diff --git a/man/request-key.8 b/man/request-key.8
index b008d80..50a7506 100644
--- a/man/request-key.8
+++ b/man/request-key.8
@@ -18,18 +18,41 @@ This program is invoked by the kernel when the kernel is asked for a key that
 it doesn't have immediately available. The kernel creates a partially set up
 key and then calls out to this program to instantiate it. It is not intended
 to be called directly.
+.PP
+However, for debugging purposes, it can be given some options on the command
+line:
+.IP \fB-d\fP
+Turn on debugging mode.  In this mode, no attempts are made to access any keys
+and, if a handler program is selected, it won't be executed; instead, this
+program will print a message and exit 0.
+.IP \fB-D <description>\fP
+In debugging mode, use the proposed key description specified with this rather
+than the sample ("user;0;0;1f0000;debug:1234") built into the program.
+.IP \fB-l\fP
+Use configuration from the current directory.  The program will use
+.IR request-key.d/* " and " request-key.conf
+from the current directory rather than from
+.IR /etc .
+.IP \fB-n\fP
+Don't log to the system log.  Ordinarily, error messages and debugging messages
+will be copied to the system log - this will prevent that.
+.IP \fB-v\fP
+Turn on debugging output.  This may be specified multiple times to produce
+increasing levels of verbosity.
+.IP \fB--version\fP
+Print the program version and exit.
 .SH ERRORS
 All errors will be logged to the syslog.
 .SH FILES
 .ul
-/etc/request\-key.conf
+/etc/request\-key.d/*.conf
 .ul 0
-Instantiation handler configuration file.
+Individual configuration files.
 .P
 .ul
-/etc/request\-key.d/<keytype>.conf
+/etc/request\-key.conf
 .ul 0
-Keytype specific configuration file.
+Fallback configuration file.
 .SH SEE ALSO
 .ad l
 .nh
diff --git a/man/request-key.conf.5 b/man/request-key.conf.5
index 49facad..276c771 100644
--- a/man/request-key.conf.5
+++ b/man/request-key.conf.5
@@ -12,20 +12,24 @@
 request\-key.conf \- Instantiation handler configuration file
 .SH DESCRIPTION
 .P
-This file and its associated key-type specific variants are used by the
-/sbin/request\-key program to determine which program it should run to
-instantiate a key.
+These files are used by the /sbin/request\-key program to determine which
+program it should run to instantiate a key.
 .P
-request\-key looks first in /etc/request\-key.d/ for a file of the key type name
-plus ".conf" that it can use.  If that is not found, it will fall back to
-/etc/request\-key.conf.
+request\-key looks for the best match, reading all the following files:
+.IP
+	/etc/request\-key.d/*.conf
+.br
+	/etc/request\-key.conf
+.P
+If it doesn't find a match, it will return an error
+and the kernel will automatically negate the key.
 .P
-request\-key scans through the chosen file one line at a time until it
-finds a match, which it will then use. If it doesn't find a match, it'll return
-an error and the kernel will automatically negate the key.
+The best match is defined as the line with the shortest wildcard skips, ranking
+the columns in order left to right.  If two lines have the same length skips,
+then the first read is the one taken.
 .P
-Any blank line or line beginning with a hash mark '#' is considered to be a
-comment and ignored.
+In the files, any blank line or line beginning with a hash mark '#' is
+considered to be a comment and ignored.
 .P
 All other lines are assumed to be command lines with a number of white space
 separated fields:
@@ -36,10 +40,10 @@ The first four fields are used to match the parameters passed to request\-key by
 the kernel. \fIop\fR is the operation type; currently the only supported
 operation is "create".
 .P
-\fItype\fR, \fIdescription\fR and \fIcallout\-info\fR match the three parameters
-passed to \fBkeyctl request2\fR or the \fBrequest_key()\fR system call. Each of
-these may contain one or more asterisk '*' characters as wildcards anywhere
-within the string.
+\fItype\fR, \fIdescription\fR and \fIcallout\-info\fR match the three
+parameters passed to \fBkeyctl request2\fR or the \fBrequest_key()\fR system
+call.  Each of these may contain one asterisk '*' character as a wildcard
+anywhere within the string.
 .P
 Should a match be made, the program specified by <prog> will be exec'd. This
 must have a fully qualified path name. argv[0] will be set from the part of the
@@ -135,7 +139,7 @@ the payload.
 .ul 0
 .br
 .ul
-/etc/request\-key.d/<keytype>.conf
+/etc/request\-key.d/*.conf
 .ul 0
 .SH SEE ALSO
 \fBkeyctl\fR(1), \fBrequest\-key.conf\fR(5)
diff --git a/request-key.c b/request-key.c
index ecd7b79..293fa2f 100644
--- a/request-key.c
+++ b/request-key.c
@@ -24,6 +24,8 @@
 #include <signal.h>
 #include <syslog.h>
 #include <unistd.h>
+#include <dirent.h>
+#include <limits.h>
 #include <getopt.h>
 #include <fcntl.h>
 #include <errno.h>
@@ -33,44 +35,54 @@
 #include "keyutils.h"
 
 
+struct parameters {
+	key_serial_t	key_id;
+	char		*op;
+	char		*key_type;
+	char		*key_desc;
+	char		*callout_info;
+	char		*key;
+	char		*uid;
+	char		*gid;
+	char		*thread_keyring;
+	char		*process_keyring;
+	char		*session_keyring;
+	int		len;
+	int		oplen;
+	int		ktlen;
+	int		kdlen;
+	int		cilen;
+
+};
+
 static int verbosity;
+static int xlocaldirs;
 static int xnolog;
 static int debug_mode;
-static char *xkey;
-static char *xuid;
-static char *xgid;
-static char *xthread_keyring;
-static char *xprocess_keyring;
-static char *xsession_keyring;
-static char conffile[256];
+static char conffile[PATH_MAX + 1];
 static int confline;
 static int norecurse;
 
-static void lookup_action(char *op,
-			  key_serial_t key,
-			  char *ktype,
-			  char *kdesc,
-			  char *callout_info)
+static char cmd[4096 + 2], cmd_conffile[PATH_MAX + 1];
+static unsigned int cmd_wildness[4] = { UINT_MAX, UINT_MAX, UINT_MAX, UINT_MAX };
+static int cmd_len, cmd_confline;
+
+static void lookup_action(struct parameters *params)
 	__attribute__((noreturn));
+static void scan_conf_dir(struct parameters *params, const char *confdir);
+static void scan_conf_file(struct parameters *params, int dirfd, const char *conffile);
 
-static void execute_program(char *op,
-			    key_serial_t key,
-			    char *ktype,
-			    char *kdesc,
-			    char *callout_info,
+static void execute_program(struct parameters *params,
 			    char *cmdline)
 	__attribute__((noreturn));
 
-static void pipe_to_program(char *op,
-			    key_serial_t key,
-			    char *ktype,
-			    char *kdesc,
-			    char *callout_info,
+static void pipe_to_program(struct parameters *params,
 			    char *prog,
 			    char **argv)
 	__attribute__((noreturn));
 
-static int match(const char *pattern, int plen, const char *datum, int dlen);
+static int match(const char *pattern, int plen, const char *datum, int dlen,
+		 unsigned int *wildness);
 
 static void debug(const char *fmt, ...) __attribute__((format(printf, 1, 2)));
 static void debug(const char *fmt, ...)
@@ -132,8 +144,9 @@ static void oops(int x)
  */
 int main(int argc, char *argv[])
 {
-	key_serial_t key;
-	char *ktype, *kdesc, *buf, *callout_info;
+	struct parameters params;
+	char *test_desc = "user;0;0;1f0000;debug:1234";
+	char *buf;
 	int ret, ntype, dpos, n, fd, opt;
 
 	if (argc == 2 && strcmp(argv[1], "--version") == 0) {
@@ -146,12 +159,18 @@ int main(int argc, char *argv[])
 	signal(SIGBUS, oops);
 	signal(SIGPIPE, SIG_IGN);
 
-	while (opt = getopt(argc, argv, "dnv"),
+	while (opt = getopt(argc, argv, "D:dlnv"),
 	       opt != -1) {
 		switch (opt) {
+		case 'D':
+			test_desc = optarg;
+			break;
 		case 'd':
 			debug_mode = 1;
 			break;
+		case 'l':
+			xlocaldirs = 1;
+			break;
 		case 'n':
 			xnolog = 1;
 			break;
@@ -182,32 +201,34 @@ int main(int argc, char *argv[])
 			error("dup failed: %m\n");
 	}
 
-	xkey = argv[1];
-	xuid = argv[2];
-	xgid = argv[3];
-	xthread_keyring = argv[4];
-	xprocess_keyring = argv[5];
-	xsession_keyring = argv[6];
+	params.op		= argv[0];
+	params.key		= argv[1];
+	params.uid		= argv[2];
+	params.gid		= argv[3];
+	params.thread_keyring	= argv[4];
+	params.process_keyring	= argv[5];
+	params.session_keyring	= argv[6];
+	params.callout_info	= argv[7];
 
-	key = atoi(xkey);
+	params.key_id = atoi(params.key);
 
 	/* assume authority over the key
 	 * - older kernel doesn't support this function
 	 */
 	if (!debug_mode) {
-		ret = keyctl_assume_authority(key);
+		ret = keyctl_assume_authority(params.key_id);
 		if (ret < 0 && !(argc == 8 || errno == EOPNOTSUPP))
-			error("Failed to assume authority over key %d (%m)\n", key);
+			error("Failed to assume authority over key %d (%m)\n",
+			      params.key_id);
 	}
 
 	/* ask the kernel to describe the key to us */
 	if (!debug_mode) {
-		ret = keyctl_describe_alloc(key, &buf);
+		ret = keyctl_describe_alloc(params.key_id, &buf);
 		if (ret < 0)
 			goto inaccessible;
-	}
-	else {
-		buf = strdup("user;0;0;1f0000;debug:1234");
+	} else {
+		buf = strdup(test_desc);
 	}
 
 	/* extract the type and description from the key */
@@ -219,37 +240,34 @@ int main(int argc, char *argv[])
 	if (n != 1)
 		error("Failed to parse key description\n");
 
-	ktype = buf;
-	ktype[ntype] = 0;
-	kdesc = buf + dpos;
+	params.key_type = buf;
+	params.key_type[ntype] = 0;
+	params.key_desc = buf + dpos;
 
-	debug("Key type: %s\n", ktype);
-	debug("Key desc: %s\n", kdesc);
+	debug("Key type: %s\n", params.key_type);
+	debug("Key desc: %s\n", params.key_desc);
 
 	/* get hold of the callout info */
-	callout_info = argv[7];
-
-	if (!callout_info) {
+	if (!params.callout_info) {
 		void *tmp;
 
 		if (keyctl_read_alloc(KEY_SPEC_REQKEY_AUTH_KEY, &tmp) < 0)
 			error("Failed to retrieve callout info (%m)\n");
 
-		callout_info = tmp;
+		params.callout_info = tmp;
 	}
 
-	debug("CALLOUT: '%s'\n", callout_info);
+	debug("CALLOUT: '%s'\n", params.callout_info);
 
 	/* determine the action to perform */
-	lookup_action(argv[0],		/* op */
-		      key,		/* ID of key under construction */
-		      ktype,		/* key type */
-		      kdesc,		/* key description */
-		      callout_info	/* call out information */
-		      );
+	params.oplen = strlen(params.op);
+	params.ktlen = strlen(params.key_type);
+	params.kdlen = strlen(params.key_desc);
+	params.cilen = strlen(params.callout_info);
+	lookup_action(&params);
 
 inaccessible:
-	error("Key %d is inaccessible (%m)\n", key);
+	error("Key %d is inaccessible (%m)\n", params.key_id);
 
 } /* end main() */
 
@@ -257,52 +275,88 @@ inaccessible:
 /*
  * determine the action to perform
  */
-static void lookup_action(char *op,
-			  key_serial_t key,
-			  char *ktype,
-			  char *kdesc,
-			  char *callout_info)
+static void lookup_action(struct parameters *params)
+{
+	if (!xlocaldirs) {
+		scan_conf_dir(params, "/etc/request-key.d");
+		scan_conf_file(params, AT_FDCWD, "/etc/request-key.conf");
+	} else {
+		scan_conf_dir(params, "request-key.d");
+		scan_conf_file(params, AT_FDCWD, "request-key.conf");
+	}
+
+	if (cmd_len > 0)
+		execute_program(params, cmd);
+
+	file_error("No matching action\n");
+}
+
+/*****************************************************************************/
+/*
+ * Scan the files in a configuration directory.
+ */
+static void scan_conf_dir(struct parameters *params, const char *confdir)
+{
+	struct dirent *d;
+	DIR *dir;
+	int l;
+
+	debug("__ SCAN %s __\n", confdir);
+
+	dir = opendir(confdir);
+	if (!dir) {
+		if (errno == ENOENT)
+			return;
+		error("Cannot open %s: %m\n", confdir);
+	}
+
+	while ((d = readdir(dir))) {
+		if (d->d_name[0] == '.')
+			continue;
+		if (d->d_type != DT_UNKNOWN && d->d_type != DT_REG)
+			continue;
+		l = strlen(d->d_name);
+		if (l < 5)
+			continue;
+		if (memcmp(d->d_name + l - 5, ".conf", 5) != 0)
+			continue;
+		scan_conf_file(params, dirfd(dir), d->d_name);
+	}
+
+	closedir(dir);
+}
+
+/*****************************************************************************/
+/*
+ * Scan the contents of a configuration file.
+ */
+static void scan_conf_file(struct parameters *params, int dirfd, const char *conffile)
 {
 	char buf[4096 + 2], *p, *q;
 	FILE *conf;
-	int len, oplen, ktlen, kdlen, cilen;
-
-	oplen = strlen(op);
-	ktlen = strlen(ktype);
-	kdlen = strlen(kdesc);
-	cilen = strlen(callout_info);
-
-	/* search the config file for a command to run */
-	if (strlen(ktype) <= sizeof(conffile) - 30) {
-		if (verbosity < 2)
-			snprintf(conffile, sizeof(conffile) - 1,
-				 "/etc/request-key.d/%s.conf", ktype);
-		else
-			snprintf(conffile, sizeof(conffile) - 1,
-				 "request-key.d/%s.conf", ktype);
-		conf = fopen(conffile, "r");
-		if (conf)
-			goto opened_conf_file;
-		if (errno != ENOENT)
-			error("Cannot open %s: %m\n", conffile);
+	int fd;
+
+	debug("__ read %s __\n", conffile);
+
+	fd = openat(dirfd, conffile, O_RDONLY);
+	if (fd < 0) {
+		if (errno == ENOENT)
+			return;
+		error("Cannot open %s: %m\n", conffile);
 	}
 
-	if (verbosity < 2)
-		snprintf(conffile, sizeof(conffile) - 1, "/etc/request-key.conf");
-	else
-		snprintf(conffile, sizeof(conffile) - 1, "request-key.conf");
-	conf = fopen(conffile, "r");
+	conf = fdopen(fd, "r");
 	if (!conf)
 		error("Cannot open %s: %m\n", conffile);
 
-opened_conf_file:
-	debug("Opened config file '%s'\n", conffile);
-
 	for (confline = 1;; confline++) {
+		unsigned int wildness[4] = {};
+		unsigned int len;
+
 		/* read the file line-by-line */
 		if (!fgets(buf, sizeof(buf), conf)) {
 			if (feof(conf))
-				error("Cannot find command to construct key %d\n", key);
+				break;
 			file_error("error %m\n");
 		}
 
@@ -324,7 +378,7 @@ opened_conf_file:
 			goto syntax_error;
 		*p = 0;
 
-		if (!match(q, p - q, op, oplen))
+		if (!match(q, p - q, params->op, params->oplen, &wildness[0]))
 			continue;
 
 		p++;
@@ -340,7 +394,7 @@ opened_conf_file:
 			goto syntax_error;
 		*p = 0;
 
-		if (!match(q, p - q, ktype, ktlen))
+		if (!match(q, p - q, params->key_type, params->ktlen, &wildness[1]))
 			continue;
 
 		p++;
@@ -356,7 +410,7 @@ opened_conf_file:
 			goto syntax_error;
 		*p = 0;
 
-		if (!match(q, p - q, kdesc, kdlen))
+		if (!match(q, p - q, params->key_desc, params->kdlen, &wildness[2]))
 			continue;
 
 		p++;
@@ -372,42 +426,64 @@ opened_conf_file:
 			goto syntax_error;
 		*p = 0;
 
-		if (!match(q, p - q, callout_info, cilen))
+		if (!match(q, p - q, params->callout_info, params->cilen, &wildness[3]))
 			continue;
 
 		p++;
 
-		debug("%s:%d: Line matches\n", conffile, confline);
-
-		/* we've got an action */
+		/* we've got a match */
 		while (isspace(*p)) p++;
 		if (!*p)
 			goto syntax_error;
 
-		fclose(conf);
-
-		execute_program(op, key, ktype, kdesc, callout_info, p);
+		debug("%s:%d: Line matches '%s' (%u,%u,%u,%u)\n",
+		      conffile, confline, p,
+		      wildness[0], wildness[1], wildness[2], wildness[3]);
+
+		if (wildness[0] < cmd_wildness[0] ||
+		    (wildness[0] == cmd_wildness[0] &&
+		     wildness[1] < cmd_wildness[1]) ||
+		    (wildness[0] == cmd_wildness[0] &&
+		     wildness[1] == cmd_wildness[1] &&
+		     wildness[2] < cmd_wildness[2]) ||
+		    (wildness[0] == cmd_wildness[0] &&
+		     wildness[1] == cmd_wildness[1] &&
+		     wildness[2] == cmd_wildness[2] &&
+		     wildness[3] < cmd_wildness[3])
+		    ) {
+			memcpy(cmd_wildness, wildness, sizeof(cmd_wildness));
+			cmd_len = len - (p - buf);
+			cmd_confline = confline;
+			debug("%s:%d: Prefer command (%u,%u,%u,%u)\n",
+			      conffile, confline,
+			      wildness[0], wildness[1], wildness[2], wildness[3]);
+			memcpy(cmd, p, cmd_len + 1);
+			strcpy(cmd_conffile, conffile);
+		}
 	}
 
-	file_error("No matching action\n");
+	fclose(conf);
+	return;
 
 syntax_error:
 	line_error("Syntax error\n");
-
-} /* end lookup_action() */
+}
 
 /*****************************************************************************/
 /*
  * attempt to match a datum to a pattern
  * - one asterisk is allowed anywhere in the pattern to indicate a wildcard
  * - returns true if matched, false if not
+ * - adds the total number of chars skipped by wildcard to *_wildness
  */
-static int match(const char *pattern, int plen, const char *datum, int dlen)
+static int match(const char *pattern, int plen, const char *datum, int dlen,
+		 unsigned int *_wildness)
 {
 	const char *asterisk;
 	int n;
 
-	debug("match(%*.*s,%*.*s)\n", plen, plen, pattern, dlen, dlen, datum);
+	if (verbosity >= 2)
+		debug("match(%*.*s,%*.*s)", plen, plen, pattern, dlen, dlen, datum);
 
 	asterisk = memchr(pattern, '*', plen);
 	if (!asterisk) {
@@ -426,12 +502,11 @@ static int match(const char *pattern, int plen, const char *datum, int dlen)
 		/* wildcard at beginning of pattern */
 		pattern++;
 		if (!*pattern)
-			goto yes; /* "*" matches everything */
+			goto yes_wildcard; /* "*" matches everything */
 
 		/* match the end of the datum */
-		plen--;
-		if (memcmp(pattern, datum + (dlen - plen), plen) == 0)
-			goto yes;
+		if (memcmp(pattern, datum + (dlen - (plen - 1)), plen - 1) == 0)
+			goto yes_wildcard;
 		goto no;
 	}
 
@@ -440,20 +515,28 @@ static int match(const char *pattern, int plen, const char *datum, int dlen)
 		goto no;
 
 	if (!asterisk[1])
-		goto yes; /* "abc*" matches */
+		goto yes_wildcard; /* "abc*" matches */
 
 	/* match the end of the datum */
 	asterisk++;
 	n = plen - n - 1;
 	if (memcmp(pattern, datum + (dlen - n), n) == 0)
-		goto yes;
+		goto yes_wildcard;
 
 no:
-	debug(" = no\n");
+	if (verbosity >= 2)
+		debug(" = no\n");
 	return 0;
 
 yes:
-	debug(" = yes\n");
+	if (verbosity >= 2)
+		debug(" = yes (w=0)\n");
+	return 1;
+
+yes_wildcard:
+	*_wildness += dlen - (plen - 1);
+	if (verbosity >= 2)
+		debug(" = yes (w=%u)\n", dlen - (plen - 1));
 	return 1;
 
 } /* end match() */
@@ -462,18 +545,13 @@ yes:
 /*
  * execute a program to deal with a key
  */
-static void execute_program(char *op,
-			    key_serial_t key,
-			    char *ktype,
-			    char *kdesc,
-			    char *callout_info,
-			    char *cmdline)
+static void execute_program(struct parameters *params, char *cmdline)
 {
 	char *argv[256];
 	char *prog, *p, *q;
 	int argc, pipeit;
 
-	debug("execute_program('%s','%s')\n", callout_info, cmdline);
+	debug("execute_program('%s','%s')\n", params->callout_info, cmdline);
 
 	/* if the commandline begins with a bar, then we pipe the callout data into it and read
 	 * back the payload data
@@ -532,16 +610,16 @@ static void execute_program(char *op,
 		/* single character macros */
 		if (!q[1]) {
 			switch (*q) {
-			case 'o': argv[argc] = op;			continue;
-			case 'k': argv[argc] = xkey;			continue;
-			case 't': argv[argc] = ktype;			continue;
-			case 'd': argv[argc] = kdesc;			continue;
-			case 'c': argv[argc] = callout_info;		continue;
-			case 'u': argv[argc] = xuid;			continue;
-			case 'g': argv[argc] = xgid;			continue;
-			case 'T': argv[argc] = xthread_keyring;		continue;
-			case 'P': argv[argc] = xprocess_keyring;	continue;
-			case 'S': argv[argc] = xsession_keyring;	continue;
+			case 'o': argv[argc] = params->op;		continue;
+			case 'k': argv[argc] = params->key;		continue;
+			case 't': argv[argc] = params->key_type;	continue;
+			case 'd': argv[argc] = params->key_desc;	continue;
+			case 'c': argv[argc] = params->callout_info;	continue;
+			case 'u': argv[argc] = params->uid;		continue;
+			case 'g': argv[argc] = params->gid;		continue;
+			case 'T': argv[argc] = params->thread_keyring;	continue;
+			case 'P': argv[argc] = params->process_keyring;	continue;
+			case 'S': argv[argc] = params->session_keyring;	continue;
 			default:
 				line_error("Unsupported macro\n");
 			}
@@ -624,7 +702,7 @@ static void execute_program(char *op,
 	}
 
 	if (pipeit)
-		pipe_to_program(op, key, ktype, kdesc, callout_info, prog, argv);
+		pipe_to_program(params, prog, argv);
 
 	/* attempt to execute the command */
 	execv(prog, argv);
@@ -635,22 +713,16 @@ static void execute_program(char *op,
 
 /*****************************************************************************/
 /*
- * pipe the callout information to the specified program and retrieve the payload data over another
- * pipe
+ * pipe the callout information to the specified program and retrieve the
+ * payload data over another pipe
  */
-static void pipe_to_program(char *op,
-			    key_serial_t key,
-			    char *ktype,
-			    char *kdesc,
-			    char *callout_info,
-			    char *prog,
-			    char **argv)
+static void pipe_to_program(struct parameters *params, char *prog, char **argv)
 {
 	char errbuf[512], payload[32768 + 1], *pp, *pc, *pe;
 	int ipi[2], opi[2], epi[2], childpid;
 	int ifl, ofl, efl, npay, ninfo, espace, tmp;
 
-	debug("pipe_to_program(%s -> %s)", callout_info, prog);
+	debug("pipe_to_program(%s -> %s)", params->callout_info, prog);
 
 	if (pipe(ipi) < 0 || pipe(opi) < 0 || pipe(epi) < 0)
 		error("pipe failed: %m");
@@ -700,8 +772,8 @@ static void pipe_to_program(char *op,
 	    fcntl(FROMSTDERR, F_SETFL, efl) < 0)
 		error("fcntl/F_SETFL failed: %m");
 
-	ninfo = strlen(callout_info);
-	pc = callout_info;
+	ninfo = params->cilen;
+	pc = params->callout_info;
 
 	npay = sizeof(payload);
 	pp = payload;
@@ -858,7 +930,8 @@ static void pipe_to_program(char *op,
 
 		norecurse = 1;
 		debug("child exited %d\n", WEXITSTATUS(tmp));
-		lookup_action("negate", key, ktype, kdesc, callout_info);
+		params->op = "negate";
+		lookup_action(params);
 	}
 
 	if (WIFSIGNALED(tmp)) {
@@ -866,14 +939,14 @@ static void pipe_to_program(char *op,
 			error("child died on signal %d\n", WTERMSIG(tmp));
 
 		norecurse = 1;
-		debug("child died on signal %d\n", WTERMSIG(tmp));
-		lookup_action("negate", key, ktype, kdesc, callout_info);
+		params->op = "negate";
+		lookup_action(params);
 	}
 
 	/* attempt to instantiate the key */
 	debug("instantiate with %td bytes\n", pp - payload);
 
-	if (keyctl_instantiate(key, payload, pp - payload, 0) < 0)
+	if (keyctl_instantiate(params->key_id, payload, pp - payload, 0) < 0)
 		error("instantiate key failed: %m\n");
 
 	debug("instantiation successful\n");
