create  dns_resolver *		*               /sbin/key.dns_resolver %k
negate	*	*		*		/bin/keyctl negate %k 30 %S