diff --git a/keystore/test-keystore b/keystore/test-keystore
index 3be51b3..071cfcd 100755
--- a/keystore/test-keystore
+++ b/keystore/test-keystore
@@ -44,7 +44,7 @@
 function run() {
     # strip out carriage returns from adb
     # strip out date/time from ls -l
-    "$@" | tr --delete '\r' | sed -E 's/[0-9]{4}-[0-9]{2}-[0-9]{2} +[0-9]{1,2}:[0-9]{2} //' >> $log_file
+    "$@" | tr -d '\r' | sed -E 's/[0-9]{4}-[0-9]{2}-[0-9]{2} +[0-9]{1,2}:[0-9]{2} //' >> $log_file
 }
 
 function keystore() {
@@ -53,8 +53,15 @@
     run adb shell su $user keystore_cli "$@"
 }
 
+function keystore_in() {
+    declare -r user=$1
+    declare -r input=$2
+    shift; shift
+    run adb shell "echo '$input' | su $user keystore_cli $@"
+}
+
 function list_keystore_directory() {
-    run adb shell ls -al /data/misc/keystore
+    run adb shell ls -al /data/misc/keystore$@
 }
 
 function compare() {
@@ -68,195 +75,211 @@
     # reset
     #
     log "reset keystore as system user"
-    keystore system r
-    expect "1 No error"
+    keystore system reset
+    expect "reset: No error (1)"
     list_keystore_directory
+    expect "-rw------- keystore keystore        4 .metadata"
+    expect "drwx------ keystore keystore          user_0"
 
     #
     # basic tests as system/root
     #
     log "root does not have permission to run test"
-    keystore root t
-    expect "6 Permission denied"
-    
+    keystore root test
+    expect "test: Permission denied (6)"
+
     log "but system user does"
-    keystore system t
-    expect "3 Uninitialized"
+    keystore system test
+    expect "test: Uninitialized (3)"
     list_keystore_directory
+    expect "-rw------- keystore keystore        4 .metadata"
+    expect "drwx------ keystore keystore          user_0"
 
     log "password is now bar"
-    keystore system p bar
-    expect "1 No error"
-    list_keystore_directory
+    keystore system password bar
+    expect "password: No error (1)"
+    list_keystore_directory /user_0
     expect "-rw------- keystore keystore       84 .masterkey"
-    
+
     log "no error implies initialized and unlocked"
-    keystore system t
-    expect "1 No error"
-    
+    keystore system test
+    expect "test: No error (1)"
+
     log "saw with no argument"
-    keystore system s
-    expect "5 Protocol error"
+    keystore system saw
 
     log "saw nothing"
-    keystore system s ""
-    expect "1 No error"
+    keystore system saw ""
 
     log "add key baz"
-    keystore system i baz quux
-    expect "1 No error"
+    keystore_in system quux insert baz
+    expect "insert: No error (1)"
 
     log "1000 is uid of system"
-    list_keystore_directory
+    list_keystore_directory /user_0
     expect "-rw------- keystore keystore       84 .masterkey"
     expect "-rw------- keystore keystore       52 1000_baz"
 
     log "saw baz"
-    keystore system s ""
-    expect "1 No error"
+    keystore system saw
     expect "baz"
 
     log "get baz"
-    keystore system g baz
-    expect "1 No error"
+    keystore system get baz
     expect "quux"
 
     log "root can read system user keys (as can wifi or vpn users)"
-    keystore root g baz
-    expect "1 No error"
+    keystore root get baz
     expect "quux"
 
     #
     # app user tests
     #
 
-    # app_0 has uid 10000, as seen below
+    # u0_a0 has uid 10000, as seen below
     log "other uses cannot see the system keys"
-    keystore app_0 g baz
-    expect "7 Key not found"
-    
-    log "app user cannot use reset, password, lock, unlock"
-    keystore app_0 r
-    expect "6 Permission denied"
-    keystore app_0 p
-    expect "6 Permission denied"
-    keystore app_0 l
-    expect "6 Permission denied"
-    keystore app_0 u
-    expect "6 Permission denied"
+    keystore u0_a0 get baz
 
-    log "install app_0 key"
-    keystore app_0 i 0x deadbeef
-    expect 1 No error
-    list_keystore_directory
+    log "app user cannot use reset, password, lock, unlock"
+    keystore u0_a0 reset
+    expect "reset: Permission denied (6)"
+    keystore u0_a0 password some_pass
+    expect "password: Permission denied (6)"
+    keystore u0_a0 lock
+    expect "lock: Permission denied (6)"
+    keystore u0_a0 unlock some_pass
+    expect "unlock: Permission denied (6)"
+
+    log "install u0_a0 key"
+    keystore_in u0_a0 deadbeef insert 0x
+    expect "insert: No error (1)"
+    list_keystore_directory /user_0
     expect "-rw------- keystore keystore       84 .masterkey"
     expect "-rw------- keystore keystore       52 10000_0x"
     expect "-rw------- keystore keystore       52 1000_baz"
 
     log "get with no argument"
-    keystore app_0 g
-    expect "5 Protocol error"
-    
-    keystore app_0 g 0x
-    expect "1 No error"
+    keystore u0_a0 get
+    expect "Usage: keystore_cli get <name>"
+
+    log "few get tests for an app"
+    keystore u0_a0 get 0x
     expect "deadbeef"
-    
-    keystore app_0 i fred barney
-    expect "1 No error"
-    
-    keystore app_0 s ""
-    expect "1 No error"
+
+    keystore_in u0_a0 barney insert fred
+    expect "insert: No error (1)"
+
+    keystore u0_a0 saw
     expect "0x"
     expect "fred"
 
     log "note that saw returns the suffix of prefix matches"
-    keystore app_0 s fr # fred
-    expect "1 No error"
+    keystore u0_a0 saw fr # fred
     expect "ed" # fred
 
     #
     # lock tests
     #
     log "lock the store as system"
-    keystore system l
-    expect "1 No error"
-    keystore system t
-    expect "2 Locked"
-    
+    keystore system lock
+    expect "lock: No error (1)"
+    keystore system test
+    expect "test: Locked (2)"
+
     log "saw works while locked"
-    keystore app_0 s ""
-    expect "1 No error"
+    keystore u0_a0 saw
     expect "0x"
     expect "fred"
 
-    log "...but cannot read keys..."
-    keystore app_0 g 0x
-    expect "2 Locked"
-    
-    log "...but they can be deleted."
-    keystore app_0 e 0x
-    expect "1 No error"
-    keystore app_0 d 0x
-    expect "1 No error"
-    keystore app_0 e 0x
-    expect "7 Key not found"
+    log "...and app can read keys..."
+    keystore u0_a0 get 0x
+    expect "deadbeef"
+
+    log "...but they cannot be deleted."
+    keystore u0_a0 exist 0x
+    expect "exist: No error (1)"
+    keystore u0_a0 del_key 0x
+    expect "del_key: Key not found (7)"
 
     #
     # password
     #
     log "wrong password"
-    keystore system u foo
-    expect "13 Wrong password (4 tries left)"
+    keystore system unlock foo
+    expect "unlock: Wrong password (4 tries left) (13)"
     log "right password"
-    keystore system u bar
-    expect "1 No error"
-    
+    keystore system unlock bar
+    expect "unlock: No error (1)"
+
     log "make the password foo"
-    keystore system p foo
-    expect "1 No error"
-    
+    keystore system password foo
+    expect "password: No error (1)"
+
     #
     # final reset
     #
     log "reset wipes everything for all users"
-    keystore system r
-    expect "1 No error"
+    keystore system reset
+    expect "reset: No error (1)"
     list_keystore_directory
-    
-    keystore system t
-    expect "3 Uninitialized"
+    expect "-rw------- keystore keystore        4 .metadata"
+    expect "drwx------ keystore keystore          user_0"
+    list_keystore_directory /user_0
 
+    keystore system test
+    expect "test: Uninitialized (3)"
+}
+
+function test_grant() {
+    log "test granting"
+    keystore system reset
+    expect "reset: No error (1)"
+    keystore system password test_pass
+    expect "password: No error (1)"
+
+    keystore_in system granted_key_value insert granted_key
+    expect "insert: No error (1)"
+  
+    # Cannot read before grant.
+    keystore u10_a0 get granted_key
+    
+    # Grant and read.
+    log "System grants to u0_a1"
+    keystore system grant granted_key 10001 
+    expect "Working with uid 10001"
+    expect "grant: No error (1)"
+    keystore u0_a1 get 1000_granted_key
+    expect "granted_key_value"
 }
 
 function test_4599735() {
     # http://b/4599735
     log "start regression test for b/4599735"
-    keystore system r
-    expect "1 No error"
+    keystore system reset
+    expect "reset: No error (1)"
+    list_keystore_directory /user_0
 
-    keystore system p foo
-    expect "1 No error"
+    keystore system password foo
+    expect "password: No error (1)"
 
-    keystore system i baz quux
-    expect "1 No error"
-    
-    keystore root g baz
-    expect "1 No error"
+    keystore_in system quux insert baz
+    expect "insert: No error (1)"
+
+    keystore root get baz
     expect "quux"
 
-    keystore system l
-    expect "1 No error"
+    keystore system lock
+    expect "lock: No error (1)"
 
-    keystore system p foo
-    expect "1 No error"
+    keystore system password foo
+    expect "password: No error (1)"
 
     log "after unlock, regression led to result of '8 Value corrupted'"
-    keystore root g baz
-    expect "1 No error"
+    keystore root get baz
     expect "quux"
 
-    keystore system r
-    expect "1 No error"
+    keystore system reset
+    expect "reset: No error (1)"
     log "end regression test for b/4599735"
 }
 
@@ -265,6 +288,7 @@
     log $tag START
     test_basic
     test_4599735
+    test_grant
     compare
     log $tag PASSED
     cleanup_output