PR_PAC_RESET_KEYS(2const)

💖 PR_PAC_RESET_KEYS — ok bestie, let's talk pointer auth keys

So like, this is the PR_PAC_RESET_KEYS(2const) page, aka the little corner of prctl(2) that handles pointer authentication on arm64. It's giving "security girlie" energy and honestly? We stan. ✨

---

🌸 NAME

PR_PAC_RESET_KEYS — reset the calling thread's pointer authentication code keys 💅

---

📚 LIBRARY

Standard C library (libc, -lc). The usual suspects, no cap.

---

🎀 SYNOPSIS

#include <linux/prctl.h>  /* Definition of PR_* constants */
#include <sys/prctl.h>

int prctl(PR_PAC_RESET_KEYS, unsigned long keys, 0L, 0L, 0L);

---

✨ DESCRIPTION

Okay so the whole vibe here: this securely resets your thread's pointer authentication keys to fresh random values that the kernel generates for you. Like a glow-up for your crypto keys, except the old ones get yeeted. 🦋

The set of keys you're resetting is specified by keys, and bestie, it has to be a logical OR of zero or more of these:

• PR_PAC_APIAKEY — instruction authentication key A 🔑
• PR_PAC_APIBKEY — instruction authentication key B 🔑
• PR_PAC_APDAKEY — data authentication key A 🔑
• PR_PAC_APDBKEY — data authentication key B 🔑
• PR_PAC_APGAKEY — generic authentication “A” key.

And for PR_PAC_APGAKEY, the manpage really said:

(Yes folks, there really is no generic B key.)

I cannot make this up. The kernel devs are funny for that one. 😭 No generic B key. None. Don't ask. 💀

🫶 the special case (iykyk)

As a special case, if keys is zero, then all the keys are reset. And here's the tea: since new keys could get added in the future, this is literally the recommended way to completely wipe the existing keys when you're establishing a clean execution context. So when in doubt, pass that zero and let it cook. 🔥

🌈 one thing you do NOT need to do

There is no need to use PR_PAC_RESET_KEYS in preparation for calling execve(2), because execve(2) resets all the pointer authentication keys for you. It's already on top of it. Don't do extra credit that nobody asked for. Periodt. 👑

---

⭐ RETURN VALUE

• On success, 0 is returned. Slay.
• On error, -1 is returned, and errno is set to indicate the error. Not slay, but informative. 🫠

---

😭 ERRORS

• EINVAL — keys contains set bits that are invalid or unsupported on this platform.

---

👑 STANDARDS

Linux. arm64 only. So if you're on x86 bestie… this is not your moment. 💀

---

🧚 HISTORY

Linux 5.0 (arm64). A modern classic, honestly.

---

🚨 CAVEATS — please read this part, I'm begging

Because the compiler or run-time environment may be using some or all of the keys, a successful PR_PAC_RESET_KEYS may crash the calling process.

Girl. Not a vibe. 😭

The conditions for using it safely are complex and system-dependent, so there's genuinely no simple answer here. And the manpage's official advice is basically:

Don't use it unless you know what you are doing.

That's not me being dramatic, that's literally the text. If you don't know exactly what you're doing, this call will humble you instantly. Main character energy only in the sense that the main character gets absolutely destroyed in scene one. 🙈

---

🔍 SEE ALSO

• prctl(2)

And for more information, see the kernel source file Documentation/arch/arm64/pointer-authentication.rst. 📖

---

That's the whole page, bestie. This was pulled from Linux man-pages 6.20, dated 2026-02-08 — so like, fresh off the press. Go forth and reset responsibly, or honestly, don't reset at all unless you're built different. 💖✨🎀