KEYCTL_CHOWN(2const)

💅 KEYCTL_CHOWN (the 2const one, bestie)

okay so. this is KEYCTL_CHOWN, and it's literally just "change the ownership of a key". that's it. that's the whole vibe. it lives in the 2const section, which is the little corner of the manual where all the keyctl sub-commands hang out. 🎀

---

✨ NAME ✨

KEYCTL_CHOWN — change the ownership of a key 👑

📚 LIBRARY 📚

Standard C library (libc, -lc) 🫶

🌀 SYNOPSIS 🌀

#include <linux/keyctl.h>  /* Definition of KEY* constants */
#include <sys/syscall.h>   /* Definition of SYS_* constants */
#include <unistd.h>

long syscall(SYS_keyctl, KEYCTL_CHOWN, key_serial_t key,
             uid_t uid, gid_t gid);

like, yes, you're calling syscall(2) directly because it's giving raw-kernel-energy today 😭

---

🌸 DESCRIPTION 🌸

Change the ownership (user and group ID) of a key. that's the whole thing. you're handing someone else the keys to the key. iconic.

• key contains the key ID. 👈 which key we're messing with
• uid contains the new user ID — or -1 in case the user ID shouldn't be changed. so -1 is the "no thank u, leave it" option 🚫
• gid contains the new group ID — or -1 in case the group ID shouldn't be changed. same deal, -1 means "don't touch" 🙈

The key must grant the caller setattr permission. no permission, no chown, no exceptions, periodt. 🔒

For the UID to be changed, or for the GID to be changed to a group the caller is not a member of, the caller must have the CAP_SYS_ADMIN capability (see capabilities(7)). so if you're out here trying to hand your key to a group you're not even in, you better be root-ish, bestie. 👑

If the UID is to be changed, the new user must have sufficient quota to accept the key. 📊 and the quota deduction will be removed from the old user and moved to the new user should the UID be changed. the accounting literally follows the key around like a little luggage tag. 🧳

---

⭐ RETURN VALUE ⭐

• On success, 0 is returned. slay. 🎉
• On error, -1 is returned, and errno is set to indicate the error. 💀

---

🦋 VERSIONS 🦋

A wrapper is provided in the libkeyutils library: keyctl_chown(3). so if you don't wanna raw-dog the syscall, there's a whole cozy little function for you in libkeyutils. 🫶

---

🌈 STANDARDS 🌈

Linux. just Linux. that's the standard. 🐧

---

💜 HISTORY 💜

Linux 2.6.10. ancient in kernel years, still eating. 🔥

---

👀 SEE ALSO 👀

• keyctl(2)
• keyctl_chown(3)

---

⚠️ quick vibe check: -1 for uid or gid means "don't change this one" — do not pass -1 thinking it's a real ID. and remember the setattr permission + CAP_SYS_ADMIN rules, because the kernel does not do vibes-based access control. 🧚

k that's the whole page, ily, go chown responsibly 💖

Linux man-pages 6.20, dated 2026-02-08 — that's the source/version energy this page is pulling from, mwah 💋