keyctl on score

manipulate the kernel's key management facility

sys_keyctl(int cmd, unsigned long arg2, unsigned long arg3, unsigned long arg4, unsigned long arg5)
number219 (0xdb)
abicommon
kconfigCONFIG_KEYS
familykeys see the whole family on score
entry pointsys_keyctl
sinceLinux 3.7 or earlier (3.7 is the first release scanned for score)
man pagekeyctl(2)
sourceelixir.bootlin.com

Registers

registervalue
r27219, the syscall number
r4int cmd
r5unsigned long arg2
r6unsigned long arg3
r7unsigned long arg4
r8unsigned long arg5
r4the return value

Then run syscall to enter the kernel.

r7 is the error flag and r4 then holds the positive error number.

This architecture was removed from the Linux kernel in Linux 4.17. The newest release with a syscall table here is Linux 4.16. The other removed architectures live on the historical architectures page.

Same syscall on other architectures

Get this as JSON: https://api.syscall.sh/v2/syscalls/score/keyctl?kernel=all