diff --git a/sdk_container/src/third_party/coreos-overlay/sys-apps/keyutils/Manifest b/sdk_container/src/third_party/coreos-overlay/sys-apps/keyutils/Manifest
new file mode 100644
index 0000000000..08c5655aca
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/sys-apps/keyutils/Manifest
@@ -0,0 +1 @@
+DIST keyutils-1.5.9.tar.bz2 74683 SHA256 4da2c5552c688b65ab14d4fd40fbdf720c8b396d8ece643e040cf6e707e083ae SHA512 d4ee1dabb87844e18bfd8d094a5bc9ce792c96720b71e77961b6c36bb1addb9acea2a7004ddfba1d09b167af908368162312e5c3656b22a6266955bb57b887e2 WHIRLPOOL 0509cce076a32d2f319f596506d4aaeb83e1853ee6337e6a3041e6957e9098f4482ae56a9c6455605b72b3f34701a890e9be666b6fdd752ff14a3d3564dcba19
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-apps/keyutils/files/keyutils-1.5.5-makefile-fixup.patch b/sdk_container/src/third_party/coreos-overlay/sys-apps/keyutils/files/keyutils-1.5.5-makefile-fixup.patch
new file mode 100644
index 0000000000..ff4bcfa94d
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/sys-apps/keyutils/files/keyutils-1.5.5-makefile-fixup.patch
@@ -0,0 +1,27 @@
+Raw patch edit based on:
+
+From af14e945bd617bb82ebc4c6c8d4fb948d715f16a Mon Sep 17 00:00:00 2001
+From: Mike Frysinger <vapier@gentoo.org>
+Date: Fri, 2 Sep 2011 13:30:30 -0400
+Subject: [PATCH] depend on $(DEVELLIB) not -lkeyutils
+
+---
+ Makefile |    6 +++---
+ 1 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/Makefile b/Makefile
+index 9e3fa9b..46695d1 100644
+--- a/Makefile
++++ b/Makefile
+@@ -91,7 +91,7 @@
+ 	$(INSTALL) -D $(LIBNAME) $(DESTDIR)$(LIBDIR)/$(LIBNAME)
+ 	$(LNS) $(LIBNAME) $(DESTDIR)$(LIBDIR)/$(SONAME)
+ 	mkdir -p $(DESTDIR)$(USRLIBDIR)
+-	$(LNS) $(LIBDIR)/$(SONAME) $(DESTDIR)$(USRLIBDIR)/$(DEVELLIB)
++	$(LNS) $(SONAME) $(DESTDIR)$(LIBDIR)/$(DEVELLIB)
+ 	$(INSTALL) -D keyctl $(DESTDIR)$(BINDIR)/keyctl
+ 	$(INSTALL) -D request-key $(DESTDIR)$(SBINDIR)/request-key
+ 	$(INSTALL) -D request-key-debug.sh $(DESTDIR)$(SHAREDIR)/request-key-debug.sh
+-- 
+1.7.6
+
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-apps/keyutils/files/tmpfiles.d/keyutils.conf b/sdk_container/src/third_party/coreos-overlay/sys-apps/keyutils/files/tmpfiles.d/keyutils.conf
new file mode 100644
index 0000000000..5750b4b167
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/sys-apps/keyutils/files/tmpfiles.d/keyutils.conf
@@ -0,0 +1,3 @@
+L	/etc/request-key.conf	-	-	-	-	../usr/share/keyutils/request-key.conf
+d	/etc/request-key.d	-	-	-	-	-
+
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-apps/keyutils/keyutils-1.5.9-r2.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-apps/keyutils/keyutils-1.5.9-r2.ebuild
new file mode 100644
index 0000000000..911d66efe7
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/sys-apps/keyutils/keyutils-1.5.9-r2.ebuild
@@ -0,0 +1,87 @@
+# Copyright 1999-2014 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/sys-apps/keyutils/keyutils-1.5.9-r1.ebuild,v 1.11 2014/08/10 17:25:33 ago Exp $
+
+EAPI="5"
+
+inherit multilib eutils toolchain-funcs linux-info multilib-minimal systemd
+
+DESCRIPTION="Linux Key Management Utilities"
+HOMEPAGE="http://people.redhat.com/dhowells/keyutils/"
+SRC_URI="http://people.redhat.com/dhowells/${PN}/${P}.tar.bz2"
+
+LICENSE="GPL-2 LGPL-2.1"
+SLOT="0"
+KEYWORDS="alpha amd64 arm arm64 hppa ia64 ~m68k ~mips ppc ppc64 ~s390 ~sh sparc x86 ~amd64-linux ~arm-linux ~ia64-linux ~x86-linux"
+IUSE="test"
+
+RDEPEND="
+	abi_x86_32? (
+		!<=app-emulation/emul-linux-x86-baselibs-20140508-r1
+		!app-emulation/emul-linux-x86-baselibs[-abi_x86_32(-)]
+	)"
+DEPEND="!prefix? ( >=sys-kernel/linux-headers-2.6.11 )"
+
+pkg_setup() {
+	CONFIG_CHECK="~KEYS"
+	use test && CONFIG_CHECK="${CONFIG_CHECK} ~KEYS_DEBUG_PROC_KEYS"
+	ERROR_KEYS="You must have CONFIG_KEYS to use this package!"
+	ERROR_KEYS_DEBUG_PROC_KEYS="You must have CONFIG_KEYS_DEBUG_PROC_KEYS to run the package testsuite!"
+	linux-info_pkg_setup
+}
+
+src_prepare() {
+	epatch "${FILESDIR}"/${PN}-1.5.5-makefile-fixup.patch
+
+	# The lsb check is useless, so avoid spurious command not found messages.
+	sed -i -e 's,lsb_release,:,' tests/prepare.inc.sh || die
+	# All the test files are bash, but try to execute via `sh`.
+	sed -i -r \
+		-e 's:([[:space:]])sh([[:space:]]):\1bash\2:' \
+		tests/{Makefile*,*.sh} || die
+	find tests/ -name '*.sh' -exec sed -i '1s:/sh$:/bash:' {} +
+	# Some tests call the kernel which calls userspace, but that will
+	# run the install keyutils rather than the locally compiled one,
+	# so disable round trip tests.
+	rm -rf tests/keyctl/requesting/{bad-args,piped,valid}
+
+	multilib_copy_sources
+}
+
+multilib_src_compile() {
+	tc-export CC
+	tc-export AR
+	sed -i \
+		-e '1iRPATH=' \
+		-e '/^C.*FLAGS/s|:=|+=|' \
+		-e 's:-Werror::' \
+		-e '/^BUILDFOR/s:=.*:=:' \
+		-e "/^LIBDIR/s:=.*:=/usr/$(get_libdir):" \
+		-e '/^USRLIBDIR/s:=.*:=$(LIBDIR):' \
+		Makefile || die
+
+	emake
+}
+
+multilib_src_test() {
+	# Execute the locally compiled code rather than the
+	# older versions already installed in the system.
+	LD_LIBRARY_PATH=${BUILD_DIR} \
+	PATH="${BUILD_DIR}:${PATH}" \
+	emake test
+}
+
+multilib_src_install() {
+	# setup tmpfiles symlinks for moved confs
+	systemd_dotmpfilesd "${FILESDIR}"/tmpfiles.d/keyutils.conf
+
+	emake install ETCDIR=/usr/share/keyutils DESTDIR="${D}"
+	multilib_is_native_abi && gen_usr_ldscript -a keyutils
+
+	dosym ../usr/share/keyutils/request-key.conf /etc/request-key.conf
+	dodir /etc/request-key.d
+}
+
+multilib_src_install_all() {
+	dodoc README
+}