restrict_link_by_ca(9)

💅 restrict_link_by_ca(9) — the Kernel API Manual moment

okay so bestie, welcome to the kernel API manual, and today's main character is restrict_link_by_ca. yes she's a real function, yes she's from the kernel docs, and yes we're gonna read her together. grab a boba 🧋

---

✨ NAME ✨

restrict_link_by_ca — the vibe-checker that restricts additions to a ring of CA keys 🔐

---

🌸 SYNOPSIS 🌸

int restrict_link_by_ca (struct key *dest_keyring , const struct
       key_type *type , const union key_payload *payload , struct key
       *trust_keyring );

like, look at that signature. it's giving "I return an int and I mean it" 💅

---

🎀 ARGUMENTS 🎀

• dest_keyring — the keyring that's being linked to. she's the destination, the moment, the place where things get added 🫶
• type — the type of the key being added. literally just telling you what kind of key we're dealing with ✨
• payload — the payload of this new key. the actual contents, the inner world, the lore 🌸
• trust_keyring — unused. not used. sitting there. we don't touch her 🙈

---

🦋 DESCRIPTION 🦋

okay so here's the whole plot: this function checks if the new certificate is a CA. that's it, that's the quest 🗺️

if it is a CA? slay. then the new certificate gets marked as being ok to link. she's accepted, she's in, she's part of the group chat 👑

now the return values, and pay attention because this is the important part:

• returns 0 if the new certificate was accepted 💖
• -ENOKEY if the certificate is not a CA 😭 (she's just not that girl, no cap)
• -ENOPKG if the signature uses unsupported crypto 💀
• or some other error if there is a matching certificate but the signature check cannot be performed 🙃

ngl bestie, that last one is the shady one — matching cert exists but we can't even run the signature check, so you get "some other error" and you'll just have to deal. it's giving mysterious. it's giving iykyk.

---

🔥 SEE ALSO 🔥

• the kernel file ./crypto/asymmetric_keys/restrict.c — go read the source, it's right there 🧚
• restrict_link_by_signature(9)
• restrict_link_by_digsig(9)
• restrict_link_by_key_or_keyring(9)
• restrict_link_by_key_or_keyring_chain(9)

like the whole friendship group of restrict functions. iconic lineup honestly ⭐

---

and that's the page, bestie 🎀 this little gem lives in ./crypto/asymmetric_keys and it's dated October 2026 — so mark your calendar, screenshot it, send it to the group chat, periodt 💜🦋✨