---
name: "KEYCTL_ASSUME_AUTHORITY"
section: "2const"
platform: "linux"
package: "man-pages"
version: "6.19-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/KEYCTL_ASSUME_AUTHORITY"
---

# KEYCTL\_ASSUME\_AUTHORITY(2const)

assume the authority to instantiate a key

## NAME

KEYCTL\_ASSUME\_AUTHORITY - assume the authority to instantiate a key

## LIBRARY

Standard C library (*libc*, *-lc*)

## SYNOPSIS

```
#include <linux/keyctl.h>  /* Definition of KEY* constants */
#include <sys/syscall.h>   /* Definition of SYS_* constants */
#include <unistd.h>
```

**long syscall(SYS\_keyctl, KEYCTL\_ASSUME\_AUTHORITY, key\_serial\_t** *key***);**

## DESCRIPTION

Assume (or divest) the authority for the calling thread to instantiate a key.

The *key* argument specifies either a nonzero key ID to assume authority, or the value 0 to divest authority.

If *key* is nonzero, then it specifies the ID of an uninstantiated key for which authority is to be assumed. That key can then be instantiated using one of [**KEYCTL\_INSTANTIATE**(2const)](/KEYCTL_INSTANTIATE/2const.md), [**KEYCTL\_INSTANTIATE\_IOV**(2const)](/KEYCTL_INSTANTIATE_IOV/2const.md), [**KEYCTL\_REJECT**(2const)](/KEYCTL_REJECT/2const.md), or [**KEYCTL\_NEGATE**(2const)](/KEYCTL_NEGATE/2const.md). Once the key has been instantiated, the thread is automatically divested of authority to instantiate the key.

Authority over a key can be assumed only if the calling thread has present in its keyrings the authorization key that is associated with the specified key. (In other words, the **KEYCTL\_ASSUME\_AUTHORITY** operation is available only from a [**request-key**(8)](/request-key/8.md)-style program; see [**request\_key**(2)](/request_key/2.md) for an explanation of how this operation is used.) The caller must have *search* permission on the authorization key.

If the specified key has a matching authorization key, then the ID of that key is returned. The authorization key can be read ([**KEYCTL\_READ**(2const)](/KEYCTL_READ/2const.md)) to obtain the callout information passed to [**request\_key**(2)](/request_key/2.md).

If the ID given in *key* is 0, then the currently assumed authority is cleared (divested), and the value 0 is returned.

The **KEYCTL\_ASSUME\_AUTHORITY** mechanism allows a program such as [**request-key**(8)](/request-key/8.md) to assume the necessary authority to instantiate a new uninstantiated key that was created as a consequence of a call to [**request\_key**(2)](/request_key/2.md). For further information, see [**request\_key**(2)](/request_key/2.md) and the kernel source file *Documentation/security/keys/request-key.rst*.

## RETURN VALUE

On success, either 0, if the ID given was 0, or the ID of the authorization key matching the specified key, if a nonzero key ID was provided.

On error, -1 is returned, and *errno* is set to indicate the error.

## VERSIONS

A wrapper is provided in the *libkeyutils* library: [**keyctl\_assume\_authority**(3)](/keyctl_assume_authority/3.md).

## STANDARDS

Linux.

## HISTORY

Linux 2.6.16.

## SEE ALSO

[**keyctl**(2)](/keyctl/2.md), [**keyctl\_assume\_authority**(3)](/keyctl_assume_authority/3.md)