restrict_lin..._and_machine(9)

✨ restrict_lin..._and_machine(9) ✨

okay so bestie, welcome to the Kernel API Manual 💖 this one's a little kernel function with a very long name and honestly? it's giving gatekeeper energy — quite literally, because its whole job is deciding who gets to be in the keyring. iykyk 🔑

---

🌸 NAME 🌸

restrict_link_by_builtin_secondary_and_machine — it restricts keyring addition. that's it, that's the vibe 🎀

---

🦋 SYNOPSIS 🦋

int restrict_link_by_builtin_secondary_and_machine(struct key *dest_keyring,
                                                   const struct key_type *type,
                                                   const union key_payload *payload,
                                                   struct key *restrict_key);

literally the whole signature, no notes. copy it exactly, queen 👑

---

💅 ARGUMENTS 💅

so it takes four things, and here's what each one is doing at the function party:

• dest_keyring — the keyring that's being linked to. the destination. the place where the new key wants to live 🏠
• type — the type of the key that's being added. what kind of key is it, bestie? 👀
• payload — the payload of the new key. the actual contents, the main character itself ✨
• restrict_key — a ring of keys that can be used to vouch for the new cert. think of it as the friend group that has to say "yeah, we know her" 🫶

---

🌈 DESCRIPTION 🌈

so here's the tea ☕: this function restricts the addition of keys into a keyring — the key trying to get added has to be vouched for by a key that lives in one of three places:

1. the built-in keyring
2. the secondary keyring
3. the machine keyring

any one of those three can do the vouching, and then the new key gets to slide in. no vouch, no entry 💀 it's a whole vibe check for cryptographic keys, and honestly? iconic.

---

💜 SEE ALSO 💜

• the kernel file: ./certs/system_keyring.c
• restrict_link_by_builtin_trusted(9)
• restrict_link_by_digsig_builtin(9)
• restrict_link_by_builtin_and_secondary_trusted(9)
• restrict_link_by_digsig_builtin_and_secondary(9)
• add_to_secondary_keyring(9)
• verify_pkcs7_message_sig(9)
• verify_pkcs7_signature(9)

go read all of them, fr fr, they're besties too 🧚

---

no cap, this is the entire page — nothing skipped, nothing invented. every option, every argument, every reference, all of it. slay 💅

---

and that's a wrap, bestie! 🎀 this one came out of ./certs, dated October 2026, and the header says restrict_lin..._and_machine(9) (yes the title is literally truncated like that, we don't make the rules 😭). mwah, go forth and keyring responsibly 💖✨🦋