restrict_link_reject(9)

📦 version 7.3.1, in nixpkgs unstable

okay so bestie, we're in the restrict_link_reject(9) page today and honestly? it's a short one, but it ate. it's a tiny function with one job and zero chill about it. let's get into it 🎀

✨ NAME ✨

restrict_link_reject — literally just hands you back -EPERM to restrict link. that's it. that's the whole vibe. iconic, lowkey. 💅

🦋 SYNOPSIS 🦋

int restrict_link_reject (struct key *keyring , const struct key_type
*type , const union key_payload *payload , struct key *restriction_key
);

no cap, that's the signature. four args, one int, all business. 🫶

🌸 ARGUMENTS 🌸

  • keyring — the keyring being added to. the destination, the main character of this whole situation 👑
  • type — the type of key being added. tells you what kind of key is trying to slide in 🙈
  • payload — the payload of the key intended to be added. the actual contents of the wannabe key 🍓
  • restriction_key — keys providing additional data for evaluating restriction. extra context for the restriction logic, iykyk 💜

🔥 DESCRIPTION 🔥

so the whole personality of this function: reject the addition of any links to a keyring. every single one. no exceptions, no "but they're nice keys", nothing gets in. it's giving bouncer-at-the-club energy 💀

✨ but ✨ — and this is the important part — it can be overridden by passing KEY_ALLOC_BYPASS_RESTRICTION to key_instantiate_and_link when adding a key to a keyring. so there's a back door, but you gotta know the password. no cap. 🔑

this thing is meant to be stored in a key_restriction structure which is passed in the restrict_link parameter to keyring_alloc. so like, that's where it lives, that's how it gets wired up. periodt. 🎀

ngl bestie, if you're using this you're deliberately locking things down — that's the point, so don't act surprised when links get rejected 😭

🌈 SEE ALSO 🌈

Kernel file ./security/keys/keyring.c — and the whole friend group:

go read them, they're all slay in their own way fr fr 📚✨

okay that's the page!! this came out of ./security/keys, dated October 2026, and it's the restrict_link_reject(9) page — Kernel API Manual edition. mwah, love u, go read your kernel source bestie 💖🦋🧚

📦 where this page comes from