bpf_lookup_system_key(9)

💅 bpf_lookup_system_key(9) — from the Kernel API Manual, bestie ✨

okay so picture this: you're deep in kernel land, the Kernel API Manual is open, and you need to find a key by a system-defined ID. That's the whole entire vibe of bpf_lookup_system_key. Let me walk you through it 🫶

---

🌸 NAME 🌸

bpf_lookup_system_key — lookup a key by a system-defined ID 🔑

---

✨ SYNOPSIS ✨

__bpf_kfunc struct bpf_key * bpf_lookup_system_key (u64 id );

literally that's it. that's the whole signature. no cap 💅

---

🎀 ARGUMENTS 🎀

• id — the key ID. that's it, that's the arg 🍓

---

🦋 DESCRIPTION 🦋

So what does it do? It obtains a bpf_key structure with a key pointer set to the passed key ID. Easy. Iconic. No notes. 💖

But here's the spicy part: that key pointer is marked as invalid, on purpose, so that bpf_key_put won't try to decrement the key reference count on that pointer. yeah, it's giving "don't touch, i'm not a real ref". The key pointer set in such a way is currently understood only by verify_pkcs7_signature. So like, only that one function speaks this language. iykyk 😭

Now, set id to one of the values defined in include/linux/verification.h — here's the menu, bestie:

• 0 — for the primary keyring (that's the immutable keyring of system keys) 👑
• VERIFY_USE_SECONDARY_KEYRING — for both the primary and secondary keyring (where keys can be added only if they are vouched for by existing keys in those keyrings) 🌈
• VERIFY_USE_PLATFORM_KEYRING — for the platform keyring (primarily used by the integrity subsystem to verify a kexec'ed kerned image and, possibly, the initramfs signature) 🔥

ngl the platform keyring one is doing a lot of heavy lifting in that sentence. read it twice. it's fine. it's beautiful. 🧚

---

💜 RETURN 💜

On success? a bpf_key pointer with an invalid key pointer set from the pre-determined ID. 💫

Otherwise? a NULL pointer. and that's the tea 💀

---

⭐ SEE ALSO ⭐

go read the kernel file ./kernel/bpf/helpers.c bestie, and while you're there, here's the whole friend group:

• bpf_obj_new(9)
• bpf_percpu_obj_new(9)
• bpf_obj_drop(9)
• bpf_percpu_obj_drop(9)
• bpf_refcount_acquire(9)
• bpf_list_push_front(9)
• bpf_list_push_back(9)
• bpf_rbtree_add(9)
• bpf_task_acquire(9)
• bpf_task_release(9)
• bpf_cgroup_acquire(9)
• bpf_cgroup_release(9)
• bpf_cgroup_ancestor(9)
• bpf_cgroup_from_id(9)
• bpf_task_under_cgroup(9)
• bpf_task_get_cgroup1(9)
• bpf_task_from_pid(9)
• bpf_task_from_vpid(9)
• bpf_dynptr_slice(9)
• bpf_dynptr_slice_rdwr(9)
• bpf_dynptr_copy(9)
• bpf_dynptr_memset(9)
• bpf_iter_bits_new(9)
• bpf_iter_bits_next(9)
• bpf_iter_bits_destroy(9)
• bpf_copy_from_user_str(9)
• bpf_copy_from_user_task_str(9)
• bpf_strcmp(9)
• bpf_strcasecmp(9)
• bpf_strnchr(9)
• bpf_strchr(9)
• bpf_strchrnul(9)
• bpf_strrchr(9)
• bpf_strnlen(9)
• bpf_strlen(9)
• bpf_strspn(9)
• bpf_strcspn(9)
• bpf_strstr(9)
• bpf_strcasestr(9)
• bpf_strnstr(9)
• bpf_strncasestr(9)
• bpf_lookup_user_key(9)
• bpf_key_put(9)
• bpf_verify_pkcs7_signature(9)
• bpf_task_work_schedule_signal(9)
• bpf_task_work_schedule_resume(9)
• bpf_timer_cancel_async(9)

---

and that's the page!! 🎀 mwah 💋

from the ./kernel/bpf corner of the world, dated October 2026 — go forth and look up those keys, bestie. slay 💅✨