KEYCTL_RESTRICT_KEYRING(2const)

NAME
KEYCTL_RESTRICT_KEYRING - restrict keys that may be linked to a keyring

LIBRARY
Standard C library (libc, -lc)

SYNOPSIS
#include <linux/keyctl.h>  /* Definition of KEY* constants */
#include <sys/syscall.h>   /* Definition of SYS_* constants */
#include <unistd.h>

long syscall(SYS_keyctl, KEYCTL_RESTRICT_KEYRING, key_serial_t keyring,
             const char *_Nullable type, const char *restriction);

DESCRIPTION
Apply a key-linking restriction to the keyring with the ID provided in keyring. The caller must have setattr permission on the key. If type is NULL, any attempt to add a key to the keyring is blocked; otherwise it contains a pointer to a string with a key type name and restriction contains a pointer to string that describes the type-specific restriction. As of Linux 4.12, only the type "asymmetric" has restrictions defined:

builtin_trusted
    Allows only keys that are signed by a key linked to the built-in keyring (".builtin_trusted_keys").

builtin_and_secondary_trusted
    Allows only keys that are signed by a key linked to the secondary keyring (".secondary_trusted_keys") or, by extension, a key in a built-in keyring, as the latter is linked to the former.

key_or_keyring:key
key_or_keyring:key:chain
    If key specifies the ID of a key of type "asymmetric", then only keys that are signed by this key are allowed.

    If key specifies the ID of a keyring, then only keys that are signed by a key linked to this keyring are allowed.

    If ":chain" is specified, keys that are signed by a keys linked to the destination keyring (that is, the keyring with the ID specified in the keyring argument) are also allowed.

Note that a restriction can be configured only once for the specified keyring; once a restriction is set, it can't be overridden.

RETURN VALUE
On success, 0 is returned.

On error, -1 is returned, and errno is set to indicate the error.

ERRORS

EDEADLK
    The requested keyring restriction would result in a cycle.

EEXIST
    keyring already has a restriction set.

ENOENT
    The type provided in type argument doesn't support setting key linking restrictions.

EOPNOTSUPP
    type was "asymmetric", and the key specified in the restriction specification provided in restriction has type other than "asymmetric" or "keyring".

VERSIONS
A wrapper is provided in the libkeyutils library: keyctl_restrict_keyring(3).

STANDARDS
Linux.

HISTORY
Linux 4.12.

SEE ALSO
keyctl(2), keyctl_restrict_keyring(3)