restrict_li...gsig_builtin(9)

Hii bestie 💖 okay so this is the Kernel API Manual page for restrict_li...gsig_builtin(9), and it's literally all about the built-in keyring being the main character when it comes to vouching for new keys. No cap.

✨ NAME ✨

restrict_link_by_digsig_builtin — restrict digitalSignature key additions by the built-in keyring.

🌸 SYNOPSIS 🌸

int restrict_link_by_digsig_builtin (struct key *dest_keyring , const
       struct key_type *type , const union key_payload *payload , struct key
       *restriction_key );

🎀 ARGUMENTS 🎀

• dest_keyring — the keyring that's being linked to, aka the destination bestie.
• type — the type of the key being added.
• payload — the payload of the new key.
• restriction_key — a ring of keys that can be used to vouch for the new cert. Yep, a whole squad of vouchers.

💅 DESCRIPTION 💅

So the vibe check here is this: the function restricts the addition of keys into a keyring, based on the key-to-be-added being vouched for by a key in the built-in system keyring. Translation? The new key can't just stroll in on main character energy alone — it needs that built-in system keyring vouch. Also super important: the new key must have the digitalSignature usage field set. Non-negotiable, periodt.

🦋 SEE ALSO 🦋

• Kernel file ./certs/system_keyring.c
• restrict_link_by_builtin_trusted(9)
• restrict_link_by_builtin_and_secondary_trusted(9)
• restrict_link_by_digsig_builtin_and_secondary(9)
• add_to_secondary_keyring(9)
• restrict_link_by_builtin_secondary_and_machine(9)
• verify_pkcs7_message_sig(9)
• verify_pkcs7_signature(9)

okay bye bestie 🫶 this lil page's source/version is ./certs, dated October 2026, and it's the restrict_li...gsig_builtin(9) manual entry — iconic, mwah 💋✨