restrict_li...y_or_keyring(9)

💜 restrict_link_by_key_or_keyring(9) — the Kernel API Manual page your group chat needed

okay bestie so you're in the Kernel API Manual and this function is called restrict_link_by_key_or_keyring (yes the header abbreviates it as restrict_li...y_or_keyring(9), we're all doing our best 💅). It's the one that decides whether a new key is allowed to join the keyring, using the restrict_key info that's already stored in the ring. slay.

---

✨ SYNOPSIS ✨

int restrict_link_by_key_or_keyring (struct key *dest_keyring , const
       struct key_type *type , const union key_payload *payload , struct key
       *trusted );

that's the whole signature, verbatim, no cap 🫶

---

🎀 ARGUMENTS 🎀

• dest_keyring — the keyring being linked to. the destination, the final boss, the place the new key wants to live 💖
• type — the type of key being added. like, what kind of key is this, bestie 🌸
• payload — the payload of the new key. the actual contents, the inner self ✨
• trusted — a key or ring of keys that can be used to vouch for the new cert. your key's references, basically 👑

---

🦋 DESCRIPTION 🦋

so here's the vibe check 🔍: it checks the new certificate only against the key or keys passed in the data parameter. literally only those. if one of those is the signing key and it validates the new certificate, then the new certificate gets marked as being ok to link — green flag, come on in 🎉💚

it's giving "you're either vouched for or you're not" and honestly? iconic.

what it returns (the moment of truth, the results, the ✨ grades ✨):

• Returns 0 if the new certificate was accepted — ate and left no crumbs 👑
• -ENOKEY if we couldn't find a matching parent certificate in the trusted list — the vibe is missing 😭
• -EKEYREJECTED if the signature check fails — rejected, blocked, unfollowed 💀
• -ENOPKG if the signature uses unsupported crypto — not our department bestie 🙈
• or some other error if there is a matching certificate but the signature check cannot be performed — close but no cigar, undefined vibes 🌀

ngl, most of the time you'll see that 0 and everything's cute, but keep the error list in mind fr fr 💅

---

🌈 SEE ALSO 🌈

• Kernel file ./crypto/asymmetric_keys/restrict.c — the source, the origin story 🧚
• restrict_link_by_signature(9)
• restrict_link_by_ca(9)
• restrict_link_by_digsig(9)
• restrict_link_by_key_or_keyring_chain(9)

all the sibling functions, the whole friend group, iykyk 🫶

---

okay that's the page!! 🍓 it lives under ./crypto/asymmetric_keys and this edition dropped in October 2026 — so if you're reading it, hi from the future, hope your keyring is valid and your signatures check out. bye bestie, go slay some crypto 💖🎀🌟