# KEYCTL_RESTRICT_KEYRING

## NAME



           KEYCTL_RESTRICT_KEYRING - restrict keys that may be linked to a
           keyring
    


## LIBRARY



           Standard C library (_libc_ , _-lc_)
    


## SYNOPSIS



           **#include <linux/keyctl.h>  **/* Definition of **KEY*** constants */
           **#include <sys/syscall.h>   **/* Definition of **SYS_*** constants */
           **#include <unistd.h>**
    
           **long syscall(SYS_keyctl, KEYCTL_RESTRICT_KEYRING, key_serial_t** _keyring_**,**
                        **const char *_Nullable** _type_**, const char ***_restriction_**);**
    


## DESCRIPTION



           Apply a key-linking restriction to the keyring with the ID
           provided in _keyring_.  The caller must have _setattr_ permission on
           the key.  If _type_ is NULL, any attempt to add a key to the keyring
           is blocked; otherwise it contains a pointer to a string with a key
           type name and _restriction_ contains a pointer to string that
           describes the type-specific restriction.  As of Linux 4.12, only
           the type "asymmetric" has restrictions defined:
    
           **builtin_trusted**
                  Allows only keys that are signed by a key linked to the
                  built-in keyring (".builtin_trusted_keys").
    
           **builtin_and_secondary_trusted**
                  Allows only keys that are signed by a key linked to the
                  secondary keyring (".secondary_trusted_keys") or, by
                  extension, a key in a built-in keyring, as the latter is
                  linked to the former.
    
           **key_or_keyring:**_key_
           **key_or_keyring:**_key_**:chain**
                  If _key_ specifies the ID of a key of type "asymmetric", then
                  only keys that are signed by this key are allowed.
    
                  If _key_ specifies the ID of a keyring, then only keys that
                  are signed by a key linked to this keyring are allowed.
    
                  If ":chain" is specified, keys that are signed by a keys
                  linked to the destination keyring (that is, the keyring
                  with the ID specified in the _keyring_ argument) are also
                  allowed.
    
           Note that a restriction can be configured only once for the
           specified keyring; once a restriction is set, it can't be
           overridden.
    


## RETURN VALUE



           On success, 0 is returned.
    
           On error, -1 is returned, and _errno_ is set to indicate the error.
    


## ERRORS



           **EDEADLK**
                  The requested keyring restriction would result in a cycle.
    
           **EEXIST** _keyring_ already has a restriction set.
    
           **ENOENT** The type provided in _type_ argument doesn't support setting
                  key linking restrictions.
    
           **EOPNOTSUPP**
                  _type_ was "asymmetric", and the key specified in the
                  restriction specification provided in _restriction_ has type
                  other than "asymmetric" or "keyring".
    


## VERSIONS



           A wrapper is provided in the _libkeyutils_ library:
           keyctl_restrict_keyring(3).
    


## STANDARDS



           Linux.
    


* * *