pkcs7_validate_trust(9)

💜 pkcs7_validate_trust 💜

okay so bestie, welcome to the kernel API manual for pkcs7_validate_trust — she's a function, she lives in the kernel, and honestly? she's doing the most important vibe check of your entire life: is this certificate chain actually trusted or is it giving stranger danger 🕵️‍♀️✨

---

🌸 NAME 🌸

pkcs7_validate_trust — validate the PKCS#7 trust chain, no cap 🔥

---

🎀 SYNOPSIS 🎀

int pkcs7_validate_trust (struct pkcs7_message *pkcs7 , struct key
*trust_keyring );

like, that's her whole signature, and yes she returns an int, she's an icon 💅

---

🦋 ARGUMENTS 🦋

• pkcs7 — The PKCS#7 certificate to validate. this is the main character of the operation, the one getting checked 👑
• trust_keyring — Signing certificates to use as starting points. think of these as the trusted besties you're like "ok if these girlies vouch for you, you're in" 🫶

---

⭐ DESCRIPTION ⭐

So here's the tea ☕: pkcs7_validate_trust validates that the certificate chain inside the PKCS#7 message intersects keys we already know and trust. literally a "do I know you?? do WE have mutuals??" situation 😭

She returns, in order of descending priority (yes bestie, priority order matters, read them in this order ngl):

• -EKEYREJECTED if a signature failed to match for which we have a valid key — 💀 the fraud detector went OFF, we had a key and the signature did NOT match. or:
• 0 if at least one signature chain intersects with the keys in the trust keyring — slay!! mutuals confirmed, trust established ✨ or:
• -ENOPKG if a suitable crypto module couldn't be found for a check on a chain — like we literally couldn't find the right tool for the job 🙈
• -ENOKEY if we couldn't find a match for any of the signature chains in the message — nobody knows this cert, we have zero mutuals, blocked 🚫

May also return -ENOMEM — because of course, memory said "not today" 😭

fr fr, watch the ordering: a matching failure with a valid key (-EKEYREJECTED) outranks a success (0), which outranks -ENOPKG, which outranks -ENOKEY. and -ENOMEM can just show up whenever it wants, rude.

---

🌈 SEE ALSO 🌈

• Kernel file ./crypto/asymmetric_keys/pkcs7_trust.c — go read the source bestie, it's right there 🧚‍♀️

---

and that's the whole page gorgeous 💖 this one's from the ./crypto/asymmetric_keys corner of the kernel, dated October 2026 — periodt, go validate some trust chains 👑🌸