restrict_link_by_signature(9)

💅 restrict_link_by_signature(9) 💅

okay so bestie, we're deep in the Kernel API Manual and this one is literally about keeping your keyring safe from fakes. no cap. it's giving bouncer energy for public keys. 🎀

---

✨ NAME ✨

restrict_link_by_signature — bestie, this is the function that restricts (aka gatekeeps) additions to a ring of public keys. periodt. 👑

---

🦋 SYNOPSIS 🦋

int restrict_link_by_signature (struct key *dest_keyring , const struct
key_type *type , const union key_payload *payload , struct key
*trust_keyring );

like, here's the whole vibe of what you're calling. exact same signature, i would never touch it. 💖

---

🌸 ARGUMENTS 🌸

• dest_keyring — the keyring that's literally being linked to. main character of this operation ngl. 🔥
• type — the type of key being added. gotta know what you're working with bestie. ✨
• payload — the payload of the new key. the actual goods. 🎀
• trust_keyring — a ring of keys that can be used to vouch for the new cert. like, they're the mutuals who go "oh yeah i know her" for the new cert. 🫶

---

💜 DESCRIPTION 💜

so here's the tea: this function checks the new certificate against the ones in the trust keyring. if one of those is the signing key and validates the new certificate, THEN we mark the new certificate as being trusted. it's a whole vibe check for certs, honestly. 🧚

and now the return values, bestie, listen up because this is where the plot thickens: it returns 0 if the new certificate was accepted (slay 💅), -ENOKEY if we couldn't find a matching parent certificate in the trusted list (rip no mutuals 😭), -EKEYREJECTED if the signature check fails OR the key is blacklisted (not iconic 💀), -ENOPKG if the signature uses unsupported crypto (unsupported?? in THIS economy?? 🙈), or some other error if there is a matching certificate but the signature check cannot be performed. fr fr, read these carefully. 📖

lowkey important: this function does NOT mess around. if the signature check fails or the key is blacklisted, it's -EKEYREJECTED, no debate, no exceptions. 💀

---

⭐ SEE ALSO ⭐

• Kernel file ./crypto/asymmetric_keys/restrict.c — like, the whole source file bestie, go look!
• restrict_link_by_ca(9) — the CA-based sister function 💖
• restrict_link_by_digsig(9) — digital signature version ✨
• restrict_link_by_key_or_keyring(9) — the "key OR keyring" one 🎀
• restrict_link_by_key_or_keyring_chain(9) — and its chain counterpart 🦋

---

and that's the whole page bestie!! no skips, no summarising, we ate that. 🍓

this diva lives at ./crypto/asymmetric_keys and the version date is October 2026 — mark your calendars and follow for more kernel lore, iykyk 💅✨🎀