keyctl
Partial in Antinomie 0.7.0 · Syscall list
Synopsis
Section titled “Synopsis”long keyctl(int cmd, unsigned long arg2, unsigned long arg3, unsigned long arg4, unsigned long arg5);| Number (x86-64) | 250 |
| ABI | common |
| Kernel entry point | sys_keyctl |
This is the raw kernel prototype from the pinned Linux 6.12.94 schema, not the libc wrapper.
Description
Section titled “Description”Manipulates the kernel key store: read, update, revoke, search, set permissions and more, selected by a command.
Arguments
Section titled “Arguments”| Name | Type | Meaning |
|---|---|---|
cmd (arg0) |
int |
keyctl command (KEYCTL_READ, KEYCTL_SEARCH, …). |
arg2 (arg1) |
unsigned long |
Command-specific argument. |
arg3 (arg2) |
unsigned long |
Command-specific argument. |
arg4 (arg3) |
unsigned long |
Command-specific argument. |
arg5 (arg4) |
unsigned long |
Command-specific argument. |
Return value
Section titled “Return value”On success: a command-specific value.
In an Antinomie trace the Return column and the ret filter field show the raw kernel return value. On failure that is the negative errno, for example -2 for ENOENT, not the -1 plus errno that the libc wrapper gives. syscall.errno holds the positive errno and syscall.success is false.
Common errors
Section titled “Common errors”| Raw return | Name | Meaning |
|---|---|---|
-13 |
EACCES |
Permission denied. |
-127 |
EKEYEXPIRED |
The key has expired. |
-126 |
ENOKEY |
The required key is not available. |
Man page
Section titled “Man page”Captured by Antinomie
Section titled “Captured by Antinomie”Coverage mark: Partial. Known commands decode their pointee. An unknown command records a keyctl.unknown_selector “no decoder” gap.
Every call is recorded as an Entry record (the six argument words and the pointees copied at entry) and an Exit record (the return value and the pointees copied at exit).
Arguments
Section titled “Arguments”| Argument | When | How | Recorded field key | Condition |
|---|---|---|---|---|
cmd (arg0) |
Entry | raw scalar word | args.0, args.cmd |
|
arg2 (arg1) |
Entry | raw scalar word | args.1, args.arg2 |
|
arg3 (arg2) |
Entry | raw scalar word | args.2, args.arg3 |
|
arg4 (arg3) |
Entry | raw scalar word | args.3, args.arg4 |
|
arg5 (arg4) |
Entry | raw scalar word | args.4, args.arg5 |
Family notes
Section titled “Family notes”- Selector:
cmd. Descriptions, types and payloads are copied at entry (strings up to 32 bytes for a key type, 4,096 for a description, payloads up to a page or 1 MiB); read-style commands copy their buffer at exit on success.
Other recorded fields
Section titled “Other recorded fields”arg1.name, arg2.payload, arg2.iov, arg2.buffer, arg2.type, arg3.description, arg3.restriction, arg3.info, arg4.query, arg1.buffer, keyctl.unknown_selector, arg1.params, arg4.kdf, arg4.kdf.hashname, arg4.kdf.otherinfo, arg2.info, arg3.input, arg4.signature, arg4.output. When and how each is recorded: Not documented yet.
Filter fields
Section titled “Filter fields”- Result:
ret,syscall.errno,syscall.success,syscall.duration_ns. - Argument words:
args.cmd(arg0),args.arg2(arg1),args.arg3(arg2),args.arg4(arg3),args.arg5(arg4);args.0toargs.5by position. - Structure
keyctl_pkey_paramsbehindarg2(arg1):args.arg2.<member>for__spare[0],__spare[1],__spare[2],__spare[3],__spare[4],__spare[5],__spare[6],in_len,key_id. - Structure
keyctl_pkey_querybehindarg5(arg4):args.arg5.<member>for__spare[0],__spare[1],__spare[2],__spare[3],__spare[4],__spare[5],__spare[6],__spare[7],__spare[8],__spare[9],key_size,max_data_size,max_dec_size,max_enc_size,max_sig_size,supported_ops.
See Syscall Trace filter for the full syntax.
Known gaps
Section titled “Known gaps”- See the coverage mark above for the code paths that record a gap.
For what the capture statuses mean, see Capture statuses. For what is never recorded, see Known gaps.