KADM5_POLICY_TL_DATA
KADM5_POLICY_ALLOWED_KEYSALTS | KADM5_POLICY_TL_DATA)
if (!(mask & KADM5_POLICY_TL_DATA)) {
if ((mask & KADM5_POLICY_TL_DATA)) {