key_remove_domain(9)

💖 NAME 💖

okay bestie, meet key_remove_domain — “kill off a key domain and gc its keys.” This is key_remove_domain(9) from the Kernel API Manual, and it’s literally here to mark a domain tag dead, release a ref on it, and poke the gc if that wasn’t the last reference. no cap. 🫶

✨ SYNOPSIS ✨

void key_remove_domain (struct key_tag *domain_tag );

🌸 ARGUMENTS 🌸

• domain_tag — the domain tag to release. that’s the one. 🎀

🦋 DESCRIPTION 🦋

So here’s the vibe: key_remove_domain() marks a domain tag as being dead and releases a ref on it. 💅

If that ref wasn’t the last reference, the garbage collector is poked to try and delete all keys that were in the domain. periodt. 🧚

lowkey important: “not the last reference” is the condition for poking the gc — that’s the exact branch from the original. don’t skip it. 👑

⭐ SEE ALSO ⭐

Kernel file ./security/keys/keyring.c — and the related pages are:

• key_put_tag(9)
• restrict_link_reject(9)
• keyring_search_rcu(9)
• keyring_search(9)
• keyring_restrict(9)
• key_link(9)
• key_unlink(9)
• key_move(9)
• keyring_clear(9)

xoxo, your ./security/keys girlie — October 2026 edition, key_remove_domain(9) signing off 🎀✨