key_move(9)

💅 key_move(9) — like, the actual manual page, bestie

okay so this is key_move(9) from the Kernel API Manual, and honestly? it's giving "small function, big responsibilities." it moves a key from one keyring to another. that's the whole vibe. let's get into it 🎀

---

✨ NAME ✨

key_move — move a key from one keyring to another. yes, literally that. no crumbs left behind 🦋

---

🌸 SYNOPSIS 🌸

int key_move (struct key *key , struct key *from_keyring , struct key
*to_keyring , unsigned int flags );

look at her. four parameters. one int return. main character energy fr fr 👑

---

💖 ARGUMENTS 💖

• key — the key we're moving. the little guy in question 🥺
• from_keyring — the keyring we're removing the link from. she's losing a link today, it's fine, she'll recover 💅
• to_keyring — the keyring we're making the link in. she's gaining one. slay.
• flags — qualifying flags, like KEYCTL_MOVE_EXCL. the "qualifying" is doing a lot of work there ngl ✨

---

🦋 DESCRIPTION 🦋

so what actually happens? key_move makes a link in to_keyring to a key, such that the keyring holds a reference on that key and the key can potentially be found by searching that keyring — and simultaneously removes a link to the key from from_keyring. one motion, two outcomes, iconic behaviour honestly 🔥

this function will write-lock both keyring's semaphores and will consume some of the user's key data quota to hold the link on to to_keyring. so yeah, it's not free. budget accordingly 🙈

returns 0 if successful. and if it's not successful, here's the whole mood board of error codes:

• -ENOTDIR — if either keyring isn't a keyring. like bestie, that's not a keyring 💀
• -EKEYREVOKED — if either keyring has been revoked. oop.
• -ENFILE — if the second keyring is full. no room, no vibes 😭
• -EDQUOT — if there is insufficient key data quota remaining to add another link. the quota said no 🍓
• -ENOMEM — if there's insufficient memory. classic.
• -EEXIST — only if KEYCTL_MOVE_EXCL is set, and only if there's already a matching key in to_keyring. exclusivity is a boundary, respect it 💅

also important, and i'm not being cute about this one: it is assumed that the caller has checked that it is permitted for a link to be made. meaning the keyring should have Write permission and the key needs Link permission. the function is not doing that check for you — that's your job, bestie 🫶

---

🌈 SEE ALSO 🌈

go read these next, they're all part of the same friend group:

• Kernel file ./security/keys/keyring.c
• key_put_tag(9)
• key_remove_domain(9)
• restrict_link_reject(9)
• keyring_search_rcu(9)
• keyring_search(9)
• keyring_restrict(9)
• key_link(9)
• key_unlink(9)
• keyring_clear(9)

---

⭐ okay that's the page!! sourced from ./security/keys, dated October 2026 — so like, future-dated documentation, we love a forward-thinking queen. bye bestie, go move some keys 💜🧚