key_ref = lookup_user_key(NULL, id, 1, 1, 0); 
key_ref = lookup_user_key(NULL, id, 1, 1, KEY_SETATTR); 
long keyctl_chown_key(key_serial_t id, uid_t uid, gid_t gid){	struct key *key;	key_ref_t key_ref;	long ret;	ret = 0;	if (uid == (uid_t) -1 && gid == (gid_t) -1)		goto error;	key_ref = lookup_user_key(NULL, id, 1, 1, 0);	if (IS_ERR(key_ref)) {		ret = PTR_ERR(key_ref);		goto error;	}	key = key_ref_to_ptr(key_ref);	/* make the changes with the locks held to prevent chown/chown races */	ret = -EACCES;	down_write(&key->sem);	if (!capable(CAP_SYS_ADMIN)) {		/* only the sysadmin can chown a key to some other UID */		if (uid != (uid_t) -1 && key->uid != uid)			goto no_access;		/* only the sysadmin can set the key's GID to a group other		 * than one of those that the current process subscribes to */		if (gid != (gid_t) -1 && gid != key->gid && !in_group_p(gid))			goto no_access;	}	/* change the UID (have to update the quotas) */	if (uid != (uid_t) -1 && uid != key->uid) {		/* don't support UID changing yet */		ret = -EOPNOTSUPP;		goto no_access;	}	/* change the GID */	if (gid != (gid_t) -1)		key->gid = gid;	ret = 0; no_access:	up_write(&key->sem);	key_put(key); error:	return ret;} /* end keyctl_chown_key() */
10457	/local/tlutelli/issta_data/temp/c/2005_temp/2005/10457/29db9190634067c5a328ee5fcc2890251b836b4b/keyctl.c/buggy/security/keys/keyctl.c