restrict_lin...ltin_trusted(9)

💖 NAME 💖

okay so bestie, this is the restrict_lin...ltin_trusted(9) page from the Kernel API Manual, and we're diving in 🌈. The function is restrict_link_by_builtin_trusted, and it does exactly this: Restrict keyring addition by built-in CA. no cap, that's the whole name.

✨ SYNOPSIS ✨

int restrict_link_by_builtin_trusted (struct key *dest_keyring , const struct key_type *type , const union key_payload *payload , struct key *restriction_key );

🫶 ARGUMENTS 🫶

• dest_keyring — the keyring being linked to. literally the destination of the link, bestie.
• type — the type of key being added. gotta know the type 👑.
• payload — the payload of the new key. the actual contents, the goods, the payload.
• restriction_key — a ring of keys that can be used to vouch for the new cert. it's giving “vouch for me” energy 💅.

🌸 DESCRIPTION 🌸

so the vibe is: restrict the addition of keys into a keyring based on the key-to-be-added being vouched for by a key in the built in system keyring. That's it, that's the tea 🍵. The key-to-be-added needs that vouch from the built in system keyring — no extra lore, no invented rules, periodt.

🔥 SEE ALSO 🔥

Kernel file ./certs/system_keyring.c is right here in the mix, and the rest of the squad is:

• restrict_link_by_digsig_builtin(9)
• restrict_link_by_builtin_and_secondary_trusted(9)
• restrict_link_by_digsig_builtin_and_secondary(9)
• add_to_secondary_keyring(9)
• restrict_link_by_builtin_secondary_and_machine(9)
• verify_pkcs7_message_sig(9)
• verify_pkcs7_signature(9)

mwah 💋 — source is ./certs, version date is October 2026, and this iconic page is restrict_lin...ltin_trusted(9). periodt.