restrict_li...nd_secondary(9)

🎀 NAME 🎀

okay so we're in the Kernel API Manual, bestie, and this page header is all truncated like restrict_li...nd_secondary(9) — but the actual star of the show is restrict_link_by_digsig_builtin_and_secondary — Restrict by digitalSignature. 💅✨

🌸 SYNOPSIS 🌸

int restrict_link_by_digsig_builtin_and_secondary (struct key *dest_keyring , const struct key_type *type , const union key_payload *payload , struct key *restrict_key );

💖 ARGUMENTS 💖

• dest_keyring — the keyring being linked to. that's the destination, bestie 🫶
• type — the type of key being added. gotta know her type 👑
• payload — the payload of the new key. the actual contents, no cap 💌
• restrict_key — a ring of keys that can be used to vouch for the new cert. it's giving references, but make it keys 🔑

🦋 DESCRIPTION 🦋

okay so this function restricts the addition of keys into a keyring. the vibe check is simple: the key-to-be-added has to be vouched for by a key in either the built-in system keyring or the secondary system keyring. built-in bestie or secondary bestie, either one can vouch. 💖

and the new key must have the digitalSignature usage field set. no digitalSignature field? no entry. periodt. 💀✨

🌈 SEE ALSO 🌈

• Kernel file ./certs/system_keyring.c
• restrict_link_by_builtin_trusted(9)
• restrict_link_by_digsig_builtin(9)
• restrict_link_by_builtin_and_secondary_trusted(9)
• add_to_secondary_keyring(9)
• restrict_link_by_builtin_secondary_and_machine(9)
• verify_pkcs7_message_sig(9)
• verify_pkcs7_signature(9)

okay bye bestie — this page is from the Kernel API Manual, source ./certs, dated October 2026, and its page name is restrict_li...nd_secondary(9). slay ✨💅