static struct key *construct_key_and_link(struct keyring_search_context *ctx,
					  const char *callout_info,
					  size_t callout_len,
					  void *aux,
					  struct key *dest_keyring,
					  unsigned long flags)
{
	struct key_user *user;
	struct key *key;
	int ret;

	kenter("");

 	if (ctx->index_key.type == &key_type_keyring)
 		return ERR_PTR(-EPERM);
 
	ret = construct_get_dest_keyring(&dest_keyring);
	if (ret)
		goto error;
 
	user = key_user_lookup(current_fsuid());
	if (!user) {
		ret = -ENOMEM;
		goto error_put_dest_keyring;
	}
 
 	ret = construct_alloc_key(ctx, dest_keyring, flags, user, &key);
 	key_user_put(user);

	if (ret == 0) {
		ret = construct_key(key, callout_info, callout_len, aux,
				    dest_keyring);
		if (ret < 0) {
			kdebug("cons failed");
			goto construction_failed;
		}
 	} else if (ret == -EINPROGRESS) {
 		ret = 0;
 	} else {
		goto error_put_dest_keyring;
 	}
 
 	key_put(dest_keyring);
	kleave(" = key %d", key_serial(key));
	return key;

 construction_failed:
 	key_negate_and_link(key, key_negative_timeout, NULL, NULL);
 	key_put(key);
error_put_dest_keyring:
 	key_put(dest_keyring);
error:
 	kleave(" = %d", ret);
 	return ERR_PTR(ret);
 }

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.