perror)(const char *msg);
+static char *(*libc_strerror_r)(int errnum, char *buf, size_t n);
+//static int (*libc_xpg_strerror_r)(int errnum, char *buf, size_t n);
+#define RTLD_NEXT      ((void *) -1L)
+#endif
+
+#define __weak __attribute__((weak))
+
+key_serial_t __weak add_key(const char *type,
+			    const char *description,
+			    const void *payload,
+			    size_t plen,
+			    key_serial_t ringid)
+{
+	return syscall(__NR_add_key,
+		       type, description, payload, plen, ringid);
+}
+
+key_serial_t __weak request_key(const char *type,
+				const char *description,
+				const char * callout_info,
+				key_serial_t destringid)
+{
+	return syscall(__NR_request_key,
+		       type, description, callout_info, destringid);
+}
+
+static inline long __keyctl(int cmd,
+			    unsigned long arg2,
+			    unsigned long arg3,
+			    unsigned long arg4,
+			    unsigned long arg5)
+{
+	return syscall(__NR_keyctl,
+		       cmd, arg2, arg3, arg4, arg5);
+}
+
+long __weak keyctl(int cmd, ...)
+{
+	va_list va;
+	unsigned long arg2, arg3, arg4, arg5;
+
+	va_start(va, cmd);
+	arg2 = va_arg(va, unsigned long);
+	arg3 = va_arg(va, unsigned long);
+	arg4 = va_arg(va, unsigned long);
+	arg5 = va_arg(va, unsigned long);
+	va_end(va);
+
+	return __keyctl(cmd, arg2, arg3, arg4, arg5);
+}
+
+key_serial_t keyctl_get_keyring_ID(key_serial_t id, int create)
+{
+	return keyctl(KEYCTL_GET_KEYRING_ID, id, create);
+}
+
+key_serial_t keyctl_join_session_keyring(const char *name)
+{
+	return keyctl(KEYCTL_JOIN_SESSION_KEYRING, name);
+}
+
+long keyctl_update(key_serial_t id, const void *payload, size_t plen)
+{
+	return keyctl(KEYCTL_UPDATE, id, payload, plen);
+}
+
+long keyctl_revoke(key_serial_t id)
+{
+	return keyctl(KEYCTL_REVOKE, id);
+}
+
+long keyctl_chown(key_serial_t id, uid_t uid, gid_t gid)
+{
+	return keyctl(KEYCTL_CHOWN, id, uid, gid);
+}
+
+long keyctl_setperm(key_serial_t id, key_perm_t perm)
+{
+	return keyctl(KEYCTL_SETPERM, id, perm);
+}
+
+long keyctl_describe(key_serial_t id, char *buffer, size_t buflen)
+{
+	return keyctl(KEYCTL_DESCRIBE, id, buffer, buflen);
+}
+
+long keyctl_clear(key_serial_t ringid)
+{
+	return keyctl(KEYCTL_CLEAR, ringid);
+}
+
+long keyctl_link(key_serial_t id, key_serial_t ringid)
+{
+	return keyctl(KEYCTL_LINK, id, ringid);
+}
+
+long keyctl_unlink(key_serial_t id, key_serial_t ringid)
+{
+	return keyctl(KEYCTL_UNLINK, id, ringid);
+}
+
+long keyctl_search(key_serial_t ringid,
+		   const char *type,
+		   const char *description,
+		   key_serial_t destringid)
+{
+	return keyctl(KEYCTL_SEARCH, ringid, type, description, destringid);
+}
+
+long keyctl_read(key_serial_t id, char *buffer, size_t buflen)
+{
+	return keyctl(KEYCTL_READ, id, buffer, buflen);
+}
+
+long keyctl_instantiate(key_serial_t id,
+			const void *payload,
+			size_t plen,
+			key_serial_t ringid)
+{
+	return keyctl(KEYCTL_INSTANTIATE, id, payload, plen, ringid);
+}
+
+long keyctl_negate(key_serial_t id, unsigned timeout, key_serial_t ringid)
+{
+	return keyctl(KEYCTL_NEGATE, id, timeout, ringid);
+}
+
+long keyctl_set_reqkey_keyring(int reqkey_defl)
+{
+	return keyctl(KEYCTL_SET_REQKEY_KEYRING, reqkey_defl);
+}
+
+long keyctl_set_timeout(key_serial_t id, unsigned timeout)
+{
+	return keyctl(KEYCTL_SET_TIMEOUT, id, timeout);
+}
+
+long keyctl_assume_authority(key_serial_t id)
+{
+	return keyctl(KEYCTL_ASSUME_AUTHORITY, id);
+}
+
+long keyctl_get_security(key_serial_t id, char *buffer, size_t buflen)
+{
+	return keyctl(KEYCTL_GET_SECURITY, id, buffer, buflen);
+}
+
+long keyctl_session_to_parent(void)
+{
+	return keyctl(KEYCTL_SESSION_TO_PARENT);
+}
+
+long keyctl_reject(key_serial_t id, unsigned timeout, unsigned error,
+		   key_serial_t ringid)
+{
+	long ret = keyctl(KEYCTL_REJECT, id, timeout, error, ringid);
+
+	/* fall back to keyctl_negate() if this op is not supported by this
+	 * kernel version */
+	if (ret == -1 && errno == EOPNOTSUPP)
+		return keyctl_negate(id, timeout, ringid);
+	return ret;
+}
+
+long keyctl_instantiate_iov(key_serial_t id,
+			    const struct iovec *payload_iov,
+			    unsigned ioc,
+			    key_serial_t ringid)
+{
+	long ret = keyctl(KEYCTL_INSTANTIATE_IOV, id, payload_iov, ioc, ringid);
+
+	/* fall back to keyctl_instantiate() if this op is not supported by
+	 * this kernel version */
+	if (ret == -1 && errno == EOPNOTSUPP) {
+		unsigned loop;
+		size_t bsize = 0, seg;
+		void *buf, *p;
+
+		if (!payload_iov || !ioc)
+			return keyctl_instantiate(id, NULL, 0, ringid);
+		for (loop = 0; loop < ioc; loop++)
+			bsize += payload_iov[loop].iov_len;
+		if (bsize == 0)
+			return keyctl_instantiate(id, NULL, 0, ringid);
+		p = buf = malloc(bsize);
+		if (!buf)
+			return -1;
+		for (loop = 0; loop < ioc; loop++) {
+			seg = payload_iov[loop].iov_len;
+			p = memcpy(p, payload_iov[loop].iov_base, seg) + seg;
+		}
+		ret = keyctl_instantiate(id, buf, bsize, ringid);
+		free(buf);
+	}
+	return ret;
+}
+
+long keyctl_invalidate(key_serial_t id)
+{
+	return keyctl(KEYCTL_INVALIDATE, id);
+}
+
+long keyctl_get_persistent(uid_t uid, key_serial_t id)
+{
+	return keyctl(KEYCTL_GET_PERSISTENT, uid, id);
+}
+
+long keyctl_dh_compute(key_serial_t priv, key_serial_t prime,
+		       key_serial_t base, char *buffer, size_t buflen)
+{
+	struct keyctl_dh_params params = { .priv = priv,
+					   .prime = prime,
+					   .base = base };
+
+	return keyctl(KEYCTL_DH_COMPUTE, &params, buffer, buflen, 0);
+}
+
+/*****************************************************************************/
+/*
+ * fetch key description into an allocated buffer
+ * - resulting string is NUL terminated
+ * - returns count not including NUL
+ */
+int keyctl_describe_alloc(key_serial_t id, char **_buffer)
+{
+	char *buf;
+	long buflen, ret;
+
+	ret = keyctl_describe(id, NULL, 0);
+	if (ret < 0)
+		return -1;
+
+	for (;;) {
+		buflen = ret;
+		buf = malloc(buflen);
+		if (!buf)
+			return -1;
+
+		ret = keyctl_describe(id, buf, buflen);
+		if (ret < 0) {
+			free(buf);
+			return -1;
+		}
+
+		if (buflen >= ret)
+			break;
+		free(buf);
+	}
+
+	*_buffer = buf;
+	return ret - 1;
+}
+
+/*****************************************************************************/
+/*
+ * fetch key contents into an allocated buffer
+ * - resulting buffer has an extra NUL added to the end
+ * - returns count (not including extraneous NUL)
+ */
+int keyctl_read_alloc(key_serial_t id, void **_buffer)
+{
+	char *buf;
+	long buflen, ret;
+
+	ret = keyctl_read(id, NULL, 0);
+	if (ret < 0)
+		return -1;
+
+	for (;;) {
+		buflen = ret;
+		buf = malloc(buflen + 1);
+		if (!buf)
+			return -1;
+
+		ret = keyctl_read(id, buf, buflen);
+		if (ret < 0) {
+			free(buf);
+			return -1;
+		}
+
+		if (buflen >= ret)
+			break;
+		free(buf);
+	}
+
+	buf[ret] = 0;
+	*_buffer = buf;
+	return ret;
+}
+
+/*****************************************************************************/
+/*
+ * fetch key security label into an allocated buffer
+ * - resulting string is NUL terminated
+ * - returns count not including NUL
+ */
+int keyctl_get_security_alloc(key_serial_t id, char **_buffer)
+{
+	char *buf;
+	long buflen, ret;
+
+	ret = keyctl_get_security(id, NULL, 0);
+	if (ret < 0)
+		return -1;
+
+	for (;;) {
+		buflen = ret;
+		buf = malloc(buflen);
+		if (!buf)
+			return -1;
+
+		ret = keyctl_get_security(id, buf, buflen);
+		if (ret < 0) {
+			free(buf);
+			return -1;
+		}
+
+		if (buflen >= ret)
+			break;
+		free(buf);
+	}
+
+	*_buffer = buf;
+	return ret - 1;
+}
+
+/*****************************************************************************/
+/*
+ * fetch DH computation results into an allocated buffer
+ * - resulting buffer has an extra NUL added to the end
+ * - returns count (not including extraneous NUL)
+ */
+int keyctl_dh_compute_alloc(key_serial_t priv, key_serial_t prime,
+			    key_serial_t base, void **_buffer)
+{
+	char *buf;
+	long buflen, ret;
+
+	ret = keyctl_dh_compute(priv, prime, base, NULL, 0);
+	if (ret < 0)
+		return -1;
+
+	buflen = ret;
+	buf = malloc(buflen + 1);
+	if (!buf)
+		return -1;
+
+	ret = keyctl_dh_compute(priv, prime, base, buf, buflen);
+	if (ret < 0) {
+		free(buf);
+		return -1;
+	}
+
+	buf[ret] = 0;
+	*_buffer = buf;
+	return ret;
+}
+
+/*
+ * Depth-first recursively apply a function over a keyring tree
+ */
+static int recursive_key_scan_aux(key_serial_t parent, key_serial_t key,
+				  int depth, recursive_key_scanner_t func,
+				  void *data)
+{
+	key_serial_t *pk;
+	key_perm_t perm;
+	size_t ringlen;
+	void *ring;
+	char *desc, type[255];
+	int desc_len, uid, gid, ret, n, kcount = 0;
+
+	if (depth > 800)
+		return 0;
+
+	/* read the key description */
+	desc = NULL;
+	desc_len = keyctl_describe_alloc(key, &desc);
+	if (desc_len < 0)
+		goto do_this_key;
+
+	/* parse */
+	type[0] = 0;
+
+	n = sscanf(desc, "%[^;];%d;%d;%x;", type, &uid, &gid, &perm);
+	if (n != 4) {
+		free(desc);
+		desc = NULL;
+		errno = -EINVAL;
+		desc_len = -1;
+		goto do_this_key;
+	}
+
+	/* if it's a keyring then we're going to want to recursively search it
+	 * if we can */
+	if (strcmp(type, "keyring") == 0) {
+		/* read the keyring's contents */
+		ret = keyctl_read_alloc(key, &ring);
+		if (ret < 0)
+			goto do_this_key;
+
+		ringlen = ret;
+
+		/* walk the keyring */
+		pk = ring;
+		for (ringlen = ret;
+		     ringlen >= sizeof(key_serial_t);
+		     ringlen -= sizeof(key_serial_t)
+		     )
+			kcount += recursive_key_scan_aux(key, *pk++, depth + 1,
+							 func, data);
+
+		free(ring);
+	}
+
+do_this_key:
+	kcount += func(parent, key, desc, desc_len, data);
+	free(desc);
+	return kcount;
+}
+
+/*
+ * Depth-first apply a function over a keyring tree
+ */
+int recursive_key_scan(key_serial_t key, recursive_key_scanner_t func, void *data)
+{
+	return recursive_key_scan_aux(0, key, 0, func, data);
+}
+
+/*
+ * Depth-first apply a function over session keyring tree
+ */
+int recursive_session_key_scan(recursive_key_scanner_t func, void *data)
+{
+	key_serial_t session =
+		keyctl_get_keyring_ID(KEY_SPEC_SESSION_KEYRING, 0);
+	if (session > 0)
+		return recursive_key_scan(session, func, data);
+	return 0;
+}
+
+/*
+ * Find a key by type and description
+ */
+key_serial_t find_key_by_type_and_desc(const char *type, const char *desc,
+				       key_serial_t destringid)
+{
+	key_serial_t id, error;
+	FILE *f;
+	char buf[1024], typebuf[40], rdesc[1024], *kdesc, *cp;
+	int n, ndesc, dlen;
+
+	error = ENOKEY;
+
+	id = request_key(type, desc, NULL, destringid);
+	if (id >= 0 || errno == ENOMEM)
+		return id;
+	if (errno != ENOKEY)
+		error = errno;
+
+	dlen = strlen(desc);
+
+	f = fopen("/proc/keys", "r");
+	if (!f) {
+		fprintf(stderr, "libkeyutils: Can't open /proc/keys: %m\n");
+		return -1;
+	}
+
+	while (fgets(buf, sizeof(buf), f)) {
+		cp = strchr(buf, '\n');
+		if (*cp)
+			*cp = '\0';
+
+		ndesc = 0;
+		n = sscanf(buf, "%x %*s %*u %*s %*x %*d %*d %s %n",
+			   &id, typebuf, &ndesc);
+		if (n == 2 && ndesc > 0 && ndesc <= cp - buf) {
+			if (strcmp(typebuf, type) != 0)
+				continue;
+			kdesc = buf + ndesc;
+			if (memcmp(kdesc, desc, dlen) != 0)
+				continue;
+			if (kdesc[dlen] != ':' &&
+			    kdesc[dlen] != '\0' &&
+			    kdesc[dlen] != ' ')
+				continue;
+			kdesc[dlen] = '\0';
+
+			/* The key type appends extra stuff to the end of the
+			 * description after a colon in /proc/keys.  Colons,
+			 * however, are allowed in descriptions, so we need to
+			 * make a further check. */
+			n = keyctl_describe(id, rdesc, sizeof(rdesc) - 1);
+			if (n == -1) {
+				if (errno != ENOKEY)
+					error = errno;
+				if (errno == ENOMEM)
+					break;
+			}
+			if (n >= sizeof(rdesc) - 1)
+				continue;
+			rdesc[n] = '\0';
+
+			cp = strrchr(rdesc, ';');
+			if (!cp)
+				continue;
+			cp++;
+			if (strcmp(cp, desc) != 0)
+				continue;
+
+			fclose(f);
+
+			if (destringid &&
+			    keyctl_link(id, destringid) == -1)
+				return -1;
+
+			return id;
+		}
+	}
+
+	fclose(f);
+	errno = error;
+	return -1;
+}
+
+#ifdef NO_GLIBC_KEYERR
+/*****************************************************************************/
+/*
+ * initialise error handling
+ */
+static void error_init(void)
+{
+	char *err;
+
+	error_inited = 1;
+
+	dlerror();
+
+	libc_perror = dlsym(RTLD_NEXT,"perror");
+	if (!libc_perror) {
+		fprintf(stderr, "Failed to look up next perror\n");
+		err = dlerror();
+		if (err)
+			fprintf(stderr, "%s\n", err);
+		abort();
+	}
+
+	//fprintf(stderr, "next perror at %p\n", libc_perror);
+
+	libc_strerror_r = dlsym(RTLD_NEXT,"strerror_r");
+	if (!libc_strerror_r) {
+		fprintf(stderr, "Failed to look up next strerror_r\n");
+		err = dlerror();
+		if (err)
+			fprintf(stderr, "%s\n", err);
+		abort();
+	}
+
+	//fprintf(stderr, "next strerror_r at %p\n", libc_strerror_r);
+
+#if 0
+	libc_xpg_strerror_r = dlsym(RTLD_NEXT,"xpg_strerror_r");
+	if (!libc_xpg_strerror_r) {
+		fprintf(stderr, "Failed to look up next xpg_strerror_r\n");
+		err = dlerror();
+		if (err)
+			fprintf(stderr, "%s\n", err);
+		abort();
+	}
+
+	//fprintf(stderr, "next xpg_strerror_r at %p\n", libc_xpg_strerror_r);
+#endif
+
+} /* end error_init() */
+
+/*****************************************************************************/
+/*
+ * overload glibc's strerror_r() with a version that knows about key errors
+ */
+char *strerror_r(int errnum, char *buf, size_t n)
+{
+	const char *errstr;
+	int len;
+
+	printf("hello\n");
+
+	if (!error_inited)
+		error_init();
+
+	switch (errnum) {
+	case ENOKEY:
+		errstr = "Requested key not available";
+		break;
+
+	case EKEYEXPIRED:
+		errstr = "Key has expired";
+		break;
+
+	case EKEYREVOKED:
+		errstr = "Key has been revoked";
+		break;
+
+	case EKEYREJECTED:
+		errstr = "Key was rejected by service";
+		break;
+
+	default:
+		return libc_strerror_r(errnum, buf, n);
+	}
+
+	len = strlen(errstr) + 1;
+	if (n > len) {
+		errno = ERANGE;
+		if (n > 0) {
+			memcpy(buf, errstr, n - 1);
+			buf[n - 1] = 0;
+		}
+		return NULL;
+	}
+	else {
+		memcpy(buf, errstr, len);
+		return buf;
+	}
+
+} /* end strerror_r() */
+
+#if 0
+/*****************************************************************************/
+/*
+ * overload glibc's strerror_r() with a version that knows about key errors
+ */
+int xpg_strerror_r(int errnum, char *buf, size_t n)
+{
+	const char *errstr;
+	int len;
+
+	if (!error_inited)
+		error_init();
+
+	switch (errnum) {
+	case ENOKEY:
+		errstr = "Requested key not available";
+		break;
+
+	case EKEYEXPIRED:
+		errstr = "Key has expired";
+		break;
+
+	case EKEYREVOKED:
+		errstr = "Key has been revoked";
+		break;
+
+	case EKEYREJECTED:
+		errstr = "Key was rejected by service";
+		break;
+
+	default:
+		return libc_xpg_strerror_r(errnum, buf, n);
+	}
+
+	len = strlen(errstr) + 1;
+	if (n > len) {
+		errno = ERANGE;
+		if (n > 0) {
+			memcpy(buf, errstr, n - 1);
+			buf[n - 1] = 0;
+		}
+		return -1;
+	}
+	else {
+		memcpy(buf, errstr, len);
+		return 0;
+	}
+
+} /* end xpg_strerror_r() */
+#endif
+
+/*****************************************************************************/
+/*
+ *
+ */
+void perror(const char *msg)
+{
+	if (!error_inited)
+		error_init();
+
+	switch (errno) {
+	case ENOKEY:
+		fprintf(stderr, "%s: Requested key not available\n", msg);
+		return;
+
+	case EKEYEXPIRED:
+		fprintf(stderr, "%s: Key has expired\n", msg);
+		return;
+
+	case EKEYREVOKED:
+		fprintf(stderr, "%s: Key has been revoked\n", msg);
+		return;
+
+	case EKEYREJECTED:
+		fprintf(stderr, "%s: Key was rejected by service\n", msg);
+		return;
+
+	default:
+		libc_perror(msg);
+		return;
+	}
+
+} /* end perror() */
+#endif
diff --git a/keyutils.h b/keyutils.h
new file mode 100644
index 0000000..a69fa7a
--- /dev/null
+++ b/keyutils.h
@@ -0,0 +1,183 @@
+/* keyutils.h: key utility library interface
+ *
+ * Copyright (C) 2005,2011 Red Hat, Inc. All Rights Reserved.
+ * Written by David Howells (dhowells@redhat.com)
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version
+ * 2 of the License, or (at your option) any later version.
+ */
+
+#ifndef KEYUTILS_H
+#define KEYUTILS_H
+
+#include <sys/types.h>
+#include <stdint.h>
+
+extern const char keyutils_version_string[];
+extern const char keyutils_build_string[];
+
+/* key serial number */
+typedef int32_t key_serial_t;
+
+/* special process keyring shortcut IDs */
+#define KEY_SPEC_THREAD_KEYRING		-1	/* - key ID for thread-specific keyring */
+#define KEY_SPEC_PROCESS_KEYRING	-2	/* - key ID for process-specific keyring */
+#define KEY_SPEC_SESSION_KEYRING	-3	/* - key ID for session-specific keyring */
+#define KEY_SPEC_USER_KEYRING		-4	/* - key ID for UID-specific keyring */
+#define KEY_SPEC_USER_SESSION_KEYRING	-5	/* - key ID for UID-session keyring */
+#define KEY_SPEC_GROUP_KEYRING		-6	/* - key ID for GID-specific keyring */
+#define KEY_SPEC_REQKEY_AUTH_KEY	-7	/* - key ID for assumed request_key auth key */
+
+/* request-key default keyrings */
+#define KEY_REQKEY_DEFL_NO_CHANGE		-1
+#define KEY_REQKEY_DEFL_DEFAULT			0
+#define KEY_REQKEY_DEFL_THREAD_KEYRING		1
+#define KEY_REQKEY_DEFL_PROCESS_KEYRING		2
+#define KEY_REQKEY_DEFL_SESSION_KEYRING		3
+#define KEY_REQKEY_DEFL_USER_KEYRING		4
+#define KEY_REQKEY_DEFL_USER_SESSION_KEYRING	5
+#define KEY_REQKEY_DEFL_GROUP_KEYRING		6
+
+/* key handle permissions mask */
+typedef uint32_t key_perm_t;
+
+#define KEY_POS_VIEW	0x01000000	/* possessor can view a key's attributes */
+#define KEY_POS_READ	0x02000000	/* possessor can read key payload / view keyring */
+#define KEY_POS_WRITE	0x04000000	/* possessor can update key payload / add link to keyring */
+#define KEY_POS_SEARCH	0x08000000	/* possessor can find a key in search / search a keyring */
+#define KEY_POS_LINK	0x10000000	/* possessor can create a link to a key/keyring */
+#define KEY_POS_SETATTR	0x20000000	/* possessor can set key attributes */
+#define KEY_POS_ALL	0x3f000000
+
+#define KEY_USR_VIEW	0x00010000	/* user permissions... */
+#define KEY_USR_READ	0x00020000
+#define KEY_USR_WRITE	0x00040000
+#define KEY_USR_SEARCH	0x00080000
+#define KEY_USR_LINK	0x00100000
+#define KEY_USR_SETATTR	0x00200000
+#define KEY_USR_ALL	0x003f0000
+
+#define KEY_GRP_VIEW	0x00000100	/* group permissions... */
+#define KEY_GRP_READ	0x00000200
+#define KEY_GRP_WRITE	0x00000400
+#define KEY_GRP_SEARCH	0x00000800
+#define KEY_GRP_LINK	0x00001000
+#define KEY_GRP_SETATTR	0x00002000
+#define KEY_GRP_ALL	0x00003f00
+
+#define KEY_OTH_VIEW	0x00000001	/* third party permissions... */
+#define KEY_OTH_READ	0x00000002
+#define KEY_OTH_WRITE	0x00000004
+#define KEY_OTH_SEARCH	0x00000008
+#define KEY_OTH_LINK	0x00000010
+#define KEY_OTH_SETATTR	0x00000020
+#define KEY_OTH_ALL	0x0000003f
+
+/* keyctl commands */
+#define KEYCTL_GET_KEYRING_ID		0	/* ask for a keyring's ID */
+#define KEYCTL_JOIN_SESSION_KEYRING	1	/* join or start named session keyring */
+#define KEYCTL_UPDATE			2	/* update a key */
+#define KEYCTL_REVOKE			3	/* revoke a key */
+#define KEYCTL_CHOWN			4	/* set ownership of a key */
+#define KEYCTL_SETPERM			5	/* set perms on a key */
+#define KEYCTL_DESCRIBE			6	/* describe a key */
+#define KEYCTL_CLEAR			7	/* clear contents of a keyring */
+#define KEYCTL_LINK			8	/* link a key into a keyring */
+#define KEYCTL_UNLINK			9	/* unlink a key from a keyring */
+#define KEYCTL_SEARCH			10	/* search for a key in a keyring */
+#define KEYCTL_READ			11	/* read a key or keyring's contents */
+#define KEYCTL_INSTANTIATE		12	/* instantiate a partially constructed key */
+#define KEYCTL_NEGATE			13	/* negate a partially constructed key */
+#define KEYCTL_SET_REQKEY_KEYRING	14	/* set default request-key keyring */
+#define KEYCTL_SET_TIMEOUT		15	/* set timeout on a key */
+#define KEYCTL_ASSUME_AUTHORITY		16	/* assume authority to instantiate key */
+#define KEYCTL_GET_SECURITY		17	/* get key security label */
+#define KEYCTL_SESSION_TO_PARENT	18	/* set my session keyring on my parent process */
+#define KEYCTL_REJECT			19	/* reject a partially constructed key */
+#define KEYCTL_INSTANTIATE_IOV		20	/* instantiate a partially constructed key */
+#define KEYCTL_INVALIDATE		21	/* invalidate a key */
+#define KEYCTL_GET_PERSISTENT		22	/* get a user's persistent keyring */
+#define KEYCTL_DH_COMPUTE		23	/* Compute Diffie-Hellman values */
+
+/* keyctl structures */
+struct keyctl_dh_params {
+	key_serial_t priv;
+	key_serial_t prime;
+	key_serial_t base;
+};
+
+/*
+ * syscall wrappers
+ */
+extern key_serial_t add_key(const char *type,
+			    const char *description,
+			    const void *payload,
+			    size_t plen,
+			    key_serial_t ringid);
+
+extern key_serial_t request_key(const char *type,
+				const char *description,
+				const char *callout_info,
+				key_serial_t destringid);
+
+extern long keyctl(int cmd, ...);
+
+/*
+ * keyctl function wrappers
+ */
+extern key_serial_t keyctl_get_keyring_ID(key_serial_t id, int create);
+extern key_serial_t keyctl_join_session_keyring(const char *name);
+extern long keyctl_update(key_serial_t id, const void *payload, size_t plen);
+extern long keyctl_revoke(key_serial_t id);
+extern long keyctl_chown(key_serial_t id, uid_t uid, gid_t gid);
+extern long keyctl_setperm(key_serial_t id, key_perm_t perm);
+extern long keyctl_describe(key_serial_t id, char *buffer, size_t buflen);
+extern long keyctl_clear(key_serial_t ringid);
+extern long keyctl_link(key_serial_t id, key_serial_t ringid);
+extern long keyctl_unlink(key_serial_t id, key_serial_t ringid);
+extern long keyctl_search(key_serial_t ringid,
+			  const char *type,
+			  const char *description,
+			  key_serial_t destringid);
+extern long keyctl_read(key_serial_t id, char *buffer, size_t buflen);
+extern long keyctl_instantiate(key_serial_t id,
+			       const void *payload,
+			       size_t plen,
+			       key_serial_t ringid);
+extern long keyctl_negate(key_serial_t id, unsigned timeout, key_serial_t ringid);
+extern long keyctl_set_reqkey_keyring(int reqkey_defl);
+extern long keyctl_set_timeout(key_serial_t key, unsigned timeout);
+extern long keyctl_assume_authority(key_serial_t key);
+extern long keyctl_get_security(key_serial_t key, char *buffer, size_t buflen);
+extern long keyctl_session_to_parent(void);
+extern long keyctl_reject(key_serial_t id, unsigned timeout, unsigned error,
+			  key_serial_t ringid);
+struct iovec;
+extern long keyctl_instantiate_iov(key_serial_t id,
+				   const struct iovec *payload_iov,
+				   unsigned ioc,
+				   key_serial_t ringid);
+extern long keyctl_invalidate(key_serial_t id);
+extern long keyctl_get_persistent(uid_t uid, key_serial_t id);
+extern long keyctl_dh_compute(key_serial_t priv, key_serial_t prime,
+			      key_serial_t base, char *buffer, size_t buflen);
+
+/*
+ * utilities
+ */
+extern int keyctl_describe_alloc(key_serial_t id, char **_buffer);
+extern int keyctl_read_alloc(key_serial_t id, void **_buffer);
+extern int keyctl_get_security_alloc(key_serial_t id, char **_buffer);
+extern int keyctl_dh_compute_alloc(key_serial_t priv, key_serial_t prime,
+				   key_serial_t base, void **_buffer);
+
+typedef int (*recursive_key_scanner_t)(key_serial_t parent, key_serial_t key,
+				       char *desc, int desc_len, void *data);
+extern int recursive_key_scan(key_serial_t key, recursive_key_scanner_t func, void *data);
+extern int recursive_session_key_scan(recursive_key_scanner_t func, void *data);
+extern key_serial_t find_key_by_type_and_desc(const char *type, const char *desc,
+					      key_serial_t destringid);
+
+#endif /* KEYUTILS_H */
diff --git a/keyutils.spec b/keyutils.spec
new file mode 100644
index 0000000..1cbcf86
--- /dev/null
+++ b/keyutils.spec
@@ -0,0 +1,286 @@
+%define vermajor 1
+%define verminor 5.10
+%define version %{vermajor}.%{verminor}
+%define libapivermajor 1
+%define libapiversion %{libapivermajor}.6
+
+# % define buildid .local
+
+Summary: Linux Key Management Utilities
+Name: keyutils
+Version: %{version}
+Release: 1%{?buildid}%{?dist}
+License: GPLv2+ and LGPLv2+
+Group: System Environment/Base
+ExclusiveOS: Linux
+Url: http://people.redhat.com/~dhowells/keyutils/
+
+Source0: http://people.redhat.com/~dhowells/keyutils/keyutils-%{version}.tar.bz2
+
+BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
+BuildRequires: glibc-kernheaders >= 2.4-9.1.92
+Requires: keyutils-libs == %{version}-%{release}
+
+%description
+Utilities to control the kernel key management facility and to provide
+a mechanism by which the kernel call back to user space to get a key
+instantiated.
+
+%package libs
+Summary: Key utilities library
+Group: System Environment/Base
+
+%description libs
+This package provides a wrapper library for the key management facility system
+calls.
+
+%package libs-devel
+Summary: Development package for building Linux key management utilities
+Group: System Environment/Base
+Requires: keyutils-libs == %{version}-%{release}
+
+%description libs-devel
+This package provides headers and libraries for building key utilities.
+
+%prep
+%setup -q
+
+%define datadir %{_datarootdir}/keyutils
+
+%build
+make \
+	NO_ARLIB=1 \
+	ETCDIR=%{_sysconfdir} \
+	LIBDIR=%{_libdir} \
+	USRLIBDIR=%{_libdir} \
+	BINDIR=%{_bindir} \
+	SBINDIR=%{_sbindir} \
+	MANDIR=%{_mandir} \
+	INCLUDEDIR=%{_includedir} \
+	SHAREDIR=%{datadir} \
+	RELEASE=.%{release} \
+	NO_GLIBC_KEYERR=1 \
+	CFLAGS="-Wall $RPM_OPT_FLAGS -Werror"
+
+%install
+rm -rf $RPM_BUILD_ROOT
+make \
+	NO_ARLIB=1 \
+	DESTDIR=$RPM_BUILD_ROOT \
+	ETCDIR=%{_sysconfdir} \
+	LIBDIR=%{_libdir} \
+	USRLIBDIR=%{_libdir} \
+	BINDIR=%{_bindir} \
+	SBINDIR=%{_sbindir} \
+	MANDIR=%{_mandir} \
+	INCLUDEDIR=%{_includedir} \
+	SHAREDIR=%{datadir} \
+	install
+
+%clean
+rm -rf $RPM_BUILD_ROOT
+
+%post libs -p /sbin/ldconfig
+%postun libs -p /sbin/ldconfig
+
+%files
+%defattr(-,root,root,-)
+%doc README LICENCE.GPL
+%{_sbindir}/*
+%{_bindir}/*
+%{datadir}
+%{_mandir}/man1/*
+%{_mandir}/man5/*
+%{_mandir}/man8/*
+%config(noreplace) %{_sysconfdir}/*
+
+%files libs
+%defattr(-,root,root,-)
+%doc LICENCE.LGPL
+%{_mandir}/man7/*
+%{_libdir}/libkeyutils.so.%{libapiversion}
+%{_libdir}/libkeyutils.so.%{libapivermajor}
+
+%files libs-devel
+%defattr(-,root,root,-)
+%{_libdir}/libkeyutils.so
+%{_includedir}/*
+%{_mandir}/man3/*
+
+%changelog
+* Wed Mar 15 2017 David Howells <dhowells@redhat.com> - 1.5.10-1
+- Include sys/types.h in keyutils.h.
+- The dns resolver needs limits.h.
+- Overhaul of all manual pages.
+- Some manual pages moved to Linux man-pages project.
+- Add Diffie-Helman keyctl function.
+
+* Fri Feb 21 2014 David Howells <dhowells@redhat.com> - 1.5.9-1
+- Add manpages for get_persistent.
+- Fix memory leaks in keyctl_describe/read/get_security_alloc().
+- Use keyctl_describe_alloc in dump_key_tree_aux rather than open coding it.
+- Exit rather than returning from act_xxx() functions.
+- Fix memory leak in dump_key_tree_aux.
+- Only get the groups list if we need it.
+- Don't trust sscanf's %n argument.
+- Use the correct path macros in the specfile.
+- Avoid use realloc when the memory has no content.
+- Fix a bunch of issues in key.dns_resolver.
+- Fix command table searching in keyctl utility.
+- Fix a typo in the permissions mask constants.
+- Improve the keyctl_read manpage.
+- Add man7 pages describing various keyrings concepts.
+
+* Fri Oct 4 2013 David Howells <dhowells@redhat.com> - 1.5.8-1
+- New lib symbols should go in a new library minor version.
+
+* Wed Oct 2 2013 David Howells <dhowells@redhat.com> - 1.5.7-1
+- Provide a utility function to find a key by type and name.
+- Allow keyctl commands to take a type+name arg instead of a key-id arg.
+- Add per-UID get_persistent keyring function.
+
+* Thu Aug 29 2013 David Howells <dhowells@redhat.com> - 1.5.6-1
+- Fix the request-key.conf.5 manpage.
+- Fix the max depth of key tree dump (keyctl show).
+- The input buffer size for keyctl padd and pinstantiate should be larger.
+- Add keyctl_invalidate.3 manpage.
+
+* Wed Nov 30 2011 David Howells <dhowells@redhat.com> - 1.5.5-1
+- Fix a Makefile error.
+
+* Wed Nov 30 2011 David Howells <dhowells@redhat.com> - 1.5.4-1
+- Fix the keyctl padd command and similar to handle binary input.
+- Make keyctl show able to take a keyring to dump.
+- Make keyctl show able to take a flag to request hex key IDs.
+- Make keyctl show print the real ID of the root keyring.
+
+* Tue Nov 15 2011 David Howells <dhowells@redhat.com>
+- Allow /sbin/request-key to have multiple config files.
+
+* Wed Aug 31 2011 David Howells <dhowells@redhat.com>
+- Adjust the manual page for 'keyctl unlink' to show keyring is optional.
+- Add --version support for the keyutils version and build date.
+
+* Thu Aug 11 2011 David Howells <dhowells@redhat.com> - 1.5.3-1
+- Make the keyutils rpm depend on the same keyutils-libs rpm version.
+
+* Tue Jul 26 2011 David Howells <dhowells@redhat.com> - 1.5.2-1
+- Use correct format spec for printing pointer subtraction results.
+
+* Tue Jul 19 2011 David Howells <dhowells@redhat.com> - 1.5.1-1
+- Fix unread variables.
+- Licence file update.
+
+* Thu Mar 10 2011 David Howells <dhowells@redhat.com> - 1.5-1
+- Disable RPATH setting in Makefile.
+- Add -I. to build to get this keyutils.h.
+- Make CFLAGS override on make command line work right.
+- Make specfile UTF-8.
+- Support KEYCTL_REJECT.
+- Support KEYCTL_INSTANTIATE_IOV.
+- Add AFSDB DNS lookup program from Wang Lei.
+- Generalise DNS lookup program.
+- Add recursive scan utility function.
+- Add bad key reap command to keyctl.
+- Add multi-unlink variant to keyctl unlink command.
+- Add multi key purge command to keyctl.
+- Handle multi-line commands in keyctl command table.
+- Move the package to version to 1.5.
+
+* Tue Mar 1 2011 David Howells <dhowells@redhat.com> - 1.4-4
+- Make build guess at default libdirs and word size.
+- Make program build depend on library in Makefile.
+- Don't include $(DESTDIR) in MAN* macros.
+- Remove NO_GLIBC_KEYSYS as it is obsolete.
+- Have Makefile extract version info from specfile and version script.
+- Provide RPM build rule in Makefile.
+- Provide distclean rule in Makefile.
+
+* Fri Dec 17 2010 Diego Elio Pettenò <flameeyes@hosting.flameeyes.eu> - 1.4-3
+- Fix local linking and RPATH.
+
+* Thu Jun 10 2010 David Howells <dhowells@redhat.com> - 1.4-2
+- Fix prototypes in manual pages (some char* should be void*).
+- Rename the keyctl_security.3 manpage to keyctl_get_security.3.
+
+* Fri Mar 19 2010 David Howells <dhowells@redhat.com> - 1.4-1
+- Fix the library naming wrt the version.
+- Move the package to version to 1.4.
+
+* Fri Mar 19 2010 David Howells <dhowells@redhat.com> - 1.3-3
+- Fix spelling mistakes in manpages.
+- Add an index manpage for all the keyctl functions.
+
+* Thu Mar 11 2010 David Howells <dhowells@redhat.com> - 1.3-2
+- Fix rpmlint warnings.
+
+* Fri Feb 26 2010 David Howells <dhowells@redhat.com> - 1.3-1
+- Fix compiler warnings in request-key.
+- Expose the kernel function to get a key's security context.
+- Expose the kernel function to set a processes keyring onto its parent.
+- Move libkeyutils library version to 1.3.
+
+* Tue Aug 22 2006 David Howells <dhowells@redhat.com> - 1.2-1
+- Remove syscall manual pages (section 2) to man-pages package [BZ 203582]
+- Don't write to serial port in debugging script
+
+* Mon Jun 5 2006 David Howells <dhowells@redhat.com> - 1.1-4
+- Call ldconfig during (un)installation.
+
+* Fri May 5 2006 David Howells <dhowells@redhat.com> - 1.1-3
+- Don't include the release number in the shared library filename
+- Don't build static library
+
+* Fri May 5 2006 David Howells <dhowells@redhat.com> - 1.1-2
+- More bug fixes from Fedora reviewer.
+
+* Thu May 4 2006 David Howells <dhowells@redhat.com> - 1.1-1
+- Fix rpmlint errors
+
+* Mon Dec 5 2005 David Howells <dhowells@redhat.com> - 1.0-2
+- Add build dependency on glibc-kernheaders with key management syscall numbers
+
+* Tue Nov 29 2005 David Howells <dhowells@redhat.com> - 1.0-1
+- Add data pipe-in facility for keyctl request2
+
+* Mon Nov 28 2005 David Howells <dhowells@redhat.com> - 1.0-1
+- Rename library and header file "keyutil" -> "keyutils" for consistency
+- Fix shared library version naming to same way as glibc.
+- Add versioning for shared library symbols
+- Create new keyutils-libs package and install library and main symlink there
+- Install base library symlink in /usr/lib and place in devel package
+- Added a keyutils archive library
+- Shorten displayed key permissions list to just those we actually have
+
+* Thu Nov 24 2005 David Howells <dhowells@redhat.com> - 0.3-4
+- Add data pipe-in facilities for keyctl add, update and instantiate
+
+* Fri Nov 18 2005 David Howells <dhowells@redhat.com> - 0.3-3
+- Added stdint.h inclusion in keyutils.h
+- Made request-key.c use request_key() rather than keyctl_search()
+- Added piping facility to request-key
+
+* Thu Nov 17 2005 David Howells <dhowells@redhat.com> - 0.3-2
+- Added timeout keyctl option
+- request_key auth keys must now be assumed
+- Fix keyctl argument ordering for debug negate line in request-key.conf
+
+* Thu Jul 28 2005 David Howells <dhowells@redhat.com> - 0.3-1
+- Must invoke initialisation from perror() override in libkeyutils
+- Minor UI changes
+
+* Wed Jul 20 2005 David Howells <dhowells@redhat.com> - 0.2-2
+- Bump version to permit building in main repositories.
+
+* Tue Jul 12 2005 David Howells <dhowells@redhat.com> - 0.2-1
+- Don't attempt to define the error codes in the header file.
+- Pass the release ID through to the makefile to affect the shared library name.
+
+* Tue Jul 12 2005 David Howells <dhowells@redhat.com> - 0.1-3
+- Build in the perror() override to get the key error strings displayed.
+
+* Tue Jul 12 2005 David Howells <dhowells@redhat.com> - 0.1-2
+- Need a defattr directive after each files directive.
+
+* Tue Jul 12 2005 David Howells <dhowells@redhat.com> - 0.1-1
+- Package creation.
diff --git a/man/find_key_by_type_and_name.3 b/man/find_key_by_type_and_name.3
new file mode 100644
index 0000000..2fbd21e
--- /dev/null
+++ b/man/find_key_by_type_and_name.3
@@ -0,0 +1,65 @@
+.\"
+.\" Copyright (C) 2013 Red Hat, Inc. All Rights Reserved.
+.\" Written by David Howells (dhowells@redhat.com)
+.\"
+.\" This program is free software; you can redistribute it and/or
+.\" modify it under the terms of the GNU General Public Licence
+.\" as published by the Free Software Foundation; either version
+.\" 2 of the Licence, or (at your option) any later version.
+.\"
+.TH FIND_KEY_BY_TYPE_AND_NAME 3 "10 Sep 2013" Linux "Linux Key Utility Calls"
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH NAME
+find_key_by_type_and_name \- find a key by type and name
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH SYNOPSIS
+.nf
+.B #include <keyutils.h>
+.sp
+.BI "key_serial_t find_key_by_type_and_name(const char *" type ,
+.BI "    const char *" description ", key_serial_t " destringid ");"
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH DESCRIPTION
+.BR find_key_by_type_and_name ()
+searches for a key with the given
+.I type
+and exact
+.IR description ,
+firstly in the thread, process and session keyrings to which a process is
+subscribed and secondly in
+.IR /proc/keys .
+.P
+If a key is found, and
+.I destringid
+is not 0 and specifies a keyring, then the found key will be linked into it.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH RETURN VALUE
+The function returns the ID of the key if a key was found or \-1 otherwise.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH ERRORS
+.TP
+.B ENOKEY
+No key was found or the keyring specified is invalid.
+.TP
+.B EKEYEXPIRED
+The key or keyring have expired.
+.TP
+.B EKEYREVOKED
+The key or keyring have been revoked.
+.TP
+.B EACCES
+The key is not accessible or keyring exists, but is not
+.B writable
+by the calling process.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH LINKING
+When linking,
+.B \-lkeyutils
+should be specified to the linker.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH SEE ALSO
+.ad l
+.nh
+.BR request_key (2),
+.BR keyctl (3),
+.BR keyrings (7)
diff --git a/man/key.dns_resolver.8 b/man/key.dns_resolver.8
new file mode 100644
index 0000000..e1882e0
--- /dev/null
+++ b/man/key.dns_resolver.8
@@ -0,0 +1,34 @@
+.\"
+.\" Copyright (C) 2011 Red Hat, Inc. All Rights Reserved.
+.\" Written by David Howells (dhowells@redhat.com)
+.\"
+.\" This program is free software; you can redistribute it and/or
+.\" modify it under the terms of the GNU General Public License
+.\" as published by the Free Software Foundation; either version
+.\" 2 of the License, or (at your option) any later version.
+.\"
+.TH KEY.DNS_RESOLVER 8 "04 Mar 2011" Linux "Linux Key Management Utilities"
+.SH NAME
+key.dns_resolver \- upcall for request\-key to handle dns_resolver keys
+.SH SYNOPSIS
+\fB/sbin/key.dns_resolver \fR<key>
+.br
+\fB/sbin/key.dns_resolver \fR\-D [\-v] [\-v] <keydesc> <calloutinfo>
+.SH DESCRIPTION
+This program is invoked by request\-key on behalf of the kernel when kernel
+services (such as NFS, CIFS and AFS) want to perform a hostname lookup and the
+kernel does not have the key cached.  It is not ordinarily intended to be
+called directly.
+.P
+It can be called in debugging mode to test its functionality by passing a
+\fB\-D\fR flag on the command line.  For this to work, the key description and
+the callout information must be supplied.  Verbosity can be increased by
+supplying one or more \fB\-v\fR flags.
+.SH ERRORS
+All errors will be logged to the syslog.
+.SH SEE ALSO
+.ad l
+.nh
+.BR request\-key.conf (5),
+.BR keyrings (7),
+.BR request\-key (8)
diff --git a/man/keyctl.1 b/man/keyctl.1
new file mode 100644
index 0000000..7060506
--- /dev/null
+++ b/man/keyctl.1
@@ -0,0 +1,728 @@
+.\"
+.\" Copyright (C) 2004 Red Hat, Inc. All Rights Reserved.
+.\" Written by David Howells (dhowells@redhat.com)
+.\"
+.\" This program is free software; you can redistribute it and/or
+.\" modify it under the terms of the GNU General Public License
+.\" as published by the Free Software Foundation; either version
+.\" 2 of the License, or (at your option) any later version.
+.\"
+.TH KEYCTL 1 "20 Feb 2014" Linux "Linux Key Management Utilities"
+.SH NAME
+keyctl \- key management facility control
+.SH SYNOPSIS
+\fBkeyctl\fR \-\-version
+.br
+\fBkeyctl\fR show [\-x] [<keyring>]
+.br
+\fBkeyctl\fR add <type> <desc> <data> <keyring>
+.br
+\fBkeyctl\fR padd <type> <desc> <keyring>
+.br
+\fBkeyctl\fR request <type> <desc> [<dest_keyring>]
+.br
+\fBkeyctl\fR request2 <type> <desc> <info> [<dest_keyring>]
+.br
+\fBkeyctl\fR prequest2 <type> <desc> [<dest_keyring>]
+.br
+\fBkeyctl\fR update <key> <data>
+.br
+\fBkeyctl\fR pupdate <key>
+.br
+\fBkeyctl\fR newring <name> <keyring>
+.br
+\fBkeyctl\fR revoke <key>
+.br
+\fBkeyctl\fR clear <keyring>
+.br
+\fBkeyctl\fR link <key> <keyring>
+.br
+\fBkeyctl\fR unlink <key> [<keyring>]
+.br
+\fBkeyctl\fR search <keyring> <type> <desc> [<dest_keyring>]
+.br
+\fBkeyctl\fR read <key>
+.br
+\fBkeyctl\fR pipe <key>
+.br
+\fBkeyctl\fR print <key>
+.br
+\fBkeyctl\fR list <keyring>
+.br
+\fBkeyctl\fR rlist <keyring>
+.br
+\fBkeyctl\fR describe <keyring>
+.br
+\fBkeyctl\fR rdescribe <keyring> [sep]
+.br
+\fBkeyctl\fR chown <key> <uid>
+.br
+\fBkeyctl\fR chgrp <key> <gid>
+.br
+\fBkeyctl\fR setperm <key> <mask>
+.br
+\fBkeyctl\fR new_session
+.br
+\fBkeyctl\fR session
+.br
+\fBkeyctl\fR session \- [<prog> <arg1> <arg2> ...]
+.br
+\fBkeyctl\fR session <name> [<prog> <arg1> <arg2> ...]
+.br
+\fBkeyctl\fR instantiate <key> <data> <keyring>
+.br
+\fBkeyctl\fR pinstantiate <key> <keyring>
+.br
+\fBkeyctl\fR negate <key> <timeout> <keyring>
+.br
+\fBkeyctl\fR reject <key> <timeout> <error> <keyring>
+.br
+\fBkeyctl\fR timeout <key> <timeout>
+.br
+\fBkeyctl\fR security <key>
+.br
+\fBkeyctl\fR reap [\-v]
+.br
+\fBkeyctl\fR purge <type>
+.br
+\fBkeyctl\fR purge [\-i] [\-p] <type> <desc>
+.br
+\fBkeyctl\fR purge \-s <type> <desc>
+.br
+\fBkeyctl\fR get_persistent <keyring> [<uid>]
+.br
+\fBkeyctl\fR dh_compute <private> <prime> <base>
+.SH DESCRIPTION
+This program is used to control the key management facility in various ways
+using a variety of subcommands.
+.SH KEY IDENTIFIERS
+The key identifiers passed to or returned from keyctl are, in general, positive
+integers. There are, however, some special values with special meanings that
+can be passed as arguments:
+.TP
+No key: \fB0\fR
+.TP
+Thread keyring: \fB@t\fR or \fB\-1\fR
+Each thread may have its own keyring. This is searched first, before all
+others. The thread keyring is replaced by (v)fork, exec and clone.
+.TP
+Process keyring: \fB@p\fR or \fB\-2\fR
+Each process (thread group) may have its own keyring. This is shared between
+all members of a group and will be searched after the thread keyring. The
+process keyring is replaced by (v)fork and exec.
+.TP
+Session keyring: \fB@s\fR or \fB\-3\fR
+Each process subscribes to a session keyring that is inherited across (v)fork,
+exec and clone. This is searched after the process keyring. Session keyrings
+can be named and an extant keyring can be joined in place of a process's
+current session keyring.
+.TP
+User specific keyring: \fB@u\fR or \fB\-4\fR
+This keyring is shared between all the processes owned by a particular user. It
+isn't searched directly, but is normally linked to from the session keyring.
+.TP
+User default session keyring: \fB@us\fR or \fB\-5\fR
+This is the default session keyring for a particular user. Login processes that
+change to a particular user will bind to this session until another session is
+set.
+.TP
+Group specific keyring: \fB@g\fR or \fB\-6\fR
+This is a place holder for a group specific keyring, but is not actually
+implemented yet in the kernel.
+.TP
+Assumed request_key authorisation key: \fB@a\fR or \fB\-7\fR
+This selects the authorisation key provided to the
+.BR request_key ()
+helper to
+permit it to access the callers keyrings and instantiate the target key.
+.TP
+Keyring by name: \fB%:<name>\fR
+A named keyring.  This will be searched for in the process's keyrings and in
+.IR /proc/keys .
+.TP
+Key by name: \fB%<type>:<name>\fR
+A named key of the given type.  This will be searched for in the process's
+keyrings and in
+.IR /proc/keys .
+.SH COMMAND SYNTAX
+Any non-ambiguous shortening of a command name may be used in lieu of the full
+command name. This facility should not be used in scripting as new commands may
+be added in future that then cause ambiguity.
+.SS Display the package version number
+\fBkeyctl \-\-version\fR
+
+This command prints the package version number and build date and exits:
+
+.RS
+.nf
+$ keyctl \-\-version
+keyctl from keyutils\-1.5.3 (Built 2011\-08\-24)
+.fi
+.RE
+.SS Show process keyrings
+\fBkeyctl show [\-x] [<keyring>]\fR
+
+By default this command recursively shows what keyrings a process is subscribed
+to and what keys and keyrings they contain.  If a keyring is specified then
+that keyring will be dumped instead.  If \fB\-x\fR is specified then the keyring
+IDs will be dumped in hex instead of decimal.
+.SS Add a key to a keyring
+\fBkeyctl add\fR <type> <desc> <data> <keyring>
+.br
+\fBkeyctl padd\fR <type> <desc> <keyring>
+
+This command creates a key of the specified type and description; instantiates
+it with the given data and attaches it to the specified keyring. It then prints
+the new key's ID on stdout:
+
+.RS
+.nf
+$ keyctl add user mykey stuff @u
+26
+.fi
+.RE
+
+The \fBpadd\fR variant of the command reads the data from stdin rather than
+taking it from the command line:
+
+.RS
+.fi
+$ echo \-n stuff | keyctl padd user mykey @u
+26
+.fi
+.RE
+.SS Request a key
+\fBkeyctl request\fR <type> <desc> [<dest_keyring>]
+.br
+\fBkeyctl request2\fR <type> <desc> <info> [<dest_keyring>]
+.br
+\fBkeyctl prequest2\fR <type> <desc> [<dest_keyring>]
+
+These three commands request the lookup of a key of the given type and
+description. The process's keyrings will be searched, and if a match is found
+the matching key's ID will be printed to stdout; and if a destination keyring
+is given, the key will be added to that keyring also.
+
+If there is no key, the first command will simply return the error ENOKEY and
+fail. The second and third commands will create a partial key with the type and
+description, and call out to
+.IR /sbin/request\-key
+with that key and the
+extra information supplied. This will then attempt to instantiate the key in
+some manner, such that a valid key is obtained.
+
+The third command is like the second, except that the callout information is
+read from stdin rather than being passed on the command line.
+
+If a valid key is obtained, the ID will be printed and the key attached as if
+the original search had succeeded.
+
+If there wasn't a valid key obtained, a temporary negative key will be attached
+to the destination keyring if given and the error "Requested key not available"
+will be given.
+
+.RS
+.nf
+$ keyctl request2 user debug:hello wibble
+23
+$ echo \-n wibble | keyctl prequest2 user debug:hello
+23
+$ keyctl request user debug:hello
+23
+.fi
+.RE
+.SS Update a key
+\fBkeyctl update\fR <key> <data>
+.br
+\fBkeyctl pupdate\fR <key>
+
+This command replaces the data attached to a key with a new set of data. If the
+type of the key doesn't support update then error "Operation not supported"
+will be returned.
+
+.RS
+.nf
+$ keyctl update 23 zebra
+.fi
+.RE
+
+The \fBpupdate\fR variant of the command reads the data from stdin rather than
+taking it from the command line:
+
+.RS
+.nf
+$ echo \-n zebra | keyctl pupdate 23
+.fi
+.RE
+.SS Create a keyring
+\fBkeyctl newring\fR <name> <keyring>
+
+This command creates a new keyring of the specified name and attaches it to the
+specified keyring. The ID of the new keyring will be printed to stdout if
+successful.
+
+.RS
+.nf
+$ keyctl newring squelch @us
+27
+.fi
+.RE
+.SS Revoke a key
+\fBkeyctl revoke\fR <key>
+
+This command marks a key as being revoked. Any further operations on that key
+(apart from unlinking it) will return error "Key has been revoked".
+
+.RS
+.nf
+$ keyctl revoke 26
+$ keyctl describe 26
+keyctl_describe: Key has been revoked
+.fi
+.RE
+.SS Clear a keyring
+\fBkeyctl clear\fR <keyring>
+
+This command unlinks all the keys attached to the specified keyring. Error
+"Not a directory" will be returned if the key specified is not a keyring.
+
+.RS
+.nf
+$ keyctl clear 27
+.fi
+.RE
+.SS Link a key to a keyring
+\fBkeyctl link\fR <key> <keyring>
+
+This command makes a link from the key to the keyring if there's enough
+capacity to do so. Error "Not a directory" will be returned if the destination
+is not a keyring. Error "Permission denied" will be returned if the key doesn't
+have link permission or the keyring doesn't have write permission. Error "File
+table overflow" will be returned if the keyring is full. Error "Resource
+deadlock avoided" will be returned if an attempt was made to introduce a
+recursive link.
+
+.RS
+.nf
+$ keyctl link 23 27
+$ keyctl link 27 27
+keyctl_link: Resource deadlock avoided
+.fi
+.RE
+.SS Unlink a key from a keyring or the session keyring tree
+\fBkeyctl unlink\fR <key> [<keyring>]
+
+If the keyring is specified, this command removes a link to the key from the
+keyring. Error "Not a directory" will be returned if the destination is not a
+keyring. Error "Permission denied" will be returned if the keyring doesn't have
+write permission. Error "No such file or directory" will be returned if the key
+is not linked to by the keyring.
+
+If the keyring is not specified, this command performs a depth-first search of
+the session keyring tree and removes all the links to the nominated key that it
+finds (and that it is permitted to remove).  It prints the number of successful
+unlinks before exiting.
+
+.RS
+.nf
+$ keyctl unlink 23 27
+.fi
+.RE
+.SS Search a keyring
+\fBkeyctl search\fR <keyring> <type> <desc> [<dest_keyring>]
+
+This command non-recursively searches a keyring for a key of a particular type
+and description. If found, the ID of the key will be printed on stdout and the
+key will be attached to the destination keyring if present. Error "Requested
+key not available" will be returned if the key is not found.
+
+.RS
+.nf
+$ keyctl search @us user debug:hello
+23
+$ keyctl search @us user debug:bye
+keyctl_search: Requested key not available
+.fi
+.RE
+.SS Read a key
+\fBkeyctl read\fR <key>
+.br
+\fBkeyctl pipe\fR <key>
+.br
+\fBkeyctl print\fR <key>
+
+These commands read the payload of a key. "read" prints it on stdout as a hex
+dump, "pipe" dumps the raw data to stdout and "print" dumps it to stdout
+directly if it's entirely printable or as a hexdump preceded by ":hex:" if not.
+
+If the key type does not support reading of the payload, then error "Operation
+not supported" will be returned.
+
+.RS
+.nf
+$ keyctl read 26
+1 bytes of data in key:
+62
+$ keyctl print 26
+b
+$ keyctl pipe 26
+$
+.fi
+.RE
+.SS List a keyring
+\fBkeyctl list\fR <keyring>
+.br
+\fBkeyctl rlist\fR <keyring>
+
+These commands list the contents of a key as a keyring. "list" pretty prints
+the contents and "rlist" just produces a space-separated list of key IDs.
+
+No attempt is made to check that the specified keyring is a keyring.
+
+.RS
+.nf
+$ keyctl list @us
+2 keys in keyring:
+       22: vrwsl\-\-\-\-\-\-\-\-\-\-  4043    \-1 keyring: _uid.4043
+       23: vrwsl\-\-\-\-\-\-\-\-\-\-  4043  4043 user: debug:hello
+$ keyctl rlist @us
+22 23
+.fi
+.RE
+.SS Describe a key
+\fBkeyctl describe\fR <keyring>
+.br
+\fBkeyctl rdescribe\fR <keyring> [sep]
+
+These commands fetch a description of a keyring. "describe" pretty prints the
+description in the same fashion as the "list" command; "rdescribe" prints the
+raw data returned from the kernel.
+
+.RS
+.nf
+$ keyctl describe @us
+       \-5: vrwsl\-\-\-\-\-\-\-\-\-\-  4043    \-1 keyring: _uid_ses.4043
+$ keyctl rdescribe @us
+keyring;4043;\-1;3f1f0000;_uid_ses.4043
+.fi
+.RE
+
+The raw string is "<type>;<uid>;<gid>;<perms>;<description>", where \fIuid\fR
+and \fIgid\fR are the decimal user and group IDs, \fIperms\fR is the
+permissions mask in hex, \fItype\fR and \fIdescription\fR are the type name and
+description strings (neither of which will contain semicolons).
+.SS Change the access controls on a key
+\fBkeyctl chown\fR <key> <uid>
+.br
+\fBkeyctl chgrp\fR <key> <gid>
+
+These two commands change the UID and GID associated with evaluating a key's
+permissions mask. The UID also governs which quota a key is taken out of.
+
+The chown command is not currently supported; attempting it will earn the error
+"Operation not supported" at best.
+
+For non-superuser users, the GID may only be set to the process's GID or a GID
+in the process's groups list. The superuser may set any GID it likes.
+
+.RS
+.nf
+$ sudo keyctl chown 27 0
+keyctl_chown: Operation not supported
+$ sudo keyctl chgrp 27 0
+.fi
+.RE
+.SS Set the permissions mask on a key
+\fBkeyctl setperm\fR <key> <mask>
+
+This command changes the permission control mask on a key. The mask may be
+specified as a hex number if it begins "0x", an octal number if it begins "0"
+or a decimal number otherwise.
+
+The hex numbers are a combination of:
+
+.RS
+.nf
+Possessor UID       GID       Other     Permission Granted
+========  ========  ========  ========  ==================
+01000000  00010000  00000100  00000001  View
+02000000  00020000  00000200  00000002  Read
+04000000  00040000  00000400  00000004  Write
+08000000  00080000  00000800  00000008  Search
+10000000  00100000  00001000  00000010  Link
+20000000  00200000  00002000  00000020  Set Attribute
+3f000000  003f0000  00003f00  0000003f  All
+.fi
+.RE
+
+\fIView\fR permits the type, description and other parameters of a key to be
+viewed.
+
+\fIRead\fR permits the payload (or keyring list) to be read if supported by the
+type.
+
+\fIWrite\fR permits the payload (or keyring list) to be modified or updated.
+
+\fISearch\fR on a key permits it to be found when a keyring to which it is
+linked is searched.
+
+\fILink\fR permits a key to be linked to a keyring.
+
+\fISet Attribute\fR permits a key to have its owner, group membership,
+permissions mask and timeout changed.
+
+.RS
+.nf
+$ keyctl setperm 27 0x1f1f1f00
+.fi
+.RE
+.SS Start a new session with fresh keyrings
+\fBkeyctl session\fR
+.br
+\fBkeyctl session\fR \- [<prog> <arg1> <arg2> ...]
+.br
+\fBkeyctl session\fR <name> [<prog> <arg1> <arg2> ...]
+
+These commands join or create a new keyring and then run a shell or other
+program with that keyring as the session key.
+
+The variation with no arguments just creates an anonymous session keyring and
+attaches that as the session keyring; it then exec's $SHELL.
+
+The variation with a dash in place of a name creates an anonymous session
+keyring and attaches that as the session keyring; it then exec's the supplied
+command, or $SHELL if one isn't supplied.
+
+The variation with a name supplied creates or joins the named keyring and
+attaches that as the session keyring; it then exec's the supplied command, or
+$SHELL if one isn't supplied.
+
+.RS
+.nf
+$ keyctl rdescribe @s
+keyring;4043;\-1;3f1f0000;_uid_ses.4043
+
+$ keyctl session
+Joined session keyring: 28
+
+$ keyctl rdescribe @s
+keyring;4043;4043;3f1f0000;_ses.24082
+
+$ keyctl session \-
+Joined session keyring: 29
+$ keyctl rdescribe @s
+keyring;4043;4043;3f1f0000;_ses.24139
+
+$ keyctl session \- keyctl rdescribe @s
+Joined session keyring: 30
+keyring;4043;4043;3f1f0000;_ses.24185
+
+$ keyctl session fish
+Joined session keyring: 34
+$ keyctl rdescribe @s
+keyring;4043;4043;3f1f0000;fish
+
+$ keyctl session fish keyctl rdesc @s
+Joined session keyring: 35
+keyring;4043;4043;3f1f0000;fish
+.fi
+.RE
+.SS Instantiate a key
+\fBkeyctl instantiate\fR <key> <data> <keyring>
+.br
+\fBkeyctl pinstantiate\fR <key> <keyring>
+.br
+\fBkeyctl negate\fR <key> <timeout> <keyring>
+.br
+\fBkeyctl reject\fR <key> <timeout> <error> <keyring>
+
+These commands are used to attach data to a partially set up key (as created by
+the kernel and passed to
+.IR /sbin/request\-key ).
+"instantiate" marks a key as
+being valid and attaches the data as the payload.  "negate" and "reject" mark a
+key as invalid and sets a timeout on it so that it'll go away after a while.
+This prevents a lot of quickly sequential requests from slowing the system down
+overmuch when they all fail, as all subsequent requests will then fail with
+error "Requested key not found" (if negated) or the specified error (if
+rejected) until the negative key has expired.
+
+Reject's error argument can either be a UNIX error number or one of
+.BR "" "'" rejected "', '" expired "' or '" revoked "'."
+
+The newly instantiated key will be attached to the specified keyring.
+
+These commands may only be run from the program run by request\-key - a special
+authorisation key is set up by the kernel and attached to the request\-key's
+session keyring. This special key is revoked once the key to which it refers
+has been instantiated one way or another.
+
+.RS
+.nf
+$ keyctl instantiate $1 "Debug $3" $4
+$ keyctl negate $1 30 $4
+$ keyctl reject $1 30 64 $4
+.fi
+.RE
+
+The \fBpinstantiate\fR variant of the command reads the data from stdin rather
+than taking it from the command line:
+
+.RS
+.nf
+$ echo \-n "Debug $3" | keyctl pinstantiate $1 $4
+.fi
+.RE
+.SS Set the expiry time on a key
+\fBkeyctl timeout\fR <key> <timeout>
+
+This command is used to set the timeout on a key, or clear an existing timeout
+if the value specified is zero. The timeout is given as a number of seconds
+into the future.
+
+.RS
+.nf
+$ keyctl timeout $1 45
+.fi
+.RE
+.SS Retrieve a key's security context
+\fBkeyctl security\fR <key>
+
+This command is used to retrieve a key's LSM security context.  The label is
+printed on stdout.
+
+.RS
+.nf
+$ keyctl security @s
+unconfined_u:unconfined_r:unconfined_t:s0\-s0:c0.c1023
+.fi
+.RE
+.SS Give the parent process a new session keyring
+\fBkeyctl new_session\fR
+
+This command is used to give the invoking process (typically a shell) a new
+session keyring, discarding its old session keyring.
+
+.RS
+.nf
+$  keyctl session foo
+Joined session keyring: 723488146
+$  keyctl show
+Session Keyring
+       \-3 \-\-alswrv      0     0  keyring: foo
+$  keyctl new_session
+490511412
+$  keyctl show
+Session Keyring
+       \-3 \-\-alswrv      0     0  keyring: _ses
+.fi
+.RE
+
+Note that this affects the \fIparent\fP of the process that invokes the system
+call, and so may only affect processes with matching credentials.
+Furthermore, the change does not take effect till the parent process next
+transitions from kernel space to user space - typically when the \fBwait\fP()
+system call returns.
+.SS Remove dead keys from the session keyring tree
+\fBkeyctl reap\fR
+
+This command performs a depth-first search of the caller's session keyring tree
+and attempts to unlink any key that it finds that is inaccessible due to
+expiry, revocation, rejection or negation.  It does not attempt to remove live
+keys that are unavailable simply due to a lack of granted permission.
+
+A key that is designated reapable will only be removed from a keyring if the
+caller has Write permission on that keyring, and only keyrings that grant
+Search permission to the caller will be searched.
+
+The command prints the number of keys reaped before it exits.  If the \fB\-v\fR
+flag is passed then the reaped keys are listed as they're being reaped,
+together with the success or failure of the unlink.
+.SS Remove matching keys from the session keyring tree
+\fBkeyctl\fR purge <type>
+.br
+\fBkeyctl\fR purge [\-i] [\-p] <type> <desc>
+.br
+\fBkeyctl\fR purge \-s <type> <desc>
+
+These commands perform a depth-first search to find matching keys in the
+caller's session keyring tree and attempts to unlink them.  The number of
+keys successfully unlinked is printed at the end.
+
+The keyrings must grant Read and View permission to the caller to be searched,
+and the keys to be removed must also grant View permission.  Keys can only be
+removed from keyrings that grant Write permission.
+
+The first variant purges all keys of the specified type.
+
+The second variant purges all keys of the specified type that also match the
+given description literally.  The \-i flag allows a case-independent match and
+the \-p flag allows a prefix match.
+
+The third variant purges all keys of the specified type and matching
+description using the key type's comparator in the kernel to match the
+description.  This permits the key type to match a key with a variety of
+descriptions.
+.SS Get persistent keyring
+\fBkeyctl\fR get_persistent <keyring> [<uid>]
+
+This command gets the persistent keyring for either the current UID or the
+specified UID and attaches it to the nominated keyring.  The persistent
+keyring's ID will be printed on stdout.
+
+The kernel will create the keyring if it doesn't exist and every time this
+command is called, will reset the expiration timeout on the keyring to the
+value in:
+.IP
+/proc/sys/kernel/keys/persistent_keyring_expiry
+.P
+(by default three days).  Should the timeout be reached, the persistent keyring
+will be removed and everything it pins can then be garbage collected.
+
+If a UID other than the process's real or effective UIDs is specified, then an
+error will be given if the process does not have the CAP_SETUID capability.
+.SS Compute a Diffie-Hellman shared secret or public key
+\fBkeyctl\fR dh_compute <private> <prime> <base>
+
+This command computes either a Diffie-Hellman shared secret or the
+public key corresponding to the provided private key using the
+payloads of three keys. The computation is:
+.IP
+base ^ private (mod prime)
+.P
+The three inputs must be user keys with read permission. If the
+provided base key contains the shared generator value, the public key
+will be computed.  If the provided base key contains the remote public
+key value, the shared secret will be computed.
+
+The result is printed to stdout as a hex dump.
+
+.RS
+.nf
+$ keyctl dh_compute $1 $2 $3
+8 bytes of data in result:
+00010203 04050607
+.fi
+.RE
+.SH ERRORS
+There are a number of common errors returned by this program:
+
+"Not a directory" - a key wasn't a keyring.
+
+"Requested key not found" - the looked for key isn't available.
+
+"Key has been revoked" - a revoked key was accessed.
+
+"Key has expired" - an expired key was accessed.
+
+"Permission denied" - permission was denied by a UID/GID/mask combination.
+.SH SEE ALSO
+.ad l
+.nh
+.BR keyctl (1),
+.BR keyctl (2),
+.BR request_key (2),
+.BR keyctl (3),
+.BR request\-key.conf (5),
+.BR keyrings (7),
+.BR request\-key (8)
diff --git a/man/keyctl.3 b/man/keyctl.3
new file mode 100644
index 0000000..81929c2
--- /dev/null
+++ b/man/keyctl.3
@@ -0,0 +1,107 @@
+.\"
+.\" Copyright (C) 2010 Red Hat, Inc. All Rights Reserved.
+.\" Written by David Howells (dhowells@redhat.com)
+.\"
+.\" This program is free software; you can redistribute it and/or
+.\" modify it under the terms of the GNU General Public Licence
+.\" as published by the Free Software Foundation; either version
+.\" 2 of the Licence, or (at your option) any later version.
+.\"
+.TH KEYCTL 3 "21 Feb 2014" Linux "Linux Key Management Calls"
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH NAME
+keyctl_*() \- key management function wrappers
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH DESCRIPTION
+The
+.BR keyctl ()
+system call is a multiplexor for a number of key management functions.  These
+should be called via the wrappers in the libkeyutils library.
+.P
+The functions can be compiled in by including the \fBkeyutils\fR header file:
+.sp
+.RS
+.nf
+.B #include <keyutils.h>
+.RE
+.P
+and then telling the linker it should link in the library:
+.sp
+.RS
+.nf
+.B \-lkeyutils
+.RE
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH KEYCTL FUNCTIONS
+.BR keyctl_assume_authority (3)
+.br
+.BR keyctl_chown (3)
+.br
+.BR keyctl_clear (3)
+.br
+.BR keyctl_describe (3)
+.br
+.BR keyctl_describe_alloc (3)
+.br
+.BR keyctl_dh_compute (3)
+.br
+.BR keyctl_dh_compute_alloc (3)
+.br
+.BR keyctl_get_keyring_ID (3)
+.br
+.BR keyctl_get_persistent (3)
+.br
+.BR keyctl_get_security (3)
+.br
+.BR keyctl_get_security_alloc (3)
+.br
+.BR keyctl_instantiate (3)
+.br
+.BR keyctl_instantiate_iov (3)
+.br
+.BR keyctl_invalidate (3)
+.br
+.BR keyctl_join_session_keyring (3)
+.br
+.BR keyctl_link (3)
+.br
+.BR keyctl_negate (3)
+.br
+.BR keyctl_read (3)
+.br
+.BR keyctl_read_alloc (3)
+.br
+.BR keyctl_reject (3)
+.br
+.BR keyctl_revoke (3)
+.br
+.BR keyctl_search (3)
+.br
+.BR keyctl_session_to_parent (3)
+.br
+.BR keyctl_set_reqkey_keyring (3)
+.br
+.BR keyctl_set_timeout (3)
+.br
+.BR keyctl_setperm (3)
+.br
+.BR keyctl_unlink (3)
+.br
+.BR keyctl_update (3)
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH UTILITY FUNCTIONS
+.BR find_key_by_type_and_name (3)
+.br
+.BR recursive_key_scan (3)
+.br
+.BR recursive_session_key_scan (3)
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH SEE ALSO
+.ad l
+.nh
+.BR keyctl (1),
+.BR add_key (2),
+.BR keyctl (2),
+.BR request_key (2),
+.BR keyrings (7),
+.BR keyutils (7)
diff --git a/man/keyctl_chown.3 b/man/keyctl_chown.3
new file mode 100644
index 0000000..286bded
--- /dev/null
+++ b/man/keyctl_chown.3
@@ -0,0 +1,88 @@
+.\"
+.\" Copyright (C) 2006 Red Hat, Inc. All Rights Reserved.
+.\" Written by David Howells (dhowells@redhat.com)
+.\"
+.\" This program is free software; you can redistribute it and/or
+.\" modify it under the terms of the GNU General Public License
+.\" as published by the Free Software Foundation; either version
+.\" 2 of the License, or (at your option) any later version.
+.\"
+.TH KEYCTL_CHOWN 3 "4 May 2006" Linux "Linux Key Management Calls"
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH NAME
+keyctl_chown \- change the ownership of a key
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH SYNOPSIS
+.nf
+.B #include <keyutils.h>
+.sp
+.BI "long keyctl_chown(key_serial_t " key ", uid_t " uid ", gid_t " gid ");"
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH DESCRIPTION
+.BR keyctl_chown ()
+changes the user and group ownership details of a key.
+.P
+A setting of
+.B -1
+on either
+.I uid
+or
+.I gid
+will cause that setting to be ignored.
+.P
+A process that does not have the
+.B SysAdmin
+capability may not change a key's UID or set the key's GID to a value that
+does not match the process's GID or one of its group list.
+.P
+The caller must have
+.B setattr
+permission on a key to be able change its ownership.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH RETURN VALUE
+On success
+.BR keyctl_chown ()
+returns
+.B 0 .
+On error, the value
+.B -1
+will be returned and
+.I errno
+will have been set to an appropriate error.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH ERRORS
+.TP
+.B ENOKEY
+The specified key does not exist.
+.TP
+.B EKEYEXPIRED
+The specified key has expired.
+.TP
+.B EKEYREVOKED
+The specified key has been revoked.
+.TP
+.B EDQUOT
+Changing the UID to the one specified would run that UID out of quota.
+.TP
+.B EACCES
+The key exists, but does not grant
+.B setattr
+permission to the calling process.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH LINKING
+This is a library function that can be found in
+.IR libkeyutils .
+When linking,
+.B \-lkeyutils
+should be specified to the linker.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH SEE ALSO
+.ad l
+.nh
+.BR keyctl (1),
+.BR add_key (2),
+.BR keyctl (2),
+.BR request_key (2),
+.BR keyctl (3),
+.BR keyrings (7),
+.BR keyutils (7)
diff --git a/man/keyctl_clear.3 b/man/keyctl_clear.3
new file mode 100644
index 0000000..21e0c26
--- /dev/null
+++ b/man/keyctl_clear.3
@@ -0,0 +1,74 @@
+.\"
+.\" Copyright (C) 2006 Red Hat, Inc. All Rights Reserved.
+.\" Written by David Howells (dhowells@redhat.com)
+.\"
+.\" This program is free software; you can redistribute it and/or
+.\" modify it under the terms of the GNU General Public License
+.\" as published by the Free Software Foundation; either version
+.\" 2 of the License, or (at your option) any later version.
+.\"
+.TH KEYCTL_CLEAR 3 "4 May 2006" Linux "Linux Key Management Calls"
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH NAME
+keyctl_clear \- clear a keyring
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH SYNOPSIS
+.nf
+.B #include <keyutils.h>
+.sp
+.BI "long keyctl_clear(key_serial_t " keyring ");"
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH DESCRIPTION
+.BR keyctl_clear ()
+clears the contents of a
+.IR keyring .
+.P
+The caller must have
+.B write
+permission on a keyring to be able clear it.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH RETURN VALUE
+On success
+.BR keyctl_clear ()
+returns
+.BR 0 .
+On error, the value
+.B -1
+will be returned and
+.I errno
+will have been set to an appropriate error.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH ERRORS
+.TP
+.B ENOKEY
+The keyring specified is invalid.
+.TP
+.B EKEYEXPIRED
+The keyring specified has expired.
+.TP
+.B EKEYREVOKED
+The keyring specified had been revoked.
+.TP
+.B EACCES
+The keyring exists, but is not
+.B writable
+by the calling process.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH LINKING
+This is a library function that can be found in
+.IR libkeyutils .
+When linking,
+.B \-lkeyutils
+should be specified to the linker.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH SEE ALSO
+.ad l
+.nh
+.BR keyctl (1),
+.BR add_key (2),
+.BR keyctl (2),
+.BR request_key (2),
+.BR keyctl (3),
+.BR keyrings (7),
+.BR keyutils (7)
+
diff --git a/man/keyctl_describe.3 b/man/keyctl_describe.3
new file mode 100644
index 0000000..b4f100e
--- /dev/null
+++ b/man/keyctl_describe.3
@@ -0,0 +1,112 @@
+.\"
+.\" Copyright (C) 2006 Red Hat, Inc. All Rights Reserved.
+.\" Written by David Howells (dhowells@redhat.com)
+.\"
+.\" This program is free software; you can redistribute it and/or
+.\" modify it under the terms of the GNU General Public License
+.\" as published by the Free Software Foundation; either version
+.\" 2 of the License, or (at your option) any later version.
+.\"
+.TH KEYCTL_DESCRIBE 3 "4 May 2006" Linux "Linux Key Management Calls"
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH NAME
+keyctl_describe \- describe a key
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH SYNOPSIS
+.nf
+.B #include <keyutils.h>
+.sp
+.BI "long keyctl_describe(key_serial_t " key ", char *" buffer ,
+.BI "size_t" buflen ");"
+.sp
+.BI "long keyctl_describe_alloc(key_serial_t " key ", char **" _buffer ");"
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH DESCRIPTION
+.BR keyctl_describe ()
+describes the attributes of a key as a NUL-terminated string.
+.P
+The caller must have
+.B view
+permission on a key to be able to get a description of it.
+.P
+.I buffer
+and
+.I buflen
+specify the buffer into which the key description will be placed.  If the
+buffer is too small, the full size of the description will be returned, and no
+copy will take place.
+.P
+.BR keyctl_describe_alloc ()
+is similar to
+.BR keyctl_describe ()
+except that it allocates a buffer big enough to hold the description and
+places the description in it.  If successful, A pointer to the buffer is
+placed in
+.IR *_buffer .
+The caller must free the buffer.
+.P
+The description will be a string of format:
+.IP
+.B "\*(lq%s;%d;%d;%08x;%s\*(rq"
+.P
+where the arguments are: key type name, key UID, key GID, key permissions mask
+and key description.
+.P
+.B NOTE!
+The key description will not contain any semicolons, so that should be
+separated out by working backwards from the end of the string.  This permits
+extra information to be inserted before it by later versions of the kernel
+simply by inserting more semicolon-terminated substrings.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH RETURN VALUE
+On success
+.BR keyctl_describe ()
+returns the amount of data placed into the buffer.  If the buffer was too
+small, then the size of buffer required will be returned, but no data will be
+transferred.  On error, the value
+.B -1
+will be returned and
+.I errno
+will have been set to an appropriate error.
+.P
+On success
+.BR keyctl_describe_alloc ()
+returns the amount of data in the buffer, less the NUL terminator.  On error, the value
+.B -1
+will be returned and
+.I errno
+will have been set to an appropriate error.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH ERRORS
+.TP
+.B ENOKEY
+The key specified is invalid.
+.TP
+.B EKEYEXPIRED
+The key specified has expired.
+.TP
+.B EKEYREVOKED
+The key specified had been revoked.
+.TP
+.B EACCES
+The key exists, but is not
+.B viewable
+by the calling process.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH LINKING
+This is a library function that can be found in
+.IR libkeyutils .
+When linking,
+.B \-lkeyutils
+should be specified to the linker.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH SEE ALSO
+.ad l
+.nh
+.BR keyctl (1),
+.BR add_key (2),
+.BR keyctl (2),
+.BR request_key (2),
+.BR keyctl (3),
+.BR keyrings (7),
+.BR keyutils (7)
diff --git a/man/keyctl_dh_compute.3 b/man/keyctl_dh_compute.3
new file mode 100644
index 0000000..3b04dba
--- /dev/null
+++ b/man/keyctl_dh_compute.3
@@ -0,0 +1,109 @@
+.\"
+.\" Copyright (C) 2006 Red Hat, Inc. All Rights Reserved.
+.\" Copyright (C) 2016 Intel Corporation. All rights reserved.
+.\"
+.\" This program is free software; you can redistribute it and/or
+.\" modify it under the terms of the GNU General Public License
+.\" as published by the Free Software Foundation; either version
+.\" 2 of the License, or (at your option) any later version.
+.\"
+.TH KEYCTL_DH_COMPUTE 3 "07 Apr 2016" Linux "Linux Key Management Calls"
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH NAME
+keyctl_dh_compute \- Compute a Diffie-Hellman shared secret or public key
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH SYNOPSIS
+.nf
+.B #include <keyutils.h>
+.sp
+.BI "long keyctl_dh_compute(key_serial_t " private ", key_serial_t " prime ,
+.BI "key_serial_t " base ", char *" buffer ", size_t " buflen ");"
+.sp
+.BI "long keyctl_dh_compute_alloc(key_serial_t " private,
+.BI "key_serial_t " prime ", key_serial_t " base ", void **" _buffer ");"
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH DESCRIPTION
+.BR keyctl_dh_compute ()
+computes a Diffie-Hellman public key or shared secret.  That computation is:
+.IP
+.I base
+^
+.I private
+( mod
+.I prime
+)
+.P
+When
+.I base
+is a key containing the shared generator value, the remote public key is
+computed.  When
+.I base
+is a key containing the remote public key, the shared secret is computed.
+.P
+.IR base ", " private ", and " prime
+must all refer to
+.BR user -type
+keys containing the parameters for the computation.  Each of these keys must
+grant the caller
+.B read
+permission in order for them to be used.
+.P
+.I buffer
+and
+.I buflen
+specify the buffer into which the computed result will be placed.
+.I buflen
+may be zero, in which case the buffer is not used and the minimum buffer length
+is fetched.
+.P
+.BR keyctl_dh_compute_alloc ()
+is similar to
+.BR keyctl_dh_compute ()
+except that it allocates a buffer big enough to hold the payload data and
+places the data in it.  If successful, a pointer to the buffer is placed in
+.IR *_buffer .
+The caller must free the buffer.
+.P
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH RETURN VALUE
+On success
+.BR keyctl_dh_compute ()
+returns the amount of data placed into the buffer when
+.I buflen
+is non-zero.  When
+.I buflen
+is zero, the minimum buffer length to hold the data is returned.
+.P
+On success
+.BR keyctl_dh_compute_alloc ()
+returns the amount of data in the buffer.
+.P
+On error, both functions set errno to an appropriate code and return the value
+.BR -1 .
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH ERRORS
+.TP
+.B ENOKEY
+One of the keys specified is invalid or not readable.
+.TP
+.B EINVAL
+The buffer pointer is invalid or buflen is too small.
+.TP
+.B EOPNOTSUPP
+One of the keys was not a valid user key.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH LINKING
+This is a library function that can be found in
+.IR libkeyutils .
+When linking,
+.B \-lkeyutils
+should be specified to the linker.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH SEE ALSO
+.BR keyctl (1),
+.br
+.BR keyctl (2),
+.br
+.BR keyctl (3),
+.br
+.BR keyutils (7)
diff --git a/man/keyctl_get_keyring_ID.3 b/man/keyctl_get_keyring_ID.3
new file mode 100644
index 0000000..6525292
--- /dev/null
+++ b/man/keyctl_get_keyring_ID.3
@@ -0,0 +1,96 @@
+.\"
+.\" Copyright (C) 2006 Red Hat, Inc. All Rights Reserved.
+.\" Written by David Howells (dhowells@redhat.com)
+.\"
+.\" This program is free software; you can redistribute it and/or
+.\" modify it under the terms of the GNU General Public License
+.\" as published by the Free Software Foundation; either version
+.\" 2 of the License, or (at your option) any later version.
+.\"
+.TH KEYCTL_GET_KEYRING_ID 3 "4 May 2006" Linux "Linux Key Management Calls"
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH NAME
+keyctl_get_keyring_ID \- get the ID of a special keyring
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH SYNOPSIS
+.nf
+.B #include <keyutils.h>
+.sp
+.BI "key_serial_t keyctl_get_keyring_ID(key_serial_t " key ","
+.BI " int " create ");"
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH DESCRIPTION
+.BR keyctl_get_keyring_ID ()
+maps a special
+.I key
+or keyring ID to the serial number of the key actually representing that
+feature.  The serial number will be returned if that key exists.
+.P
+If the key or keyring does not yet exist, then if
+.I create
+is non-zero, the key or keyring will be created if it is appropriate to do so.
+.P
+The following special key IDs may be specified as
+.IR key :
+.TP
+.B KEY_SPEC_THREAD_KEYRING
+This specifies the caller's thread-specific keyring.
+.TP
+.B KEY_SPEC_PROCESS_KEYRING
+This specifies the caller's process-specific keyring.
+.TP
+.B KEY_SPEC_SESSION_KEYRING
+This specifies the caller's session-specific keyring.
+.TP
+.B KEY_SPEC_USER_KEYRING
+This specifies the caller's UID-specific keyring.
+.TP
+.B KEY_SPEC_USER_SESSION_KEYRING
+This specifies the caller's UID-session keyring.
+.TP
+.B KEY_SPEC_REQKEY_AUTH_KEY
+This specifies the authorisation key created by
+.BR request_key ()
+and passed to the process it spawns to generate a key.
+.P
+If a valid keyring ID is passed in, then this will simply be returned if the
+key exists; an error will be issued if it doesn't exist.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH RETURN VALUE
+On success
+.BR keyctl_get_keyring_ID ()
+returns the serial number of the key it found.  On error, the value
+.B -1
+will be returned and
+.I errno
+will have been set to an appropriate error.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH ERRORS
+.TP
+.B ENOKEY
+No matching key was found.
+.TP
+.B ENOMEM
+Insufficient memory to create a key.
+.TP
+.B EDQUOT
+The key quota for this user would be exceeded by creating this key or linking
+it to the keyring.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH LINKING
+This is a library function that can be found in
+.IR libkeyutils .
+When linking,
+.B \-lkeyutils
+should be specified to the linker.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH SEE ALSO
+.ad l
+.nh
+.BR keyctl (1),
+.BR add_key (2),
+.BR keyctl (2),
+.BR request_key (2),
+.BR keyctl (3),
+.BR keyrings (7),
+.BR keyutils (7)
diff --git a/man/keyctl_get_persistent.3 b/man/keyctl_get_persistent.3
new file mode 100644
index 0000000..8d79957
--- /dev/null
+++ b/man/keyctl_get_persistent.3
@@ -0,0 +1,114 @@
+.\"
+.\" Copyright (C) 2013 Red Hat, Inc. All Rights Reserved.
+.\" Written by David Howells (dhowells@redhat.com)
+.\"
+.\" This program is free software; you can redistribute it and/or
+.\" modify it under the terms of the GNU General Public License
+.\" as published by the Free Software Foundation; either version
+.\" 2 of the License, or (at your option) any later version.
+.\"
+.TH KEYCTL_GET_PERSISTENT 3 "20 Feb 2014" Linux "Linux Key Management Calls"
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH NAME
+keyctl_get_persistent \- get the persistent keyring for a user
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH SYNOPSIS
+.nf
+.B #include <keyutils.h>
+.sp
+.BI "long keyctl_get_persistent(uid_t " uid ", key_serial_t " keyring ");"
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH DESCRIPTION
+.BR keyctl_get_persistent ()
+gets the persistent keyring for the specified user ID.  Unlike the session and
+user keyrings, this keyring will persist once all login sessions have been
+deleted and can thus be used to carry authentication tokens for processes that
+run without user interaction, such as programs started by cron.
+.P
+The persistent keyring will be created by the kernel if it does not yet exist.
+Each time this function is called, the persistent keyring will have its
+expiration timeout reset to the value in:
+.IP
+/proc/sys/kernel/keys/persistent_keyring_expiry
+.P
+(by default three days).  Should the timeout be reached, the persistent keyring
+will be removed and everything it pins can then be garbage collected.
+.P
+If
+.I uid
+is
+.B -1
+then the calling process's real user ID will be used.  If
+.I uid
+is not
+.B -1
+then error
+.B EPERM
+will be given if the user ID requested does not match either the caller's real
+or effective user IDs or if the calling process does not have
+.B SetUid
+capability.
+.P
+If successful, a link to the persistent keyring will be added into
+.IR keyring .
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH RETURN VALUE
+On success
+.BR keyctl_get_persistent ()
+returns the serial number of the persistent keyring.  On error, the value
+.B -1
+will be returned and
+.I errno
+will have been set to an appropriate error.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH ERRORS
+.TP
+.B EPERM
+Not permitted to access the persistent keyring for the requested
+.IR uid .
+.TP
+.B ENOMEM
+Insufficient memory to create the persistent keyring or to extend
+.IR keyring .
+.TP
+.B ENOKEY
+.I keyring
+does not exist.
+.TP
+.B EKEYEXPIRED
+.I keyring
+has expired.
+.TP
+.B EKEYREVOKED
+.I keyring
+has been revoked.
+.TP
+.B EDQUOT
+The user does not have sufficient quota to extend
+.IR keyring .
+.TP
+.B EACCES
+.I keyring
+exists, but does not grant
+.B write
+permission to the calling process.
+
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH LINKING
+This is a library function that can be found in
+.IR libkeyutils .
+When linking,
+.B \-lkeyutils
+should be specified to the linker.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH SEE ALSO
+.ad l
+.nh
+.BR keyctl (1),
+.BR add_key (2),
+.BR keyctl (2),
+.BR request_key (2),
+.BR keyctl (3),
+.BR keyrings (7),
+.BR keyutils (7),
+.BR persistent\-keyring (7),
diff --git a/man/keyctl_get_security.3 b/man/keyctl_get_security.3
new file mode 100644
index 0000000..a2c5b41
--- /dev/null
+++ b/man/keyctl_get_security.3
@@ -0,0 +1,102 @@
+.\"
+.\" Copyright (C) 2010 Red Hat, Inc. All Rights Reserved.
+.\" Written by David Howells (dhowells@redhat.com)
+.\"
+.\" This program is free software; you can redistribute it and/or
+.\" modify it under the terms of the GNU General Public License
+.\" as published by the Free Software Foundation; either version
+.\" 2 of the License, or (at your option) any later version.
+.\"
+.TH KEYCTL_GET_SECURITY 3 "26 Feb 2010" Linux "Linux Key Management Calls"
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH NAME
+keyctl_get_security \- retrieve a key's security context
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH SYNOPSIS
+.nf
+.B #include <keyutils.h>
+.sp
+.BI "long keyctl_get_security(key_serial_t " key ", char *" buffer ,
+.BI "size_t " buflen ");"
+.sp
+.BI "long keyctl_get_security_alloc(key_serial_t " key ", char **" _buffer ");"
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH DESCRIPTION
+.BR keyctl_get_security ()
+retrieves the security context of a key as a NUL-terminated string.  This will
+be rendered in a form appropriate to the LSM in force - for instance, with
+SELinux, it may look like
+.IP
+.B "unconfined_u:unconfined_r:unconfined_t:s0\-s0:c0.c1023"
+.P
+The caller must have
+.B view
+permission on a key to be able to get its security context.
+.P
+.I buffer
+and
+.I buflen
+specify the buffer into which the string will be placed.  If the buffer is too
+small, the full size of the string will be returned, and no copy will take
+place.
+.P
+.BR keyctl_get_security_alloc ()
+is similar to
+.BR keyctl_get_security ()
+except that it allocates a buffer big enough to hold the string and copies the
+string into it.  If successful, A pointer to the buffer is placed in
+.IR *_buffer .
+The caller must free the buffer.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH RETURN VALUE
+On success
+.BR keyctl_get_security ()
+returns the amount of data placed into the buffer.  If the buffer was too
+small, then the size of buffer required will be returned, but no data will be
+transferred.  On error, the value
+.B -1
+will be returned and
+.I errno
+will have been set to an appropriate error.
+.P
+On success
+.BR keyctl_get_security_alloc ()
+returns the amount of data in the buffer, less the NUL terminator.  On error, the value
+.B -1
+will be returned and
+.I errno
+will have been set to an appropriate error.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH ERRORS
+.TP
+.B ENOKEY
+The key specified is invalid.
+.TP
+.B EKEYEXPIRED
+The key specified has expired.
+.TP
+.B EKEYREVOKED
+The key specified had been revoked.
+.TP
+.B EACCES
+The key exists, but is not
+.B viewable
+by the calling process.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH LINKING
+This is a library function that can be found in
+.IR libkeyutils .
+When linking,
+.B \-lkeyutils
+should be specified to the linker.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH SEE ALSO
+.ad l
+.nh
+.BR keyctl (1),
+.BR add_key (2),
+.BR keyctl (2),
+.BR request_key (2),
+.BR keyctl (3),
+.BR keyrings (7),
+.BR keyutils (7)
diff --git a/man/keyctl_instantiate.3 b/man/keyctl_instantiate.3
new file mode 100644
index 0000000..5ea3b98
--- /dev/null
+++ b/man/keyctl_instantiate.3
@@ -0,0 +1,191 @@
+.\"
+.\" Copyright (C) 2006 Red Hat, Inc. All Rights Reserved.
+.\" Written by David Howells (dhowells@redhat.com)
+.\"
+.\" This program is free software; you can redistribute it and/or
+.\" modify it under the terms of the GNU General Public License
+.\" as published by the Free Software Foundation; either version
+.\" 2 of the License, or (at your option) any later version.
+.\"
+.TH KEYCTL_INSTANTIATE 3 "4 May 2006" Linux "Linux Key Management Calls"
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH NAME
+keyctl_assume_authority, keyctl_instantiate, keyctl_instantiate_iov, keyctl_reject, keyctl_negate \- key instantiation functions
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH SYNOPSIS
+.nf
+.B #include <keyutils.h>
+.sp
+.BI "long keyctl_assume_authority(key_serial_t " key ");"
+.sp
+.BI "long keyctl_instantiate(key_serial_t " key ", const void *" payload ,
+.BI "size_t " plen ", key_serial_t " keyring ");"
+.sp
+.BI "long keyctl_instantiate_iov(key_serial_t " key ,
+.BI "const struct iovec *" payload_iov ", unsigned " ioc ,
+.BI "key_serial_t " keyring ");"
+.sp
+.BI "long keyctl_negate(key_serial_t " key ", unsigned " timeout ,
+.BI "key_serial_t " keyring ");"
+.sp
+.BI "long keyctl_reject(key_serial_t " key ", unsigned " timeout ,
+.BI "unsigned " error ", key_serial_t " keyring ");"
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH DESCRIPTION
+.BR keyctl_assume_authority ()
+assumes the authority for the calling thread to deal with and instantiate the
+specified uninstantiated
+.IR key .
+.P
+The calling thread must have the appopriate authorisation key resident in one
+of its keyrings for this to succeed, and that authority must not have been
+revoked.
+.P
+The authorising key is allocated by
+.BR request_key()
+when it needs to invoke
+userspace to generate a key for the requesting process.  This is then attached
+to one of the keyrings of the userspace process to which the task of
+instantiating the key is given:
+.IP
+requester -> request_key() -> instantiator
+.P
+Calling this function modifies the way
+.BR request_key ()
+works when called thereafter by the calling (instantiator) thread; once the
+authority is assumed, the keyrings of the initial process are added to the
+search path, using the initial process's UID, GID, groups and security
+context.
+.P
+If a thread has multiple instantiations to deal with, it may call this
+function to change the authorisation key currently in effect.  Supplying a
+.B zero
+.I key
+de-assumes the currently assumed authority.
+.P
+.B NOTE!
+This is a per-thread setting and not a per-process setting so that a
+multithreaded process can be used to instantiate several keys at once.
+.P
+.BR keyctl_instantiate ()
+instantiates the payload of an uninstantiated key from the data specified.
+.I payload
+and
+.I plen
+specify the data for the new payload.
+.I payload
+may be NULL and
+.I plen
+may be zero if the key type permits that.  The key type may reject the data if
+it's in the wrong format or in some other way invalid.
+.P
+.BR keyctl_instantiate_iov ()
+is similar, but the data is passed in an array of iovec structs instead of in
+a flat buffer.
+.I payload_iov
+points to the base of the array and
+.I ioc
+indicates how many elements there are.
+.I payload_iov
+may be NULL or
+.I ioc
+may be zero to indicate that no data is being supplied.
+.P
+.BR keyctl_reject ()
+marks a key as negatively instantiated and sets the expiration timer on it.
+.I timeout
+specifies the lifetime of the key in seconds.
+.I error
+specifies the error to be returned when a search hits the key (this is
+typically
+.BR EKEYREJECTED ", " EKEYREVOKED " or " EKEYEXPIRED ")."
+Note that
+.BR keyctl_reject ()
+falls back to
+.BR keyctl_negate ()
+if the kernel does not
+support it.
+.P
+.BR keyctl_negate ()
+as
+.BR keyctl_reject ()
+with an error code of
+.IB ENOKEY .
+.P
+Only a key for which authority has been assumed may be instantiated or
+negatively instantiated, and once instantiated, the authorisation key will be
+revoked and the requesting process will be able to resume.
+.P
+The destination
+.IR keyring ,
+if given, is assumed to belong to the initial requester, and not the
+instantiating process.  Therefore, the special keyring IDs refer to the
+requesting process's keyrings, not the caller's, and the requester's UID,
+etc. will be used to access them.
+.P
+The destination keyring can be
+.B zero
+if no extra link is desired.
+.P
+The requester, not the caller, must have
+.B write
+permission on the destination for a link to be made there.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH RETURN VALUE
+On success
+.BR keyctl_instantiate ()
+returns
+.BR 0 .
+On error, the value
+.B -1
+will be returned and
+.I errno
+will have been set to an appropriate error.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH ERRORS
+.TP
+.B ENOKEY
+The key or keyring specified is invalid.
+.TP
+.B EKEYEXPIRED
+The keyring specified has expired.
+.TP
+.B EKEYREVOKED
+The key or keyring specified had been revoked, or the authorisation has been
+revoked.
+.TP
+.B EINVAL
+The payload data was invalid.
+.TP
+.B ENOMEM
+Insufficient memory to store the new payload or to expand the destination
+keyring.
+.TP
+.B EDQUOT
+The key quota for the key's user would be exceeded by increasing the size of
+the key to accommodate the new payload or the key quota for the keyring's user
+would be exceeded by expanding the destination keyring.
+.TP
+.B EACCES
+The key exists, but is not
+.B writable
+by the requester.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH LINKING
+This is a library function that can be found in
+.IR libkeyutils .
+When linking,
+.B \-lkeyutils
+should be specified to the linker.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH SEE ALSO
+.ad l
+.nh
+.BR keyctl (1),
+.BR add_key (2),
+.BR keyctl (2),
+.BR request_key (2),
+.BR keyctl (3),
+.BR keyrings (7),
+.BR keyutils (7),
+.BR request\-key (8)
diff --git a/man/keyctl_invalidate.3 b/man/keyctl_invalidate.3
new file mode 100644
index 0000000..120da45
--- /dev/null
+++ b/man/keyctl_invalidate.3
@@ -0,0 +1,76 @@
+.\"
+.\" Copyright (C) 2013 Red Hat, Inc. All Rights Reserved.
+.\" Written by David Howells (dhowells@redhat.com)
+.\"
+.\" This program is free software; you can redistribute it and/or
+.\" modify it under the terms of the GNU General Public License
+.\" as published by the Free Software Foundation; either version
+.\" 2 of the License, or (at your option) any later version.
+.\"
+.TH KEYCTL_INVALIDATE 3 "29 Aug 2013" Linux "Linux Key Management Calls"
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH NAME
+keyctl_invalidate \- invalidate a key
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH SYNOPSIS
+.nf
+.B #include <keyutils.h>
+.sp
+.BI "long keyctl_invalidate(key_serial_t " key ");"
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH DESCRIPTION
+.BR keyctl_invalidate ()
+invalidates a
+.IR key .
+The key is scheduled for immediate removal from all the keyrings that point to
+it, after which it will be deleted.  The key will be ignored by all searches
+once this function is called even if it is not yet fully dealt with.
+.P
+The caller must have
+.B search
+permission on a key to be able to invalidate it.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH RETURN VALUE
+On success
+.BR keyctl_invalidate ()
+returns
+.BR 0 .
+On error, the value
+.B -1
+will be returned and
+.I errno
+will have been set to an appropriate error.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH ERRORS
+.TP
+.B ENOKEY
+The key specified is invalid.
+.TP
+.B EKEYEXPIRED
+The key specified has expired.
+.TP
+.B EKEYREVOKED
+The key specified had been revoked.
+.TP
+.B EACCES
+The key exists, but is not
+.B searchable
+by the calling process.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH LINKING
+This is a library function that can be found in
+.IR libkeyutils .
+When linking,
+.B \-lkeyutils
+should be specified to the linker.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH SEE ALSO
+.ad l
+.nh
+.BR keyctl (1),
+.BR add_key (2),
+.BR keyctl (2),
+.BR request_key (2),
+.BR keyctl (3),
+.BR keyrings (7),
+.BR keyutils (7)
diff --git a/man/keyctl_join_session_keyring.3 b/man/keyctl_join_session_keyring.3
new file mode 100644
index 0000000..4e27717
--- /dev/null
+++ b/man/keyctl_join_session_keyring.3
@@ -0,0 +1,84 @@
+.\"
+.\" Copyright (C) 2006 Red Hat, Inc. All Rights Reserved.
+.\" Written by David Howells (dhowells@redhat.com)
+.\"
+.\" This program is free software; you can redistribute it and/or
+.\" modify it under the terms of the GNU General Public License
+.\" as published by the Free Software Foundation; either version
+.\" 2 of the License, or (at your option) any later version.
+.\"
+.TH KEYCTL_JOIN_SESSION_KEYRING 3 "20 Feb 2014" Linux "Linux Key Management Calls"
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH NAME
+keyctl_join_session_keyring \- join a different session keyring
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH SYNOPSIS
+.nf
+.B #include <keyutils.h>
+.sp
+.BI "key_serial_t keyctl_join_session_keyring(const char *" name ");"
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH DESCRIPTION
+.BR keyctl_join_session_keyring ()
+changes the session keyring to which a process is subscribed.
+.P
+If
+.I name
+is
+.B NULL
+then a new anonymous keyring will be created, and the process will be
+subscribed to that.
+.P
+If
+.I name
+points to a string, then if a keyring of that name is available, the process
+will attempt to subscribe to that keyring, giving an error if that is not
+permitted; otherwise a new keyring of that name is created and attached as the
+session keyring.
+.P
+To attach to an extant named keyring, the keyring must have
+.B search
+permission available to the calling process.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH RETURN VALUE
+On success
+.BR keyctl_join_session_keyring ()
+returns the serial number of the key it found or created.  On error, the value
+.B -1
+will be returned and
+.I errno
+will have been set to an appropriate error.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH ERRORS
+.TP
+.B ENOMEM
+Insufficient memory to create a key.
+.TP
+.B EDQUOT
+The key quota for this user would be exceeded by creating this key or linking
+it to the keyring.
+.TP
+.B EACCES
+The named keyring exists, but is not
+.B searchable
+by the calling process.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH LINKING
+This is a library function that can be found in
+.IR libkeyutils .
+When linking,
+.B \-lkeyutils
+should be specified to the linker.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH SEE ALSO
+.ad l
+.nh
+.BR keyctl (1),
+.BR add_key (2),
+.BR keyctl (2),
+.BR request_key (2),
+.BR keyctl (3),
+.BR keyrings (7),
+.BR keyutils (7),
+.BR session\-keyring (7),
+.BR user\-session\-keyring (7)
diff --git a/man/keyctl_link.3 b/man/keyctl_link.3
new file mode 100644
index 0000000..1185874
--- /dev/null
+++ b/man/keyctl_link.3
@@ -0,0 +1,108 @@
+.\"
+.\" Copyright (C) 2006 Red Hat, Inc. All Rights Reserved.
+.\" Written by David Howells (dhowells@redhat.com)
+.\"
+.\" This program is free software; you can redistribute it and/or
+.\" modify it under the terms of the GNU General Public License
+.\" as published by the Free Software Foundation; either version
+.\" 2 of the License, or (at your option) any later version.
+.\"
+.TH KEYCTL_LINK 3 "4 May 2006" Linux "Linux Key Management Calls"
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH NAME
+keyctl_link, keyctl_unlink \- link/unlink a key to/from a keyring
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH SYNOPSIS
+.nf
+.B #include <keyutils.h>
+.sp
+.BI "long keyctl_link(key_serial_t " key ", key_serial_t " keyring ");"
+.sp
+.BI "long keyctl_unlink(key_serial_t " key ", key_serial_t " keyring ");"
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH DESCRIPTION
+.BR keyctl_link ()
+creates a link from
+.I keyring
+to
+.IR key ,
+displacing any link to another key of the same type and description in that
+keyring if one exists.
+.P
+.BR keyctl_unlink ()
+removes the link from
+.I keyring
+to
+.I key
+if it exists.
+.P
+The caller must have
+.B write
+permission on a keyring to be able create or remove links in it.
+.P
+The caller must have
+.B link
+permission on a key to be able to create a link to it.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH RETURN VALUE
+On success
+.BR keyctl_link ()
+and
+.BR keyctl_unlink ()
+return
+.BR 0 .
+On error, the value
+.B -1
+will be returned and
+.I errno
+will have been set to an appropriate error.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH ERRORS
+.TP
+.B ENOKEY
+The key or the keyring specified are invalid.
+.TP
+.B EKEYEXPIRED
+The key or the keyring specified have expired.
+.TP
+.B EKEYREVOKED
+The key or the keyring specified have been revoked.
+.TP
+.B EACCES
+The keyring exists, but is not
+.B writable
+by the calling process.
+.P
+For
+.BR keyctl_link ()
+only:
+.TP
+.B ENOMEM
+Insufficient memory to expand the keyring
+.TP
+.B EDQUOT
+Expanding the keyring would exceed the keyring owner's quota.
+.TP
+.B EACCES
+The key exists, but is not
+.B linkable
+by the calling process.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH LINKING
+This is a library function that can be found in
+.IR libkeyutils .
+When linking,
+.B \-lkeyutils
+should be specified to the linker.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH SEE ALSO
+.ad l
+.nh
+.BR keyctl (1),
+.BR add_key (2),
+.BR keyctl (2),
+.BR request_key (2),
+.BR keyctl (3),
+.BR keyrings (7),
+.BR keyutils (7)
+
diff --git a/man/keyctl_read.3 b/man/keyctl_read.3
new file mode 100644
index 0000000..25821ad
--- /dev/null
+++ b/man/keyctl_read.3
@@ -0,0 +1,112 @@
+.\"
+.\" Copyright (C) 2006 Red Hat, Inc. All Rights Reserved.
+.\" Written by David Howells (dhowells@redhat.com)
+.\"
+.\" This program is free software; you can redistribute it and/or
+.\" modify it under the terms of the GNU General Public License
+.\" as published by the Free Software Foundation; either version
+.\" 2 of the License, or (at your option) any later version.
+.\"
+.TH KEYCTL_READ 3 "21 Feb 2014" Linux "Linux Key Management Calls"
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH NAME
+keyctl_read \- read a key
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH SYNOPSIS
+.nf
+.B #include <keyutils.h>
+.sp
+.BI "long keyctl_read(key_serial_t " key ", char *" buffer ,
+.BI "size_t" buflen ");"
+.sp
+.BI "long keyctl_read_alloc(key_serial_t " key ", void **" _buffer ");"
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH DESCRIPTION
+.BR keyctl_read ()
+reads the payload of a key if the key type supports it.
+.P
+The caller must have
+.B read
+permission on a key to be able to read it.
+.P
+.I buffer
+and
+.I buflen
+specify the buffer into which the payload data will be placed.  If the buffer
+is too small, the full size of the payload will be returned and no copy will
+take place.
+.P
+.BR keyctl_read_alloc ()
+is similar to
+.BR keyctl_read ()
+except that it allocates a buffer big enough to hold the payload data and
+places the data in it.  If successful, a pointer to the buffer is placed in
+.IR *_buffer .
+The caller must free the buffer.
+.P
+.BR keyctl_read_alloc ()
+adds a NUL character after the data it retrieves, though this is not counted
+in the size value it returns.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH READING KEYRINGS
+This call can be used to list the contents of a keyring.  The data is
+presented to the user as an array of
+.B key_serial_t
+values, each of which corresponds to a key to which the keyring holds a link.
+.P
+The size of the keyring will be sizeof(key_serial_t) multiplied by the number
+of keys.  The size of key_serial_t is invariant across different word sizes,
+though the byte-ordering is as appropriate for the kernel.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH RETURN VALUE
+On success
+.BR keyctl_read ()
+returns the amount of data placed into the buffer.  If the buffer was too
+small, then the size of buffer required will be returned, but no data will be
+transferred.
+.P
+On success
+.BR keyctl_read_alloc ()
+returns the amount of data in the buffer.
+.P
+On error, both functions set
+.I errno
+to an appropriate code and return the value
+.BR -1 .
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH ERRORS
+.TP
+.B ENOKEY
+The key specified is invalid.
+.TP
+.B EKEYEXPIRED
+The key specified has expired.
+.TP
+.B EKEYREVOKED
+The key specified had been revoked.
+.TP
+.B EACCES
+The key exists, but is not
+.B readable
+by the calling process.
+.TP
+.B EOPNOTSUPP
+The key type does not support reading of the payload data.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH LINKING
+This is a library function that can be found in
+.IR libkeyutils .
+When linking,
+.B \-lkeyutils
+should be specified to the linker.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH SEE ALSO
+.ad l
+.nh
+.BR keyctl (1),
+.BR add_key (2),
+.BR keyctl (2),
+.BR request_key (2),
+.BR keyctl (3),
+.BR keyrings (7),
+.BR keyutils (7)
diff --git a/man/keyctl_revoke.3 b/man/keyctl_revoke.3
new file mode 100644
index 0000000..914a253
--- /dev/null
+++ b/man/keyctl_revoke.3
@@ -0,0 +1,73 @@
+.\"
+.\" Copyright (C) 2006 Red Hat, Inc. All Rights Reserved.
+.\" Written by David Howells (dhowells@redhat.com)
+.\"
+.\" This program is free software; you can redistribute it and/or
+.\" modify it under the terms of the GNU General Public License
+.\" as published by the Free Software Foundation; either version
+.\" 2 of the License, or (at your option) any later version.
+.\"
+.TH KEYCTL_REVOKE 3 "4 May 2006" Linux "Linux Key Management Calls"
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH NAME
+keyctl_revoke \- revoke a key
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH SYNOPSIS
+.nf
+.B #include <keyutils.h>
+.sp
+.BI "long keyctl_revoke(key_serial_t " key ");"
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH DESCRIPTION
+.BR keyctl_revoke ()
+marks a key as being revoked.
+.P
+After this operation has been performed on a key, attempts to access it will
+meet with error
+.BR EKEYREVOKED .
+.P
+The caller must have
+.B write
+permission on a key to be able revoke it.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH RETURN VALUE
+On success
+.BR keyctl_revoke ()
+returns
+.BR 0 .
+On error, the value
+.B -1
+will be returned and
+.I errno
+will have been set to an appropriate error.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH ERRORS
+.TP
+.B ENOKEY
+The specified key does not exist.
+.TP
+.B EKEYREVOKED
+The key has already been revoked.
+.TP
+.B EACCES
+The named key exists, but is not
+.B writable
+by the calling process.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH LINKING
+This is a library function that can be found in
+.IR libkeyutils .
+When linking,
+.B \-lkeyutils
+should be specified to the linker.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH SEE ALSO
+.ad l
+.nh
+.BR keyctl (1),
+.BR add_key (2),
+.BR keyctl (2),
+.BR request_key (2),
+.BR keyctl (3),
+.BR keyrings (7),
+.BR keyutils (7)
diff --git a/man/keyctl_search.3 b/man/keyctl_search.3
new file mode 100644
index 0000000..f3e7bc5
--- /dev/null
+++ b/man/keyctl_search.3
@@ -0,0 +1,138 @@
+.\"
+.\" Copyright (C) 2006 Red Hat, Inc. All Rights Reserved.
+.\" Written by David Howells (dhowells@redhat.com)
+.\"
+.\" This program is free software; you can redistribute it and/or
+.\" modify it under the terms of the GNU General Public License
+.\" as published by the Free Software Foundation; either version
+.\" 2 of the License, or (at your option) any later version.
+.\"
+.TH KEYCTL_SEARCH 3 "4 May 2006" Linux "Linux Key Management Calls"
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH NAME
+keyctl_search \- search a keyring for a key
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH SYNOPSIS
+.nf
+.B #include <keyutils.h>
+.sp
+.BI "long keyctl_search(key_serial_t " keyring ", const char *" type ,
+.BI "const char *" description ", key_serial_t " destination ");"
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH DESCRIPTION
+.BR keyctl_search ()
+recursively searches the
+.I keyring
+for a key of the specified
+.I type
+and
+.IR description .
+.P
+If found, the key will be attached to the
+.I destination
+keyring (if given), and its serial number will be returned.
+.P
+The source keyring must grant
+.B search
+permission to the caller, and for a key to be found, it must also grant
+.B search
+permission to the caller.  Child keyrings will be only be recursively searched
+if they grant
+.B search
+permission to the caller as well.
+.P
+If the destination keyring is
+.BR zero ,
+no attempt will be made to forge a link to the key, and just the serial number
+will be returned.
+.P
+If the destination keyring is given, then the link may only be formed if the
+found key grants the caller
+.B link
+permission and the destination keyring grants the caller
+.B write
+permission.
+.P
+If the search is successful, and if the destination keyring already contains a
+link to a key that matches the specified
+.IR type " and " description ,
+then that link will be replaced by a link to the found key.
+.P
+The source keyring and destination keyring serial numbers may be those of
+valid keyrings to which the caller has appropriate permission, or they may be
+special keyring IDs:
+.TP
+.B KEY_SPEC_THREAD_KEYRING
+This specifies the caller's thread-specific keyring.
+.TP
+.B KEY_SPEC_PROCESS_KEYRING
+This specifies the caller's process-specific keyring.
+.TP
+.B KEY_SPEC_SESSION_KEYRING
+This specifies the caller's session-specific keyring.
+.TP
+.B KEY_SPEC_USER_KEYRING
+This specifies the caller's UID-specific keyring.
+.TP
+.B KEY_SPEC_USER_SESSION_KEYRING
+This specifies the caller's UID-session keyring.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH RETURN VALUE
+On success
+.BR keyctl_search ()
+returns the serial number of the key it found.  On error, the value
+.B -1
+will be returned and
+.I errno
+will have been set to an appropriate error.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH ERRORS
+.TP
+.B ENOKEY
+One of the keyrings doesn't exist, no key was found by the search, or the only
+key found by the search was a negative key.
+.TP
+.B ENOTDIR
+One of the keyrings is a valid key that isn't a keyring.
+.TP
+.B EKEYEXPIRED
+One of the keyrings has expired, or the only key found was expired.
+.TP
+.B EKEYREVOKED
+One of the keyrings has been revoked, or the only key found was revoked.
+.TP
+.B ENOMEM
+Insufficient memory to expand the destination keyring.
+.TP
+.B EDQUOT
+The key quota for this user would be exceeded by creating a link to the found
+key in the destination keyring.
+.TP
+.B EACCES
+The source keyring didn't grant
+.B search
+permission, the destination keyring didn't grant
+.B write
+permission or the found key didn't grant
+.B link
+permission to the caller.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH LINKING
+Although this is a Linux system call, it is not present in
+.I libc
+but can be found rather in
+.IR libkeyutils .
+When linking,
+.B \-lkeyutils
+should be specified to the linker.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH SEE ALSO
+.ad l
+.nh
+.BR keyctl (1),
+.BR add_key (2),
+.BR keyctl (2),
+.BR request_key (2),
+.BR keyctl (3),
+.BR keyrings (7),
+.BR keyutils (7)
diff --git a/man/keyctl_session_to_parent.3 b/man/keyctl_session_to_parent.3
new file mode 100644
index 0000000..829b3be
--- /dev/null
+++ b/man/keyctl_session_to_parent.3
@@ -0,0 +1,77 @@
+.\"
+.\" Copyright (C) 2010 Red Hat, Inc. All Rights Reserved.
+.\" Written by David Howells (dhowells@redhat.com)
+.\"
+.\" This program is free software; you can redistribute it and/or
+.\" modify it under the terms of the GNU General Public License
+.\" as published by the Free Software Foundation; either version
+.\" 2 of the License, or (at your option) any later version.
+.\"
+.TH KEYCTL_SESSION_TO_PARENT 3 "20 Feb 2014" Linux "Linux Key Management Calls"
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH NAME
+keyctl_session_to_parent \- set the parent process's session keyring
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH SYNOPSIS
+.nf
+.B #include <keyutils.h>
+.sp
+.BI "long keyctl_session_to_parent();"
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH DESCRIPTION
+.BR keyctl_session_to_parent ()
+changes the session keyring to which the calling process's parent subscribes
+to be the that of the calling process.
+.P
+The keyring must have
+.B link
+permission available to the calling process, the parent process must have the
+same UIDs/GIDs as the calling process, and the LSM must not reject the
+replacement.  Furthermore, this may not be used to affect init or a kernel
+thread.
+.P
+Note that the replacement will not take immediate effect upon the parent
+process, but will rather be deferred to the next time it returns to userspace
+from kernel space.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH RETURN VALUE
+On success
+.BR keyctl_session_to_parent ()
+returns 0.  On error, the value
+.B -1
+will be returned and
+.I errno
+will have been set to an appropriate error.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH ERRORS
+.TP
+.B ENOMEM
+Insufficient memory to create a key.
+.TP
+.B EPERM
+The credentials of the parent don't match those of the caller.
+.TP
+.B EACCES
+The named keyring exists, but is not
+.B linkable
+by the calling process.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH LINKING
+This is a library function that can be found in
+.IR libkeyutils .
+When linking,
+.B \-lkeyutils
+should be specified to the linker.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH SEE ALSO
+.ad l
+.nh
+.BR keyctl (1),
+.BR add_key (2),
+.BR keyctl (2),
+.BR request_key (2),
+.BR keyctl (3),
+.BR keyrings (7),
+.BR keyutils (7),
+.BR session\-keyring (7),
+.BR user\-session-keyring (7)
diff --git a/man/keyctl_set_reqkey_keyring.3 b/man/keyctl_set_reqkey_keyring.3
new file mode 100644
index 0000000..00da586
--- /dev/null
+++ b/man/keyctl_set_reqkey_keyring.3
@@ -0,0 +1,101 @@
+.\"
+.\" Copyright (C) 2006 Red Hat, Inc. All Rights Reserved.
+.\" Written by David Howells (dhowells@redhat.com)
+.\"
+.\" This program is free software; you can redistribute it and/or
+.\" modify it under the terms of the GNU General Public License
+.\" as published by the Free Software Foundation; either version
+.\" 2 of the License, or (at your option) any later version.
+.\"
+.TH KEYCTL_SET_REQKEY_KEYRING 3 "4 May 2006" Linux "Linux Key Management Calls"
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH NAME
+keyctl_set_reqkey_keyring \- set the implicit destination keyring
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH SYNOPSIS
+.nf
+.B #include <keyutils.h>
+.sp
+.BI "long keyctl_set_reqkey_keyring(int " reqkey_defl ");"
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH DESCRIPTION
+.BR keyctl_set_reqkey_keyring ()
+sets the default destination for implicit key requests for the current thread
+and returns the old setting.
+.P
+After this operation has been issued, keys acquired by implicit key requests,
+such as might be performed by
+.BR open ()
+on an AFS or NFS filesystem, will be
+linked by default to the specified keyring by this function.
+.P
+The valid values of
+.I reqkey_defl
+are:
+.TP
+.B KEY_REQKEY_DEFL_NO_CHANGE
+This makes no change to the current setting.
+.TP
+.B KEY_REQKEY_DEFL_THREAD_KEYRING
+This makes the thread-specific keyring the default destination.
+.TP
+.B KEY_REQKEY_DEFL_PROCESS_KEYRING
+This makes the process-specific keyring the default destination.
+.TP
+.B KEY_REQKEY_DEFL_SESSION_KEYRING
+This makes the session keyring the default destination.
+.TP
+.B KEY_REQKEY_DEFL_USER_KEYRING
+This makes the UID-specific keyring the default destination.
+.TP
+.B KEY_REQKEY_DEFL_USER_SESSION_KEYRING
+This makes the UID-specific session keyring the default destination.
+.TP
+.B KEY_REQKEY_DEFL_DEFAULT
+This selects the default behaviour which is to use the thread-specific keyring
+if there is one, otherwise the process-specific keyring if there is one,
+otherwise the session keyring if there is one, otherwise the UID-specific
+session keyring.
+.P
+This setting is inherited across
+.BR fork ()
+and
+.BR exec ().
+
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH RETURN VALUE
+On success
+.BR keyctl_set_reqkey_keyring ()
+returns
+.BR 0 .
+On error, the value
+.B -1
+will be returned and
+.I errno
+will have been set to an appropriate error.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH ERRORS
+.TP
+.B EINVAL
+The value of
+.I reqkey_defl
+is invalid.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH LINKING
+This is a library function that can be found in
+.IR libkeyutils .
+When linking,
+.B \-lkeyutils
+should be specified to the linker.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH SEE ALSO
+.ad l
+.nh
+.BR keyctl (1),
+.BR add_key (2),
+.BR keyctl (2),
+.BR request_key (2),
+.BR keyctl (3),
+.BR keyutils (7),
+.BR keyrings (7),
+.BR request\-key (8)
diff --git a/man/keyctl_set_timeout.3 b/man/keyctl_set_timeout.3
new file mode 100644
index 0000000..1b7ec94
--- /dev/null
+++ b/man/keyctl_set_timeout.3
@@ -0,0 +1,81 @@
+.\"
+.\" Copyright (C) 2006 Red Hat, Inc. All Rights Reserved.
+.\" Written by David Howells (dhowells@redhat.com)
+.\"
+.\" This program is free software; you can redistribute it and/or
+.\" modify it under the terms of the GNU General Public License
+.\" as published by the Free Software Foundation; either version
+.\" 2 of the License, or (at your option) any later version.
+.\"
+.TH KEYCTL_SET_TIMEOUT 3 "4 May 2006" Linux "Linux Key Management Calls"
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH NAME
+keyctl_set_timeout \- set the expiration timer on a key
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH SYNOPSIS
+.nf
+.B #include <keyutils.h>
+.sp
+.BI "long keyctl_set_timeout(key_serial_t " key ", unsigned " timeout ");"
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH DESCRIPTION
+.BR keyctl_set_timeout ()
+sets the expiration timer on a key to
+.I timeout
+seconds into the future.  Setting
+.I timeout
+to
+.B zero
+cancels the expiration, assuming the key hasn't already expired.
+.P
+When the key expires, further attempts to access it will be met with error
+.BR EKEYEXPIRED .
+.P
+The caller must have
+.B setattr
+permission on a key to be able change its permissions mask.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH RETURN VALUE
+On success
+.BR keyctl_set_timeout ()
+returns
+.B 0 .
+On error, the value
+.B -1
+will be returned and
+.I errno
+will have been set to an appropriate error.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH ERRORS
+.TP
+.B ENOKEY
+The specified key does not exist.
+.TP
+.B EKEYEXPIRED
+The specified key has already expired.
+.TP
+.B EKEYREVOKED
+The specified key has been revoked.
+.TP
+.B EACCES
+The named key exists, but does not grant
+.B setattr
+permission to the calling process.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH LINKING
+This is a library function that can be found in
+.IR libkeyutils .
+When linking,
+.B \-lkeyutils
+should be specified to the linker.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH SEE ALSO
+.ad l
+.nh
+.BR keyctl (1),
+.BR add_key (2),
+.BR keyctl (2),
+.BR request_key (2),
+.BR keyctl (3),
+.BR keyrings (7),
+.BR keyutils (7)
diff --git a/man/keyctl_setperm.3 b/man/keyctl_setperm.3
new file mode 100644
index 0000000..0a4426d
--- /dev/null
+++ b/man/keyctl_setperm.3
@@ -0,0 +1,130 @@
+.\"
+.\" Copyright (C) 2006 Red Hat, Inc. All Rights Reserved.
+.\" Written by David Howells (dhowells@redhat.com)
+.\"
+.\" This program is free software; you can redistribute it and/or
+.\" modify it under the terms of the GNU General Public License
+.\" as published by the Free Software Foundation; either version
+.\" 2 of the License, or (at your option) any later version.
+.\"
+.TH KEYCTL_SETPERM 3 "4 May 2006" Linux "Linux Key Management Calls"
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH NAME
+keyctl_setperm \- change the permissions mask on a key
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH SYNOPSIS
+.nf
+.B #include <keyutils.h>
+.sp
+.BI "long keyctl_setperm(key_serial_t " key ", key_perm_t " perm ");"
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH DESCRIPTION
+.BR keyctl_setperm ()
+changes the permissions mask on a key.
+.P
+A process that does not have the
+.B SysAdmin
+capability may not change the permissions mask on a key that doesn't have the
+same UID as the caller.
+.P
+The caller must have
+.B setattr
+permission on a key to be able change its permissions mask.
+.P
+The permissions mask is a bitwise-OR of the following flags:
+.TP
+.B KEY_xxx_VIEW
+Grant permission to view the attributes of a key.
+.TP
+.B KEY_xxx_READ
+Grant permission to read the payload of a key or to list a keyring.
+.TP
+.B KEY_xxx_WRITE
+Grant permission to modify the payload of a key or to add or remove links
+to/from a keyring.
+.TP
+.B KEY_xxx_SEARCH
+Grant permission to find a key or to search a keyring.
+.TP
+.B KEY_xxx_LINK
+Grant permission to make links to a key.
+.TP
+.B KEY_xxx_SETATTR
+Grant permission to change the ownership and permissions attributes of a key.
+.TP
+.B KEY_xxx_ALL
+Grant all the above.
+.P
+The
+.RB ' xxx '
+in the above should be replaced by one of:
+.TP
+.B POS
+Grant the permission to a process that possesses the key (has it attached
+searchably to one of the process's keyrings).
+.TP
+.B USR
+Grant the permission to a process with the same UID as the key.
+.TP
+.B GRP
+Grant the permission to a process with the same GID as the key, or with a
+match for the key's GID amongst that process's Groups list.
+.TP
+.B OTH
+Grant the permission to any other process.
+.P
+Examples include:
+.BR KEY_POS_VIEW ", " KEY_USR_READ ", " KEY_GRP_SEARCH " and " KEY_OTH_ALL .
+.P
+User, group and other grants are exclusive: if a process qualifies in
+the 'user' category, it will not qualify in the 'groups' category; and if a
+process qualifies in either 'user' or 'groups' then it will not qualify in
+the 'other' category.
+.P
+Possessor grants are cumulative with the grants from the 'user', 'groups'
+and 'other' categories.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH RETURN VALUE
+On success
+.BR keyctl_setperm ()
+returns
+.B 0 .
+On error, the value
+.B -1
+will be returned and
+.I errno
+will have been set to an appropriate error.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH ERRORS
+.TP
+.B ENOKEY
+The specified key does not exist.
+.TP
+.B EKEYEXPIRED
+The specified key has expired.
+.TP
+.B EKEYREVOKED
+The specified key has been revoked.
+.TP
+.B EACCES
+The named key exists, but does not grant
+.B setattr
+permission to the calling process.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH LINKING
+This is a library function that can be found in
+.IR libkeyutils .
+When linking,
+.B \-lkeyutils
+should be specified to the linker.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH SEE ALSO
+.ad l
+.nh
+.BR keyctl (1),
+.BR add_key (2),
+.BR keyctl (2),
+.BR request_key (2),
+.BR keyctl (3),
+.BR keyrings (7),
+.BR keyutils (7)
diff --git a/man/keyctl_update.3 b/man/keyctl_update.3
new file mode 100644
index 0000000..17fbdb4
--- /dev/null
+++ b/man/keyctl_update.3
@@ -0,0 +1,96 @@
+.\"
+.\" Copyright (C) 2006 Red Hat, Inc. All Rights Reserved.
+.\" Written by David Howells (dhowells@redhat.com)
+.\"
+.\" This program is free software; you can redistribute it and/or
+.\" modify it under the terms of the GNU General Public License
+.\" as published by the Free Software Foundation; either version
+.\" 2 of the License, or (at your option) any later version.
+.\"
+.TH KEYCTL_UPDATE 3 "4 May 2006" Linux "Linux Key Management Calls"
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH NAME
+keyctl_update \- update a key
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH SYNOPSIS
+.nf
+.B #include <keyutils.h>
+.sp
+.BI "long keyctl_update(key_serial_t " key ", const void *" payload ,
+.BI "size_t " plen ");"
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH DESCRIPTION
+.BR keyctl_update ()
+updates the payload of a key if the key type permits it.
+.P
+The caller must have
+.B write
+permission on a key to be able update it.
+.P
+.I payload
+and
+.I plen
+specify the data for the new payload.
+.I payload
+may be NULL and
+.I plen
+may be zero if the key type permits that.  The key type may reject the data if
+it's in the wrong format or in some other way invalid.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH RETURN VALUE
+On success
+.BR keyctl_update ()
+returns
+.BR 0 .
+On error, the value
+.B -1
+will be returned and
+.I errno
+will have been set to an appropriate error.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH ERRORS
+.TP
+.B ENOKEY
+The key specified is invalid.
+.TP
+.B EKEYEXPIRED
+The key specified has expired.
+.TP
+.B EKEYREVOKED
+The key specified had been revoked.
+.TP
+.B EINVAL
+The payload data was invalid.
+.TP
+.B ENOMEM
+Insufficient memory to store the new payload.
+.TP
+.B EDQUOT
+The key quota for this user would be exceeded by increasing the size of the
+key to accommodate the new payload.
+.TP
+.B EACCES
+The key exists, but is not
+.B writable
+by the calling process.
+.TP
+.B EOPNOTSUPP
+The key type does not support the update operation on its keys.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH LINKING
+This is a library function that can be found in
+.IR libkeyutils .
+When linking,
+.B \-lkeyutils
+should be specified to the linker.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH SEE ALSO
+.ad l
+.nh
+.BR keyctl (1),
+.BR add_key (2),
+.BR keyctl (2),
+.BR request_key (2),
+.BR keyctl (3),
+.BR keyrings (7),
+.BR keyutils (7)
diff --git a/man/keyutils.7 b/man/keyutils.7
new file mode 100644
index 0000000..e17253b
--- /dev/null
+++ b/man/keyutils.7
@@ -0,0 +1,105 @@
+.\"
+.\" Copyright (C) 2014 Red Hat, Inc. All Rights Reserved.
+.\" Written by David Howells (dhowells@redhat.com)
+.\"
+.\" This program is free software; you can redistribute it and/or
+.\" modify it under the terms of the GNU General Public Licence
+.\" as published by the Free Software Foundation; either version
+.\" 2 of the Licence, or (at your option) any later version.
+.\"
+.TH KEYUTILS 7 "21 Feb 2014" Linux "Kernel key management"
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH NAME
+keyutils \- in-kernel key management utilities
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH DESCRIPTION
+The
+.B keyutils
+package is a library and a set of utilities for accessing the kernel
+\fBkeyrings\fP facility.
+.P
+A header file is supplied to provide the definitions and declarations required
+to access the library:
+.P
+.RS
+.B #include <keyutils.h>
+.RE
+.P
+To link with the library, the following:
+.P
+.RS
+.B \-lkeyutils
+.RE
+.P
+should be specified to the linker.
+.P
+Three system calls are provided:
+.TP
+.BR add_key (2)
+Supply a new key to the kernel.
+.TP
+.BR request_key (2)
+Find an existing key for use, or, optionally, create one if one does not exist.
+.TP
+.BR keyctl (2)
+Control a key in various ways.  The library provides a variety of wrappers
+around this system call and those should be used rather than calling it
+directly.
+.P
+See the
+.BR add_key (2),
+.BR request_key (2),
+and
+.BR keyctl (2)
+manual pages for more information.
+.P
+The \fBkeyctl\fP() wrappers are listed on the
+.BR keyctl (3)
+manual page.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH UTILITIES
+.P
+A program is provided to interact with the kernel facility by a number of
+subcommands, e.g.:
+.P
+.RS
+.B keyctl add user foo bar @s
+.RE
+.P
+See the
+.BR keyctl (1)
+manual page for information on that.
+.P
+The kernel has the ability to upcall to userspace to fabricate new keys.  This
+can be triggered by \fBrequest_key\fP(), but userspace is better off using
+\fBadd_key\fP() instead if it possibly can.
+.P
+The upcalling mechanism is usually routed via the
+.BR request\-key (8)
+program.  What this does with any particular key is configurable in:
+.P
+.RS
+.I /etc/request\-key.conf
+.br
+.I /etc/request\-key.d/
+.RE
+.P
+See the
+.BR request\-key.conf (5)
+and the
+.BR request\-key (8)
+manual pages for more information.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH SEE ALSO
+.ad l
+.nh
+.BR keyctl (1),
+.BR keyctl (3),
+.BR keyrings (7),
+.BR persistent\-keyring (7),
+.BR process\-keyring (7),
+.BR session\-keyring (7),
+.BR thread\-keyring (7),
+.BR user\-keyring (7),
+.BR user\-session\-keyring (7),
+.BR pam_keyinit (8)
diff --git a/man/recursive_key_scan.3 b/man/recursive_key_scan.3
new file mode 100644
index 0000000..8658002
--- /dev/null
+++ b/man/recursive_key_scan.3
@@ -0,0 +1,90 @@
+.\"
+.\" Copyright (C) 2011 Red Hat, Inc. All Rights Reserved.
+.\" Written by David Howells (dhowells@redhat.com)
+.\"
+.\" This program is free software; you can redistribute it and/or
+.\" modify it under the terms of the GNU General Public Licence
+.\" as published by the Free Software Foundation; either version
+.\" 2 of the Licence, or (at your option) any later version.
+.\"
+.TH RECURSIVE_KEY_SCAN 3 "10 Mar 2011" Linux "Linux Key Utility Calls"
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH NAME
+recursive_key_scan, recursive_session_key_scan \- apply a function to all keys in a keyring tree
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH SYNOPSIS
+.nf
+.B #include <keyutils.h>
+.sp
+.BI "typedef int (*" recursive_key_scanner_t ")(key_serial_t " parent ,
+.BI "    key_serial_t " key ", char *" desc ", int " desc_len ", void *" data ");"
+.sp
+.BI "long recursive_key_scan(key_serial_t " keyring ,
+.BI "    recursive_key_scanner_t " func ", void *" data ");"
+.br
+.BI "long recursive_session_key_scan(recursive_key_scanner_t " func ,
+.BI "    void *" data ");"
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH DESCRIPTION
+.BR recursive_key_scan ()
+performs a depth-first recursive scan of the specified
+.I keyring
+tree and applies
+.I func
+to every link found in the accessible keyrings in that tree.
+.I data
+is passed to each invocation of func.
+.P
+The return values of
+.I func
+are summed and returned as the overall return value.  Errors are ignored.
+Inaccessible keyrings are not scanned, but links to them are still passed to
+func.
+.P
+.BR recursive_session_key_scan ()
+works exactly like
+.BR recursive_key_scan ()
+with the caller's session keyring specified as the starting keyring.
+.P
+The callback function is called for each link found in all the keyrings in the
+nominated tree and so may be called multiple times for a particular key if that
+key has multiple links to it.
+.P
+The callback function is passed the following parameters:
+.TP
+.B parent
+The keyring containing the link or 0 for the initial key.
+.TP
+.BR key
+The key to which the link points.
+.TP
+.BR desc " and " desc_len
+A pointer to the raw description and its length as retrieved with
+.BR keyctl_describe_alloc ().
+These will be NULL and \-1 respectively if the description couldn't be
+retrieved and
+.I errno
+will retain the error from
+.BR keyctl_describe_alloc ().
+.TP
+.B data
+The data passed to the scanner function.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH RETURN VALUE
+These functions return the sum of the results of the callback functions they
+invoke.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH ERRORS
+Ignored.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH LINKING
+When linking,
+.B \-lkeyutils
+should be specified to the linker.
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.SH SEE ALSO
+.ad l
+.nh
+.BR keyctl (3),
+.BR keyctl_describe_alloc (3),
+.BR keyrings (7)
diff --git a/man/request-key.8 b/man/request-key.8
new file mode 100644
index 0000000..b008d80
--- /dev/null
+++ b/man/request-key.8
@@ -0,0 +1,38 @@
+.\"
+.\" Copyright (C) 2004 Red Hat, Inc. All Rights Reserved.
+.\" Written by David Howells (dhowells@redhat.com)
+.\"
+.\" This program is free software; you can redistribute it and/or
+.\" modify it under the terms of the GNU General Public License
+.\" as published by the Free Software Foundation; either version
+.\" 2 of the License, or (at your option) any later version.
+.\"
+.TH REQUEST-KEY 8 "15 Nov 2011" Linux "Linux Key Management Utilities"
+.SH NAME
+request\-key \- handle key instantiation callback requests from the kernel
+.SH SYNOPSIS
+\fB/sbin/request\-key \fR<op> <key> <uid> <gid> <threadring> <processring>
+	<sessionring> [<info>]
+.SH DESCRIPTION
+This program is invoked by the kernel when the kernel is asked for a key that
+it doesn't have immediately available. The kernel creates a partially set up
+key and then calls out to this program to instantiate it. It is not intended
+to be called directly.
+.SH ERRORS
+All errors will be logged to the syslog.
+.SH FILES
+.ul
+/etc/request\-key.conf
+.ul 0
+Instantiation handler configuration file.
+.P
+.ul
+/etc/request\-key.d/<keytype>.conf
+.ul 0
+Keytype specific configuration file.
+.SH SEE ALSO
+.ad l
+.nh
+.BR keyctl (1),
+.BR request\-key.conf (5),
+.BR keyrings (7)
diff --git a/man/request-key.conf.5 b/man/request-key.conf.5
new file mode 100644
index 0000000..49facad
--- /dev/null
+++ b/man/request-key.conf.5
@@ -0,0 +1,141 @@
+.\" -*- nroff -*-
+.\" Copyright (C) 2005 Red Hat, Inc. All Rights Reserved.
+.\" Written by David Howells (dhowells@redhat.com)
+.\"
+.\" This program is free software; you can redistribute it and/or
+.\" modify it under the terms of the GNU General Public License
+.\" as published by the Free Software Foundation; either version
+.\" 2 of the License, or (at your option) any later version.
+.\"
+.TH REQUEST-KEY.CONF 5 "15 November 2011" Linux "Linux Key Management Utilities"
+.SH NAME
+request\-key.conf \- Instantiation handler configuration file
+.SH DESCRIPTION
+.P
+This file and its associated key-type specific variants are used by the
+/sbin/request\-key program to determine which program it should run to
+instantiate a key.
+.P
+request\-key looks first in /etc/request\-key.d/ for a file of the key type name
+plus ".conf" that it can use.  If that is not found, it will fall back to
+/etc/request\-key.conf.
+.P
+request\-key scans through the chosen file one line at a time until it
+finds a match, which it will then use. If it doesn't find a match, it'll return
+an error and the kernel will automatically negate the key.
+.P
+Any blank line or line beginning with a hash mark '#' is considered to be a
+comment and ignored.
+.P
+All other lines are assumed to be command lines with a number of white space
+separated fields:
+.P
+<op> <type> <description> <callout\-info> <prog> <arg1> <arg2> ...
+.P
+The first four fields are used to match the parameters passed to request\-key by
+the kernel. \fIop\fR is the operation type; currently the only supported
+operation is "create".
+.P
+\fItype\fR, \fIdescription\fR and \fIcallout\-info\fR match the three parameters
+passed to \fBkeyctl request2\fR or the \fBrequest_key()\fR system call. Each of
+these may contain one or more asterisk '*' characters as wildcards anywhere
+within the string.
+.P
+Should a match be made, the program specified by <prog> will be exec'd. This
+must have a fully qualified path name. argv[0] will be set from the part of the
+program name that follows the last slash '/' character.
+.P
+If the program name is prefixed with a pipe bar character '|', then the program
+will be forked and exec'd attached to three pipes. The callout information will
+be piped to it on it's stdin and the intended payload data will be retrieved
+from its stdout. Anything sent to stderr will be posted in syslog. If the
+program exits 0, then /sbin/request\-key will attempt to instantiate the key
+with the data read from stdout. If it fails in any other way, then request\-key
+will attempt to execute the appropriate 'negate' operation command.
+.P
+The program arguments can be substituted with various macros. Only complete
+argument substitution is supported - macro substitutions can't be embedded. All
+macros begin with a percent character '%'. An argument beginning with two
+percent characters will have one of them discarded.
+.P
+The following macros are supported:
+.P
+.RS
+%o    Operation type
+.br
+%k    Key ID
+.br
+%t    Key type
+.br
+%d    Key description
+.br
+%c    Callout information
+.br
+%u    Key UID
+.br
+%g    Key GID
+.br
+%T    Requestor's thread keyring
+.br
+%P    Requestor's process keyring
+.br
+%S    Requestor's session keyring
+.RE
+.P
+There's another macro substitution too that permits the interpolation of the
+contents of a key:
+.P
+.RS
+%{<type>:<description>}
+.RE
+.P
+This performs a lookup for a key of the given type and description on the
+requestor's keyrings, and if found, substitutes the contents for the macro. If
+not found an error will be logged and the key under construction will be
+negated.
+.SH EXAMPLE
+.P
+A basic file will be installed in the /etc. This will contain two debugging
+lines that can be used to test the installation:
+.P
+.RS
+create user debug:* negate /bin/keyctl negate %k 30 %S
+.br
+create user debug:loop:* * |/bin/cat
+.br
+create user debug:* * /usr/share/keyutils/request\-key\-debug.sh %k %d %c %S
+.br
+negate * * * /bin/keyctl negate %k 30 %S
+.RE
+.P
+This is set up so that something like:
+.P
+.RS
+keyctl request2 user debug:xxxx negate
+.RE
+.P
+will create a negative user-defined key, something like:
+.P
+.RS
+keyctl request2 user debug:yyyy spoon
+.RE
+.P
+will create an instantiated user-defined key with "Debug spoon" as the payload,
+and something like:
+.P
+.RS
+keyctl request2 user debug:loop:zzzz abcdefghijkl
+.RE
+.P
+will create an instantiated user-defined key with the callout information as
+the payload.
+.SH FILES
+.ul
+/etc/request\-key.conf
+.ul 0
+.br
+.ul
+/etc/request\-key.d/<keytype>.conf
+.ul 0
+.SH SEE ALSO
+\fBkeyctl\fR(1), \fBrequest\-key.conf\fR(5)
diff --git a/request-key-debug.sh b/request-key-debug.sh
new file mode 100755
index 0000000..83af01d
--- /dev/null
+++ b/request-key-debug.sh
@@ -0,0 +1,33 @@
+#!/bin/sh
+###############################################################################
+#
+# Copyright (C) 2005 Red Hat, Inc. All Rights Reserved.
+# Written by David Howells (dhowells@redhat.com)
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version
+# 2 of the License, or (at your option) any later version.
+#
+###############################################################################
+#
+# Request key debugging
+#
+# Call: request-key-debug.sh <keyid> <desc> <callout> <session-keyring>
+#
+
+echo RQDebug keyid: $1
+echo RQDebug desc: $2
+echo RQDebug callout: $3
+echo RQDebug session keyring: $4
+
+if [ "$3" != "neg" ]
+then
+    keyctl instantiate $1 "Debug $3" $4 || exit 1
+else
+    cat /proc/keys
+    echo keyctl negate $1 30 $4
+    keyctl negate $1 30 $4
+fi
+
+exit 0
diff --git a/request-key.c b/request-key.c
new file mode 100644
index 0000000..3762e9a
--- /dev/null
+++ b/request-key.c
@@ -0,0 +1,870 @@
+/* request-key.c: hand a key request off to the appropriate process
+ *
+ * Copyright (C) 2005 Red Hat, Inc. All Rights Reserved.
+ * Written by David Howells (dhowells@redhat.com)
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version
+ * 2 of the License, or (at your option) any later version.
+ *
+ * /sbin/request-key <op> <key> <uid> <gid> <threadring> <processring> <sessionring> [<info>]
+ *
+ * Searches the specified session ring for a key indicating the command to run:
+ *	type:	"user"
+ *	desc:	"request-key:<op>"
+ *	data:	command name, eg: "/home/dhowells/request-key-create.sh"
+ */
+
+#include <stdio.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <stdarg.h>
+#include <string.h>
+#include <signal.h>
+#include <syslog.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <ctype.h>
+#include <sys/select.h>
+#include <sys/wait.h>
+#include "keyutils.h"
+
+
+static int xdebug;
+static int xnolog;
+static char *xkey;
+static char *xuid;
+static char *xgid;
+static char *xthread_keyring;
+static char *xprocess_keyring;
+static char *xsession_keyring;
+static char conffile[256];
+static int confline;
+static int norecurse;
+
+static void lookup_action(char *op,
+			  key_serial_t key,
+			  char *ktype,
+			  char *kdesc,
+			  char *callout_info)
+	__attribute__((noreturn));
+
+static void execute_program(char *op,
+			    key_serial_t key,
+			    char *ktype,
+			    char *kdesc,
+			    char *callout_info,
+			    char *cmdline)
+	__attribute__((noreturn));
+
+static void pipe_to_program(char *op,
+			    key_serial_t key,
+			    char *ktype,
+			    char *kdesc,
+			    char *callout_info,
+			    char *prog,
+			    char **argv)
+	__attribute__((noreturn));
+
+static int match(const char *pattern, int plen, const char *datum, int dlen);
+
+static void debug(const char *fmt, ...) __attribute__((format(printf, 1, 2)));
+static void debug(const char *fmt, ...)
+{
+	va_list va;
+
+	if (xdebug) {
+		va_start(va, fmt);
+		vfprintf(stderr, fmt, va);
+		va_end(va);
+
+		if (!xnolog) {
+			openlog("request-key", 0, LOG_AUTHPRIV);
+
+			va_start(va, fmt);
+			vsyslog(LOG_DEBUG, fmt, va);
+			va_end(va);
+
+			closelog();
+		}
+	}
+}
+
+static void error(const char *fmt, ...) __attribute__((noreturn, format(printf, 1, 2)));
+static void error(const char *fmt, ...)
+{
+	va_list va;
+
+	if (xdebug) {
+		va_start(va, fmt);
+		vfprintf(stderr, fmt, va);
+		va_end(va);
+	}
+
+	if (!xnolog) {
+		openlog("request-key", 0, LOG_AUTHPRIV);
+
+		va_start(va, fmt);
+		vsyslog(LOG_ERR, fmt, va);
+		va_end(va);
+
+		closelog();
+	}
+
+	exit(1);
+}
+
+#define file_error(FMT, ...)  error("%s: "FMT, conffile, ## __VA_ARGS__)
+#define line_error(FMT, ...)  error("%s:%d: "FMT, conffile, confline, ## __VA_ARGS__)
+
+static void oops(int x)
+{
+	error("Died on signal %d", x);
+}
+
+/*****************************************************************************/
+/*
+ *
+ */
+int main(int argc, char *argv[])
+{
+	key_serial_t key;
+	char *ktype, *kdesc, *buf, *callout_info;
+	int ret, ntype, dpos, n, fd;
+
+	if (argc == 2 && strcmp(argv[1], "--version") == 0) {
+		printf("request-key from %s (Built %s)\n",
+		       keyutils_version_string, keyutils_build_string);
+		return 0;
+	}
+
+	signal(SIGSEGV, oops);
+	signal(SIGBUS, oops);
+	signal(SIGPIPE, SIG_IGN);
+
+	for (;;) {
+		if (argc > 1 && strcmp(argv[1], "-d") == 0) {
+			xdebug++;
+			argv++;
+			argc--;
+		}
+		else if (argc > 1 && strcmp(argv[1], "-n") == 0) {
+			xnolog = 1;
+			argv++;
+			argc--;
+		}
+		else
+			break;
+	}
+
+	if (argc != 8 && argc != 9)
+		error("Unexpected argument count: %d\n", argc);
+
+	fd = open("/dev/null", O_RDWR);
+	if (fd < 0)
+		error("open");
+	if (fd > 2) {
+		close(fd);
+	}
+	else if (fd < 2) {
+		ret = dup(fd);
+		if (ret < 0)
+			error("dup failed: %m\n");
+
+		if (ret < 2 && dup(fd) < 0)
+			error("dup failed: %m\n");
+	}
+
+	xkey = argv[2];
+	xuid = argv[3];
+	xgid = argv[4];
+	xthread_keyring = argv[5];
+	xprocess_keyring = argv[6];
+	xsession_keyring = argv[7];
+
+	key = atoi(xkey);
+
+	/* assume authority over the key
+	 * - older kernel doesn't support this function
+	 */
+	ret = keyctl_assume_authority(key);
+	if (ret < 0 && !(argc == 9 || errno == EOPNOTSUPP))
+		error("Failed to assume authority over key %d (%m)\n", key);
+
+	/* ask the kernel to describe the key to us */
+	if (xdebug < 2) {
+		ret = keyctl_describe_alloc(key, &buf);
+		if (ret < 0)
+			goto inaccessible;
+	}
+	else {
+		buf = strdup("user;0;0;1f0000;debug:1234");
+	}
+
+	/* extract the type and description from the key */
+	debug("Key descriptor: \"%s\"\n", buf);
+	ntype = -1;
+	dpos = -1;
+
+	n = sscanf(buf, "%*[^;]%n;%*d;%*d;%x;%n", &ntype, &n, &dpos);
+	if (n != 1)
+		error("Failed to parse key description\n");
+
+	ktype = buf;
+	ktype[ntype] = 0;
+	kdesc = buf + dpos;
+
+	debug("Key type: %s\n", ktype);
+	debug("Key desc: %s\n", kdesc);
+
+	/* get hold of the callout info */
+	callout_info = argv[8];
+
+	if (!callout_info) {
+		void *tmp;
+
+		if (keyctl_read_alloc(KEY_SPEC_REQKEY_AUTH_KEY, &tmp) < 0)
+			error("Failed to retrieve callout info (%m)\n");
+
+		callout_info = tmp;
+	}
+
+	debug("CALLOUT: '%s'\n", callout_info);
+
+	/* determine the action to perform */
+	lookup_action(argv[1],		/* op */
+		      key,		/* ID of key under construction */
+		      ktype,		/* key type */
+		      kdesc,		/* key description */
+		      callout_info	/* call out information */
+		      );
+
+inaccessible:
+	error("Key %d is inaccessible (%m)\n", key);
+
+} /* end main() */
+
+/*****************************************************************************/
+/*
+ * determine the action to perform
+ */
+static void lookup_action(char *op,
+			  key_serial_t key,
+			  char *ktype,
+			  char *kdesc,
+			  char *callout_info)
+{
+	char buf[4096 + 2], *p, *q;
+	FILE *conf;
+	int len, oplen, ktlen, kdlen, cilen;
+
+	oplen = strlen(op);
+	ktlen = strlen(ktype);
+	kdlen = strlen(kdesc);
+	cilen = strlen(callout_info);
+
+	/* search the config file for a command to run */
+	if (strlen(ktype) <= sizeof(conffile) - 30) {
+		if (xdebug < 2)
+			snprintf(conffile, sizeof(conffile) - 1,
+				 "/etc/request-key.d/%s.conf", ktype);
+		else
+			snprintf(conffile, sizeof(conffile) - 1,
+				 "request-key.d/%s.conf", ktype);
+		conf = fopen(conffile, "r");
+		if (conf)
+			goto opened_conf_file;
+		if (errno != ENOENT)
+			error("Cannot open %s: %m\n", conffile);
+	}
+
+	if (xdebug < 2)
+		snprintf(conffile, sizeof(conffile) - 1, "/etc/request-key.conf");
+	else
+		snprintf(conffile, sizeof(conffile) - 1, "request-key.conf");
+	conf = fopen(conffile, "r");
+	if (!conf)
+		error("Cannot open %s: %m\n", conffile);
+
+opened_conf_file:
+	debug("Opened config file '%s'\n", conffile);
+
+	for (confline = 1;; confline++) {
+		/* read the file line-by-line */
+		if (!fgets(buf, sizeof(buf), conf)) {
+			if (feof(conf))
+				error("Cannot find command to construct key %d\n", key);
+			file_error("error %m\n");
+		}
+
+		len = strlen(buf);
+		if (len >= sizeof(buf) - 2)
+			line_error("Line too long\n");
+
+		/* ignore blank lines and comments */
+		if (len == 1 || buf[0] == '#' || isspace(buf[0]))
+			continue;
+
+		buf[--len] = 0;
+		p = buf;
+
+		/* attempt to match the op */
+		q = p;
+		while (*p && !isspace(*p)) p++;
+		if (!*p)
+			goto syntax_error;
+		*p = 0;
+
+		if (!match(q, p - q, op, oplen))
+			continue;
+
+		p++;
+
+		/* attempt to match the type */
+		while (isspace(*p)) p++;
+		if (!*p)
+			goto syntax_error;
+
+		q = p;
+		while (*p && !isspace(*p)) p++;
+		if (!*p)
+			goto syntax_error;
+		*p = 0;
+
+		if (!match(q, p - q, ktype, ktlen))
+			continue;
+
+		p++;
+
+		/* attempt to match the description */
+		while (isspace(*p)) p++;
+		if (!*p)
+			goto syntax_error;
+
+		q = p;
+		while (*p && !isspace(*p)) p++;
+		if (!*p)
+			goto syntax_error;
+		*p = 0;
+
+		if (!match(q, p - q, kdesc, kdlen))
+			continue;
+
+		p++;
+
+		/* attempt to match the callout info */
+		while (isspace(*p)) p++;
+		if (!*p)
+			goto syntax_error;
+
+		q = p;
+		while (*p && !isspace(*p)) p++;
+		if (!*p)
+			goto syntax_error;
+		*p = 0;
+
+		if (!match(q, p - q, callout_info, cilen))
+			continue;
+
+		p++;
+
+		debug("%s:%d: Line matches\n", conffile, confline);
+
+		/* we've got an action */
+		while (isspace(*p)) p++;
+		if (!*p)
+			goto syntax_error;
+
+		fclose(conf);
+
+		execute_program(op, key, ktype, kdesc, callout_info, p);
+	}
+
+	file_error("No matching action\n");
+
+syntax_error:
+	line_error("Syntax error\n");
+
+} /* end lookup_action() */
+
+/*****************************************************************************/
+/*
+ * attempt to match a datum to a pattern
+ * - one asterisk is allowed anywhere in the pattern to indicate a wildcard
+ * - returns true if matched, false if not
+ */
+static int match(const char *pattern, int plen, const char *datum, int dlen)
+{
+	const char *asterisk;
+	int n;
+
+	debug("match(%*.*s,%*.*s)\n", plen, plen, pattern, dlen, dlen, datum);
+
+	asterisk = memchr(pattern, '*', plen);
+	if (!asterisk) {
+		/* exact match only if no wildcard */
+		if (plen == dlen && memcmp(pattern, datum, dlen) == 0)
+			goto yes;
+		goto no;
+	}
+
+	/* the datum mustn't be shorter than the pattern without the asterisk */
+	if (dlen < plen - 1)
+		goto no;
+
+	n = asterisk - pattern;
+	if (n == 0) {
+		/* wildcard at beginning of pattern */
+		pattern++;
+		if (!*pattern)
+			goto yes; /* "*" matches everything */
+
+		/* match the end of the datum */
+		plen--;
+		if (memcmp(pattern, datum + (dlen - plen), plen) == 0)
+			goto yes;
+		goto no;
+	}
+
+	/* need to match beginning of datum for "abc*" and "abc*def" */
+	if (memcmp(pattern, datum, n) != 0)
+		goto no;
+
+	if (!asterisk[1])
+		goto yes; /* "abc*" matches */
+
+	/* match the end of the datum */
+	asterisk++;
+	n = plen - n - 1;
+	if (memcmp(pattern, datum + (dlen - n), n) == 0)
+		goto yes;
+
+no:
+	debug(" = no\n");
+	return 0;
+
+yes:
+	debug(" = yes\n");
+	return 1;
+
+} /* end match() */
+
+/*****************************************************************************/
+/*
+ * execute a program to deal with a key
+ */
+static void execute_program(char *op,
+			    key_serial_t key,
+			    char *ktype,
+			    char *kdesc,
+			    char *callout_info,
+			    char *cmdline)
+{
+	char *argv[256];
+	char *prog, *p, *q;
+	int argc, pipeit;
+
+	debug("execute_program('%s','%s')\n", callout_info, cmdline);
+
+	/* if the commandline begins with a bar, then we pipe the callout data into it and read
+	 * back the payload data
+	 */
+	pipeit = 0;
+
+	if (cmdline[0] == '|') {
+		pipeit = 1;
+		cmdline++;
+	}
+
+	/* extract the path to the program to run */
+	prog = p = cmdline;
+	while (*p && !isspace(*p)) p++;
+//	if (!*p)
+//		line_error("No command path\n");
+//	*p++ = 0;
+	if (*p)
+		*p++ = 0;
+
+	argv[0] = strrchr(prog, '/') + 1;
+
+	/* extract the arguments */
+	for (argc = 1; p; argc++) {
+		while (isspace(*p)) p++;
+		if (!*p)
+			break;
+
+		if (argc >= 254)
+			line_error("Too many arguments\n");
+		argv[argc] = q = p;
+
+		while (*p && !isspace(*p)) p++;
+
+		if (*p)
+			*p++ = 0;
+		else
+			p = NULL;
+
+		debug("argv[%d]: '%s'\n", argc, argv[argc]);
+
+		if (*q != '%')
+			continue;
+
+		/* it's a macro */
+		q++;
+		if (!*q)
+			line_error("Missing macro name\n");
+
+		if (*q == '%') {
+			/* it's actually an anti-macro escape "%%..." -> "%..." */
+			argv[argc]++;
+			continue;
+		}
+
+		/* single character macros */
+		if (!q[1]) {
+			switch (*q) {
+			case 'o': argv[argc] = op;			continue;
+			case 'k': argv[argc] = xkey;			continue;
+			case 't': argv[argc] = ktype;			continue;
+			case 'd': argv[argc] = kdesc;			continue;
+			case 'c': argv[argc] = callout_info;		continue;
+			case 'u': argv[argc] = xuid;			continue;
+			case 'g': argv[argc] = xgid;			continue;
+			case 'T': argv[argc] = xthread_keyring;		continue;
+			case 'P': argv[argc] = xprocess_keyring;	continue;
+			case 'S': argv[argc] = xsession_keyring;	continue;
+			default:
+				line_error("Unsupported macro\n");
+			}
+		}
+
+		/* keysub macro */
+		if (*q == '{') {
+			key_serial_t keysub;
+			void *tmp;
+			char *ksdesc, *end, *subdata;
+			int ret, loop;
+
+			/* extract type and description */
+			q++;
+			ksdesc = strchr(q, ':');
+			if (!ksdesc)
+				line_error("Keysub macro lacks ':'\n");
+			*ksdesc++ = 0;
+			end = strchr(ksdesc, '}');
+			if (!end)
+				line_error("Unterminated keysub macro\n");
+
+			*end++ = 0;
+			if (*end)
+				line_error("Keysub macro has trailing rubbish\n");
+
+			debug("Keysub: %s key \"%s\"\n", q, ksdesc);
+
+			if (!q[0])
+				line_error("Keysub type empty\n");
+
+			if (!ksdesc[0])
+				line_error("Keysub description empty\n");
+
+			/* look up the key in the requestor's keyrings, but fail immediately if the
+			 * key is not found rather than invoking /sbin/request-key again
+			 */
+			keysub = request_key(q, ksdesc, NULL, 0);
+			if (keysub < 0)
+				line_error("Keysub key not found: %m\n");
+
+			ret = keyctl_read_alloc(keysub, &tmp);
+			if (ret < 0)
+				line_error("Can't read keysub %d data: %m\n", keysub);
+			subdata = tmp;
+
+			for (loop = 0; loop < ret; loop++)
+				if (!isprint(subdata[loop]))
+					error("keysub %d data not printable ('%02hhx')\n",
+					      keysub, subdata[loop]);
+
+			argv[argc] = subdata;
+			continue;
+		}
+	}
+
+	if (argc == 0)
+		line_error("No arguments\n");
+
+	argv[argc] = NULL;
+
+	if (xdebug) {
+		char **ap;
+
+		debug("%s %s\n", pipeit ? "PipeThru" : "Run", prog);
+		for (ap = argv; *ap; ap++)
+			debug("- argv[%td] = \"%s\"\n", ap - argv, *ap);
+	}
+
+	/* become the same UID/GID as the key requesting process */
+	//setgid(atoi(xuid));
+	//setuid(atoi(xgid));
+
+	/* if the last argument is a single bar, we spawn off the program dangling on the end of
+	 * three pipes and read the key material from the program, otherwise we just exec
+	 */
+	if (pipeit)
+		pipe_to_program(op, key, ktype, kdesc, callout_info, prog, argv);
+
+	/* attempt to execute the command */
+	execv(prog, argv);
+
+	line_error("Failed to execute '%s': %m\n", prog);
+
+} /* end execute_program() */
+
+/*****************************************************************************/
+/*
+ * pipe the callout information to the specified program and retrieve the payload data over another
+ * pipe
+ */
+static void pipe_to_program(char *op,
+			    key_serial_t key,
+			    char *ktype,
+			    char *kdesc,
+			    char *callout_info,
+			    char *prog,
+			    char **argv)
+{
+	char errbuf[512], payload[32768 + 1], *pp, *pc, *pe;
+	int ipi[2], opi[2], epi[2], childpid;
+	int ifl, ofl, efl, npay, ninfo, espace, tmp;
+
+	debug("pipe_to_program(%s -> %s)", callout_info, prog);
+
+	if (pipe(ipi) < 0 || pipe(opi) < 0 || pipe(epi) < 0)
+		error("pipe failed: %m");
+
+	childpid = fork();
+	if (childpid == -1)
+		error("fork failed: %m");
+
+	if (childpid == 0) {
+		/* child process */
+		if (dup2(ipi[0], 0) < 0 ||
+		    dup2(opi[1], 1) < 0 ||
+		    dup2(epi[1], 2) < 0)
+			error("dup2 failed: %m");
+		close(ipi[0]);
+		close(ipi[1]);
+		close(opi[0]);
+		close(opi[1]);
+		close(epi[0]);
+		close(epi[1]);
+
+		execv(prog, argv);
+		line_error("Failed to execute '%s': %m\n", prog);
+	}
+
+	/* parent process */
+	close(ipi[0]);
+	close(opi[1]);
+	close(epi[1]);
+
+#define TOSTDIN ipi[1]
+#define FROMSTDOUT opi[0]
+#define FROMSTDERR epi[0]
+
+	ifl = fcntl(TOSTDIN, F_GETFL);
+	ofl = fcntl(FROMSTDOUT, F_GETFL);
+	efl = fcntl(FROMSTDERR, F_GETFL);
+	if (ifl < 0 || ofl < 0 || efl < 0)
+		error("fcntl/F_GETFL failed: %m");
+
+	ifl |= O_NONBLOCK;
+	ofl |= O_NONBLOCK;
+	efl |= O_NONBLOCK;
+
+	if (fcntl(TOSTDIN, F_SETFL, ifl) < 0 ||
+	    fcntl(FROMSTDOUT, F_SETFL, ofl) < 0 ||
+	    fcntl(FROMSTDERR, F_SETFL, efl) < 0)
+		error("fcntl/F_SETFL failed: %m");
+
+	ninfo = strlen(callout_info);
+	pc = callout_info;
+
+	npay = sizeof(payload);
+	pp = payload;
+
+	espace = sizeof(errbuf);
+	pe = errbuf;
+
+	do {
+		fd_set rfds, wfds;
+
+		FD_ZERO(&rfds);
+		FD_ZERO(&wfds);
+
+		if (TOSTDIN != -1) {
+			if (ninfo > 0) {
+				FD_SET(TOSTDIN, &wfds);
+			}
+			else {
+				close(TOSTDIN);
+				TOSTDIN = -1;
+				continue;
+			}
+		}
+
+		if (FROMSTDOUT != -1)
+			FD_SET(FROMSTDOUT, &rfds);
+
+		if (FROMSTDERR != -1)
+			FD_SET(FROMSTDERR, &rfds);
+
+		tmp = TOSTDIN > FROMSTDOUT ? TOSTDIN : FROMSTDOUT;
+		tmp = tmp > FROMSTDERR ? tmp : FROMSTDERR;
+		tmp++;
+
+		debug("select r=%d,%d w=%d m=%d\n", FROMSTDOUT, FROMSTDERR, TOSTDIN, tmp);
+
+		tmp = select(tmp, &rfds, &wfds, NULL, NULL);
+		if (tmp < 0)
+			error("select failed: %m\n");
+
+		if (TOSTDIN != -1 && FD_ISSET(TOSTDIN, &wfds)) {
+			tmp = write(TOSTDIN, pc, ninfo);
+			if (tmp < 0) {
+				if (errno != EPIPE)
+					error("write failed: %m\n");
+
+				debug("EPIPE");
+				ninfo = 0;
+			}
+			else {
+				debug("wrote %d\n", tmp);
+
+				pc += tmp;
+				ninfo -= tmp;
+			}
+		}
+
+		if (FROMSTDOUT != -1 && FD_ISSET(FROMSTDOUT, &rfds)) {
+			tmp = read(FROMSTDOUT, pp, npay);
+			if (tmp < 0)
+				error("read failed: %m\n");
+
+			debug("read %d\n", tmp);
+
+			if (tmp == 0) {
+				close(FROMSTDOUT);
+				FROMSTDOUT = -1;
+			}
+			else {
+				pp += tmp;
+				npay -= tmp;
+
+				if (npay == 0)
+					error("Too much data read from query program\n");
+			}
+		}
+
+		if (FROMSTDERR != -1 && FD_ISSET(FROMSTDERR, &rfds)) {
+			char *nl;
+
+			tmp = read(FROMSTDERR, pe, espace);
+			if (tmp < 0)
+				error("read failed: %m\n");
+
+			debug("read err %d\n", tmp);
+
+			if (tmp == 0) {
+				close(FROMSTDERR);
+				FROMSTDERR = -1;
+				continue;
+			}
+
+			pe += tmp;
+			espace -= tmp;
+
+			while ((nl = memchr(errbuf, '\n', pe - errbuf))) {
+				int n, rest;
+
+				nl++;
+				n = nl - errbuf;
+
+				if (xdebug)
+					fprintf(stderr, "Child: %*.*s", n, n, errbuf);
+
+				if (!xnolog) {
+					openlog("request-key", 0, LOG_AUTHPRIV);
+					syslog(LOG_ERR, "Child: %*.*s", n, n, errbuf);
+					closelog();
+				}
+
+				rest = pe - nl;
+				if (rest > 0) {
+					memmove(errbuf, nl, rest);
+					pe -= n;
+					espace += n;
+				}
+				else {
+					pe = errbuf;
+					espace = sizeof(errbuf);
+				}
+			}
+
+			if (espace == 0) {
+				int n = sizeof(errbuf);
+
+				if (xdebug)
+					fprintf(stderr, "Child: %*.*s", n, n, errbuf);
+
+				if (!xnolog) {
+					openlog("request-key", 0, LOG_AUTHPRIV);
+					syslog(LOG_ERR, "Child: %*.*s", n, n, errbuf);
+					closelog();
+				}
+
+				pe = errbuf;
+				espace = sizeof(errbuf);
+			}
+		}
+
+	} while (TOSTDIN != -1 || FROMSTDOUT != -1 || FROMSTDERR != -1);
+
+	/* wait for the program to exit */
+	if (waitpid(childpid, &tmp, 0) != childpid)
+		error("wait for child failed: %m\n");
+
+	/* if the process exited non-zero or died on a signal, then we call back in to ourself to
+	 * decide on negation
+	 * - this is not exactly beautiful but the quickest way of having configurable negation
+	 *   settings
+	 */
+	if (WIFEXITED(tmp) && WEXITSTATUS(tmp) != 0) {
+		if (norecurse)
+			error("child exited %d\n", WEXITSTATUS(tmp));
+
+		norecurse = 1;
+		debug("child exited %d\n", WEXITSTATUS(tmp));
+		lookup_action("negate", key, ktype, kdesc, callout_info);
+	}
+
+	if (WIFSIGNALED(tmp)) {
+		if (norecurse)
+			error("child died on signal %d\n", WTERMSIG(tmp));
+
+		norecurse = 1;
+		debug("child died on signal %d\n", WTERMSIG(tmp));
+		lookup_action("negate", key, ktype, kdesc, callout_info);
+	}
+
+	/* attempt to instantiate the key */
+	debug("instantiate with %td bytes\n", pp - payload);
+
+	if (keyctl_instantiate(key, payload, pp - payload, 0) < 0)
+		error("instantiate key failed: %m\n");
+
+	debug("instantiation successful\n");
+	exit(0);
+
+} /* end pipe_to_program() */
diff --git a/request-key.conf b/request-key.conf
new file mode 100644
index 0000000..ff16a95
--- /dev/null
+++ b/request-key.conf
@@ -0,0 +1,41 @@
+###############################################################################
+#
+# Copyright (C) 2005 Red Hat, Inc. All Rights Reserved.
+# Written by David Howells (dhowells@redhat.com)
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version
+# 2 of the License, or (at your option) any later version.
+#
+###############################################################################
+
+
+###############################################################################
+#
+# We can run programs or scripts
+# - Macro substitutions in arguments:
+#	%%...	%...
+#	%o	operation name
+#	%k	ID of key being operated upon
+#	%t	type of key being operated upon
+#	%d	description of key being operated upon
+#	%c	callout info
+#	%u	UID of requestor
+#	%g	GID of requestor
+#	%T	thread keyring of requestor (may be 0)
+#	%P	process keyring of requestor (may be 0)
+#	%S	session keyring of requestor (may be the user's default session)
+#
+################################################################################
+
+#OP	TYPE	DESCRIPTION	CALLOUT INFO	PROGRAM ARG1 ARG2 ARG3 ...
+#======	=======	===============	===============	===============================
+create  dns_resolver *		*               /sbin/key.dns_resolver %k
+create	user	debug:*		negate		/bin/keyctl negate %k 30 %S
+create  user    debug:*         rejected        /bin/keyctl reject %k 30 %c %S
+create  user    debug:*         expired         /bin/keyctl reject %k 30 %c %S
+create  user    debug:*         revoked         /bin/keyctl reject %k 30 %c %S
+create	user	debug:loop:*	*		|/bin/cat
+create	user	debug:*		*		/usr/share/keyutils/request-key-debug.sh %k %d %c %S
+negate	*	*		*		/bin/keyctl negate %k 30 %S
diff --git a/tests/Makefile b/tests/Makefile
new file mode 100644
index 0000000..5f0cc9c
--- /dev/null
+++ b/tests/Makefile
@@ -0,0 +1,75 @@
+# Copyright (c) 2006 Red Hat, Inc. All rights reserved. This copyrighted material 
+# is made available to anyone wishing to use, modify, copy, or
+# redistribute it subject to the terms and conditions of the GNU General
+# Public License v.2.
+#
+# This program is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A
+# PARTICULAR PURPOSE. See the GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+#
+# Author: David Howells <dhowells@redhat.com>
+# Updated to new Make model by Bill Peck <bpeck@redhat.com>
+
+# The toplevel namespace within which the test lives.
+TOPLEVEL_NAMESPACE=/kernel
+
+# The name of the package under test:
+PACKAGE_NAME=keyutils
+
+# The path of the test below the package:
+RELATIVE_PATH=testsuite
+
+# Version of the Test. Used with make tag.
+export TESTVERSION=1.3
+
+# The combined namespace of the test.
+export TEST=$(TOPLEVEL_NAMESPACE)/$(PACKAGE_NAME)/$(RELATIVE_PATH)
+
+.PHONY: all install download clean
+
+TESTS	= $(shell /usr/bin/find . -name runtest.sh | \
+                  /bin/sed -e 's/runtest.sh//g;s/^\.\///;s/\/$$//')
+
+BUILT_FILES= 
+FILES=$(METADATA) *.sh Makefile PURPOSE bugzillas keyctl
+
+run: $(FILES) build
+	bash runtest.sh $(TESTS)
+
+build: $(BUILT_FILES)
+
+clean:
+	rm -f *~ *.rpm $(BUILT_FILES)
+	find * -name test.out -delete
+
+# You may need to add other targets e.g. to build executables from source code
+# Add them here:
+
+
+# Include Common Makefile
+ifneq ($(wildcard /usr/share/rhts/lib/rhts-make.include),)
+include /usr/share/rhts/lib/rhts-make.include
+
+# Generate the testinfo.desc here:
+$(METADATA): Makefile
+	@touch $(METADATA)
+	@echo "Owner:        David Howells <dhowells@redhat.com>" > $(METADATA)
+	@echo "Name:         $(TEST)" >> $(METADATA)
+	@echo "Path:         $(TEST_DIR)"	>> $(METADATA)
+	@echo "License:      Unknown" >> $(METADATA)
+	@echo "TestVersion:  $(TESTVERSION)"	>> $(METADATA)
+	@echo "Description:  testsuite to verify keyutils ">> $(METADATA)
+	@echo "TestTime:     30m" >> $(METADATA)
+	@echo "RunFor:       $(PACKAGE_NAME)" >> $(METADATA)
+	@echo "Requires:     $(PACKAGE_NAME)" >> $(METADATA)
+	@echo "Releases:     -RHEL2.1 -RHEL3" >> $(METADATA)
+	@echo "Type:         Tier1" >> $(METADATA)
+	@echo "Type:         KernelTier1" >> $(METADATA)
+	@echo "Destructive:  no" >> $(METADATA)
+	rhts-lint $(METADATA)
+
+endif
diff --git a/tests/PURPOSE b/tests/PURPOSE
new file mode 100644
index 0000000..064e775
--- /dev/null
+++ b/tests/PURPOSE
@@ -0,0 +1,82 @@
+The purpose of this testsuite is to do negative and positive testing against
+the keyutils package.
+Sub Test		Description
+------------------	-----------------------------------------------------
+/listing/noargs		Check list/rlist subcommands fail with the wrong 
+			number of arguments
+/listing/bad-args	Check list/rlist subcommands fail with bad arguments
+/listing/valid		Check list/rlist subcommands work
+/show/noargs		Check show subcommand works with no arguments
+/reading/noargs		Check read/pipe/print subcommands fail with the wrong 
+			number of arguments
+/reading/bad-args	Check read/pipe/print subcommands fail with bad 
+			arguments
+/reading/valid		Check read/pipe/print subcommands work
+/pupdate/noargs		Check pupdate subcommand fails with the wrong number 
+			of arguments
+/pupdate/bad-args	Check pupdate subcommand fails with bad arguments
+/pupdate/userupdate	Check pupdate subcommand works for user defined keys
+/newring/noargs		Check newring subcommand fails with the wrong number 
+			of arguments
+/newring/bad-args	Check newring subcommand fails with a bad arguments
+/newring/valid		Check newring subcommand works
+/session/bad-args	Check session subcommand fails with bad arguments
+/session/valid		Check session subcommand works
+/clear/noargs		Check clear subcommand fails with the wrong number of 
+			arguments
+/clear/bad-args		Check clear subcommand fails with a bad arguments
+/clear/valid		Check clear subcommand works
+/instantiating/noargs	Check instantiate/negate subcommands fail with the 
+			wrong number of arguments
+/instantiating/bad-args	Check instantiate/negate subcommands fail with bad 
+			arguments
+/permitting/noargs	Check chown/chgrp/setperm subcommands fail with the 
+			wrong number of arguments
+/permitting/bad-args	Check chown/chgrp/setperm subcommands fail with bad 
+			arguments
+/permitting/valid	Check chown/chgrp/setperm subcommands work
+/describing/noargs	Check describe/rdescribe subcommands fail with the 
+			wrong number of arguments
+/describing/bad-args	Check describe/rdescribe subcommands fail with bad 
+			arguments
+/describing/valid	Check describe/rdescribe subcommands work
+/noargs			Check keyutils with no args gives format list
+/revoke/noargs		Check revoke subcommand fails with the wrong number of 
+			arguments
+/revoke/bad-args	Check revoke subcommand fails with a bad arguments
+/revoke/valid		Check revoke subcommand works
+/padd/noargs		Check padd subcommand fails with the wrong number of 
+			arguments
+/padd/bad-args		Check padd subcommand fails with bad arguments
+/padd/useradd		Check padd subcommand works
+/timeout/noargs		Check timeout subcommand fails with the wrong number 
+			of arguments
+/timeout/bad-args	Check timeout subcommand fails with a bad arguments
+/timeout/valid		Check timeout subcommand works
+/update/noargs		Check update subcommand fails with the wrong number of 
+			arguments
+/update/bad-args	Check update subcommand fails with bad arguments
+/update/userupdate	Check update subcommand works for user defined keys
+/search/noargs		Check search subcommand fails with the wrong number of 
+			arguments
+/search/bad-args	Check search subcommand fails with a bad arguments
+/search/valid		Check search subcommand works
+/link/recursion		Check link subcommand handles recursive links correctly
+/link/noargs		Check link subcommand fails with the wrong number of 
+			arguments
+/link/bad-args		Check link subcommand fails with bad arguments
+/link/valid		Check link subcommand works
+/add/noargs		Check add subcommand fails with the wrong number of 
+			arguments
+/add/bad-args		Check add subcommand fails with a bad arguments
+/add/useradd		Check add subcommand works
+/requesting/piped	Check request/prequest2 subcommands work
+/requesting/noargs	Check request/request2 subcommands fail with the 
+			wrong number of arguments
+/requesting/bad-args	Check request/request2 subcommands fail with bad 
+			arguments
+/requesting/valid	Check request/request2 subcommands work
+/unlink/noargs		Check unlink subcommand fails with the wrong number of
+			arguments
+/unlink/bad-args	Check unlink subcommand fails with a bad arguments
+/unlink/valid		Check unlink subcommand works
diff --git a/tests/bugzillas/bz1031154/runtest.sh b/tests/bugzillas/bz1031154/runtest.sh
new file mode 100644
index 0000000..aee8a28
--- /dev/null
+++ b/tests/bugzillas/bz1031154/runtest.sh
@@ -0,0 +1,103 @@
+#!/bin/bash
+
+# Test for https://bugzilla.redhat.com/show_bug.cgi?id=1031154
+
+. ../../prepare.inc.sh
+. ../../toolbox.inc.sh
+
+# We intentionally generate AVCs so the test system shouldn't fail us
+# because the AVCs were generated.
+export AVC_ERROR=+no_avc_check
+export RHTS_OPTION_STRONGER_AVC=
+
+# ---- do the actual testing ----
+
+result=PASS
+
+if [ $have_big_key_type = 0 ]
+then
+    toolbox_skip_test $TEST "SKIPPING TEST DUE TO LACK OF BIG_KEY TYPE"
+    exit 0
+fi
+
+require_command getenforce
+require_command setenforce
+require_command runcon
+require_command ausearch
+
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+# we need a reference time to scan the audit log from so as not to pick up old
+# results from this test.
+base_date=`date +"%x@%X"`
+base_time=${base_date#*@}
+base_date=${base_date%@*}
+sleep 1
+
+# reset the permissive audit log autocancel thing
+load_policy
+
+# we need to be in permissive mode
+marker "ENTER SELINUX PERMISSIVE MODE"
+
+mode=`getenforce`
+
+if [ "$mode" != "Permissive" ]
+then
+	echo setenforce Permissive >>$OUTPUTFILE
+	if ! setenforce Permissive
+	then
+		failed
+	fi
+fi
+
+# create a big key to probe
+marker "CREATE BIG KEY"
+pcreate_key_by_size 8192 big_key test-key @s
+expect_keyid id
+
+# check the big key is file backed and the right size
+marker "CHECK BIG KEY"
+xid=`printf %08x $id`
+
+pk=`cat /proc/keys | grep "^$xid.*test-key: 8192 \\[file\\]"`
+echo $pk >>$OUTPUTFILE
+if [ -z "$pk" ]
+then
+	echo "+++ Incorrectly created key" >>$OUTPUTFILE
+	cat /proc/keys | grep "^$xid" >>$OUTPUTFILE
+	failed
+fi
+
+# use a separate context to access the key
+marker "ACCESS INTERCONTEXT"
+
+echo runcon system_u:system_r:httpd_t:s0-s0:c0.c1023 keyctl print $id >>$OUTPUTFILE
+if ! runcon system_u:system_r:httpd_t:s0-s0:c0.c1023 keyctl print $id >/dev/null 2>>$OUTPUTFILE
+then
+	failed
+fi
+
+# examine the audit logs
+marker "EXAMINE AUDIT LOGS"
+
+echo ausearch -m AVC -i --subject httpd_t -ts $base_date $base_time \| audit2allow \| grep '-P "allow httpd_t user_tmpfs_t:file [{] (open |read )+[}];"' >>$OUTPUTFILE
+if ausearch -m AVC -i --subject httpd_t -ts $base_date $base_time 2>>$OUTPUTFILE | audit2allow 2>>$OUTPUTFILE | grep -P "allow httpd_t user_tmpfs_t:file [{] (open |read )+[}];"
+then
+	failed
+fi
+
+marker "RESTORE SELINUX MODE"
+if [ "$mode" != "Permissive" ]
+then
+	echo setenforce $mode >>$OUTPUTFILE
+	if ! setenforce $mode
+	then
+		failed
+	fi
+fi
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/bugzillas/bz1033467/runtest.sh b/tests/bugzillas/bz1033467/runtest.sh
new file mode 100644
index 0000000..54ec293
--- /dev/null
+++ b/tests/bugzillas/bz1033467/runtest.sh
@@ -0,0 +1,68 @@
+#!/bin/bash
+
+# Test for https://bugzilla.redhat.com/show_bug.cgi?id=1033467
+
+. ../../prepare.inc.sh
+. ../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+# create a keyring and attach it to the session keyring
+marker "ADD SANDBOX KEYRING"
+create_keyring sandbox @s
+expect_keyid sandbox
+
+# create a bunch of nested keyrings in the sandbox
+marker "ADD NESTED KEYRINGS"
+declare -a ring
+for ((i=0; i<=16; i++))
+do
+    create_keyring ring$i $sandbox
+    expect_keyid "ring[$i]"
+done
+
+# create a key in each of those keyrings
+marker "ADD KEYS"
+keys=""
+for ((i=0; i<=16; i++))
+do
+    create_key user a$i a ${ring[$i]}
+    expect_keyid id
+    keys="$keys $id"
+done
+
+# search for the added keys, beginning at sandbox and exercising the nesting
+marker "SEARCH KEYS"
+keys2=""
+for ((i=0; i<=16; i++))
+do
+    search_for_key $sandbox user a$i
+    expect_keyid id
+    keys2="$keys2 $id"
+done
+
+marker "COMPARE KEY LISTS"
+if [ "$keys" != "$keys2" ]
+then
+	echo "Key lists differ" >>$OUTPUTFILE
+	echo List 1: "\"$keys\"" >>$OUTPUTFILE
+	echo List 2: "\"$keys2\"" >>$OUTPUTFILE
+	failed
+fi
+
+# search for some unadded keys and make sure we get an error
+marker "SEARCH MISSES"
+for ((i=17; i<=20; i++))
+do
+    search_for_key --fail $sandbox user a$i
+    expect_error ENOKEY
+done
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/bugzillas/bz1071346/runtest.sh b/tests/bugzillas/bz1071346/runtest.sh
new file mode 100644
index 0000000..45f0a02
--- /dev/null
+++ b/tests/bugzillas/bz1071346/runtest.sh
@@ -0,0 +1,79 @@
+#!/bin/bash
+
+# Test for https://bugzilla.redhat.com/show_bug.cgi?id=1071346
+
+. ../../prepare.inc.sh
+. ../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+# create a keyring and attach it to the session keyring
+marker "ADD SANDBOX KEYRING"
+create_keyring sandbox @s
+expect_keyid sandbox
+
+# Add a second keyring of the same name into the sandbox
+marker "ADD SECOND SANDBOX KEYRING"
+create_keyring sandbox $sandbox
+expect_keyid second
+
+# Now try and link keyrings together in ways that should fail
+marker "CHECK NO LINK SESSION TO SECOND"
+link_key --fail @s $second
+expect_error EDEADLK
+marker "CHECK NO LINK SANDBOX TO SECOND"
+link_key --fail $sandbox $second
+expect_error EDEADLK
+marker "CHECK NO LINK SECOND TO SECOND"
+link_key --fail $second $second
+expect_error EDEADLK
+
+# Add another keyring into sandbox and stick a third sandbox keyring in that
+marker "ADD SIDE KEYRING"
+create_keyring side $sandbox
+expect_keyid side
+marker "ADD THIRD SANDBOX KEYRING"
+create_keyring sandbox $side
+expect_keyid third
+
+# Make sure we can't link the session keyring, the sandbox, the side
+# keyring or the third keyring itself into the third keyring.
+marker "CHECK NO LINK SESSION TO THIRD"
+link_key --fail @s $third
+expect_error EDEADLK
+marker "CHECK NO LINK SANDBOX TO THIRD"
+link_key --fail $sandbox $third
+expect_error EDEADLK
+marker "CHECK NO LINK SIDE TO THIRD"
+link_key --fail $side $third
+expect_error EDEADLK
+marker "CHECK NO LINK THIRD TO THIRD"
+link_key --fail $sandbox $third
+expect_error EDEADLK
+
+# We should, however, be able to link second to third but not then
+# third to second
+marker "CHECK LINK SECOND TO THIRD"
+link_key $second $third
+marker "CHECK NO LINK THIRD TO SECOND"
+link_key --fail $third $second
+expect_error EDEADLK
+
+# We can then detach the link we just made and check the reverse
+# linkage.
+marker "UNLINK SECOND FROM THIRD"
+unlink_key $second $third
+marker "CHECK LINK THIRD TO SECOND"
+link_key $third $second
+marker "CHECK NO LINK SECOND TO THIRD"
+link_key --fail $second $third
+expect_error EDEADLK
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/add/bad-args/runtest.sh b/tests/keyctl/add/bad-args/runtest.sh
new file mode 100644
index 0000000..38795fa
--- /dev/null
+++ b/tests/keyctl/add/bad-args/runtest.sh
@@ -0,0 +1,74 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+# check that an empty key type fails correctly
+marker "CHECK EMPTY KEY TYPE"
+create_key --fail "" wibble stuff @p
+expect_error EINVAL
+
+# check that an unsupported key type fails correctly
+marker "CHECK UNSUPPORTED KEY TYPE"
+create_key --fail lizardsgizzards wibble stuff @p
+expect_error ENODEV
+
+# check that an invalid key type fails correctly
+marker "CHECK INVALID KEY TYPE"
+create_key --fail .user wibble stuff @p
+expect_error EPERM
+
+# check that an maximum length invalid key type fails correctly
+marker "CHECK MAXLEN KEY TYPE"
+create_key --fail $maxtype wibble stuff @p
+expect_error ENODEV
+
+# check that an overlong key type fails correctly
+marker "CHECK OVERLONG KEY TYPE"
+create_key --fail a$maxtype wibble stuff @p
+expect_error EINVAL
+
+# check that creation of a keyring with non-empty payload fails correctly
+marker "CHECK ADD KEYRING WITH PAYLOAD"
+create_key --fail keyring wibble a @p
+expect_error EINVAL
+
+# check that an max length key description works correctly (PAGE_SIZE inc NUL)
+if [ $PAGE_SIZE -lt $maxsquota ]
+then
+    marker "CHECK MAXLEN DESC"
+    create_key user $maxdesc stuff @p
+    expect_keyid keyid
+else
+    marker "CHECK MAXLEN DESC FAILS WITH EDQUOT"
+    create_key --fail user $maxdesc stuff @p
+    expect_error EDQUOT
+fi
+
+# This doesn't work on MIPS earler than 3.19 because of a kernel bug
+kver=`uname -r`
+kmch=`uname -m`
+if kernel_at_or_later_than 3.19 ||
+	[ "$kmch" != "mips" -a "$kmch" != "mips64" ]
+then
+	# check that an overlong key description fails correctly (>4095 inc NUL)
+	marker "CHECK OVERLONG DESC"
+	create_key --fail user a$maxdesc stuff @p
+	expect_error EINVAL
+fi
+
+# check that a bad key ID fails correctly
+marker "CHECK BAD KEY ID"
+create_key --fail user wibble stuff 0
+expect_error EINVAL
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/add/noargs/runtest.sh b/tests/keyctl/add/noargs/runtest.sh
new file mode 100644
index 0000000..d5abb7d
--- /dev/null
+++ b/tests/keyctl/add/noargs/runtest.sh
@@ -0,0 +1,35 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+# check that no arguments fails correctly
+marker "ADD NO ARGS"
+expect_args_error keyctl add
+
+# check that one argument fails correctly
+marker "ADD ONE ARG"
+expect_args_error keyctl add user
+
+# check that two arguments fail correctly
+marker "ADD TWO ARGS"
+expect_args_error keyctl add user wibble
+
+# check that three arguments fail correctly
+marker "ADD THREE ARGS"
+expect_args_error keyctl add user wibble stuff
+
+# check that five arguments fail correctly
+marker "ADD FIVE ARGS"
+expect_args_error keyctl add user wibble stuff @s x
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/add/useradd/runtest.sh b/tests/keyctl/add/useradd/runtest.sh
new file mode 100644
index 0000000..031241c
--- /dev/null
+++ b/tests/keyctl/add/useradd/runtest.sh
@@ -0,0 +1,53 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+# check that we can add a user key to the session keyring
+marker "ADD USER KEY"
+create_key user wibble stuff @s
+expect_keyid keyid
+
+# read back what we put in it
+marker "PRINT PAYLOAD"
+print_key $keyid
+expect_payload payload "stuff"
+
+# check that we can update a user key
+marker "UPDATE USER KEY"
+create_key user wibble lizard @s
+
+# check we get the same key ID back
+expect_keyid keyid2
+
+if [ "x$keyid" != "x$keyid2" ]
+then
+    failed
+fi
+
+# read back what we changed it to
+marker "PRINT UPDATED PAYLOAD"
+print_key $keyid
+expect_payload payload "lizard"
+
+# attempt to add a key to that non-keyring key
+marker "ADD KEY TO NON-KEYRING"
+create_key --fail user lizard gizzards $keyid
+expect_error ENOTDIR
+
+# remove the key we added
+marker "UNLINK KEY"
+unlink_key $keyid @s
+
+keyctl show
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/clear/bad-args/runtest.sh b/tests/keyctl/clear/bad-args/runtest.sh
new file mode 100644
index 0000000..feb89f6
--- /dev/null
+++ b/tests/keyctl/clear/bad-args/runtest.sh
@@ -0,0 +1,39 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+# check that a bad key ID fails correctly
+marker "CHECK CLEAR BAD KEY ID"
+clear_keyring --fail 0
+expect_error EINVAL
+
+# create a non-keyring
+marker "CREATE KEY"
+create_key user lizard gizzard @s
+expect_keyid keyid
+
+# check that a non-keyring ID fails correctly
+marker "CHECK CLEAR NON-KEYRING KEY"
+clear_keyring --fail $keyid
+expect_error ENOTDIR
+
+# dispose of the key we were using
+marker "UNLINK KEY"
+unlink_key --wait $keyid @s
+
+# check that a non-existent key ID fails correctly
+marker "CHECK CLEAR NON-EXISTENT KEY ID"
+clear_keyring --fail $keyid
+expect_error ENOKEY
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/clear/noargs/runtest.sh b/tests/keyctl/clear/noargs/runtest.sh
new file mode 100644
index 0000000..7bcfa89
--- /dev/null
+++ b/tests/keyctl/clear/noargs/runtest.sh
@@ -0,0 +1,23 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+# check that no arguments fails correctly
+marker "NO ARGS"
+expect_args_error keyctl clear
+
+# check that one argument fails correctly
+marker "TWO ARGS"
+expect_args_error keyctl clear 0 0
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/clear/valid/runtest.sh b/tests/keyctl/clear/valid/runtest.sh
new file mode 100644
index 0000000..9cb35ef
--- /dev/null
+++ b/tests/keyctl/clear/valid/runtest.sh
@@ -0,0 +1,96 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+# create a keyring and attach it to the session keyring
+marker "ADD KEYRING"
+create_keyring wibble @s
+expect_keyid keyringid
+
+# validate the new keyring's name and type
+marker "VALIDATE KEYRING"
+describe_key $keyringid
+expect_key_rdesc rdesc 'keyring@.*@wibble'
+
+# check that we have an empty keyring
+marker "LIST KEYRING"
+list_keyring $keyringid
+expect_keyring_rlist rlist empty
+
+# clear the empty keyring
+marker "CLEAR EMPTY KEYRING"
+clear_keyring $keyringid
+
+# check that it's empty again
+marker "LIST KEYRING 2"
+list_keyring $keyringid
+expect_keyring_rlist rlist empty
+
+# stick a key in the keyring
+marker "ADD KEY"
+create_key user lizard gizzard $keyringid
+expect_keyid keyid
+
+# check that we can list it
+marker "LIST KEYRING WITH ONE"
+list_keyring $keyringid
+expect_keyring_rlist rlist $keyid
+
+# clear the keyring
+marker "CLEAR KEYRING WITH ONE"
+clear_keyring $keyringid
+
+# check that it's now empty again
+marker "LIST KEYRING 3"
+list_keyring $keyringid
+expect_keyring_rlist rlist empty
+
+# stick forty keys in the keyring
+marker "ADD FORTY KEYS"
+keys=""
+for ((i=0; i<40; i++))
+  do
+  create_key user lizard$i gizzard$i $keyringid
+  expect_keyid x
+  keys="$keys $x"
+  list_keyring $keyringid
+  expect_keyring_rlist rlist $x
+done
+
+marker "CHECK KEYRING CONTENTS"
+list_keyring $keyringid
+for i in $keys
+do
+    expect_keyring_rlist rlist $i
+done
+
+marker "SHOW KEYRING"
+if ! keyctl show >>$OUTPUTFILE 2>&1
+then
+    failed
+fi
+
+# clear the keyring
+marker "CLEAR KEYRING WITH ONE"
+clear_keyring $keyringid
+
+# check that it's now empty yet again
+marker "LIST KEYRING 4"
+list_keyring $keyringid
+expect_keyring_rlist rlist empty
+
+# remove the keyring we added
+marker "UNLINK KEY"
+unlink_key $keyringid @s
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/describing/bad-args/runtest.sh b/tests/keyctl/describing/bad-args/runtest.sh
new file mode 100644
index 0000000..a49ee52
--- /dev/null
+++ b/tests/keyctl/describing/bad-args/runtest.sh
@@ -0,0 +1,38 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+# check that a bad key ID fails correctly
+marker "CHECK BAD KEY ID"
+describe_key --fail 0
+expect_error EINVAL
+pretty_describe_key --fail 0
+expect_error EINVAL
+
+# create a key
+marker "CREATE KEY"
+create_key user lizard gizzard @s
+expect_keyid keyid
+
+# dispose of the key
+marker "UNLINK KEY"
+unlink_key --wait $keyid @s
+
+# check that a non-existent key ID fails correctly
+marker "CHECK NON-EXISTENT KEY ID"
+describe_key --fail $keyid
+expect_error ENOKEY
+pretty_describe_key --fail $keyid
+expect_error ENOKEY
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/describing/noargs/runtest.sh b/tests/keyctl/describing/noargs/runtest.sh
new file mode 100644
index 0000000..fac4c49
--- /dev/null
+++ b/tests/keyctl/describing/noargs/runtest.sh
@@ -0,0 +1,25 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+marker "NO ARGS"
+expect_args_error keyctl describe
+expect_args_error keyctl rdescribe
+
+marker "TWO ARGS"
+expect_args_error keyctl describe 0 0
+
+marker "THREE ARGS"
+expect_args_error keyctl rdescribe 0 0 0
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/describing/valid/runtest.sh b/tests/keyctl/describing/valid/runtest.sh
new file mode 100644
index 0000000..e327e4b
--- /dev/null
+++ b/tests/keyctl/describing/valid/runtest.sh
@@ -0,0 +1,71 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+# create a keyring and attach it to the session keyring
+marker "ADD KEYRING"
+create_keyring wibble @s
+expect_keyid keyringid
+
+# validate the new keyring's name and type
+marker "VALIDATE KEYRING"
+describe_key $keyringid
+expect_key_rdesc rdesc 'keyring@.*@wibble'
+
+# validate a pretty description of the keyring
+marker "VALIDATE PRETTY KEYRING"
+pretty_describe_key $keyringid
+expect_key_rdesc pdesc " *$keyringid: [-avrwsl]* *[-0-9]* *[-0-9]* keyring: wibble"
+
+# check that we have an empty keyring
+marker "LIST KEYRING"
+list_keyring $keyringid
+expect_keyring_rlist rlist empty
+
+# stick a key in the keyring
+marker "ADD KEY"
+create_key user lizard gizzard $keyringid
+expect_keyid keyid
+
+# validate the new key's name and type
+marker "VALIDATE KEY"
+describe_key $keyid
+expect_key_rdesc rdesc 'user@.*@lizard'
+
+# validate a pretty description of the key
+marker "VALIDATE PRETTY KEY"
+pretty_describe_key $keyid
+expect_key_rdesc pdesc " *$keyid: [-avrwsl]* *[0-9]* *[-0-9]* user: lizard"
+
+# turn off view permission on the key
+marker "DISABLE VIEW PERM"
+set_key_perm $keyid 0x3e0000
+describe_key --fail $keyid
+expect_error EACCES
+
+# turn on view permission on the key
+marker "REINSTATE VIEW PERM"
+set_key_perm $keyid 0x3f0000
+describe_key $keyid
+
+# revoke the key
+marker "REVOKE KEY"
+revoke_key $keyid
+describe_key --fail $keyid
+expect_error EKEYREVOKED
+
+# remove the keyring we added
+marker "UNLINK KEY"
+unlink_key $keyringid @s
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/dh_compute/bad-args/runtest.sh b/tests/keyctl/dh_compute/bad-args/runtest.sh
new file mode 100644
index 0000000..7e8828b
--- /dev/null
+++ b/tests/keyctl/dh_compute/bad-args/runtest.sh
@@ -0,0 +1,89 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+if [ $have_dh_compute = 0 ]
+then
+    toolbox_skip_test $TEST "SKIPPING DUE TO LACK OF DIFFIE-HELLMAN"
+    exit 0
+fi
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+# Prime, generator, and key values created with:
+#   openssl dhparam 2048 -check -out dh.pem
+#   openssl genpkey -paramfile dh.pem -text
+prime="\x00\xb6\x89\x4d\x8f\xf7\xaf\x56\xd4\x46\xc9\x50\xc7\xe9\x1d"
+prime+="\x29\x8a\x07\x8d\xae\xa7\x79\x66\xf1\x1f\xc1\x6f\x22\x92\x11"
+prime+="\x73\x7f\x1f\x39\xce\xf3\xda\xd7\x87\x2a\x53\x8f\x6c\x8f\x9a"
+prime+="\x27\x6a\x7c\xf7\x7b\xb2\xd6\x3a\x87\x2a\x4d\xb9\xed\x12\xae"
+prime+="\x0f\x1c\x69\xaf\x9b\xf2\xf2\xe3\x69\x1d\x36\x15\xa1\xd7\xd5"
+prime+="\x77\xa8\x7d\x1c\xb4\xab\xa0\x49\x4b\xae\x0c\x24\x9b\x0c\xce"
+prime+="\xef\x6b\x7a\xb9\xa7\xbe\x70\xb5\xb4\x5e\x4c\xf7\xcb\x71\xad"
+prime+="\x8f\xeb\x7a\x4d\x6c\x7c\xcb\x96\xd5\x29\x8f\x0f\xee\xb4\x78"
+prime+="\x77\x60\x5e\x80\xa0\x33\x86\x91\xe3\x58\x62\xf0\xf4\xcb\xb2"
+prime+="\x09\xe1\x7d\xd9\xfe\xbc\xce\x4c\x21\x57\x70\x06\xce\xb1\x15"
+prime+="\x7b\x18\x15\x92\xd2\xf7\x84\xba\x44\xe0\x06\xc3\x14\xdf\x53"
+prime+="\x06\xbd\xbb\x17\xa0\x10\xb3\x66\x0d\x47\x93\x56\xd8\xd5\x2c"
+prime+="\x5a\xf0\x14\x53\x6c\x20\x89\x7e\x76\x53\x21\x8e\x2c\x7a\x65"
+prime+="\x0a\x73\xdc\x27\x58\x45\x98\xde\x92\xde\x5c\x62\x70\x67\x71"
+prime+="\xfa\x2d\x67\xf6\x25\x44\x1d\x91\x1c\xa0\x3f\x21\x49\xb6\xd4"
+prime+="\xc7\x6b\x5e\xcd\x98\x96\xe9\xd7\x99\xa3\xa5\x00\xec\xec\xc5"
+prime+="\x19\xe3\x1b\x71\x15\x4d\x7b\x36\x1b\xd0\xdd\x15\xf7\xce\x8d"
+prime+="\xfc\x63"
+
+generator="\x02"
+
+private="\x40\x94\x9d\xa2\xca\x2b\x7c\x35\x3d\xe3\x8f\xef\xb0\x6d\xdd"
+private+="\x0d\x67\x47\x9a\x63\x61\xc8\x9e\x77\xb9\x80\xd2\x48\x6c\x4d"
+private+="\x31\x97\x1e\xb8\x8f\x65\x72\x06\x99\x73\xe3\xae\x5a\x43\xce"
+private+="\x76\xbc\xcb\x35\xea\x05\xac\x65\x38\xeb\x0e\xa6\xad\xee\x49"
+private+="\x37\x60\x04\x35\xdd\x79\x40\x88\x5d\x2e\x3f\x78\xc7\x28\x08"
+private+="\x34\xf8\x78\xd3\xd5\x50\xcc\x93\x05\x33\x0b\xb8\xf0\x20\x85"
+private+="\xee\x6c\x23\x0d\x42\xd8\x4e\xb6\x7a\x24\x5b\x92\x81\x7f\xd1"
+private+="\x54\xbc\xb1\x39\x4a\x28\x9d\x11\xaf\xb5\xa1\xe5\x0e\x13\x95"
+private+="\x09\x08\xaf\x70\x75\x67\x04\xe9\xbf\x03\xdf\xf0\xe5\xd4\x90"
+private+="\x74\x38\x41\xc5\x34\xcb\x7e\x2c\xf4\xb9\xf0\x49\x3a\x73\x0b"
+private+="\x0d\x71\x09\x6a\x16\xbd\xc0\xe8\x52\xf1\x75\x75\x51\x34\xb2"
+private+="\xb4\x11\x12\x28\x0a\x88\x21\x27\x28\xaf\xbe\x16\xd4\x17\xf3"
+private+="\x18\x93\xcb\xe4\x42\xe0\x6d\x21\x2d\x8e\xfe\x22\x7a\xa0\x03"
+private+="\x9a\x65\xce\x99\x81\x07\xfa\xe2\x78\x51\x1c\x6b\xf4\xd5\x99"
+private+="\x32\x53\x4a\xe9\xfc\x39\xdb\x80\x63\x51\x63\xc0\x54\x66\x57"
+private+="\x50\x08\x66\xd5\x46\x1c\x5f\xa3\x54\x02\x38\x32\x4a\x29\xf3"
+private+="\x16\xe0\x68\xf3\xba\x17\x37\xd0\x42\xcb\x51\xa8\x97\x1b\xc7"
+private+="\xa2"
+
+pcreate_key "-e $prime" user dh:prime @s
+expect_keyid primeid
+
+pcreate_key "-e $generator" user dh:generator @s
+expect_keyid generatorid
+
+pcreate_key "-e $private" user dh:private @s
+expect_keyid privateid
+
+pcreate_key "-e \x00" logon dh:logon @s
+expect_keyid logonid
+
+marker "CHECK WRONG KEY TYPE"
+dh_compute --fail $privateid $primeid $logonid
+expect_error ENOKEY
+dh_compute --fail $privateid $primeid @s
+expect_error EOPNOTSUPP
+
+marker "CHECK MISSING KEY"
+dh_compute --fail $privateid $primeid 0
+expect_error ENOKEY
+unlink_key --wait $generatorid @s
+dh_compute --fail $privateid $primeid $generatorid
+expect_error ENOKEY
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/dh_compute/noargs/runtest.sh b/tests/keyctl/dh_compute/noargs/runtest.sh
new file mode 100644
index 0000000..e761f6b
--- /dev/null
+++ b/tests/keyctl/dh_compute/noargs/runtest.sh
@@ -0,0 +1,30 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+if [ $have_dh_compute = 0 ]
+then
+    toolbox_skip_test $TEST "SKIPPING DUE TO LACK OF DIFFIE-HELLMAN"
+    exit 0
+fi
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+marker "NO ARGS"
+expect_args_error keyctl dh_compute
+
+marker "TWO ARGS"
+expect_args_error keyctl dh_compute 0 0
+
+marker "FOUR ARGS"
+expect_args_error keyctl dh_compute 0 0 0 0
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/dh_compute/valid/runtest.sh b/tests/keyctl/dh_compute/valid/runtest.sh
new file mode 100644
index 0000000..f2aace6
--- /dev/null
+++ b/tests/keyctl/dh_compute/valid/runtest.sh
@@ -0,0 +1,88 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+if [ $have_dh_compute = 0 ]
+then
+    toolbox_skip_test $TEST "SKIPPING DUE TO LACK OF DIFFIE-HELLMAN"
+    exit 0
+fi
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+# Prime, generator, and key values created with:
+#   openssl dhparam 2048 -check -out dh.pem
+#   openssl genpkey -paramfile dh.pem -text
+prime="\x00\xb6\x89\x4d\x8f\xf7\xaf\x56\xd4\x46\xc9\x50\xc7\xe9\x1d"
+prime+="\x29\x8a\x07\x8d\xae\xa7\x79\x66\xf1\x1f\xc1\x6f\x22\x92\x11"
+prime+="\x73\x7f\x1f\x39\xce\xf3\xda\xd7\x87\x2a\x53\x8f\x6c\x8f\x9a"
+prime+="\x27\x6a\x7c\xf7\x7b\xb2\xd6\x3a\x87\x2a\x4d\xb9\xed\x12\xae"
+prime+="\x0f\x1c\x69\xaf\x9b\xf2\xf2\xe3\x69\x1d\x36\x15\xa1\xd7\xd5"
+prime+="\x77\xa8\x7d\x1c\xb4\xab\xa0\x49\x4b\xae\x0c\x24\x9b\x0c\xce"
+prime+="\xef\x6b\x7a\xb9\xa7\xbe\x70\xb5\xb4\x5e\x4c\xf7\xcb\x71\xad"
+prime+="\x8f\xeb\x7a\x4d\x6c\x7c\xcb\x96\xd5\x29\x8f\x0f\xee\xb4\x78"
+prime+="\x77\x60\x5e\x80\xa0\x33\x86\x91\xe3\x58\x62\xf0\xf4\xcb\xb2"
+prime+="\x09\xe1\x7d\xd9\xfe\xbc\xce\x4c\x21\x57\x70\x06\xce\xb1\x15"
+prime+="\x7b\x18\x15\x92\xd2\xf7\x84\xba\x44\xe0\x06\xc3\x14\xdf\x53"
+prime+="\x06\xbd\xbb\x17\xa0\x10\xb3\x66\x0d\x47\x93\x56\xd8\xd5\x2c"
+prime+="\x5a\xf0\x14\x53\x6c\x20\x89\x7e\x76\x53\x21\x8e\x2c\x7a\x65"
+prime+="\x0a\x73\xdc\x27\x58\x45\x98\xde\x92\xde\x5c\x62\x70\x67\x71"
+prime+="\xfa\x2d\x67\xf6\x25\x44\x1d\x91\x1c\xa0\x3f\x21\x49\xb6\xd4"
+prime+="\xc7\x6b\x5e\xcd\x98\x96\xe9\xd7\x99\xa3\xa5\x00\xec\xec\xc5"
+prime+="\x19\xe3\x1b\x71\x15\x4d\x7b\x36\x1b\xd0\xdd\x15\xf7\xce\x8d"
+prime+="\xfc\x63"
+
+generator="\x02"
+
+private="\x40\x94\x9d\xa2\xca\x2b\x7c\x35\x3d\xe3\x8f\xef\xb0\x6d\xdd"
+private+="\x0d\x67\x47\x9a\x63\x61\xc8\x9e\x77\xb9\x80\xd2\x48\x6c\x4d"
+private+="\x31\x97\x1e\xb8\x8f\x65\x72\x06\x99\x73\xe3\xae\x5a\x43\xce"
+private+="\x76\xbc\xcb\x35\xea\x05\xac\x65\x38\xeb\x0e\xa6\xad\xee\x49"
+private+="\x37\x60\x04\x35\xdd\x79\x40\x88\x5d\x2e\x3f\x78\xc7\x28\x08"
+private+="\x34\xf8\x78\xd3\xd5\x50\xcc\x93\x05\x33\x0b\xb8\xf0\x20\x85"
+private+="\xee\x6c\x23\x0d\x42\xd8\x4e\xb6\x7a\x24\x5b\x92\x81\x7f\xd1"
+private+="\x54\xbc\xb1\x39\x4a\x28\x9d\x11\xaf\xb5\xa1\xe5\x0e\x13\x95"
+private+="\x09\x08\xaf\x70\x75\x67\x04\xe9\xbf\x03\xdf\xf0\xe5\xd4\x90"
+private+="\x74\x38\x41\xc5\x34\xcb\x7e\x2c\xf4\xb9\xf0\x49\x3a\x73\x0b"
+private+="\x0d\x71\x09\x6a\x16\xbd\xc0\xe8\x52\xf1\x75\x75\x51\x34\xb2"
+private+="\xb4\x11\x12\x28\x0a\x88\x21\x27\x28\xaf\xbe\x16\xd4\x17\xf3"
+private+="\x18\x93\xcb\xe4\x42\xe0\x6d\x21\x2d\x8e\xfe\x22\x7a\xa0\x03"
+private+="\x9a\x65\xce\x99\x81\x07\xfa\xe2\x78\x51\x1c\x6b\xf4\xd5\x99"
+private+="\x32\x53\x4a\xe9\xfc\x39\xdb\x80\x63\x51\x63\xc0\x54\x66\x57"
+private+="\x50\x08\x66\xd5\x46\x1c\x5f\xa3\x54\x02\x38\x32\x4a\x29\xf3"
+private+="\x16\xe0\x68\xf3\xba\x17\x37\xd0\x42\xcb\x51\xa8\x97\x1b\xc7"
+private+="\xa2"
+
+read -d '' public <<"EOF"
+a4cf1f93 95fce03f d02aaece da1f86bd d8d77b69 29039fcc bd138c98 2483bf9c
+7e4406c1 4f3cea24 6cafb29e 95095d0c 6768f13b 31babb24 6c590d92 6c343e69
+59dbd47f 65982a3b b1baa7a3 05a72054 89b6cd0d 78397962 fc834fc9 3ec0517e
+c218396f 9cff860e 29078aee 6b8598b6 79325014 bb84597d f031e149 edbe1c5a
+2a55fe4e bbc64a52 6da59e71 1c7ae5e0 954ba23b 9d58c423 17d84841 815708c8
+b9059987 48773eac 2244b286 cd118277 48b7ed3a 5af5cc0f 8f254190 5e16f998
+a328e894 acc343f4 66a95281 86cea6a3 93eb4fee f83c0e2e f4a00ce6 fcc9ef81
+cc4624d5 ba659411 d1ba7b5f 14a3e286 d42e6ac8 afa9f846 41cb7cb5 66965725
+EOF
+
+pcreate_key "-e $prime" user dh:prime @s
+expect_keyid primeid
+
+pcreate_key "-e $generator" user dh:generator @s
+expect_keyid generatorid
+
+pcreate_key "-e $private" user dh:private @s
+expect_keyid privateid
+
+marker "COMPUTE DH PUBLIC KEY"
+dh_compute $privateid $primeid $generatorid
+expect_multiline payload "$public"
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/instantiating/bad-args/runtest.sh b/tests/keyctl/instantiating/bad-args/runtest.sh
new file mode 100644
index 0000000..1922282
--- /dev/null
+++ b/tests/keyctl/instantiating/bad-args/runtest.sh
@@ -0,0 +1,55 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+# check that a bad key ID fails correctly
+marker "CHECK BAD KEY ID"
+instantiate_key --fail 0 a @p
+expect_error EPERM
+pinstantiate_key --fail a 0 @p
+expect_error EPERM
+negate_key --fail 0 10 @p
+expect_error EPERM
+
+# create a non-keyring
+marker "CREATE KEY"
+create_key user lizard gizzard @s
+expect_keyid keyid
+
+# check that instantiation of an instantiated key fails
+marker "CHECK ALREADY INSTANTIATED KEY"
+instantiate_key --fail $keyid a @p
+expect_error EPERM
+pinstantiate_key --fail a $keyid @p
+expect_error EPERM
+negate_key --fail $keyid 10 @p
+expect_error EPERM
+
+# check negative key timeout must be a number
+marker "CHECK NEGATE TIMEOUT"
+expect_args_error keyctl negate $keyid aa @p
+
+# dispose of the key we were using
+marker "UNLINK KEY"
+unlink_key --wait $keyid @s
+
+# check that a non-existent key ID fails correctly
+marker "CHECK NON-EXISTENT KEY ID"
+instantiate_key --fail 0 a @p
+expect_error EPERM
+pinstantiate_key --fail a 0 @p
+expect_error EPERM
+negate_key --fail 0 10 @p
+expect_error EPERM
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/instantiating/noargs/runtest.sh b/tests/keyctl/instantiating/noargs/runtest.sh
new file mode 100644
index 0000000..1b5150f
--- /dev/null
+++ b/tests/keyctl/instantiating/noargs/runtest.sh
@@ -0,0 +1,36 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+marker "NO ARGS"
+expect_args_error keyctl instantiate
+expect_args_error keyctl pinstantiate
+expect_args_error keyctl negate
+
+marker "ONE ARG"
+expect_args_error keyctl instantiate 0
+expect_args_error keyctl pinstantiate 0
+expect_args_error keyctl negate 0
+
+marker "TWO ARGS"
+expect_args_error keyctl instantiate 0 0
+expect_args_error keyctl negate 0 0
+
+marker "THREE ARGS"
+expect_args_error keyctl pinstantiate 0 0 0
+
+marker "FOUR ARGS"
+expect_args_error keyctl instantiate 0 0 0 0
+expect_args_error keyctl negate 0 0 0 0
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/invalidate/bad-args/runtest.sh b/tests/keyctl/invalidate/bad-args/runtest.sh
new file mode 100644
index 0000000..2d9ab11
--- /dev/null
+++ b/tests/keyctl/invalidate/bad-args/runtest.sh
@@ -0,0 +1,40 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+if [ $have_key_invalidate = 0 ]
+then
+    toolbox_skip_test $TEST "SKIPPING DUE TO LACK OF KEY INVALIDATION"
+    exit 0
+fi
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+# check that a bad key ID fails correctly
+marker "CHECK INVALIDATE BAD KEY ID"
+invalidate_key --fail 0
+expect_error EINVAL
+
+# create a key
+marker "CREATE KEY"
+create_key user lizard gizzard @s
+expect_keyid keyid
+
+# and dispose of it
+marker "UNLINK KEY"
+unlink_key --wait $keyid @s
+
+# check that a non-existent key ID fails correctly
+marker "CHECK INVALIDATE NON-EXISTENT KEY ID"
+invalidate_key --fail $keyid
+expect_error ENOKEY
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/invalidate/noargs/runtest.sh b/tests/keyctl/invalidate/noargs/runtest.sh
new file mode 100644
index 0000000..25b19ba
--- /dev/null
+++ b/tests/keyctl/invalidate/noargs/runtest.sh
@@ -0,0 +1,29 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+if [ $have_key_invalidate = 0 ]
+then
+    toolbox_skip_test $TEST "SKIPPING DUE TO LACK OF KEY INVALIDATION"
+    exit 0
+fi
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+# check that no arguments fails correctly
+marker "NO ARGS"
+expect_args_error keyctl invalidate
+
+# check that two arguments fail correctly
+marker "TWO ARGS"
+expect_args_error keyctl invalidate 0 0
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/invalidate/valid/runtest.sh b/tests/keyctl/invalidate/valid/runtest.sh
new file mode 100644
index 0000000..afc0d3e
--- /dev/null
+++ b/tests/keyctl/invalidate/valid/runtest.sh
@@ -0,0 +1,80 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+if [ $have_key_invalidate = 0 ]
+then
+    toolbox_skip_test $TEST "SKIPPING DUE TO LACK OF KEY INVALIDATION"
+    exit 0
+fi
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+# create a keyring and attach it to the session keyring
+marker "ADD KEYRING"
+create_keyring wibble @s
+expect_keyid keyringid
+
+# check that we have an empty keyring
+marker "LIST KEYRING"
+list_keyring $keyringid
+expect_keyring_rlist rlist empty
+
+# stick a key in the keyring
+marker "ADD KEY"
+create_key user lizard gizzard $keyringid
+expect_keyid keyid
+
+# check that we can list it
+marker "LIST KEYRING 2"
+list_keyring $keyringid
+expect_keyring_rlist rlist $keyid
+
+# invalidate the key
+marker "INVALIDATE KEY"
+invalidate_key $keyid
+
+# need to wait for the gc
+sleep 1
+
+# check that it's now empty again
+marker "LIST KEYRING 3"
+list_keyring $keyringid
+expect_keyring_rlist rlist empty
+
+# stick another key in the keyring
+marker "ADD KEY"
+create_key user lizard2 gizzard $keyringid
+expect_keyid keyid
+
+# check that we can list it
+marker "LIST KEYRING 4"
+list_keyring $keyringid
+expect_keyring_rlist rlist $keyid
+
+# invalidate the keyring
+marker "INVALIDATE KEYRING"
+invalidate_key $keyringid
+
+# need to wait for the gc
+sleep 1
+
+# check that the keyring no longer exists
+marker "CHECK KEYRING"
+list_keyring --fail $keyringid
+expect_error ENOKEY
+
+# check that the key got gc'd also
+marker "CHECK KEY"
+describe_key --fail $keyid
+expect_error ENOKEY
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/link/bad-args/runtest.sh b/tests/keyctl/link/bad-args/runtest.sh
new file mode 100644
index 0000000..39612f4
--- /dev/null
+++ b/tests/keyctl/link/bad-args/runtest.sh
@@ -0,0 +1,47 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+# check that a bad key ID fails correctly
+marker "CHECK LINK FROM BAD KEY ID"
+link_key --fail 0 @s
+expect_error EINVAL
+
+marker "CHECK LINK TO BAD KEY ID"
+link_key --fail @s 0
+expect_error EINVAL
+
+# create a non-keyring
+marker "CREATE KEY"
+create_key user lizard gizzard @s
+expect_keyid keyid
+
+# check that linking to a non-keyring ID fails correctly
+marker "CHECK LINK TO NON-KEYRING KEY"
+link_key --fail @s $keyid
+expect_error ENOTDIR
+
+# dispose of the key we were using
+marker "UNLINK KEY"
+unlink_key --wait $keyid @s
+
+# check that a non-existent key ID fails correctly
+marker "CHECK LINK TO NON-EXISTENT KEY ID"
+link_key --fail @s $keyid
+expect_error ENOKEY
+
+marker "CHECK LINK FROM NON-EXISTENT KEY ID"
+link_key --fail $keyid @s
+expect_error ENOKEY
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/link/noargs/runtest.sh b/tests/keyctl/link/noargs/runtest.sh
new file mode 100644
index 0000000..94c2a9f
--- /dev/null
+++ b/tests/keyctl/link/noargs/runtest.sh
@@ -0,0 +1,27 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+# check that no arguments fails correctly
+marker "NO ARGS"
+expect_args_error keyctl link
+
+# check that one argument fails correctly
+marker "ONE ARGS"
+expect_args_error keyctl link 0
+
+# check that three arguments fails correctly
+marker "THREE ARGS"
+expect_args_error keyctl link 0 0 0
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/link/recursion/runtest.sh b/tests/keyctl/link/recursion/runtest.sh
new file mode 100644
index 0000000..1012871
--- /dev/null
+++ b/tests/keyctl/link/recursion/runtest.sh
@@ -0,0 +1,185 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+# create a keyring and attach it to the session keyring
+marker "CREATE KEYRING 1"
+create_keyring "first" @s
+expect_keyid keyringid
+set_key_perm $keyringid 0x3f3f0000
+
+# attempt to link a keyring to itself
+marker "RECURSE 1"
+link_key --fail $keyringid $keyringid
+expect_error EDEADLK
+
+# create a second keyring in the first
+marker "CREATE KEYRING 2"
+create_keyring "second" $keyringid
+expect_keyid keyring2id
+set_key_perm $keyring2id 0x3f3f0000
+
+# attempt to link a keyring to its child keyring
+marker "RECURSE 2"
+link_key --fail $keyringid $keyring2id
+expect_error EDEADLK
+
+# create a third keyring in the second
+marker "CREATE KEYRING 3"
+create_keyring "third" $keyring2id
+expect_keyid keyring3id
+set_key_perm $keyring3id 0x3f3f0000
+
+# attempt to link a keyring to its grandchild keyring
+marker "RECURSE 3"
+link_key --fail $keyringid $keyring3id
+expect_error EDEADLK
+
+# create a fourth keyring in the third
+marker "CREATE KEYRING 4"
+create_keyring "fourth" $keyring3id
+expect_keyid keyring4id
+set_key_perm $keyring4id 0x3f3f0000
+
+# attempt to link a keyring to its great grandchild keyring
+marker "RECURSE 4"
+link_key --fail $keyringid $keyring4id
+expect_error EDEADLK
+
+# create a fifth keyring in the fourth
+marker "CREATE KEYRING 5"
+create_keyring "fifth" $keyring4id
+expect_keyid keyring5id
+set_key_perm $keyring5id 0x3f3f0000
+
+# attempt to link a keyring to its great great grandchild keyring
+marker "RECURSE 5"
+link_key --fail $keyringid $keyring5id
+expect_error EDEADLK
+
+# create a sixth keyring in the fifth
+marker "CREATE KEYRING 6"
+create_keyring "sixth" $keyring5id
+expect_keyid keyring6id
+set_key_perm $keyring6id 0x3f3f0000
+
+# attempt to link a keyring to its great great great grandchild keyring
+marker "RECURSE 6"
+link_key --fail $keyringid $keyring6id
+expect_error EDEADLK
+
+# create a seventh keyring in the sixth
+marker "CREATE KEYRING 7"
+create_keyring "seventh" $keyring6id
+expect_keyid keyring7id
+set_key_perm $keyring7id 0x3f3f0000
+
+# attempt to link a keyring to its great great great great grandchild keyring
+marker "RECURSE 7"
+link_key --fail $keyringid $keyring7id
+expect_error EDEADLK
+
+# create an eigth keyring in the seventh
+marker "CREATE KEYRING 8"
+create_keyring "eighth" @s
+expect_keyid keyring8id
+set_key_perm $keyring8id 0x3f3f0000
+link_key $keyring8id $keyring7id
+unlink_key $keyring8id @s
+
+# attempt to link a keyring to its great great great great great grandchild keyring
+marker "RECURSE 8"
+link_key --fail $keyringid $keyring8id
+expect_error EDEADLK
+
+# create a ninth keyring in the eighth
+marker "CREATE KEYRING 9"
+create_keyring "ninth" @s
+expect_keyid keyring9id
+set_key_perm $keyring9id 0x3f3f0000
+link_key $keyring9id $keyring8id
+unlink_key $keyring9id @s
+
+# attempt to link a keyring to its great great great great great great grandchild keyring
+marker "RECURSE 9"
+link_key --fail $keyringid $keyring9id
+expect_error ELOOP
+
+# remove the first keyring we added
+marker "UNLINK KEYRING"
+unlink_key $keyringid @s
+
+# create two stacks of keyrings
+marker "CREATE KEYRING STACKS"
+create_keyring "A1" @s
+expect_keyid aroot
+create_keyring "B1" @s
+expect_keyid broot
+a=$aroot
+b=$broot
+
+for ((i=2; i<=4; i++))
+  do
+  create_keyring "A$i" $a
+  expect_keyid a
+  create_keyring "B$i" $b
+  expect_keyid b
+done
+
+# make sure we can't create a cycle by linking the two stacks together
+marker "LINK A TO B"
+link_key $aroot $b
+
+marker "LINK B TO A"
+link_key --fail $broot $a
+expect_error EDEADLK
+
+marker "UNLINK A FROM B"
+unlink_key $aroot $b
+
+marker "LINK B TO A"
+link_key $broot $a
+
+marker "LINK A TO B"
+link_key --fail $aroot $b
+expect_error EDEADLK
+
+marker "UNLINK B FROM A"
+unlink_key $broot $a
+
+# extend the stacks
+marker "EXTEND STACKS"
+create_keyring "A5" $a
+expect_keyid a
+create_keyring "B5" $b
+expect_keyid b
+
+# make sure we can't hide a cycle by linking the two bigger stacks together
+marker "CHECK MAXDEPTH A TO B"
+link_key $aroot $b
+link_key --fail $broot $a
+expect_error ELOOP
+unlink_key $aroot $b
+
+marker "CHECK MAXDEPTH B TO A"
+link_key $broot $a
+link_key --fail $aroot $b
+expect_error ELOOP
+unlink_key $broot $a
+
+# remove the two stacks
+marker "UNLINK STACKS"
+unlink_key $aroot @s
+unlink_key $broot @s
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/link/valid/runtest.sh b/tests/keyctl/link/valid/runtest.sh
new file mode 100644
index 0000000..fc7f28a
--- /dev/null
+++ b/tests/keyctl/link/valid/runtest.sh
@@ -0,0 +1,139 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+# create a keyring and attach it to the session keyring
+marker "ADD KEYRING"
+create_keyring wibble @s
+expect_keyid keyringid
+
+# validate the new keyring's name and type
+marker "VALIDATE KEYRING"
+describe_key $keyringid
+expect_key_rdesc rdesc 'keyring@.*@wibble'
+
+# check that we can list it
+marker "LIST KEYRING"
+list_keyring $keyringid
+expect_keyring_rlist rlist empty
+
+# stick a key in the keyring
+marker "ADD KEY"
+create_key user lizard gizzard $keyringid
+expect_keyid keyid
+
+# check that we can list it
+marker "LIST KEYRING WITH ONE"
+list_keyring $keyringid
+expect_keyring_rlist rlist $keyid
+
+# link the key across to the session keyring
+marker "LINK KEY 1"
+link_key $keyid @s
+
+marker "CHECK KEY LINKAGE"
+list_keyring @s
+expect_keyring_rlist srlist $keyid
+
+# link the key across to the session keyring again and again
+marker "LINK KEY 2"
+link_key $keyid @s
+
+marker "LINK KEY 3"
+link_key $keyid @s
+
+# subsequent links should displace earlier links, giving us a maximum of 1 link
+marker "COUNT LINKS"
+list_keyring @s
+expect_keyring_rlist srlist
+
+nlinks=0
+for i in $srlist
+  do
+  if [ "x$i" = "x$keyid" ]
+  then
+      nlinks=$(($nlinks + 1))
+  fi
+done
+
+if [ $nlinks != 1 ]
+then
+    failed
+fi
+
+# remove the links
+marker "UNLINK KEY FROM SESSION"
+unlink_key $keyid @s
+
+# removing again should fail
+unlink_key --fail $keyid @s
+expect_error ENOENT
+
+# remove that key from the keyring (the key should be destroyed)
+marker "UNLINK KEY FROM KEYRING"
+unlink_key --wait $keyid $keyringid
+
+# and a second time should fail, but now the key doesn't exist
+unlink_key --fail $keyid $keyringid
+expect_error ENOKEY
+
+# create a second keyring in the first
+create_keyring "zebra" $keyringid
+expect_keyid keyring2id
+
+# link thrice across to the session keyring
+marker "LINK 2ND KEYRING TO SESSION"
+link_key $keyring2id @s
+link_key $keyring2id @s
+link_key $keyring2id @s
+
+# subsequent links should displace earlier links, giving us a maximum of 1 link
+marker "COUNT KEYRING LINKS"
+list_keyring @s
+expect_keyring_rlist srlist
+
+nlinks=0
+for i in $srlist
+  do
+  if [ "x$i" = "x$keyring2id" ]
+  then
+      nlinks=$(($nlinks + 1))
+  fi
+done
+
+if [ $nlinks != 1 ]
+then
+    failed
+fi
+
+# remove the keyring links
+marker "UNLINK 2ND KEYRING FROM SESSION"
+unlink_key $keyring2id @s
+
+# removing again should fail
+unlink_key --fail $keyring2id @s
+expect_error ENOENT
+
+# make another keyring link
+marker "LINK 2ND KEYRING TO SESSION"
+link_key $keyring2id @s
+
+# remove the first keyring we added
+marker "UNLINK KEYRING"
+unlink_key --wait $keyringid @s
+
+# remove the second keyring we added
+marker "UNLINK 2ND KEYRING"
+unlink_key --wait $keyring2id @s
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/listing/bad-args/runtest.sh b/tests/keyctl/listing/bad-args/runtest.sh
new file mode 100644
index 0000000..beb6c99
--- /dev/null
+++ b/tests/keyctl/listing/bad-args/runtest.sh
@@ -0,0 +1,38 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+# check that a bad key ID fails correctly
+marker "CHECK BAD KEY ID"
+list_keyring --fail 0
+expect_error ENOKEY
+pretty_list_keyring --fail 0
+expect_error ENOKEY
+
+# create a non-keyring
+marker "CREATE KEY"
+create_key user lizard gizzard @s
+expect_keyid keyid
+
+# dispose of the key we were using
+marker "UNLINK KEY"
+unlink_key --wait $keyid @s
+
+# check that a non-existent key ID fails correctly
+marker "CHECK NON-EXISTENT KEY ID"
+list_keyring --fail $keyid
+expect_error ENOKEY
+pretty_list_keyring --fail $keyid
+expect_error ENOKEY
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/listing/noargs/runtest.sh b/tests/keyctl/listing/noargs/runtest.sh
new file mode 100644
index 0000000..2d9da99
--- /dev/null
+++ b/tests/keyctl/listing/noargs/runtest.sh
@@ -0,0 +1,23 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+marker "NO ARGS"
+expect_args_error keyctl list
+expect_args_error keyctl rlist
+
+marker "TWO ARGS"
+expect_args_error keyctl list 0 0
+expect_args_error keyctl rlist 0 0
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/listing/valid/runtest.sh b/tests/keyctl/listing/valid/runtest.sh
new file mode 100644
index 0000000..fe67bd4
--- /dev/null
+++ b/tests/keyctl/listing/valid/runtest.sh
@@ -0,0 +1,109 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+# create a keyring and attach it to the session keyring
+marker "ADD KEYRING"
+create_keyring wibble @s
+expect_keyid keyringid
+
+# validate the new keyring's name and type
+marker "VALIDATE KEYRING"
+describe_key $keyringid
+expect_key_rdesc rdesc 'keyring@.*@wibble'
+
+# check that we have an empty keyring
+marker "LIST KEYRING"
+list_keyring $keyringid
+expect_keyring_rlist rlist empty
+
+marker "PRETTY LIST KEYRING"
+pretty_list_keyring $keyringid
+expect_payload payload "keyring is empty"
+
+# stick a key in the keyring
+marker "ADD KEY"
+create_key user lizard gizzard $keyringid
+expect_keyid keyid
+
+# check that we can list it
+marker "LIST KEYRING WITH ONE"
+list_keyring $keyringid
+expect_keyring_rlist rlist $keyid
+
+# check that we can pretty list it
+marker "PRETTY LIST KEYRING WITH ONE"
+pretty_list_keyring $keyringid
+expect_payload payload
+
+if ! expr "$payload" : " *$keyid:.*user: lizard" >&/dev/null
+then
+    failed
+fi
+
+# stick a second key in the keyring
+marker "ADD KEY 2"
+create_key user snake skin $keyringid
+expect_keyid keyid2
+
+# check that we can see both keys
+marker "LIST KEYRING WITH TWO"
+list_keyring $keyringid
+expect_keyring_rlist rlist
+
+if [ "x$rlist" != "x$keyid $keyid2" ]
+then
+    failed
+fi
+
+# check that we can see both keys prettily
+marker "PRETTY LIST KEYRING WITH TWO"
+pretty_list_keyring $keyringid
+prlist=""
+for i in `tail -2 $OUTPUTFILE | cut -d: -f1 | sed -e 's@ +@@g'`
+  do
+  prlist="$prlist $i"
+done
+
+if [ "x$prlist" != "x $keyid $keyid2" ]
+then
+    failed
+fi
+
+# turn off read permission on the keyring
+marker "DISABLE READ PERM"
+set_key_perm $keyringid 0x3d0000
+list_keyring $keyringid
+
+# turn off read and search permission on the keyring
+marker "DISABLE SEARCH PERM"
+set_key_perm $keyringid 0x350000
+list_keyring --fail $keyringid
+expect_error EACCES
+
+# turn on read permission on the keyring
+marker "REINSTATE READ PERM"
+set_key_perm $keyringid 0x370000
+list_keyring $keyringid
+
+# revoke the keyring
+marker "REVOKE KEYRING"
+revoke_key $keyringid
+list_keyring --fail $keyringid
+expect_error EKEYREVOKED
+
+# remove the keyring we added
+marker "UNLINK KEY"
+unlink_key $keyringid @s
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/newring/bad-args/runtest.sh b/tests/keyctl/newring/bad-args/runtest.sh
new file mode 100644
index 0000000..9b0fe01
--- /dev/null
+++ b/tests/keyctl/newring/bad-args/runtest.sh
@@ -0,0 +1,49 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+# check that an max length key description works correctly (4096 inc NUL)
+if [ $PAGE_SIZE -lt $maxsquota ]
+then
+    marker "CHECK MAXLEN DESC"
+    create_keyring $maxdesc @p
+    expect_keyid keyid
+else
+    marker "CHECK MAXLEN DESC FAILS WITH EDQUOT"
+    create_keyring --fail $maxdesc @p
+    expect_error EDQUOT
+fi
+
+# This doesn't work on MIPS earler than 3.19 because of a kernel bug
+kver=`uname -r`
+kmch=`uname -m`
+if kernel_at_or_later_than 3.19 ||
+	[ "$kmch" != "mips" -a "$kmch" != "mips64" ]
+then
+	# check that an overlong key description fails correctly (>4095 inc NUL)
+	marker "CHECK OVERLONG DESC"
+	create_keyring --fail a$maxdesc @p
+	expect_error EINVAL
+fi
+
+# check that an empty keyring name fails
+marker "CHECK EMPTY KEYRING NAME"
+create_keyring --fail "" @p
+expect_error EINVAL
+
+# check that a bad key ID fails correctly
+marker "CHECK BAD KEY ID"
+create_keyring --fail wibble 0
+expect_error EINVAL
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/newring/noargs/runtest.sh b/tests/keyctl/newring/noargs/runtest.sh
new file mode 100644
index 0000000..eedef68
--- /dev/null
+++ b/tests/keyctl/newring/noargs/runtest.sh
@@ -0,0 +1,27 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+# check that no arguments fails correctly
+marker "ADD NO ARGS"
+expect_args_error keyctl newring
+
+# check that one argument fails correctly
+marker "ADD ONE ARG"
+expect_args_error keyctl newring user
+
+# check that three arguments fail correctly
+marker "ADD THREE ARGS"
+expect_args_error keyctl newring user wibble stuff
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/newring/valid/runtest.sh b/tests/keyctl/newring/valid/runtest.sh
new file mode 100644
index 0000000..b89a0d1
--- /dev/null
+++ b/tests/keyctl/newring/valid/runtest.sh
@@ -0,0 +1,61 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+# create a keyring and attach it to the session keyring
+marker "ADD KEYRING"
+create_keyring wibble @s
+expect_keyid keyringid
+
+# check that we now have an empty keyring
+marker "LIST KEYRING"
+list_keyring $keyringid
+expect_keyring_rlist rlist empty
+
+# check that creating a second keyring of the same name displaces the first
+marker "ADD KEYRING AGAIN"
+create_keyring wibble @s
+expect_keyid keyringid2
+
+# should be different keyrings
+if [ "x$keyringid" == "x$keyringid2" ]
+then
+    failed
+fi
+
+# the first should no longer exist in the session keyring
+marker "LIST SESSION KEYRING"
+list_keyring @s
+expect_keyring_rlist sessionrlist $keyringid --absent
+
+# and should no longer be accessible
+marker "VALIDATE NEW KEYRING"
+pause_till_key_destroyed $keyringid
+describe_key --fail $keyringid
+expect_error ENOKEY
+
+# list the session keyring
+marker "LIST SESSION KEYRING2"
+list_keyring @s
+expect_keyring_rlist sessionrlist $keyringid2
+
+# validate the new keyring's name and type
+marker "VALIDATE NEW KEYRING2"
+describe_key $keyringid2
+expect_key_rdesc rdesc 'keyring@.*@wibble'
+
+# remove the keyring we added
+marker "UNLINK KEY"
+unlink_key $keyringid2 @s
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/noargs/runtest.sh b/tests/keyctl/noargs/runtest.sh
new file mode 100644
index 0000000..c00e3e7
--- /dev/null
+++ b/tests/keyctl/noargs/runtest.sh
@@ -0,0 +1,24 @@
+#!/bin/bash
+
+. ../../prepare.inc.sh
+. ../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+marker "CHECK NO ARGS"
+expect_args_error keyctl
+
+if [ "`sed -n -e 3p $OUTPUTFILE | cut -d: -f1`" != "Format" ]
+then
+    failed
+fi
+
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/padd/bad-args/runtest.sh b/tests/keyctl/padd/bad-args/runtest.sh
new file mode 100644
index 0000000..fc82682
--- /dev/null
+++ b/tests/keyctl/padd/bad-args/runtest.sh
@@ -0,0 +1,74 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+# check that an empty key type fails correctly
+marker "CHECK EMPTY KEY TYPE"
+pcreate_key --fail stuff "" wibble @p
+expect_error EINVAL
+
+# check that an unsupported key type fails correctly
+marker "CHECK UNSUPPORTED KEY TYPE"
+pcreate_key --fail stuff lizardsgizzards wibble @p
+expect_error ENODEV
+
+# check that an invalid key type fails correctly
+marker "CHECK INVALID KEY TYPE"
+pcreate_key --fail stuff .user wibble @p
+expect_error EPERM
+
+# check that an maximum length invalid key type fails correctly
+marker "CHECK MAXLEN KEY TYPE"
+pcreate_key --fail stuff $maxtype wibble @p
+expect_error ENODEV
+
+# check that an overlong key type fails correctly
+marker "CHECK OVERLONG KEY TYPE"
+pcreate_key --fail stuff a$maxtype wibble @p
+expect_error EINVAL
+
+# check that creation of a keyring with non-empty payload fails correctly
+marker "CHECK ADD KEYRING WITH PAYLOAD"
+pcreate_key --fail stuff keyring wibble @p
+expect_error EINVAL
+
+# check that an max length key description works correctly
+if [ $PAGE_SIZE -lt $maxsquota ]
+then
+    marker "CHECK MAXLEN DESC"
+    pcreate_key stuff user $maxdesc @p
+    expect_keyid keyid
+else
+    marker "CHECK MAXLEN DESC FAILS WITH EDQUOT"
+    pcreate_key --fail stuff user $maxdesc @p
+    expect_error EDQUOT
+fi
+
+# This doesn't work on MIPS earler than 3.19 because of a kernel bug
+kver=`uname -r`
+kmch=`uname -m`
+if kernel_at_or_later_than 3.19 ||
+	[ "$kmch" != "mips" -a "$kmch" != "mips64" ]
+then
+	# check that an overlong key description fails correctly (>4095 inc NUL)
+	marker "CHECK OVERLONG DESC"
+	pcreate_key --fail stuff user a$maxdesc @p
+	expect_error EINVAL
+fi
+
+# check that a bad key ID fails correctly
+marker "CHECK BAD KEY ID"
+pcreate_key --fail stuff user wibble 0
+expect_error EINVAL
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/padd/noargs/runtest.sh b/tests/keyctl/padd/noargs/runtest.sh
new file mode 100644
index 0000000..5839b07
--- /dev/null
+++ b/tests/keyctl/padd/noargs/runtest.sh
@@ -0,0 +1,31 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+# check that no arguments fails correctly
+marker "ADD NO ARGS"
+expect_args_error keyctl padd
+
+# check that one argument fails correctly
+marker "ADD ONE ARG"
+expect_args_error keyctl padd user
+
+# check that two arguments fail correctly
+marker "ADD TWO ARGS"
+expect_args_error keyctl padd user wibble
+
+# check that four arguments fail correctly
+marker "ADD FOUR ARGS"
+expect_args_error keyctl padd user wibble @s x
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/padd/useradd/runtest.sh b/tests/keyctl/padd/useradd/runtest.sh
new file mode 100644
index 0000000..206a163
--- /dev/null
+++ b/tests/keyctl/padd/useradd/runtest.sh
@@ -0,0 +1,91 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+# check that we can add a user key to the session keyring
+marker "ADD USER KEY"
+pcreate_key stuff user wibble @s
+expect_keyid keyid
+
+# read back what we put in it
+marker "PRINT PAYLOAD"
+print_key $keyid
+expect_payload payload "stuff"
+
+# check that we can update a user key
+marker "UPDATE USER KEY"
+pcreate_key lizard user wibble @s
+
+# check we get the same key ID back
+expect_keyid keyid2
+
+if [ "x$keyid" != "x$keyid2" ]
+then
+    failed
+fi
+
+# read back what we changed it to
+marker "PRINT UPDATED PAYLOAD"
+print_key $keyid
+expect_payload payload "lizard"
+
+# remove the key we added
+marker "UNLINK KEY"
+unlink_key $keyid @s
+
+if [ $skip_root_required = 0 ] && {
+        [ $OSDIST = RHEL ] && ! version_less_than $OSRELEASE 6.6 ||
+        keyutils_at_or_later_than 1.5.6 ;
+        }
+then
+    # add keys with huge payloads
+    old_root_quota=`cat /proc/sys/kernel/keys/root_maxbytes`
+    if [ $old_root_quota -lt 65536 ]
+    then
+	marker "INCREASE QUOTA"
+	echo 65536 >/proc/sys/kernel/keys/root_maxbytes
+    fi
+
+    marker "ADD LARGE USER KEY"
+    pcreate_key_by_size 32767 user large @s
+    expect_keyid keyid
+    md5sum_key $keyid
+    expect_payload payload "f128f774ede3fe931e7c6745c4292f40"
+
+    if [ $have_big_key_type = 1 ]
+    then
+	marker "ADD SMALL BIG KEY"
+	pcreate_key_by_size 128 big_key small @s
+	expect_keyid keyid
+	md5sum_key $keyid
+	expect_payload payload "f09f35a5637839458e462e6350ecbce4"
+
+	marker "ADD HUGE BIG KEY"
+	pcreate_key_by_size $((1024*1024-1)) big_key huge @s
+	expect_keyid keyid
+	md5sum_key $keyid
+	expect_payload payload "e57598cd670284cf7d09e16ed9d4b2ac"
+    fi
+
+    marker "CLEAR KEYRING"
+    clear_keyring @s
+
+    if [ $old_root_quota -lt 65536 ]
+    then
+	marker "RESET QUOTA"
+	echo $old_root_quota >/proc/sys/kernel/keys/root_maxbytes
+	sleep 1
+    fi
+fi
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/permitting/bad-args/runtest.sh b/tests/keyctl/permitting/bad-args/runtest.sh
new file mode 100644
index 0000000..630f85f
--- /dev/null
+++ b/tests/keyctl/permitting/bad-args/runtest.sh
@@ -0,0 +1,49 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+# check that a bad key ID fails correctly
+marker "CHECK BAD KEY ID"
+chown_key --fail 0 0
+expect_error EINVAL
+chgrp_key --fail 0 0
+expect_error EINVAL
+set_key_perm --fail 0 0
+expect_error EINVAL
+
+# create a non-keyring
+marker "CREATE KEY"
+create_key user lizard gizzard @s
+expect_keyid keyid
+
+# check that unsupported permissions aren't permitted
+marker "CHECK PERMS"
+set_key_perm --fail $keyid 0xffffffff
+expect_error EINVAL
+set_key_perm --fail $keyid 0x7f7f7f7f
+expect_error EINVAL
+
+# dispose of the key we just made
+marker "UNLINK KEY"
+unlink_key --wait $keyid @s
+
+# check that a non-existent key ID fails correctly
+marker "CHECK CLEAR NON-EXISTENT KEY ID"
+chown_key --fail $keyid 0
+expect_error ENOKEY
+chgrp_key --fail $keyid 0
+expect_error ENOKEY
+set_key_perm --fail $keyid 0
+expect_error ENOKEY
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/permitting/noargs/runtest.sh b/tests/keyctl/permitting/noargs/runtest.sh
new file mode 100644
index 0000000..5a9408f
--- /dev/null
+++ b/tests/keyctl/permitting/noargs/runtest.sh
@@ -0,0 +1,30 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+marker "NO ARGS"
+expect_args_error keyctl read
+expect_args_error keyctl pipe
+expect_args_error keyctl print
+
+marker "ONE ARG"
+expect_args_error keyctl chown 0
+expect_args_error keyctl chgrp 0
+expect_args_error keyctl setperm 0
+
+marker "THREE ARGS"
+expect_args_error keyctl chown 0 0 0
+expect_args_error keyctl chgrp 0 0 0
+expect_args_error keyctl setperm 0 0 0
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/permitting/valid/runtest.sh b/tests/keyctl/permitting/valid/runtest.sh
new file mode 100644
index 0000000..70600e7
--- /dev/null
+++ b/tests/keyctl/permitting/valid/runtest.sh
@@ -0,0 +1,99 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+# create a keyring and attach it to the session keyring
+marker "ADD KEYRING"
+create_keyring wibble @s
+expect_keyid keyringid
+
+# stick a key in the keyring
+marker "ADD KEY"
+create_key user lizard gizzard $keyringid
+expect_keyid keyid
+
+# changing the key's ownership is not supported before 2.6.18-rc1
+if kernel_older_than 2.6.18
+then
+    marker "CHOWN"
+    chown_key --fail $keyid 1
+    expect_error EOPNOTSUPP
+elif [ `id -u` != 0 ]
+then
+    # must be running as root for this to work
+    marker "CHOWN"
+    chown_key --fail $keyid 1
+    expect_error EACCES
+else
+    marker "CHOWN"
+    chown_key $keyid 1
+
+    marker "CHOWN BACK"
+    chown_key $keyid 0
+fi
+
+# changing the key's group ownership is supported (change to "bin" group)
+if [ `id -u` != 0 ]
+then
+    marker "CHGRP"
+    chgrp_key --fail $keyid 1
+    expect_error EACCES
+else
+    marker "CHGRP"
+    chgrp_key $keyid 1
+    describe_key $keyid
+    expect_key_rdesc rdesc "user@.*@1@[0-9a-f]*@lizard"
+fi
+
+# check that each permission can be granted to the key
+marker "ITERATE PERMISSIONS"
+for i in \
+    00210002 00210004 00210008 00210010 \
+    00210200 00210400 00210800 00211000 \
+    00230000 00250000 00290000 00310000 \
+    02210000 04210000 08210000 10210000
+  do
+  set_key_perm $keyid 0x$i
+  describe_key $keyid
+  expect_key_rdesc rdesc "user@.*@.*@$i@lizard"
+done
+
+# check that we can't use group perms instead of user perms to view the key
+# (our UID matches that of the key)
+marker "VIEW GROUP PERMISSIONS"
+set_key_perm $keyid 0x00201f00
+describe_key --fail $keyid
+expect_error EACCES
+
+# check that we can't use other perms instead of user perms to view the key
+# (our UID matches that of the key)
+marker "VIEW OTHER PERMISSIONS"
+set_key_perm $keyid 0x0020001f
+describe_key --fail $keyid
+expect_error EACCES
+
+# check that taking away setattr permission renders the key immune to setperm
+marker "REMOVE SETATTR"
+set_key_perm $keyid 0x1f1f1f1f
+describe_key $keyid
+expect_key_rdesc rdesc "user@.*@.*@.*@lizard"
+
+marker "REINSTATE SETATTR"
+set_key_perm --fail $keyid 0x3f3f1f1f
+expect_error EACCES
+
+# remove the keyring we added
+marker "UNLINK KEYRING"
+unlink_key $keyringid @s
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/pupdate/bad-args/runtest.sh b/tests/keyctl/pupdate/bad-args/runtest.sh
new file mode 100644
index 0000000..bced352
--- /dev/null
+++ b/tests/keyctl/pupdate/bad-args/runtest.sh
@@ -0,0 +1,39 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+# attempt to update the session keyring
+marker "CHECK UPDATE SESSION KEYRING"
+pupdate_key --fail @s a
+expect_error EOPNOTSUPP
+
+# attempt to update an invalid key
+marker "CHECK UPDATE INVALID KEY"
+pupdate_key --fail 0 a
+expect_error EINVAL
+
+# add a user key to the session keyring for us to play with
+marker "ADD USER KEY"
+create_key user wibble stuff @s
+expect_keyid keyid
+
+# remove the key we just added
+marker "UNLINK KEY"
+unlink_key --wait $keyid @s
+
+# it should fail when we attempt to update it
+marker "UPDATE UNLINKED KEY"
+pupdate_key --fail $keyid @s
+expect_error ENOKEY
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/pupdate/noargs/runtest.sh b/tests/keyctl/pupdate/noargs/runtest.sh
new file mode 100644
index 0000000..d995851
--- /dev/null
+++ b/tests/keyctl/pupdate/noargs/runtest.sh
@@ -0,0 +1,23 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+# check that no arguments fails correctly
+marker "PUPDATE NO ARGS"
+expect_args_error keyctl pupdate
+
+# check that two arguments fail correctly
+marker "PUPDATE TWO ARGS"
+expect_args_error keyctl pupdate yyy xxxx
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/pupdate/userupdate/runtest.sh b/tests/keyctl/pupdate/userupdate/runtest.sh
new file mode 100644
index 0000000..05a77c1
--- /dev/null
+++ b/tests/keyctl/pupdate/userupdate/runtest.sh
@@ -0,0 +1,38 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+# check that we can add a user key to the session keyring
+marker "ADD USER KEY" 
+create_key user wibble stuff @s
+expect_keyid keyid
+
+# read back what we put in it
+marker "PRINT PAYLOAD" 
+print_key $keyid
+expect_payload payload "stuff"
+
+# check that we can update a user key
+marker "PUPDATE USER KEY" 
+pupdate_key $keyid "lizard"
+
+# read back what we changed it to
+marker "PRINT UPDATED PAYLOAD" 
+print_key $keyid
+expect_payload payload "lizard"
+
+# remove the key we added
+marker "UNLINK KEY" 
+unlink_key $keyid @s
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/reading/bad-args/runtest.sh b/tests/keyctl/reading/bad-args/runtest.sh
new file mode 100644
index 0000000..35ce9a3
--- /dev/null
+++ b/tests/keyctl/reading/bad-args/runtest.sh
@@ -0,0 +1,42 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+# check that a bad key ID fails correctly
+marker "CHECK BAD KEY ID"
+read_key --fail 0
+expect_error ENOKEY
+print_key --fail 0
+expect_error ENOKEY
+pipe_key --fail 0
+expect_error ENOKEY
+
+# create a non-keyring
+marker "CREATE KEY"
+create_key user lizard gizzard @s
+expect_keyid keyid
+
+# dispose of the key we just made
+marker "UNLINK KEY"
+unlink_key --wait $keyid @s
+
+# check that a non-existent key ID fails correctly
+marker "CHECK CLEAR NON-EXISTENT KEY ID"
+read_key --fail $keyid
+expect_error ENOKEY
+print_key --fail $keyid
+expect_error ENOKEY
+pipe_key --fail $keyid
+expect_error ENOKEY
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/reading/noargs/runtest.sh b/tests/keyctl/reading/noargs/runtest.sh
new file mode 100644
index 0000000..4053b65
--- /dev/null
+++ b/tests/keyctl/reading/noargs/runtest.sh
@@ -0,0 +1,25 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+marker "NO ARGS"
+expect_args_error keyctl read
+expect_args_error keyctl pipe
+expect_args_error keyctl print
+
+marker "TWO ARGS"
+expect_args_error keyctl read 0 0
+expect_args_error keyctl pipe 0 0
+expect_args_error keyctl print 0 0
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/reading/valid/runtest.sh b/tests/keyctl/reading/valid/runtest.sh
new file mode 100644
index 0000000..8e4d864
--- /dev/null
+++ b/tests/keyctl/reading/valid/runtest.sh
@@ -0,0 +1,96 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+# create a keyring and attach it to the session keyring
+marker "ADD KEYRING"
+create_keyring wibble @s
+expect_keyid keyringid
+
+# stick a key in the keyring
+marker "ADD KEY"
+create_key user lizard gizzard $keyringid
+expect_keyid keyid
+
+# check that the key is in the keyring
+marker "LIST KEYRING"
+list_keyring $keyringid
+expect_keyring_rlist rlist $keyid
+
+# read the contents of the key
+marker "PRINT KEY"
+print_key $keyid
+expect_payload payload "gizzard"
+
+# pipe the contents of the key and add a LF as the key doesn't have one
+marker "PIPE KEY"
+pipe_key $keyid
+echo >>$OUTPUTFILE
+expect_payload payload "gizzard"
+
+# read the key as hex
+marker "READ KEY"
+read_key $keyid
+expect_payload payload "67697a7a 617264"
+
+# read the contents of the keyring as hex and match it to the key ID
+marker "READ KEYRING"
+read_key $keyringid
+tmp=`printf %08x $keyid`
+if [ "$endian" = "LE" ]
+then
+    tmp=`echo $tmp | sed 's/\(..\)\(..\)\(..\)\(..\)/\4\3\2\1/'`
+fi
+expect_payload payload $tmp
+
+# remove read permission from the key and try reading it again
+# - we should still have read permission because it's searchable in our
+#   keyrings
+marker "REMOVE READ PERM"
+set_key_perm $keyid 0x3d0000
+print_key $keyid
+expect_payload payload "gizzard"
+
+# remove search permission from the key as well
+# - we should still have read permission because it's searchable in our
+#   keyrings
+marker "REMOVE SEARCH PERM"
+set_key_perm $keyid 0x350000
+print_key --fail $keyid
+expect_error EACCES
+
+# check that we can read it if we have to rely on possessor perms
+# - we should still have read permission because it's searchable in our
+#   keyrings
+marker "CHECK POSSESSOR READ"
+set_key_perm $keyid 0x3d000000
+print_key $keyid
+expect_payload payload "gizzard"
+
+# put read permission back again
+marker "REINSTATE READ PERM"
+set_key_perm $keyid 0x370000
+print_key $keyid
+expect_payload payload "gizzard"
+
+# revoke the key
+marker "REVOKE KEY"
+revoke_key $keyid
+print_key --fail $keyid
+expect_error EKEYREVOKED
+
+# remove the keyring we added
+marker "UNLINK KEYRING"
+unlink_key $keyringid @s
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/requesting/bad-args/runtest.sh b/tests/keyctl/requesting/bad-args/runtest.sh
new file mode 100644
index 0000000..83c114f
--- /dev/null
+++ b/tests/keyctl/requesting/bad-args/runtest.sh
@@ -0,0 +1,128 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+result=PASS
+if [ $skip_install_required -eq 1 ]
+then
+    echo "++++ SKIPPING TEST" >$OUTPUTFILE
+    marker "SKIP BECAUSE TEST REQUIRES FULL INSTALL (for /sbin/request-key)"
+    toolbox_report_result $TEST PASS
+    exit 0
+else
+    echo "++++ BEGINNING TEST" >$OUTPUTFILE
+fi
+
+# check that an empty key type fails correctly
+marker "CHECK EMPTY KEY TYPE"
+request_key --fail "" debug:wibble
+expect_error EINVAL
+request_key --fail "" debug:wibble @p
+expect_error EINVAL
+request_key_callout --fail "" debug:wibble stuff
+expect_error EINVAL
+request_key_callout --fail "" debug:wibble stuff @p
+expect_error EINVAL
+prequest_key_callout --fail stuff "" debug:wibble
+expect_error EINVAL
+prequest_key_callout --fail stuff "" debug:wibble @p
+expect_error EINVAL
+
+# check that an unsupported key type fails correctly
+marker "CHECK UNSUPPORTED KEY TYPE"
+request_key --fail "lizardsgizzards" debug:wibble
+expect_error ENOKEY
+request_key --fail "lizardsgizzards" debug:wibble @p
+expect_error ENOKEY
+request_key_callout --fail "lizardsgizzards" debug:wibble stuff
+expect_error ENOKEY
+request_key_callout --fail "lizardsgizzards" debug:wibble stuff @p
+expect_error ENOKEY
+prequest_key_callout --fail stuff "lizardsgizzards" debug:wibble
+expect_error ENOKEY
+prequest_key_callout --fail stuff "lizardsgizzards" debug:wibble @p
+expect_error ENOKEY
+
+# check that an invalid key type fails correctly
+# - key types beginning with a dot are internal use only
+marker "CHECK INVALID KEY TYPE"
+request_key --fail ".user" debug:wibble
+expect_error EPERM
+request_key --fail ".user" debug:wibble @p
+expect_error EPERM
+request_key_callout --fail ".user" debug:wibble stuff
+expect_error EPERM
+request_key_callout --fail ".user" debug:wibble stuff @p
+expect_error EPERM
+prequest_key_callout --fail stuff ".user" debug:wibble
+expect_error EPERM
+prequest_key_callout --fail stuff ".user" debug:wibble @p
+expect_error EPERM
+
+# check that an maximum length invalid key type fails correctly
+marker "CHECK MAXLEN INVALID KEY TYPE"
+request_key --fail $maxtype debug:wibble
+expect_error ENOKEY
+request_key --fail $maxtype debug:wibble @p
+expect_error ENOKEY
+request_key_callout --fail $maxtype debug:wibble stuff
+expect_error ENOKEY
+request_key_callout --fail $maxtype debug:wibble stuff @p
+expect_error ENOKEY
+
+# check that an overlong key type fails correctly
+marker "CHECK OVERLONG KEY TYPE"
+request_key --fail a$maxtype debug:wibble
+expect_error EINVAL
+request_key --fail a$maxtype debug:wibble @p
+expect_error EINVAL
+request_key_callout --fail a$maxtype debug:wibble stuff
+expect_error EINVAL
+request_key_callout --fail a$maxtype debug:wibble stuff @p
+expect_error EINVAL
+
+# check that an max length key description works correctly
+marker "CHECK MAXLEN DESC"
+request_key --fail user $maxdesc
+expect_error ENOKEY
+
+# This doesn't work on MIPS earler than 3.19 because of a kernel bug
+kver=`uname -r`
+kmch=`uname -m`
+if kernel_at_or_later_than 3.19 ||
+	[ "$kmch" != "mips" -a "$kmch" != "mips64" ]
+then
+	# check that an overlong key description fails correctly
+	marker "CHECK OVERLONG DESC"
+	request_key --fail user a$maxdesc
+	expect_error EINVAL
+fi
+
+# check that a max length callout info works correctly
+marker "CHECK MAXLEN CALLOUT"
+request_key_callout --fail user wibble $maxdesc @p
+expect_error ENOKEY
+
+# check that an overlong callout info fails correctly
+marker "CHECK OVERLONG CALLOUT"
+request_key_callout --fail user wibble a$maxcall
+expect_error EINVAL
+
+# check that a max length callout info works correctly
+marker "CHECK MAXLEN PIPED CALLOUT"
+prequest_key_callout --fail $maxcall user wibble @p
+expect_error ENOKEY
+
+# check that an overlong callout info fails correctly
+marker "CHECK OVERLONG PIPED CALLOUT"
+prequest_key_callout --fail a$maxcall user wibble
+expect_error EINVAL
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/requesting/noargs/runtest.sh b/tests/keyctl/requesting/noargs/runtest.sh
new file mode 100644
index 0000000..4255122
--- /dev/null
+++ b/tests/keyctl/requesting/noargs/runtest.sh
@@ -0,0 +1,43 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+result=PASS
+if [ $skip_install_required -eq 1 ]
+then
+    echo "++++ SKIPPING TEST" >$OUTPUTFILE
+    marker "SKIP BECAUSE TEST REQUIRES FULL INSTALL (for /sbin/request-key)"
+    toolbox_report_result $TEST PASS
+    exit 0
+else
+    echo "++++ BEGINNING TEST" >$OUTPUTFILE
+fi
+
+marker "NO ARGS"
+expect_args_error keyctl request
+expect_args_error keyctl request2
+expect_args_error keyctl prequest2
+
+marker "ONE ARG"
+expect_args_error keyctl request 0
+expect_args_error keyctl request2 0
+expect_args_error keyctl prequest2 0
+
+marker "TWO ARGS"
+expect_args_error keyctl request2 0 0
+
+marker "FOUR ARGS"
+expect_args_error keyctl request 0 0 0 0
+expect_args_error keyctl prequest2 0 0 0 0
+
+marker "FIVE ARGS"
+expect_args_error keyctl request2 0 0 0 0 0
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/requesting/piped/runtest.sh b/tests/keyctl/requesting/piped/runtest.sh
new file mode 100644
index 0000000..029ae08
--- /dev/null
+++ b/tests/keyctl/requesting/piped/runtest.sh
@@ -0,0 +1,106 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+result=PASS
+if [ $skip_install_required -eq 1 ]
+then
+    echo "++++ SKIPPING TEST" >$OUTPUTFILE
+    marker "SKIP BECAUSE TEST REQUIRES FULL INSTALL (for /sbin/request-key)"
+    toolbox_report_result $TEST PASS
+    exit 0
+else
+    echo "++++ BEGINNING TEST" >$OUTPUTFILE
+fi
+
+set_gc_delay 10
+
+# create a pair of keyrings to play in
+marker "CREATE KEYRINGS"
+create_keyring "sandbox" @s
+expect_keyid keyringid
+
+# check that we can't yet request a non-existent key
+marker "CHECK REQUEST FAILS"
+request_key --fail user lizard $keyringid
+expect_error ENOKEY
+
+# add a user key to the first keyring
+marker "ADD USER KEY"
+create_key user lizard gizzard $keyringid
+expect_keyid keyid
+
+# request the key
+marker "REQUEST KEY"
+request_key user lizard
+expect_keyid keyid2 $keyid
+
+# remove the key from the keyring
+marker "DETACH KEY FROM KEYRING"
+unlink_key $keyid $keyringid
+
+# request a key from /sbin/request-key to the session keyring
+marker "PIPED CALL OUT REQUEST KEY TO SESSION"
+prequest_key_callout gizzard user debug:lizard
+expect_keyid keyid
+
+# should have appeared in the session keyring
+marker "CHECK ATTACHMENT TO SESSION KEYRING"
+list_keyring @s
+expect_keyring_rlist rlist $keyid
+
+# rerequesting should pick up that key again
+marker "REDO PIPED CALL OUT REQUEST KEY TO SESSION"
+prequest_key_callout gizzard user debug:lizard
+expect_keyid keyid2 $keyid
+
+# remove the key from the session
+# - it was installed twice
+#   - once by request_key's keyring arg
+#   - once from the instantiation call
+#   but it will only have one link
+marker "DETACH KEY FROM SESSION"
+unlink_key --wait $keyid @s
+unlink_key --fail $keyid @s
+expect_error ENOKEY
+
+# request a key from /sbin/request-key to the keyring we made
+marker "PIPED CALL OUT REQUEST KEY TO KEYRING"
+prequest_key_callout gizzard user debug:lizard $keyringid
+expect_keyid keyid
+
+# should have appeared once each in the sandbox and session keyrings
+marker "CHECK ATTACHMENT TO KEYRING"
+list_keyring $keyringid
+expect_keyring_rlist rlist $keyid
+
+marker "CHECK ATTACHMENT TO SESSION"
+list_keyring @s
+expect_keyring_rlist rlist $keyid
+
+# rerequesting should pick up that key again
+marker "REDO PIPED CALL OUT REQUEST KEY TO KEYRING"
+prequest_key_callout gizzard user debug:lizard $keyringid
+expect_keyid keyid2 $keyid
+
+# remove the key from the session
+marker "DETACH KEY"
+unlink_key $keyid $keyringid
+unlink_key --wait $keyid @s
+unlink_key --fail $keyid @s
+expect_error ENOKEY
+
+# remove the keyrings we added
+marker "UNLINK KEYRINGS"
+unlink_key $keyringid @s
+
+set_gc_delay $orig_gc_delay
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/requesting/valid/runtest.sh b/tests/keyctl/requesting/valid/runtest.sh
new file mode 100644
index 0000000..e49fb0f
--- /dev/null
+++ b/tests/keyctl/requesting/valid/runtest.sh
@@ -0,0 +1,106 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+result=PASS
+if [ $skip_install_required -eq 1 ]
+then
+    echo "++++ SKIPPING TEST" >$OUTPUTFILE
+    marker "SKIP BECAUSE TEST REQUIRES FULL INSTALL (for /sbin/request-key)"
+    toolbox_report_result $TEST PASS
+    exit 0
+else
+    echo "++++ BEGINNING TEST" >$OUTPUTFILE
+fi
+
+set_gc_delay 10
+
+# create a pair of keyrings to play in
+marker "CREATE KEYRINGS"
+create_keyring "sandbox" @s
+expect_keyid keyringid
+
+# check that we can't yet request a non-existent key
+marker "CHECK REQUEST FAILS"
+request_key --fail user lizard $keyringid
+expect_error ENOKEY
+
+# add a user key to the first keyring
+marker "ADD USER KEY"
+create_key user lizard gizzard $keyringid
+expect_keyid keyid
+
+# request the key
+marker "REQUEST KEY"
+request_key user lizard
+expect_keyid keyid2 $keyid
+
+# remove the key from the keyring
+marker "DETACH KEY FROM KEYRING"
+unlink_key $keyid $keyringid
+
+# request a key from /sbin/request-key to the session keyring
+marker "CALL OUT REQUEST KEY TO SESSION"
+request_key_callout user debug:lizard gizzard
+expect_keyid keyid
+
+# should have appeared in the session keyring
+marker "CHECK ATTACHMENT TO SESSION KEYRING"
+list_keyring @s
+expect_keyring_rlist rlist $keyid
+
+# rerequesting should pick up that key again
+marker "REDO CALL OUT REQUEST KEY TO SESSION"
+request_key_callout user debug:lizard gizzard
+expect_keyid keyid2 $keyid
+
+# remove the key from the session
+# - it was installed twice
+#   - once by request_key's keyring arg
+#   - once from the instantiation call
+#   but it will only have one link
+marker "DETACH KEY FROM SESSION"
+unlink_key --wait $keyid @s
+unlink_key --fail $keyid @s
+expect_error ENOKEY
+
+# request a key from /sbin/request-key to the keyring we made
+marker "CALL OUT REQUEST KEY TO KEYRING"
+request_key_callout user debug:lizard gizzard $keyringid
+expect_keyid keyid
+
+# should have appeared once each in the sandbox and session keyrings
+marker "CHECK ATTACHMENT TO KEYRING"
+list_keyring $keyringid
+expect_keyring_rlist rlist $keyid
+
+marker "CHECK ATTACHMENT TO SESSION"
+list_keyring @s
+expect_keyring_rlist rlist $keyid
+
+# rerequesting should pick up that key again
+marker "REDO CALL OUT REQUEST KEY TO KEYRING"
+request_key_callout user debug:lizard gizzard $keyringid
+expect_keyid keyid2 $keyid
+
+# remove the key from the session
+marker "DETACH KEY"
+unlink_key $keyid $keyringid
+unlink_key --wait $keyid @s
+unlink_key --fail $keyid @s
+expect_error ENOKEY
+
+# remove the keyrings we added
+marker "UNLINK KEYRINGS"
+unlink_key $keyringid @s
+
+set_gc_delay $orig_gc_delay
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/revoke/bad-args/runtest.sh b/tests/keyctl/revoke/bad-args/runtest.sh
new file mode 100644
index 0000000..a6c0082
--- /dev/null
+++ b/tests/keyctl/revoke/bad-args/runtest.sh
@@ -0,0 +1,25 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+# check that a bad key ID fails correctly
+marker "CHECK BAD KEY ID"
+revoke_key --fail 0
+expect_error EINVAL
+
+# check that a non-existent key ID fails correctly
+marker "CHECK NON-EXISTENT KEY ID"
+revoke_key --fail @t
+expect_error ENOKEY
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/revoke/noargs/runtest.sh b/tests/keyctl/revoke/noargs/runtest.sh
new file mode 100644
index 0000000..94e1b7a
--- /dev/null
+++ b/tests/keyctl/revoke/noargs/runtest.sh
@@ -0,0 +1,22 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+# ---- do the actual testing ----
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+# check that no arguments fails correctly
+marker "ADD NO ARGS"
+expect_args_error keyctl revoke
+
+# check that two arguments fail correctly
+marker "ADD TWO ARGS"
+expect_args_error keyctl revoke 0 0
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/revoke/valid/runtest.sh b/tests/keyctl/revoke/valid/runtest.sh
new file mode 100644
index 0000000..55bbbdf
--- /dev/null
+++ b/tests/keyctl/revoke/valid/runtest.sh
@@ -0,0 +1,75 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+# ---- do the actual testing ----
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+# create a keyring and attach it to the session keyring
+marker "ADD KEYRING"
+create_keyring wibble @s
+expect_keyid keyringid
+
+# create a key and attach it to the new keyring
+marker "ADD KEY"
+create_key user lizard gizzard $keyringid
+expect_keyid keyid
+
+# check that we can list the keyring
+marker "LIST KEYRING"
+list_keyring $keyringid
+expect_keyring_rlist ringlist $keyid
+
+# check we can read the key description
+marker "CHECK VALIDATE KEY"
+describe_key $keyid
+expect_key_rdesc kdesc 'user@.*@lizard'
+
+# check we can read the key's payload
+marker "CHECK READ PAYLOAD"
+print_key $keyid
+expect_payload kpayload "gizzard"
+
+# revoke the key
+marker "REVOKE KEY"
+revoke_key $keyid
+
+# check we can no longer read the key description
+marker "CHECK NO VALIDATE KEY"
+describe_key --fail $keyid
+expect_error EKEYREVOKED
+
+# check we can no longer read the key's payload
+marker "CHECK NO READ PAYLOAD"
+print_key --fail $keyid
+expect_error EKEYREVOKED
+
+# remove the key we added
+marker "UNLINK KEY"
+unlink_key $keyid $keyringid
+
+# revoke the keyring
+marker "REVOKE KEYRING"
+revoke_key $keyringid
+
+# listing the session keyring should fail
+marker "CHECK NO LIST SESSION KEYRING"
+list_keyring --fail $keyringid
+expect_error EKEYREVOKED
+
+# validating the new keyring's name and type should also fail
+marker "CHECK NO VALIDATE KEYRING"
+describe_key --fail $keyringid
+expect_error EKEYREVOKED
+
+# remove the keyring we added
+marker "UNLINK KEYRING"
+unlink_key $keyringid @s
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/search/bad-args/runtest.sh b/tests/keyctl/search/bad-args/runtest.sh
new file mode 100644
index 0000000..dfec8dd
--- /dev/null
+++ b/tests/keyctl/search/bad-args/runtest.sh
@@ -0,0 +1,87 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+# check that an empty key type fails correctly
+marker "CHECK EMPTY KEY TYPE"
+search_for_key --fail @s "" wibble
+expect_error EINVAL
+search_for_key --fail @s "" wibble @p
+expect_error EINVAL
+
+# check that an unsupported key type fails correctly
+marker "CHECK UNSUPPORTED KEY TYPE"
+search_for_key --fail @s lizardsgizzards wibble
+expect_error ENOKEY
+search_for_key --fail @s lizardsgizzards wibble @p
+expect_error ENOKEY
+
+# check that an invalid key type fails correctly
+marker "CHECK INVALID KEY TYPE"
+search_for_key --fail @s .user wibble
+expect_error EPERM
+search_for_key --fail @s .user wibble @p
+expect_error EPERM
+
+# check that an overlong key type fails correctly
+marker "CHECK OVERLONG KEY TYPE"
+search_for_key --fail @s $maxtype wibble
+expect_error ENOKEY
+search_for_key --fail @s a$maxtype wibble @p
+expect_error EINVAL
+
+# check that an max length key description works correctly (4095 inc NUL)
+marker "CHECK MAXLEN DESC"
+search_for_key --fail @s user $maxdesc
+expect_error ENOKEY
+
+search_for_key --fail @s user $maxdesc @p
+expect_error ENOKEY
+
+# This doesn't work on MIPS earler than 3.19 because of a kernel bug
+kver=`uname -r`
+kmch=`uname -m`
+if kernel_at_or_later_than 3.19 ||
+	[ "$kmch" != "mips" -a "$kmch" != "mips64" ]
+then
+	# check that an overlong key description fails correctly (>4095 inc NUL)
+	marker "CHECK OVERLONG DESC"
+	search_for_key --fail @s user a$maxdesc
+	expect_error EINVAL
+fi
+
+search_for_key --fail @s user a$maxdesc @p
+expect_error EINVAL
+
+# check that a bad key ID fails correctly
+marker "CHECK BAD KEY ID"
+search_for_key --fail @s user wibble -2000
+expect_error EINVAL
+
+# create a non-keyring key
+marker "CREATE KEY"
+create_key user a a @s
+expect_keyid keyid
+
+# search the non-keyring key
+marker "SEARCH KEY"
+search_for_key --fail $keyid user a
+expect_error ENOTDIR
+search_for_key --fail $keyid user a @p
+expect_error ENOTDIR
+
+# dispose of the key
+marker "UNLINK KEY"
+unlink_key $keyid @s
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/search/noargs/runtest.sh b/tests/keyctl/search/noargs/runtest.sh
new file mode 100644
index 0000000..912d614
--- /dev/null
+++ b/tests/keyctl/search/noargs/runtest.sh
@@ -0,0 +1,31 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+# check that no arguments fails correctly
+marker "NO ARGS"
+expect_args_error keyctl search
+
+# check that one argument fails correctly
+marker "ONE ARGS"
+expect_args_error keyctl search 0
+
+# check that two arguments fails correctly
+marker "TWO ARGS"
+expect_args_error keyctl search 0 0
+
+# check that five arguments fails correctly
+marker "FIVE ARGS"
+expect_args_error keyctl search 0 0 0 0 0
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/search/valid/runtest.sh b/tests/keyctl/search/valid/runtest.sh
new file mode 100644
index 0000000..fb51b21
--- /dev/null
+++ b/tests/keyctl/search/valid/runtest.sh
@@ -0,0 +1,186 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+# create a pair of keyrings and attach them to the session keyring
+marker "ADD KEYRING"
+create_keyring wibble @s
+expect_keyid keyringid
+
+create_keyring wibble2 @s
+expect_keyid keyring2id
+
+# stick a key in the keyring
+marker "ADD KEY"
+create_key user lizard gizzard $keyringid
+expect_keyid keyid
+
+# check that we can list it
+marker "LIST KEYRING WITH ONE"
+list_keyring $keyringid
+expect_keyring_rlist rlist $keyid
+
+# search the session keyring for a non-existent key
+marker "SEARCH SESSION FOR NON-EXISTENT KEY"
+search_for_key --fail @s user snake
+expect_error ENOKEY
+
+# search the session keyring for the key
+marker "SEARCH SESSION"
+search_for_key @s user lizard
+expect_keyid found $keyid
+
+# search the session keyring for the key and attach to second keyring
+marker "SEARCH SESSION AND ATTACH"
+search_for_key @s user lizard $keyring2id
+expect_keyid found $keyid
+
+# check it's attached to the second keyring
+marker "CHECK ATTACHED"
+list_keyring $keyring2id
+expect_keyring_rlist rlist $keyid
+
+# check the key contains what we expect
+marker "CHECK PAYLOAD"
+print_key $keyid
+expect_payload payload "gizzard"
+
+# detach the attachment just made
+marker "DETACH KEY"
+unlink_key $found $keyring2id
+
+# create an overlapping key in the second keyring
+create_key user lizard skin $keyring2id
+expect_keyid keyid2
+
+# check the two keys contain what we expect
+marker "CHECK PAYLOADS"
+print_key $keyid
+expect_payload payload "gizzard"
+print_key $keyid2
+expect_payload payload "skin"
+
+# a search from the session keyring should find the first key
+marker "SEARCH SESSION AGAIN"
+search_for_key @s user lizard
+expect_keyid found $keyid
+
+# a search from the first keyring should find the first key
+marker "SEARCH FIRST KEYRING"
+search_for_key $keyringid user lizard
+expect_keyid found $keyid
+
+# a search from the second keyring should find the second key
+marker "SEARCH SECOND KEYRING"
+search_for_key $keyring2id user lizard
+expect_keyid found $keyid2
+
+# link the second keyring to the first
+marker "LINK FIRST KEYRING TO SECOND"
+link_key $keyring2id $keyringid
+
+# a search from the first keyring should again find the first key
+marker "SEARCH FIRST KEYRING AGAIN"
+search_for_key $keyringid user lizard
+expect_keyid found $keyid
+
+# revoking the first key should cause the second key to be available
+revoke_key $keyid
+search_for_key $keyringid user lizard
+expect_keyid found $keyid2
+
+# get rid of the dead key
+marker "UNLINK FIRST KEY"
+unlink_key $keyid $keyringid
+
+# a search from the first keyring should now find the second key
+marker "SEARCH FIRST KEYRING AGAIN 2"
+search_for_key $keyringid user lizard
+expect_keyid found $keyid2
+
+# a search from the session keyring should now find the second key
+marker "SEARCH SESSION KEYRING AGAIN 2"
+search_for_key @s user lizard
+expect_keyid found $keyid2
+
+# unlink the second keyring from the first
+marker "UNLINK SECOND KEYRING FROM FIRST"
+unlink_key $keyring2id $keyringid
+
+# a search from the first keyring should now fail
+marker "SEARCH FIRST KEYRING FOR FAIL"
+search_for_key --fail $keyringid user lizard
+expect_error ENOKEY
+
+# a search from the session keyring should still find the second key
+marker "SEARCH SESSION KEYRING AGAIN 3"
+search_for_key @s user lizard
+expect_keyid found $keyid2
+
+# move the second keyring into the first
+marker "MOVE SECOND KEYRING INTO FIRST"
+link_key $keyring2id $keyringid
+unlink_key $keyring2id @s
+
+# a search from the first keyring should now find the second key once again
+marker "SEARCH FIRST KEYRING AGAIN 4"
+search_for_key $keyringid user lizard
+expect_keyid found $keyid2
+
+# removing search permission on the second keyring should hide the key
+marker "SEARCH WITH NO-SEARCH KEYRING"
+set_key_perm $keyring2id 0x370000
+search_for_key --fail $keyringid user lizard
+expect_error ENOKEY
+
+# putting search permission on the second keyring back again should make it
+# available again
+set_key_perm $keyring2id 0x3f0000
+search_for_key $keyringid user lizard
+expect_keyid found $keyid2
+
+# removing search permission on the second key should hide the key
+marker "SEARCH WITH NO-SEARCH KEYRING2"
+set_key_perm $keyring2id 0x370000
+search_for_key --fail $keyringid user lizard
+expect_error ENOKEY
+
+# putting search permission on the second key back again should make it
+# available again
+set_key_perm $keyring2id 0x3f0000
+search_for_key $keyringid user lizard
+expect_keyid found $keyid2
+
+# revoking the key should make the key unavailable
+revoke_key $keyid2
+search_for_key --fail $keyringid user lizard
+kver=`uname -r`
+case $kver in
+    *.el7*)
+	expect_error EKEYREVOKED
+	;;
+    *)
+	if kernel_older_than 3.13
+	then
+	    expect_error ENOKEY
+	else
+	    expect_error EKEYREVOKED
+	fi
+	;;
+esac
+
+# remove the keyrings we added
+marker "UNLINK KEYRING"
+unlink_key $keyringid @s
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/session/bad-args/runtest.sh b/tests/keyctl/session/bad-args/runtest.sh
new file mode 100644
index 0000000..8bae0d4
--- /dev/null
+++ b/tests/keyctl/session/bad-args/runtest.sh
@@ -0,0 +1,32 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+# check that an empty keyring name fails correctly
+marker "SESSION WITH EMPTY KEYRING NAME"
+new_session --fail ""
+expect_error EINVAL
+
+# This doesn't work on MIPS earler than 3.19 because of a kernel bug
+kver=`uname -r`
+kmch=`uname -m`
+if kernel_at_or_later_than 3.19 ||
+	[ "$kmch" != "mips" -a "$kmch" != "mips64" ]
+then
+	# check that an overlong keyring name fails correctly
+	marker "SESSION WITH OVERLONG KEYRING NAME"
+	new_session --fail a$maxdesc
+	expect_error EINVAL
+fi
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/session/valid/runtest.sh b/tests/keyctl/session/valid/runtest.sh
new file mode 100644
index 0000000..4c83131
--- /dev/null
+++ b/tests/keyctl/session/valid/runtest.sh
@@ -0,0 +1,42 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+# describe the keyring created for an anonymous session
+if [ $OSDIST = RHEL ] && version_less_than $OSRELEASE 6
+then
+    marker "ANON SESSION"
+    new_session - keyctl rdescribe @s "@"
+    expect_key_rdesc rdesc "keyring@.*@.*@.*@_ses[^@]*\$"
+
+    # check the session keyring ID is shown
+    seskeyring="`tail -2 $OUTPUTFILE | head -1`"
+    if ! expr "$seskeyring" : "Joined session keyring: [0-9]*" >&/dev/null
+    then
+	failed
+    fi
+fi
+
+# describe the keyring created for a named session
+marker "NAMED SESSION"
+new_session qwerty keyctl rdescribe @s "@"
+expect_key_rdesc rdesc "keyring@.*@.*@.*@qwerty"
+
+# check the session keyring ID is shown
+seskeyring="`tail -2 $OUTPUTFILE | head -1`"
+if ! expr "$seskeyring" : "Joined session keyring: [0-9]*" >&/dev/null
+then
+    failed
+fi
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/show/noargs/runtest.sh b/tests/keyctl/show/noargs/runtest.sh
new file mode 100644
index 0000000..d507271
--- /dev/null
+++ b/tests/keyctl/show/noargs/runtest.sh
@@ -0,0 +1,51 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+# check that show shows us our session keyring
+marker "SHOW SESSION KEYRING"
+keyctl show >>$OUTPUTFILE 2>&1
+if [ $? != 0 ]
+then
+    failed
+fi
+
+# must be at least two lines in the output (plus the test banner lines)
+nlines=`wc -l $OUTPUTFILE | cut -d\  -f1`
+if [ "$nlines" -lt 4 ]
+then
+    failed
+fi
+
+# there must be a session keyring section on the third line
+if [ "`sed -n -e 3p $OUTPUTFILE`" != "Session Keyring" ]
+then
+    failed
+fi
+
+# the first key listed (line 2) should be a keying (the session keyring) ...
+keyring1="`grep -n keyring $OUTPUTFILE | cut -d: -f1 | head -1`"
+if [ "$keyring1" != "4" ]
+then
+    failed
+fi
+
+# ... and it should be the session keyring
+keyring1name="`sed -n -e 4p $OUTPUTFILE | awk '{print $6}'`"
+if ! expr "$keyring1name" : "^RHTS/keyctl" >&/dev/null
+then
+    failed
+fi
+
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/show/valid/runtest.sh b/tests/keyctl/show/valid/runtest.sh
new file mode 100644
index 0000000..cbdd85f
--- /dev/null
+++ b/tests/keyctl/show/valid/runtest.sh
@@ -0,0 +1,84 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+# add some keyrings, nested one inside the other
+nr_keyrings=7
+keyrings=
+parent=@s
+for ((i=1; i<=$nr_keyrings; i++))
+do
+    marker "ADD KEYRING $i"
+    create_keyring wibble$i $parent
+    expect_keyid keyringid
+    parent=$keyringid
+    keyrings="$keyrings $keyringid"
+done
+
+# check that show works
+marker "SHOW SESSION KEYRING"
+keyctl show >>$OUTPUTFILE 2>&1
+if [ $? != 0 ]
+then
+    failed
+fi
+
+if [ $OSDIST = RHEL ] && ! version_less_than $OSRELEASE 6.6 ||
+   keyutils_at_or_later_than 1.5.6
+then
+    # should be eight lines in the output (banner + session + 6 keyrings)
+    marker "COUNT LINES"
+    nlines=`keyctl show | wc -l`
+    if [ "$nlines" -ne $(($nr_keyrings + 2)) ]
+    then
+	failed
+    fi
+
+    # check the key ID list
+    marker "CHECK KEY ID LIST"
+    keyids=`keyctl show | tail -n +3 | cut -c1-11`
+
+    # we need to fix up the whitespace
+    keyids=`echo $keyids`
+    keyrings=`echo $keyrings`
+
+    echo "Compare '$keyids'" >>$OUTPUTFILE
+    echo "And     '$keyrings'" >>$OUTPUTFILE
+    if [ "$keyids" != "$keyrings" ]
+    then
+	failed
+    fi
+fi
+
+# check that shows of specified keyrings also work
+if keyutils_at_or_later_than 1.5.4
+then
+    declare -i j
+    j=$nr_keyrings
+    for i in $keyrings
+    do
+	marker "CHECK SHOW OTHERS $j"
+	echo --- $i >>$OUTPUTFILE
+	if ! keyctl show $i >>$OUTPUTFILE
+	then
+	    failed
+	fi
+	k=`keyctl show $i | wc -l`
+	if [ $(($j + 1)) != $k ]
+	then
+	    failed
+	fi
+	j=$(($j - 1))
+    done
+fi
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/timeout/bad-args/runtest.sh b/tests/keyctl/timeout/bad-args/runtest.sh
new file mode 100644
index 0000000..a93cd2d
--- /dev/null
+++ b/tests/keyctl/timeout/bad-args/runtest.sh
@@ -0,0 +1,34 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+# check that a bad key ID fails correctly
+marker "CHECK BAD KEY ID"
+timeout_key --fail 0 10
+expect_error EINVAL
+
+# get a key
+marker "CREATE KEY"
+create_key user a a @s
+expect_keyid keyid
+
+# dispose of the key so we can use its ID
+marker "DESTROY KEY ID"
+unlink_key --wait $keyid @s
+
+# check that a non-existent key ID fails correctly
+marker "CHECK NON-EXISTENT KEY ID"
+timeout_key --fail $keyid 10
+expect_error ENOKEY
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/timeout/noargs/runtest.sh b/tests/keyctl/timeout/noargs/runtest.sh
new file mode 100644
index 0000000..a2e730f
--- /dev/null
+++ b/tests/keyctl/timeout/noargs/runtest.sh
@@ -0,0 +1,26 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+# ---- do the actual testing ----
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+# check that no arguments fails correctly
+marker "ADD NO ARGS"
+expect_args_error keyctl timeout
+
+# check that one argument fails correctly
+marker "ADD ONE ARG"
+expect_args_error keyctl timeout 0
+
+# check that three arguments fail correctly
+marker "ADD THREE ARGS"
+expect_args_error keyctl timeout 0 0 0
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/timeout/valid/runtest.sh b/tests/keyctl/timeout/valid/runtest.sh
new file mode 100644
index 0000000..4d772bb
--- /dev/null
+++ b/tests/keyctl/timeout/valid/runtest.sh
@@ -0,0 +1,130 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+# ---- do the actual testing ----
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+# create a keyring and attach it to the session keyring
+marker "ADD KEYRING"
+create_keyring wibble @s
+expect_keyid keyringid
+
+# create a key and attach it to the new keyring
+marker "ADD KEY"
+create_key user lizard gizzard $keyringid
+expect_keyid keyid
+
+# check that we can list the keyring
+marker "LIST KEYRING"
+list_keyring $keyringid
+expect_keyring_rlist ringlist $keyid
+
+# check we can read the key description
+marker "CHECK VALIDATE KEY"
+describe_key $keyid
+expect_key_rdesc kdesc 'user@.*@lizard'
+
+# check we can read the key's payload
+marker "CHECK READ PAYLOAD"
+print_key $keyid
+expect_payload kpayload "gizzard"
+
+# set a silly timeout on the key
+marker "SET BIG TIMEOUT"
+timeout_key $keyid 10000000
+
+# check we can still read the key's payload
+marker "CHECK READ PAYLOAD 2"
+print_key $keyid
+expect_payload kpayload "gizzard"
+
+# set a small timeout on the key
+marker "SET SMALL TIMEOUT"
+timeout_key $keyid 2
+
+marker "WAIT FOR TIMEOUT"
+sleep_at_least 2
+
+# check the key has expired
+marker "CHECK NO READ PAYLOAD"
+print_key --fail $keyid
+if kernel_at_or_later_than 3.8 && kernel_older_than 3.13 &&
+	! rhel7_kernel_at_or_later_than 3.10.0-42.el7
+then
+	expect_error ENOKEY
+else
+	expect_error EKEYEXPIRED
+fi
+
+# check revocation doesn't work
+marker "CHECK NO REVOKE KEY"
+revoke_key --fail $keyid
+expect_error EKEYEXPIRED
+
+# check timeout setting doesn't work
+marker "CHECK NO TIMEOUT KEY"
+timeout_key --fail $keyid 20
+expect_error EKEYEXPIRED
+
+# remove the key we added
+marker "UNLINK KEY"
+unlink_key $keyid $keyringid
+
+###############################################################################
+# create a key and attach it to the new keyring
+marker "ADD KEY"
+create_key user lizard gizzard $keyringid
+expect_keyid keyid
+
+# set a silly timeout on the key
+marker "SET BIG TIMEOUT"
+timeout_key $keyid 10000000
+
+# revoke the key
+marker "REVOKE KEY"
+revoke_key $keyid
+
+# check we can no longer set the key's timeout
+marker "CHECK NO SET KEY TIMEOUT"
+timeout_key --fail $keyid 20
+expect_error EKEYREVOKED
+
+# remove the key we added
+marker "UNLINK KEY"
+unlink_key $keyid $keyringid
+
+# revoke the keyring
+marker "TIMEOUT KEYRING"
+timeout_key $keyringid 1
+
+marker "WAIT FOR KEYRING TIMEOUT"
+sleep_at_least 1
+
+# listing the session keyring should fail
+marker "CHECK NO LIST SESSION KEYRING"
+list_keyring --fail $keyringid
+if kernel_at_or_later_than 3.8 && kernel_older_than 3.13 &&
+	! rhel7_kernel_at_or_later_than 3.10.0-42.el7
+then
+	expect_error ENOKEY
+else
+	expect_error EKEYEXPIRED
+fi
+
+# validating the new keyring's name and type should also fail
+marker "CHECK NO VALIDATE KEYRING"
+describe_key --fail $keyringid
+expect_error EKEYEXPIRED
+
+# remove the keyring we added
+marker "UNLINK KEYRING"
+unlink_key $keyringid @s
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/unlink/all/runtest.sh b/tests/keyctl/unlink/all/runtest.sh
new file mode 100644
index 0000000..24aaa3f
--- /dev/null
+++ b/tests/keyctl/unlink/all/runtest.sh
@@ -0,0 +1,103 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+result=PASS
+
+if keyutils_at_or_later_than 1.5
+then
+    echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+    # create a keyring and attach it to the session keyring
+    marker "ADD KEYRING"
+    create_keyring wibble @s
+    expect_keyid keyringid
+
+    # stick a key in the keyring
+    marker "ADD KEY"
+    create_key user lizard gizzard $keyringid
+    expect_keyid keyid
+
+    # check that we can list it
+    marker "LIST KEYRING WITH ONE"
+    list_keyring $keyringid
+    expect_keyring_rlist rlist $keyid
+
+    # dispose of the key and make sure it gets destroyed
+    marker "UNLINK KEY FROM KEYRING"
+    unlink_key --wait $keyid $keyringid
+
+    # trying a tree-wide unlink should succeed with no links removed
+    marker "CHECK NO UNLINK KEY FROM TREE"
+    unlink_key $keyid
+    expect_unlink_count n_unlinked 0
+
+    # check that the keyring is now empty 
+    marker "LIST KEYRING"
+    list_keyring $keyringid
+    expect_keyring_rlist rlist empty
+
+    # create a key to be massively linked
+    marker "ADD MULTI KEY"
+    create_key user lizard gizzard $keyringid
+    expect_keyid keyid
+
+    # stick twenty keyrings in the keyring with twenty links
+    marker "ADD TWENTY KEYRINGS WITH LINKS"
+    subrings=
+    for ((i=0; i<20; i++))
+    do
+	create_keyring ring$i $keyringid
+	expect_keyid x
+	keys="$keys $x"
+	subrings="$subrings $x"
+	list_keyring $keyringid
+	expect_keyring_rlist rlist $x
+
+	link_key $keyid $x
+	list_keyring $x
+	expect_keyring_rlist rlist $keyid
+    done
+
+    marker "SHOW"
+    if ! keyctl show >>$OUTPUTFILE 2>&1
+    then
+        failed
+    fi
+
+    # delete all the keys from the keyring tree
+    marker "REMOVE ALL LINKS TO KEY"
+    unlink_key $keyid
+    expect_unlink_count n_unlinked 21
+
+    # there should not now be any left
+    unlink_key $keyid
+    expect_unlink_count n_unlinked 0
+
+    # check that the key is no longer in the main keyring
+    marker "CHECK GONE"
+    list_keyring $keyringid
+    expect_keyring_rlist rlist $keyid --absent
+
+    for i in $subrings
+    do
+	list_keyring $i
+	expect_keyring_rlist rlist $keyid --absent
+    done
+
+    # remove the keyring we added
+    marker "UNLINK KEY"
+    unlink_key $keyringid @s
+
+    echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+else
+    toolbox_skip_test $TEST "SKIPPING TEST DUE TO LACK OF UNLINK-ALL"
+    exit 0
+fi
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/unlink/bad-args/runtest.sh b/tests/keyctl/unlink/bad-args/runtest.sh
new file mode 100644
index 0000000..67cc498
--- /dev/null
+++ b/tests/keyctl/unlink/bad-args/runtest.sh
@@ -0,0 +1,47 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+# check that a bad key ID fails correctly
+marker "CHECK UNLINK BAD KEY ID"
+unlink_key --fail 0 @s
+expect_error EINVAL
+
+marker "CHECK UNLINK FROM BAD KEY ID"
+unlink_key --fail @s 0
+expect_error EINVAL
+
+# create a non-keyring
+marker "CREATE KEY"
+create_key user lizard gizzard @s
+expect_keyid keyid
+
+# check that unlinking from a non-keyring ID fails correctly
+marker "CHECK UNLINK FROM NON-KEYRING KEY"
+unlink_key --fail @s $keyid
+expect_error ENOTDIR
+
+# dispose of the key we were using
+marker "UNLINK KEY"
+unlink_key --wait $keyid @s
+
+# check that a non-existent key ID fails correctly
+marker "CHECK UNLINK FROM NON-EXISTENT KEY ID"
+unlink_key --fail @s $keyid
+expect_error ENOKEY
+
+marker "CHECK UNLINK NON-EXISTENT KEY ID"
+unlink_key --fail $keyid @s
+expect_error ENOKEY
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/unlink/noargs/runtest.sh b/tests/keyctl/unlink/noargs/runtest.sh
new file mode 100644
index 0000000..e1baf1f
--- /dev/null
+++ b/tests/keyctl/unlink/noargs/runtest.sh
@@ -0,0 +1,30 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+# check that no arguments fails correctly
+marker "NO ARGS"
+expect_args_error keyctl unlink
+
+if keyutils_older_than 1.5
+then
+    # check that one argument fails correctly
+    marker "ONE ARGS"
+    expect_args_error keyctl unlink 0
+fi
+
+# check that three arguments fails correctly
+marker "THREE ARGS"
+expect_args_error keyctl unlink 0 0 0
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/unlink/valid/runtest.sh b/tests/keyctl/unlink/valid/runtest.sh
new file mode 100644
index 0000000..9b9fa2e
--- /dev/null
+++ b/tests/keyctl/unlink/valid/runtest.sh
@@ -0,0 +1,99 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+# create a keyring and attach it to the session keyring
+marker "ADD KEYRING"
+create_keyring wibble @s
+expect_keyid keyringid
+
+# stick a key in the keyring
+marker "ADD KEY"
+create_key user lizard gizzard $keyringid
+expect_keyid keyid
+
+# check that we can list it
+marker "LIST KEYRING WITH ONE"
+list_keyring $keyringid
+expect_keyring_rlist rlist $keyid
+
+# dispose of the key and make sure it gets destroyed
+marker "UNLINK KEY FROM KEYRING"
+unlink_key --wait $keyid $keyringid
+
+# trying again should fail
+marker "CHECK NO UNLINK KEY FROM KEYRING"
+unlink_key --fail $keyid $keyringid
+expect_error ENOKEY
+
+# check that the keyring is now empty 
+marker "LIST KEYRING"
+list_keyring $keyringid
+expect_keyring_rlist rlist empty
+
+# stick twenty keys and twenty keyrings in the keyring
+marker "ADD TWENTY KEYS"
+keys=""
+for ((i=0; i<20; i++))
+  do
+  create_key user lizard$i gizzard$i $keyringid
+  expect_keyid x
+  keys="$keys $x"
+  list_keyring $keyringid
+  expect_keyring_rlist rlist $x
+done
+
+marker "ADD TWENTY KEYRINGS"
+for ((i=0; i<20; i++))
+  do
+  create_keyring ring$i $keyringid
+  expect_keyid x
+  keys="$keys $x"
+  list_keyring $keyringid
+  expect_keyring_rlist rlist $x
+done
+
+marker "CHECK KEYRING CONTENTS"
+list_keyring $keyringid
+for i in $keys
+do
+    expect_keyring_rlist rlist $i
+done
+
+marker "SHOW"
+if ! keyctl show >>$OUTPUTFILE 2>&1
+then
+    failed
+fi
+
+# delete all the keys from the keyring
+marker "DELETE CONTENTS OF KEYRING"
+for i in $keys
+  do
+  unlink_key --wait $i $keyringid
+  unlink_key --fail $i $keyringid
+  expect_error ENOKEY
+done
+
+keyctl show
+
+# check that it's now empty 
+marker "LIST KEYRING"
+list_keyring $keyringid
+expect_keyring_rlist rlist empty
+
+# remove the keyring we added
+marker "UNLINK KEY"
+unlink_key $keyringid @s
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/update/bad-args/runtest.sh b/tests/keyctl/update/bad-args/runtest.sh
new file mode 100644
index 0000000..14e7a19
--- /dev/null
+++ b/tests/keyctl/update/bad-args/runtest.sh
@@ -0,0 +1,39 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+# attempt to update the session keyring
+marker "CHECK UPDATE SESSION KEYRING"
+update_key --fail @s a
+expect_error EOPNOTSUPP
+
+# attempt to update an invalid key
+marker "CHECK UPDATE INVALID KEY"
+update_key --fail 0 a
+expect_error EINVAL
+
+# add a user key to the session keyring for us to play with
+marker "ADD USER KEY"
+create_key user wibble stuff @s
+expect_keyid keyid
+
+# remove the key we just added
+marker "UNLINK KEY"
+unlink_key --wait $keyid @s
+
+# it should fail when we attempt to update it
+marker "UPDATE UNLINKED KEY"
+update_key --fail $keyid @s
+expect_error ENOKEY
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/update/noargs/runtest.sh b/tests/keyctl/update/noargs/runtest.sh
new file mode 100644
index 0000000..8e570b9
--- /dev/null
+++ b/tests/keyctl/update/noargs/runtest.sh
@@ -0,0 +1,27 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+# check that no arguments fails correctly
+marker "ADD NO ARGS"
+expect_args_error keyctl update
+
+# check that one argument fails correctly
+marker "ADD ONE ARG"
+expect_args_error keyctl update user
+
+# check that three arguments fail correctly
+marker "ADD THREE ARGS"
+expect_args_error keyctl update user wibble stuff
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/keyctl/update/userupdate/runtest.sh b/tests/keyctl/update/userupdate/runtest.sh
new file mode 100644
index 0000000..ddc7cd4
--- /dev/null
+++ b/tests/keyctl/update/userupdate/runtest.sh
@@ -0,0 +1,38 @@
+#!/bin/bash
+
+. ../../../prepare.inc.sh
+. ../../../toolbox.inc.sh
+
+
+# ---- do the actual testing ----
+
+result=PASS
+echo "++++ BEGINNING TEST" >$OUTPUTFILE
+
+# check that we can add a user key to the session keyring
+marker "ADD USER KEY" 
+create_key user wibble stuff @s
+expect_keyid keyid
+
+# read back what we put in it
+marker "PRINT PAYLOAD" 
+print_key $keyid
+expect_payload payload "stuff"
+
+# check that we can update a user key
+marker "UPDATE USER KEY" 
+update_key $keyid "lizard"
+
+# read back what we changed it to
+marker "PRINT UPDATED PAYLOAD" 
+print_key $keyid
+expect_payload payload "lizard"
+
+# remove the key we added
+marker "UNLINK KEY" 
+unlink_key $keyid @s
+
+echo "++++ FINISHED TEST: $result" >>$OUTPUTFILE
+
+# --- then report the results in the database ---
+toolbox_report_result $TEST $result
diff --git a/tests/prepare.inc.sh b/tests/prepare.inc.sh
new file mode 100644
index 0000000..9a663c0
--- /dev/null
+++ b/tests/prepare.inc.sh
@@ -0,0 +1,120 @@
+# preparation script for running keyring tests
+
+# Find the relative path from pwd to the directory holding this file
+includes=${BASH_SOURCE[0]}
+includes=${includes%/*}/
+
+# --- need to run in own session keyring
+if [ "x`keyctl rdescribe @s | sed 's/.*;//'`" != "xRHTS/keyctl/$$" ]
+then
+    echo "Running with session keyring RHTS/keyctl/$$"
+    exec keyctl session "RHTS/keyctl/$$" bash $0 $@ || exit 8
+fi
+
+# Set up for the Red Hat Test System
+RUNNING_UNDER_RHTS=0
+if [ -x /usr/bin/rhts_environment.sh ]
+then
+    PACKAGE=$(rpm -q --qf "%{name}" --whatprovides /bin/keyctl)
+    . /usr/bin/rhts_environment.sh
+    RUNNING_UNDER_RHTS=1
+elif [ -z "$OUTPUTFILE" ]
+then
+    OUTPUTFILE=$PWD/test.out
+    echo -n >$OUTPUTFILE
+fi
+
+case `lsb_release -i -s` in
+    Fedora*)		OSDIST=Fedora;;
+    RedHatEnterprise*)	OSDIST=RHEL;;
+    *)			OSDIST=Unknown;;
+esac
+
+OSRELEASE=`lsb_release -r -s`
+
+KEYUTILSVER=`keyctl --version 2>/dev/null`
+if [ -n "$KEYUTILSVER" ]
+then
+    :
+elif [ -x /bin/rpm ]
+then
+    KEYUTILSVER=`rpm -q keyutils`
+else
+    echo "Can't determine keyutils version" >&2
+    exit 9
+fi
+
+echo "keyutils version: $KEYUTILSVER"
+KEYUTILSVER=`expr "$KEYUTILSVER" : '.*keyutils-\([0-9.]*\).*'`
+
+. $includes/version.inc.sh
+
+KERNELVER=`uname -r`
+
+#
+# Make sure the TEST envvar is set.
+#
+if [ -z "$TEST" ]
+then
+    p=`pwd`
+    case $p in
+	*/keyctl/*)
+	    TEST=keyctl/${p#*/keyctl/}
+	    ;;
+	*/bugzillas/*)
+	    TEST=bugzillas/${p#*/bugzillas/}
+	    ;;
+	*)
+	    TEST=unknown
+	    ;;
+    esac
+fi
+
+#
+# Work out whether key invalidation is supported by the kernel
+#
+have_key_invalidate=0
+if keyutils_at_or_later_than 1.5.6 && kernel_at_or_later_than 3.5-rc1
+then
+    have_key_invalidate=1
+fi
+
+#
+# Work out whether the big_key type is supported by the kernel
+#
+have_big_key_type=0
+if [ $OSDIST = RHEL ] && ! version_less_than $OSRELEASE 7
+then
+    # big_key is backported to 3.10 for RHEL-7
+    have_big_key_type=1
+elif kernel_at_or_later_than 3.13-rc1
+then
+    have_big_key_type=1
+fi
+
+#
+# Work out whether Diffie-Hellman is supported by the kernel
+#
+have_dh_compute=0
+if keyutils_at_or_later_than 1.5.10 && kernel_at_or_later_than 4.7-rc1
+then
+    have_dh_compute=1
+fi
+
+#
+# Check if skipping of tests requiring root was requested
+#
+skip_root_required=0
+if [ "$SKIPROOTREQ" = "yes" ]
+then
+    skip_root_required=1
+fi
+
+#
+# Check if skipping of tests requiring installation was requested
+#
+skip_install_required=0
+if [ "$SKIPINSTALLREQ" = "yes" ]
+then
+    skip_install_required=1
+fi
diff --git a/tests/runtest.sh b/tests/runtest.sh
new file mode 100644
index 0000000..b6eaa7c
--- /dev/null
+++ b/tests/runtest.sh
@@ -0,0 +1,35 @@
+#!/bin/bash
+
+# set the $AUTOMATED environment variable to non-zero for automated mode
+# automated mode will run all the tests to completion
+# non-automated mode (default) stops running the test suite on the first error
+AUTOMATED=${AUTOMATED:-0}
+
+TESTS=$*
+
+PARENTTEST=${TEST}
+
+if [ `id -u` != 0 ]
+then
+    echo "#### Some tests require root privileges." >&2
+    echo "#### It is recommended that this be run as root." >&2
+fi
+
+for i in ${TESTS}; do
+    export TEST=$i
+    pushd $i >/dev/null
+    echo "### RUNNING TEST $i"
+    if [[ $AUTOMATED != 0 ]] ; then
+        bash ./runtest.sh
+    else
+        bash ./runtest.sh || exit 1
+    fi
+    popd >/dev/null
+done
+
+if [ `id -u` != 0 ]
+then
+    echo "#### Some tests required root privileges." >&2
+    echo "#### They have been tested for the appropriate failure." >&2
+    echo "#### It is recommended that this be run as root." >&2
+fi
diff --git a/tests/toolbox.inc.sh b/tests/toolbox.inc.sh
new file mode 100644
index 0000000..7f19a02
--- /dev/null
+++ b/tests/toolbox.inc.sh
@@ -0,0 +1,1136 @@
+###############################################################################
+#
+# Copyright (C) 2005 Red Hat, Inc. All Rights Reserved.
+# Written by David Howells (dhowells@redhat.com)
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version
+# 2 of the License, or (at your option) any later version.
+#
+###############################################################################
+
+echo === $OUTPUTFILE ===
+
+endian=`file -L /proc/$$/exe`
+if expr "$endian" : '.* MSB \+\(executable\|shared object).*' >&/dev/null
+then
+    endian=BE
+elif expr "$endian" : '.* LSB \+\(executable\|shared object\).*' >&/dev/null
+then
+    endian=LE
+else
+    echo -e "+++ \e[31;1mCan't Determine Endianness\e[0m"
+    echo "+++ Can't Determine Endianness" >>$OUTPUTFILE
+    exit 2
+fi
+
+maxtypelen=31
+maxtype=`for ((i=0; i<$((maxtypelen)); i++)); do echo -n a; done`
+
+PAGE_SIZE=`getconf PAGESIZE`
+pagelen=$((PAGE_SIZE - 1))
+fullpage=`for ((i=0; i<$((pagelen)); i++)); do echo -n a; done`
+string4095=`for ((i=0; i<4095; i++)); do echo -n a; done`
+
+if kernel_at_or_later_than 3.18
+then
+    maxdesc=$string4095
+elif rhel6_kernel_at_or_later_than 2.6.32-589.el6
+then
+    maxdesc=$string4095
+else
+    maxdesc=$fullpage
+fi
+
+maxcall=$fullpage
+
+maxsquota=`grep '^ *0': /proc/key-users | sed s@.*/@@`
+
+key_gc_delay_file="/proc/sys/kernel/keys/gc_delay"
+if [ -f $key_gc_delay_file ]; then
+    orig_gc_delay=`cat $key_gc_delay_file`
+else
+    orig_gc_delay=300
+fi
+
+
+function marker ()
+{
+    echo -e "+++ \e[33m$*\e[0m"
+    echo +++ $* >>$OUTPUTFILE
+}
+
+function failed()
+{
+    echo -e "\e[31;1mFAILED\e[0m"
+    echo === FAILED === >>$OUTPUTFILE
+    keyctl show >>$OUTPUTFILE
+    echo ============== >>$OUTPUTFILE
+    result=FAIL
+}
+
+function expect_args_error ()
+{
+    "$@" >>$OUTPUTFILE 2>&1
+    if [ $? != 2 ]
+    then
+	failed
+    fi
+
+}
+
+function toolbox_report_result()
+{
+    if [ $RUNNING_UNDER_RHTS = 1 ]
+    then
+	report_result $1 $2
+    fi
+    if [ $2 = FAIL ]
+    then
+	exit 1
+    fi
+}
+
+function toolbox_skip_test()
+{
+    echo "++++ SKIPPING TEST" >>$OUTPUTFILE
+    marker "$2"
+    toolbox_report_result $1 PASS
+}
+
+###############################################################################
+#
+# Return true if the command is found in $PATH. If not, log that the test is
+# being skipped, report the result as PASS, and exit.
+#
+###############################################################################
+function require_command ()
+{
+    which "$1" >&/dev/null
+    if [ $? != 0 ]
+    then
+	toolbox_skip_test "SKIP DUE TO MISSING COMMAND: $1"
+        exit 0
+    fi
+}
+
+###############################################################################
+#
+# extract an error message from the log file and check it
+#
+###############################################################################
+function expect_error ()
+{
+    my_varname=$1
+
+    my_errmsg="`tail -1 $OUTPUTFILE`"
+    eval $my_varname="\"$my_errmsg\""
+
+    if [ $# != 1 ]
+    then
+	echo "Format: expect_error <symbol>" >>$OUTPUTFILE
+	failed
+    fi
+
+    case $1 in
+	EPERM)		my_err="Operation not permitted";;
+	EAGAIN)		my_err="Resource temporarily unavailable";;
+	ENOENT)		my_err="No such file or directory";;
+	EEXIST)		my_err="File exists";;
+	ENOTDIR)	my_err="Not a directory";;
+	EACCES)		my_err="Permission denied";;
+	EINVAL)		my_err="Invalid argument";;
+	ENODEV)		my_err="No such device";;
+	ELOOP)		my_err="Too many levels of symbolic links";;
+	EOPNOTSUPP)	my_err="Operation not supported";;
+	EDEADLK)	my_err="Resource deadlock avoided";;
+	EDQUOT)		my_err="Disk quota exceeded";;
+	ENOKEY)
+	    my_err="Required key not available"
+	    old_err="Requested key not available"
+	    alt_err="Unknown error 126"
+	    ;;
+	EKEYEXPIRED)
+	    my_err="Key has expired"
+	    alt_err="Unknown error 127"
+	    ;;
+	EKEYREVOKED)
+	    my_err="Key has been revoked"
+	    alt_err="Unknown error 128"
+	    ;;
+	EKEYREJECTED)
+	    my_err="Key has been rejected"
+	    alt_err="Unknown error 129"
+	    ;;
+	*)
+	    echo "Unknown error message $1" >>$OUTPUTFILE
+	    failed
+	    ;;
+    esac
+
+    if expr "$my_errmsg" : ".*: $my_err" >&/dev/null
+    then
+	:
+    elif [ "x$alt_err" != "x" ] && expr "$my_errmsg" : ".*: $alt_err" >&/dev/null
+    then
+	:
+    elif [ "x$old_err" != "x" ] && expr "$my_errmsg" : ".*: $old_err" >&/dev/null
+    then
+	:
+    else
+	failed
+    fi
+}
+
+###############################################################################
+#
+# wait for a key to be destroyed (get removed from /proc/keys)
+#
+###############################################################################
+function pause_till_key_destroyed ()
+{
+    echo "+++ WAITING FOR KEY TO BE DESTROYED" >>$OUTPUTFILE
+    hexkeyid=`printf %08x $1`
+
+    while grep $hexkeyid /proc/keys
+    do
+	sleep 1
+    done
+}
+
+###############################################################################
+#
+# wait for a key to be unlinked
+#
+###############################################################################
+function pause_till_key_unlinked ()
+{
+    echo "+++ WAITING FOR KEY TO BE UNLINKED" >>$OUTPUTFILE
+
+    while true
+    do
+	echo keyctl unlink $1 $2 >>$OUTPUTFILE
+	keyctl unlink $1 $2 >>$OUTPUTFILE 2>&1
+	if [ $? != 1 ]
+	then
+	    failed
+	fi
+
+	my_errmsg="`tail -1 $OUTPUTFILE`"
+	if ! expr "$my_errmsg" : ".*: No such file or directory" >&/dev/null
+	then
+	    break
+	fi
+	sleep 1
+    done
+}
+
+###############################################################################
+#
+# request a key and attach it to the new keyring
+#
+###############################################################################
+function request_key ()
+{
+    my_exitval=0
+    if [ "x$1" = "x--fail" ]
+    then
+	my_exitval=1
+	shift
+    fi
+
+    echo keyctl request "$@" >>$OUTPUTFILE
+    keyctl request "$@" >>$OUTPUTFILE 2>&1
+    if [ $? != $my_exitval ]
+    then
+	failed
+    fi
+}
+
+###############################################################################
+#
+# request a key and attach it to the new keyring, calling out if necessary
+#
+###############################################################################
+function request_key_callout ()
+{
+    my_exitval=0
+    if [ "x$1" = "x--fail" ]
+    then
+	my_exitval=1
+	shift
+    fi
+
+    echo keyctl request2 "$@" >>$OUTPUTFILE
+    keyctl request2 "$@" >>$OUTPUTFILE 2>&1
+    if [ $? != $my_exitval ]
+    then
+	failed
+    fi
+}
+
+###############################################################################
+#
+# request a key and attach it to the new keyring, calling out if necessary and
+# passing the callout data in on stdin
+#
+###############################################################################
+function prequest_key_callout ()
+{
+    my_exitval=0
+    if [ "x$1" = "x--fail" ]
+    then
+	my_exitval=1
+	shift
+    fi
+
+    data="$1"
+    shift
+
+    echo echo -n $data \| keyctl prequest2 "$@" >>$OUTPUTFILE
+    echo -n $data | keyctl prequest2 "$@" >>$OUTPUTFILE 2>&1
+    if [ $? != $my_exitval ]
+    then
+	failed
+    fi
+}
+
+###############################################################################
+#
+# create a key and attach it to the new keyring
+#
+###############################################################################
+function create_key ()
+{
+    my_exitval=0
+    if [ "x$1" = "x--fail" ]
+    then
+	my_exitval=1
+	shift
+    fi
+
+    echo keyctl add "$@" >>$OUTPUTFILE
+    keyctl add "$@" >>$OUTPUTFILE 2>&1
+    if [ $? != $my_exitval ]
+    then
+	failed
+    fi
+}
+
+###############################################################################
+#
+# create a key and attach it to the new keyring, piping in the data
+#
+###############################################################################
+function pcreate_key ()
+{
+    my_exitval=0
+    if [ "x$1" = "x--fail" ]
+    then
+	my_exitval=1
+	shift
+    fi
+
+    data="$1"
+    shift
+
+    echo echo -n $data \| keyctl padd "$@" >>$OUTPUTFILE
+    echo -n $data | keyctl padd "$@" >>$OUTPUTFILE 2>&1
+    if [ $? != $my_exitval ]
+    then
+	failed
+    fi
+}
+
+###############################################################################
+#
+# create a key and attach it to the new keyring, piping in the data
+#
+###############################################################################
+function pcreate_key_by_size ()
+{
+    my_exitval=0
+    if [ "x$1" = "x--fail" ]
+    then
+	my_exitval=1
+	shift
+    fi
+
+    data="$1"
+    shift
+
+    echo dd if=/dev/zero count=1 bs=$data \| keyctl padd "$@" >>$OUTPUTFILE
+    dd if=/dev/zero count=1 bs=$data 2>/dev/null | keyctl padd "$@" >>$OUTPUTFILE 2>&1
+    if [ $? != $my_exitval ]
+    then
+	failed
+    fi
+}
+
+###############################################################################
+#
+# create a key and attach it to the new keyring
+#
+###############################################################################
+function create_keyring ()
+{
+    my_exitval=0
+    if [ "x$1" = "x--fail" ]
+    then
+	my_exitval=1
+	shift
+    fi
+
+    echo keyctl newring "$@" >>$OUTPUTFILE
+    keyctl newring "$@" >>$OUTPUTFILE 2>&1
+    if [ $? != $my_exitval ]
+    then
+	failed
+    fi
+}
+
+###############################################################################
+#
+# extract a key ID from the log file
+#
+###############################################################################
+function expect_keyid ()
+{
+    my_varname=$1
+
+    my_keyid="`tail -1 $OUTPUTFILE`"
+    if expr "$my_keyid" : '[1-9][0-9]*' >&/dev/null
+    then
+	eval $my_varname=$my_keyid
+
+	if [ $# = 2 -a "x$my_keyid" != "x$2" ]
+	then
+	    failed
+	fi
+    else
+	eval $my_varname=no
+	result=FAIL
+    fi
+}
+
+###############################################################################
+#
+# prettily list a keyring
+#
+###############################################################################
+function pretty_list_keyring ()
+{
+    my_exitval=0
+    if [ "x$1" = "x--fail" ]
+    then
+	my_exitval=1
+	shift
+    fi
+
+    echo keyctl list $1 >>$OUTPUTFILE
+    keyctl list $1 >>$OUTPUTFILE 2>&1
+    if [ $? != $my_exitval ]
+    then
+	failed
+    fi
+}
+
+###############################################################################
+#
+# list a keyring
+#
+###############################################################################
+function list_keyring ()
+{
+    my_exitval=0
+    if [ "x$1" = "x--fail" ]
+    then
+	my_exitval=1
+	shift
+    fi
+
+    echo keyctl rlist $1 >>$OUTPUTFILE
+    keyctl rlist $1 >>$OUTPUTFILE 2>&1
+    if [ $? != $my_exitval ]
+    then
+	failed
+    fi
+}
+
+###############################################################################
+#
+# extract a keyring listing from the log file and see if a key ID is contained
+# therein
+#
+###############################################################################
+function expect_keyring_rlist ()
+{
+    my_varname=$1
+
+    my_rlist="`tail -1 $OUTPUTFILE`"
+    eval $my_varname="\"$my_rlist\""
+
+    if [ $# = 2 -o $# = 3 ]
+    then
+	if [ "$2" = "empty" ]
+	then
+	    if [ "x$my_rlist" != "x" ]
+	    then
+		failed
+	    fi
+	else
+	    my_keyid=$2
+	    my_found=0
+	    my_expected=1
+	    if [ $# = 3 -a "x$3" = "x--absent" ]; then my_expected=0; fi
+
+	    for k in $my_rlist
+	    do
+		if [ $k = $my_keyid ]
+		then
+		    my_found=1
+		    break;
+		fi
+	    done
+
+	    if [ $my_found != $my_expected ]
+	    then
+		failed
+	    fi
+	fi
+    fi
+}
+
+###############################################################################
+#
+# prettily describe a key
+#
+###############################################################################
+function pretty_describe_key ()
+{
+    my_exitval=0
+    if [ "x$1" = "x--fail" ]
+    then
+	my_exitval=1
+	shift
+    fi
+
+    echo keyctl describe $1 >>$OUTPUTFILE
+    keyctl describe $1 >>$OUTPUTFILE 2>&1
+    if [ $? != $my_exitval ]
+    then
+	failed
+    fi
+}
+
+###############################################################################
+#
+# describe a key
+#
+###############################################################################
+function describe_key ()
+{
+    my_exitval=0
+    if [ "x$1" = "x--fail" ]
+    then
+	my_exitval=1
+	shift
+    fi
+
+    echo keyctl rdescribe $1 "@" >>$OUTPUTFILE
+    keyctl rdescribe $1 "@" >>$OUTPUTFILE 2>&1
+    if [ $? != $my_exitval ]
+    then
+	failed
+    fi
+}
+
+###############################################################################
+#
+# extract a raw key description from the log file and check it
+#
+###############################################################################
+function expect_key_rdesc ()
+{
+    my_varname=$1
+
+    my_rdesc="`tail -1 $OUTPUTFILE`"
+    eval $my_varname="\"$my_rdesc\""
+
+    if ! expr "$my_rdesc" : "$2" >&/dev/null
+    then
+	failed
+    fi
+}
+
+###############################################################################
+#
+# read a key's payload as a hex dump
+#
+###############################################################################
+function read_key ()
+{
+    my_exitval=0
+    if [ "x$1" = "x--fail" ]
+    then
+	my_exitval=1
+	shift
+    fi
+
+    echo keyctl read $1 >>$OUTPUTFILE
+    keyctl read $1 >>$OUTPUTFILE 2>&1
+    if [ $? != $my_exitval ]
+    then
+	failed
+    fi
+}
+
+###############################################################################
+#
+# read a key's payload as a printable string
+#
+###############################################################################
+function print_key ()
+{
+    my_exitval=0
+    if [ "x$1" = "x--fail" ]
+    then
+	my_exitval=1
+	shift
+    fi
+
+    echo keyctl print $1 >>$OUTPUTFILE
+    keyctl print $1 >>$OUTPUTFILE 2>&1
+    if [ $? != $my_exitval ]
+    then
+	failed
+    fi
+}
+
+###############################################################################
+#
+# pipe a key's raw payload to stdout
+#
+###############################################################################
+function pipe_key ()
+{
+    my_exitval=0
+    if [ "x$1" = "x--fail" ]
+    then
+	my_exitval=1
+	shift
+    fi
+
+    echo keyctl pipe $1 >>$OUTPUTFILE
+    keyctl pipe $1 >>$OUTPUTFILE 2>&1
+    if [ $? != $my_exitval ]
+    then
+	failed
+    fi
+}
+
+###############################################################################
+#
+# pipe a key's raw payload through md5sum
+#
+###############################################################################
+function md5sum_key ()
+{
+    my_exitval=0
+    if [ "x$1" = "x--fail" ]
+    then
+	my_exitval=1
+	shift
+    fi
+
+    echo keyctl pipe $1 \| md5sum \| cut -c1-32 >>$OUTPUTFILE
+    keyctl pipe $1 | md5sum | cut -c1-32 >>$OUTPUTFILE 2>&1
+    if [ $? != $my_exitval ]
+    then
+	failed
+    fi
+}
+
+###############################################################################
+#
+# extract a printed payload from the log file
+#
+###############################################################################
+function expect_payload ()
+{
+    my_varname=$1
+
+    my_payload="`tail -1 $OUTPUTFILE`"
+    eval $my_varname="\"$my_payload\""
+
+    if [ $# == 2 -a "x$my_payload" != "x$2" ]
+    then
+	failed
+    fi
+}
+
+###############################################################################
+#
+# extract multiline output from the log file
+#
+###############################################################################
+function expect_multiline ()
+{
+    my_varname=$1
+    my_linecount="`echo \"$2\" | wc -l`"
+
+    my_payload=$(tail -$my_linecount $OUTPUTFILE)
+    eval $my_varname="\"$my_payload\""
+
+    if [ $# != 2 -o "x$my_payload" != "x$2" ]
+    then
+	failed
+    fi
+}
+
+###############################################################################
+#
+# revoke a key
+#
+###############################################################################
+function revoke_key ()
+{
+    my_exitval=0
+    if [ "x$1" = "x--fail" ]
+    then
+	my_exitval=1
+	shift
+    fi
+
+    echo keyctl revoke $1 >>$OUTPUTFILE
+    keyctl revoke $1 >>$OUTPUTFILE 2>&1
+    if [ $? != $my_exitval ]
+    then
+	failed
+    fi
+}
+
+###############################################################################
+#
+# unlink a key from a keyring
+#
+###############################################################################
+function unlink_key ()
+{
+    my_exitval=0
+    if [ "x$1" = "x--fail" ]
+    then
+	my_exitval=1
+	shift
+    fi
+
+    my_wait=0
+    if [ "x$1" = "x--wait" ]
+    then
+	my_wait=1
+	shift
+    fi
+
+    echo keyctl unlink $1 $2 >>$OUTPUTFILE
+    keyctl unlink $1 $2 >>$OUTPUTFILE 2>&1
+    if [ $? != $my_exitval ]
+    then
+	failed
+    fi
+
+    # keys are destroyed lazily
+    if [ $my_wait = 1 ]
+    then
+	pause_till_key_unlinked $1 $2
+    fi
+}
+
+###############################################################################
+#
+# extract a message about the number of keys unlinked
+#
+###############################################################################
+function expect_unlink_count ()
+{
+    my_varname=$1
+
+    my_nunlinks="`tail -1 $OUTPUTFILE`"
+
+    if ! expr "$my_nunlinks" : '^[0-9][0-9]* links removed$'
+    then
+	failed
+    fi
+
+    my_nunlinks=`echo $my_nunlinks | awk '{printf $1}'`
+    eval $my_varname="\"$my_nunlinks\""
+
+    if [ $# == 2 -a $my_nunlinks != $2 ]
+    then
+	failed
+    fi
+}
+
+###############################################################################
+#
+# update a key from a keyring
+#
+###############################################################################
+function update_key ()
+{
+    my_exitval=0
+    if [ "x$1" = "x--fail" ]
+    then
+	my_exitval=1
+	shift
+    fi
+
+    echo keyctl update $1 $2 >>$OUTPUTFILE
+    keyctl update $1 $2 >>$OUTPUTFILE 2>&1
+    if [ $? != $my_exitval ]
+    then
+	failed
+    fi
+}
+
+###############################################################################
+#
+# update a key from a keyring, piping the data in over stdin
+#
+###############################################################################
+function pupdate_key ()
+{
+    my_exitval=0
+    if [ "x$1" = "x--fail" ]
+    then
+	my_exitval=1
+	shift
+    fi
+
+    echo echo -n $2 \| keyctl pupdate $1 >>$OUTPUTFILE
+    echo -n $2 | keyctl pupdate $1 >>$OUTPUTFILE 2>&1
+    if [ $? != $my_exitval ]
+    then
+	failed
+    fi
+}
+
+###############################################################################
+#
+# clear a keyring
+#
+###############################################################################
+function clear_keyring ()
+{
+    my_exitval=0
+    if [ "x$1" = "x--fail" ]
+    then
+	my_exitval=1
+	shift
+    fi
+
+    echo keyctl clear $1 >>$OUTPUTFILE
+    keyctl clear $1 >>$OUTPUTFILE 2>&1
+    if [ $? != $my_exitval ]
+    then
+	failed
+    fi
+}
+
+###############################################################################
+#
+# link a key to a keyring
+#
+###############################################################################
+function link_key ()
+{
+    my_exitval=0
+    if [ "x$1" = "x--fail" ]
+    then
+	my_exitval=1
+	shift
+    fi
+
+    echo keyctl link $1 $2 >>$OUTPUTFILE
+    keyctl link $1 $2 >>$OUTPUTFILE 2>&1
+    if [ $? != $my_exitval ]
+    then
+	failed
+    fi
+}
+
+###############################################################################
+#
+# search for a key in a keyring
+#
+###############################################################################
+function search_for_key ()
+{
+    my_exitval=0
+    if [ "x$1" = "x--fail" ]
+    then
+	my_exitval=1
+	shift
+    fi
+
+    echo keyctl search "$@" >>$OUTPUTFILE
+    keyctl search "$@" >>$OUTPUTFILE 2>&1
+    if [ $? != $my_exitval ]
+    then
+	failed
+    fi
+}
+
+###############################################################################
+#
+# set the permissions mask on a key
+#
+###############################################################################
+function set_key_perm ()
+{
+    my_exitval=0
+    if [ "x$1" = "x--fail" ]
+    then
+	my_exitval=1
+	shift
+    fi
+
+    echo keyctl setperm "$@" >>$OUTPUTFILE
+    keyctl setperm "$@" >>$OUTPUTFILE 2>&1
+    if [ $? != $my_exitval ]
+    then
+	failed
+    fi
+}
+
+###############################################################################
+#
+# set the ownership of a key
+#
+###############################################################################
+function chown_key ()
+{
+    my_exitval=0
+    if [ "x$1" = "x--fail" ]
+    then
+	my_exitval=1
+	shift
+    fi
+
+    echo keyctl chown "$@" >>$OUTPUTFILE
+    keyctl chown "$@" >>$OUTPUTFILE 2>&1
+    if [ $? != $my_exitval ]
+    then
+	failed
+    fi
+}
+
+###############################################################################
+#
+# set the group ownership of a key
+#
+###############################################################################
+function chgrp_key ()
+{
+    my_exitval=0
+    if [ "x$1" = "x--fail" ]
+    then
+	my_exitval=1
+	shift
+    fi
+
+    echo keyctl chgrp "$@" >>$OUTPUTFILE
+    keyctl chgrp "$@" >>$OUTPUTFILE 2>&1
+    if [ $? != $my_exitval ]
+    then
+	failed
+    fi
+}
+
+###############################################################################
+#
+# run as a new session
+#
+###############################################################################
+function new_session ()
+{
+    my_exitval=0
+    if [ "x$1" = "x--fail" ]
+    then
+	my_exitval=1
+	shift
+    fi
+
+    echo keyctl session "$@" >>$OUTPUTFILE
+    keyctl session "$@" >>$OUTPUTFILE 2>&1
+    if [ $? != $my_exitval ]
+    then
+	failed
+    fi
+}
+
+###############################################################################
+#
+# instantiate a key
+#
+###############################################################################
+function instantiate_key ()
+{
+    my_exitval=0
+    if [ "x$1" = "x--fail" ]
+    then
+	my_exitval=1
+	shift
+    fi
+
+    echo keyctl instantiate "$@" >>$OUTPUTFILE
+    keyctl instantiate "$@" >>$OUTPUTFILE 2>&1
+    if [ $? != $my_exitval ]
+    then
+	failed
+    fi
+}
+
+###############################################################################
+#
+# instantiate a key, piping the data in over stdin
+#
+###############################################################################
+function pinstantiate_key ()
+{
+    my_exitval=0
+    if [ "x$1" = "x--fail" ]
+    then
+	my_exitval=1
+	shift
+    fi
+
+    data="$1"
+    shift
+
+    echo echo -n $data \| keyctl pinstantiate "$@" >>$OUTPUTFILE
+    echo -n $data | keyctl pinstantiate "$@" >>$OUTPUTFILE 2>&1
+    if [ $? != $my_exitval ]
+    then
+	failed
+    fi
+}
+
+###############################################################################
+#
+# negate a key
+#
+###############################################################################
+function negate_key ()
+{
+    my_exitval=0
+    if [ "x$1" = "x--fail" ]
+    then
+	my_exitval=1
+	shift
+    fi
+
+    echo keyctl negate "$@" >>$OUTPUTFILE
+    keyctl negate "$@" >>$OUTPUTFILE 2>&1
+    if [ $? != $my_exitval ]
+    then
+	failed
+    fi
+}
+
+###############################################################################
+#
+# set a key's expiry time
+#
+###############################################################################
+function timeout_key ()
+{
+    my_exitval=0
+    if [ "x$1" = "x--fail" ]
+    then
+	my_exitval=1
+	shift
+    fi
+
+    echo keyctl timeout $1 $2 >>$OUTPUTFILE
+    keyctl timeout $1 $2 >>$OUTPUTFILE 2>&1
+    if [ $? != $my_exitval ]
+    then
+	failed
+    fi
+}
+
+###############################################################################
+#
+# Invalidate a key
+#
+###############################################################################
+function invalidate_key ()
+{
+    my_exitval=0
+    if [ "x$1" = "x--fail" ]
+    then
+	my_exitval=1
+	shift
+    fi
+
+    echo keyctl invalidate $1 >>$OUTPUTFILE
+    keyctl invalidate $1 >>$OUTPUTFILE 2>&1
+    if [ $? != $my_exitval ]
+    then
+	failed
+    fi
+}
+
+###############################################################################
+#
+# Do a DH computation
+#
+###############################################################################
+function dh_compute ()
+{
+    my_exitval=0
+    if [ "x$1" = "x--fail" ]
+    then
+	my_exitval=1
+	shift
+    fi
+
+    echo keyctl dh_compute $@ >>$OUTPUTFILE
+    keyctl dh_compute $@ >>$OUTPUTFILE 2>&1
+    if [ $? != $my_exitval ]
+    then
+	failed
+    fi
+}
+
+###############################################################################
+#
+# Make sure we sleep at least N seconds
+#
+###############################################################################
+function sleep_at_least ()
+{
+    my_now=`date +%s`
+    my_done_at=$(($my_now+$1+1))
+    sleep $1
+    while [ `date +%s` -lt $my_done_at ]
+    do
+	# Sleep in 1/50th of a second bursts till the time catches up
+	sleep .02
+    done
+}
+
+###############################################################################
+#
+# set gc delay time, return original value
+#
+###############################################################################
+function set_gc_delay()
+{
+    delay=$1
+    if [ -f $key_gc_delay_file ]; then
+        echo $delay > $key_gc_delay_file
+        echo "Set $key_gc_delay_file to $delay, orig: $orig_gc_delay"
+    fi
+}
diff --git a/tests/vercmp.sh b/tests/vercmp.sh
new file mode 100644
index 0000000..8310c01
--- /dev/null
+++ b/tests/vercmp.sh
@@ -0,0 +1,31 @@
+# Commandline-driver tester for version comparison shell functions
+#
+###############################################################################
+#
+# Copyright (C) 2013 Red Hat, Inc. All Rights Reserved.
+# Written by David Howells (dhowells@redhat.com)
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version
+# 2 of the License, or (at your option) any later version.
+#
+###############################################################################
+
+. ./version.inc.sh
+
+#
+# Compare versions
+#
+if [ "$1" = "" -o "$2" = "" ]
+then
+    echo "Missing version parameters" >&2
+    exit 2
+fi
+
+if version_less_than $1 $2
+then
+    echo "$1 < $2"
+else
+    echo "$1 >= $2"
+fi
diff --git a/tests/version.inc.sh b/tests/version.inc.sh
new file mode 100644
index 0000000..3630c5a
--- /dev/null
+++ b/tests/version.inc.sh
@@ -0,0 +1,199 @@
+# Version comparison shell functions
+#
+###############################################################################
+#
+# Copyright (C) 2005, 2013 Red Hat, Inc. All Rights Reserved.
+# Written by David Howells (dhowells@redhat.com)
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version
+# 2 of the License, or (at your option) any later version.
+#
+###############################################################################
+
+###############################################################################
+#
+# compare version numbers to see if the first is less (older) than the second
+#
+###############################################################################
+function version_less_than ()
+{
+    a=$1
+    b=$2
+
+    if [ "$a" = "$b" ]
+    then
+	return 1
+    fi
+
+    # grab the leaders
+    a_version=${a%%-*} a_release=${a#*-}
+    b_version=${b%%-*} b_release=${b#*-}
+
+    if [ "$a_version" = "$b_version" ]
+    then
+	case "$a_release" in
+	    rc[0-9]*)
+		case "$b_release" in
+		    rc[0-9]*)
+			__version_less_than_dot "${a_release#rc}" "${b_release#rc}"
+			return $?
+			;;
+		    *)
+			return 0;
+			;;
+		esac
+		;;
+	esac
+
+	case "$b_release" in
+	    rc[0-9]*)
+		return 1;
+		;;
+	esac
+
+	if [ "$a_version" = "$a" -o "$b_version" = "$b" ]
+	then
+	    if [ "$a_version" = "$b_version" ]
+	    then
+		[ "$a_version" = "$a" ]
+	    else
+		__version_less_than_dot "$a_version" "$b_version"
+	    fi
+	fi
+	__version_less_than_dot "$a_release" "$b_release"
+    else
+	__version_less_than_dot "$a_version" "$b_version"
+    fi
+}
+
+function __version_less_than_dot ()
+{
+    a=$1
+    b=$2
+
+    if [ "$a" = "$b" ]
+    then
+	return 1
+    fi
+
+    # grab the leaders
+    x=${a%%.*}
+    y=${b%%.*}
+
+    if [ "$x" = "$a" -o "$y" = "$b" ]
+    then
+	if [ "$x" = "$y" ]
+	then
+	    [ "$x" = "$a" ]
+	else
+	    expr "$x" \< "$y" >/dev/null
+	fi
+    elif [ "$x" = "$y" ]
+    then
+	__version_less_than_dot "${a#*.}" "${b#*.}"
+    else
+	expr "$x" \< "$y" >/dev/null
+    fi
+}
+
+###############################################################################
+#
+# Return true if the keyutils package being tested is older than the given
+# version.
+#
+###############################################################################
+function keyutils_older_than ()
+{
+    version_less_than $KEYUTILSVER $1
+}
+
+###############################################################################
+#
+# Return true if the keyutils package being tested is at or later than the
+# given version.
+#
+###############################################################################
+function keyutils_at_or_later_than ()
+{
+    ! keyutils_older_than $1
+}
+
+###############################################################################
+#
+# Return true if the keyutils package being tested is newer than the given
+# version.
+#
+###############################################################################
+function keyutils_newer_than ()
+{
+    version_less_than $1 $KEYUTILSVER
+}
+
+###############################################################################
+#
+# Return true if the keyutils package being tested is at or older than the
+# given version.
+#
+###############################################################################
+function keyutils_at_or_older_than ()
+{
+    ! keyutils_newer_than $1
+}
+
+###############################################################################
+#
+# Return true if the kernel being tested is older than the given version.
+#
+###############################################################################
+function kernel_older_than ()
+{
+    version_less_than $KERNELVER $1
+}
+
+###############################################################################
+#
+# Return true if the kernel being tested is at or later than the given version.
+#
+###############################################################################
+function kernel_at_or_later_than ()
+{
+    ! kernel_older_than $1
+}
+
+###############################################################################
+#
+# Return true if the kernel being tested is a RHEL-6 kernel and is at or later
+# than the given version.
+#
+###############################################################################
+function rhel6_kernel_at_or_later_than ()
+{
+    case $OSDIST-$OSRELEASE in
+	RHEL-6.*)
+	    ! kernel_older_than $1
+	    ;;
+	*)
+	    false
+	    ;;
+	esac
+}
+
+###############################################################################
+#
+# Return true if the kernel being tested is a RHEL-7 kernel and is at or later
+# than the given version.
+#
+###############################################################################
+function rhel7_kernel_at_or_later_than ()
+{
+    case $OSDIST-$OSRELEASE in
+	RHEL-7.*)
+	    ! kernel_older_than $1
+	    ;;
+	*)
+	    false
+	    ;;
+	esac
+}
diff --git a/version.lds b/version.lds
new file mode 100644
index 0000000..2bfed13
--- /dev/null
+++ b/version.lds
@@ -0,0 +1,70 @@
+KEYUTILS_0.3 {
+
+	/* primary syscalls; may be overridden by glibc */
+	add_key;
+	request_key;
+	keyctl;
+
+	/* management functions */
+	keyctl_chown;
+	keyctl_clear;
+	keyctl_describe;
+	keyctl_describe_alloc;
+	keyctl_get_keyring_ID;
+	keyctl_instantiate;
+	keyctl_join_session_keyring;
+	keyctl_link;
+	keyctl_negate;
+	keyctl_read;
+	keyctl_read_alloc;
+	keyctl_revoke;
+	keyctl_search;
+	keyctl_setperm;
+	keyctl_set_reqkey_keyring;
+	keyctl_unlink;
+	keyctl_update;
+
+};
+
+KEYUTILS_1.0 {
+	/* management functions */
+	keyctl_assume_authority;
+	keyctl_set_timeout;
+
+} KEYUTILS_0.3;
+
+KEYUTILS_1.3 {
+	/* management functions */
+	keyctl_get_security;
+	keyctl_get_security_alloc;
+	keyctl_session_to_parent;
+
+} KEYUTILS_1.0;
+
+KEYUTILS_1.4 {
+	/* management functions */
+	keyctl_reject;
+	keyctl_instantiate_iov;
+	keyctl_invalidate;
+
+	/* utility functions */
+	recursive_key_scan;
+	recursive_session_key_scan;
+
+} KEYUTILS_1.3;
+
+KEYUTILS_1.5 {
+	/* management functions */
+	keyctl_get_persistent;
+
+	/* utility functions */
+	find_key_by_type_and_desc;
+
+} KEYUTILS_1.4;
+
+KEYUTILS_1.6 {
+	/* management functions */
+	keyctl_dh_compute;
+	keyctl_dh_compute_alloc;
+
+} KEYUTILS_1.5;