request_key_and_link(9)

💖 request_key_and_link(9) 💖

okay so bestie, this is from the Kernel API Manual and it's literally the glow-up guide for requesting a key and caching it in a keyring — no cap, it's giving main character energy for kernel key management 🗝️✨

---

✨ SYNOPSIS ✨

struct key * request_key_and_link (struct key_type *type , const char
*description , struct key_tag *domain_tag , const void *callout_info ,
size_t callout_len , void *aux , struct key *dest_keyring , unsigned
long flags );

---

🎀 ARGUMENTS 🎀

• type — the type of key we want, like the vibe check for what kind of key this is 💅
• description — the searchable description of the key — this is how we find it later, periodt
• domain_tag — the domain in which the key operates, iykyk 🦋
• callout_info — the data to pass to the instantiation upcall (or NULL), lowkey the instructions for the upcall 🫶
• callout_len — the length of callout_info, fr fr gotta know how much data we're passing
• aux — auxiliary data for the upcall, extra sprinkle on top ✨
• dest_keyring — where to cache the key, like its home base 🏠
• flags — flags to key_alloc, the little settings that matter 💖

---

🌸 DESCRIPTION 🌸

okay so here's the tea: a key matching the specified criteria (type, description, domain_tag) is searched for in the process's keyrings. if it's found, it's returned with its usage count incremented — slay! 🔥

otherwise, if callout_info is not NULL, a key will be allocated and some service (probably in userspace) will be asked to instantiate it. like, "hey bestie, can you make this key for me?" 😭

if successfully found or created, the key will be linked to the destination keyring if one is provided. iconic behavior tbh 💅

Returns a pointer to the key if successful. but bestie, there are so many ways this can go sideways:

• -EACCES, -ENOKEY, -EKEYREVOKED or -EKEYEXPIRED — if an inaccessible, negative, revoked or expired key was found 😬
• -ENOKEY — if no key was found and no callout_info was given, literally nothing to work with
• -EDQUOT — if insufficient key quota was available to create a new key, the quota said no 💀
• -ENOMEM — if insufficient memory was available, out of brain space

🫶 important note bestie: if the returned key was created, then it may still be under construction, and wait_for_key_construction should be used to wait for that to complete. don't skip this step, fr fr 🙈

---

🔥 SEE ALSO 🔥

• Kernel file ./security/keys/request_key.c — that's where the magic lives ✨
• complete_request_key(9) — the finisher
• wait_for_key_construction(9) — the patient bestie who waits
• request_key_tag(9) — the tag variant
• request_key_with_auxdata(9) — the auxdata variant
• request_key_rcu(9) — the RCU-friendly variant, lowkey fancy 🌈

---

and that's the whole vibe, bestie! this page is from ./security/keys and it's dated October 2026 — so go forth and request those keys like the icon you are 👑💜💖