restrict_link_by_digsig(9)

💅 restrict_link_by_digsig — the manual page, but make it make sense

okay so bestie, you clicked on restrict_link_by_digsig from the Kernel API Manual and honestly? you're about to understand keyrings better than half the people who wrote them. this is the vibe: it's a function that decides who gets to join the group chat (the keyring) based on whether their ID card has the right sticker on it. let's go 🎀

---

✨ NAME ✨

restrict_link_by_digsig — the bouncer at the door of a ring of digsig keys. restricts additions to that ring, no cap. 🔥

---

✨ SYNOPSIS ✨

int restrict_link_by_digsig (struct key *dest_keyring , const struct
       key_type *type , const union key_payload *payload , struct key
       *trust_keyring );

literally the whole signature, character for character, don't @ me 💅

---

✨ ARGUMENTS ✨

• dest_keyring — the keyring being linked to. this is the group chat we're trying to add somebody to 🫶
• type — the type of key being added. what kind of member is this, bestie
• payload — the payload of the new key. the actual content, the main character energy ✨
• trust_keyring — a ring of keys that can be used to vouch for the new cert. these are the references we call, iykyk 👑

---

✨ DESCRIPTION ✨

so here's the whole plan, and it's giving very methodical:

First, check if the new certificate has digitalSignature usage set. if it does, then mark the new certificate as being ok to link. iconic, honestly 🦋

Afterwards, verify the new certificate against the ones in the trust_keyring. like, the new cert said it's cool, but do the trusted friends actually recognise it? that's the vibe check.

Now for the return values, bestie — read these carefully, this is the important part 🌸:

• Returns 0 if the new certificate was accepted. slay, they're in 💖
• -ENOKEY if the certificate is not a digsig. not the right kind of key, sorry bestie 💀
• -ENOPKG if the signature uses unsupported crypto. like, we literally don't have the package for that, can't help you 🧚
• or some other error if there is a matching certificate but the signature check cannot be performed. so close and yet so far 😭

ngl, "some other error" is the most ominous vibe in this whole page — if you hit that branch, the cert matched but the check itself couldn't run. don't assume it's a yes. 🙈

---

✨ SEE ALSO ✨

• Kernel file ./crypto/asymmetric_keys/restrict.c — the source, go read it, it's right there 💜
• restrict_link_by_signature(9) — the sibling, also restricted, also valid 🌈
• restrict_link_by_ca(9) — ca-flavoured restriction, very demure ⭐
• restrict_link_by_key_or_keyring(9) — key or keyring, best of both 🍓
• restrict_link_by_key_or_keyring_chain(9) — same but with chain energy 🔗

---

and that's the whole page, no notes 💅 this little cutie lives in ./crypto/asymmetric_keys, and the source/version line says October 2026 — so mark your calendar, she's from the future 👑✨ stay restricted, stay iconic, periodt. 🫶