ipe_new_policy(9)

📦 version 7.3.1, in nixpkgs unstable

💖 ipe_new_policy(9) 💖

okay so bestie, welcome to ipe_new_policy — it's a kernel API manual page (the manual itself is literally called Kernel API Manual, which is giving "I'm the whole syllabus" energy ngl). This function lives in the ./security/ipe corner of the kernel and it's the main character of allocating and parsing an ipe_policy structure. Let's get into it 🫶

✨ NAME ✨

ipe_new_policy — Allocate and parse an ipe_policy structure. That's it, that's the whole job description, and honestly it ate 💅

🦋 SYNOPSIS 🦋

struct ipe_policy * ipe_new_policy (const char *text , size_t textlen ,
       const char *pkcs7 , size_t pkcs7len );

Four arguments, one struct ipe_policy * coming back at you. Slay ✨

🌸 ARGUMENTS 🌸

  • text — Supplies a pointer to the plain-text policy to parse. Like, the actual readable policy. Fresh out the group chat, no signature, just vibes.
  • textlen — Supplies the length of text. Yes bestie, you gotta tell it how long it is, it's not gonna count for you 😭
  • pkcs7 — Supplies a pointer to a pkcs7-signed IPE policy. Fancy cryptographic signed version. Iconic behavior only 🔥
  • pkcs7len — Supplies the length of pkcs7. Same deal as textlen, keep it exact.

👑 DESCRIPTION 👑

okay so here's the one rule of the whole page, and it's lowkey important:

text/textlen Should be NULL/0 if pkcs7/pkcs7len is set. No cap. Like, pick a lane — you're either doing plain text or you're doing the signed pkcs7 thing. Don't do both, it's giving messy 💀

🎀 RETURN 🎀

Here's the vibe check on what comes back at you:

  • a pointer to the ipe_policy structure — Success 🎉 (this is the good ending, we love to see it)
  • -EBADMSG — Policy is invalid 🙈 (the policy said something unhinged and got rejected)
  • -ENOMEM — Out of memory (OOM) 😭 (the machine is full, no more room bestie)
  • -ERANGE — Policy version number overflow 💀 (the version number got way too big, it's over-committing)
  • -EINVAL — Policy version parsing error 🫠 (couldn't even read the version, embarrassing)
  • -ENOKEY — Policy signing key not found 🔍 (where is the key. the key is missing. who took the key)
  • -EKEYREJECTED — Policy signature verification failed ❌ (the signature did NOT pass the vibe check, straight up rejected)
fr fr, every one of these error codes is a different flavor of "nope" — don't assume they're interchangeable, they each mean a specific thing 💅

🌈 SEE ALSO 🌈

Kernel file ./security/ipe/policy.c and its besties:

go read them, they're all part of the same squad 🧚

aaaand that's the page!! sign-off time: this one ships out of ./security/ipe in the October 2026 release, so like, future energy but make it kernel 🦋⭐ periodt ✨💜

📦 where this page comes from