Ubuntu Manpages

KEYCTL_RESTRICT_KEYRING

restrict keys that may be linked to a keyring

Standard C library (libc, -lc)

#include <linux/keyctl.h>  /* Definition of KEY* constants */
#include <sys/syscall.h>   /* Definition of SYS_* constants */
#include <unistd.h>
long syscall(SYS_keyctl, KEYCTL_RESTRICT_KEYRING, key_serial_t keyring,
             const char *_Nullable type, const char *restriction);

Apply a key-linking restriction to the keyring with the ID provided in keyring. The caller must have setattr permission on the key. If type is NULL, any attempt to add a key to the keyring is blocked; otherwise it contains a pointer to a string with a key type name and restriction contains a pointer to string that describes the type-specific restriction. As of Linux 4.12, only the type "asymmetric" has restrictions defined:

Allows only keys that are signed by a key linked to the built-in keyring (".builtin_trusted_keys").
Allows only keys that are signed by a key linked to the secondary keyring (".secondary_trusted_keys") or, by extension, a key in a built-in keyring, as the latter is linked to the former.
If key specifies the ID of a key of type "asymmetric", then only keys that are signed by this key are allowed.
If key specifies the ID of a keyring, then only keys that are signed by a key linked to this keyring are allowed.
If ":chain" is specified, keys that are signed by a keys linked to the destination keyring (that is, the keyring with the ID specified in the keyring argument) are also allowed.

Note that a restriction can be configured only once for the specified keyring; once a restriction is set, it can't be overridden.

On success, 0 is returned.

On error, -1 is returned, and errno is set to indicate the error.

The requested keyring restriction would result in a cycle.
keyring already has a restriction set.
The type provided in type argument doesn't support setting key linking restrictions.
type was "asymmetric", and the key specified in the restriction specification provided in restriction has type other than "asymmetric" or "keyring".

A wrapper is provided in the libkeyutils library: keyctl_restrict_keyring(3).

Linux.

Linux 4.12.

keyctl(2), keyctl_restrict_keyring(3)