restrict_lin...dary_trusted(9)

💅 restrict_lin...dary_trusted(9) — like, the keyring bouncer manual 💅

okay so bestie, welcome to the Kernel API Manual, section 9, where we talk about restrict_link_by_builtin_and_secondary_trusted. yes that's the whole name, yes it's a mouthful, and yes the page title gets chopped to restrict_lin...dary_trusted(9) because honestly who has the screen width for all that 😭

---

✨ NAME ✨

restrict_link_by_builtin_and_secondary_trusted — Restrict keyring addition by both built-in and secondary keyrings. that's it, that's the vibe 🎀

---

🌸 SYNOPSIS 🌸

int restrict_link_by_builtin_and_secondary_trusted (struct key
*dest_keyring , const struct key_type *type , const union key_payload
*payload , struct key *restrict_key );

like, four args, one int coming back at you. slay.

---

🦋 ARGUMENTS 🦋

• dest_keyring — Keyring being linked to. it's the destination, the final boss, the place the key is trying to get into 👑
• type — The type of key being added. gotta know what kind of key we're dealing with, iykyk 🔑
• payload — The payload of the new key. the actual contents, the whole personality of the key fr fr 💜
• restrict_key — A ring of keys that can be used to vouch for the new cert. think of it as the friend group that has to say "yeah, they're cool" before you get in 🫶

---

⭐ DESCRIPTION ⭐

so what does it actually do? it restricts the addition of keys into a keyring based on the key-to-be-added being vouched for by a key in either the built-in or the secondary system keyrings. either one, bestie — the built-in crew or the secondary crew, both count as valid vouching. no cap. ✨

---

🎀 SEE ALSO 🎀

• Kernel file ./certs/system_keyring.c — like, the actual source, go look at it, it's giving main character energy 📂
• restrict_link_by_builtin_trusted(9)
• restrict_link_by_digsig_builtin(9)
• restrict_link_by_digsig_builtin_and_secondary(9)
• add_to_secondary_keyring(9)
• restrict_link_by_builtin_secondary_and_machine(9)
• verify_pkcs7_message_sig(9)
• verify_pkcs7_signature(9)

like a whole little family of restrict-and-verify functions, obsessed 💖

---

bestie reminder: all of those SEE ALSO pages are section (9) for a reason — kernel API territory, not your regular userland commands. 🧚

---

and that's the whole page!! thanks for reading, love u, go verify some signatures 💅🌸

this gem came out of ./certs, October 2026 — catch you in the next manpage, bestie 🦋