---
name: "KEYCTL_GET_PERSISTENT"
section: "2const"
platform: "linux"
package: "man-pages"
version: "6.19-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/KEYCTL_GET_PERSISTENT"
---

# KEYCTL\_GET\_PERSISTENT(2const)

get the persistent keyring for a user

## NAME

KEYCTL\_GET\_PERSISTENT - get the persistent keyring for a user

## LIBRARY

Standard C library (*libc*, *-lc*)

## SYNOPSIS

```
#include <linux/keyctl.h>  /* Definition of KEY* constants */
#include <sys/syscall.h>   /* Definition of SYS_* constants */
#include <unistd.h>
```

**long syscall(SYS\_keyctl, KEYCTL\_GET\_PERSISTENT, uid\_t** *uid***,**              **key\_serial\_t** *keyring***);**

## DESCRIPTION

Get the persistent keyring ([**persistent-keyring**(7)](/persistent-keyring/7.md)) for a specified user and link it to a specified keyring.

The user ID is specified in *uid*. If the value -1 is specified, the caller's real user ID is used. The ID of the destination keyring is specified in *keyring*.

The caller must have the **CAP\_SETUID** capability in its user namespace in order to fetch the persistent keyring for a user ID that does not match either the real or effective user ID of the caller.

If the call is successful, a link to the persistent keyring is added to the keyring whose ID was specified in *keyring*.

The caller must have *write* permission on the keyring.

The persistent keyring will be created by the kernel if it does not yet exist.

Each time the **KEYCTL\_GET\_PERSISTENT** operation is performed, the persistent keyring will have its expiration timeout reset to the value in:

```
/proc/sys/kernel/keys/persistent_keyring_expiry
```

Should the timeout be reached, the persistent keyring will be removed and everything it pins can then be garbage collected.

Persistent keyrings were added in Linux 3.13.

## RETURN VALUE

On success, the ID of the persistent keyring.

On error, -1 is returned, and *errno* is set to indicate the error.

## ERRORS

- **EPERM**

  *uid* specified a UID other than the calling thread's real or effective UID, and the caller did not have the **CAP\_SETUID** capability.

## VERSIONS

A wrapper is provided in the *libkeyutils* library: [**keyctl\_get\_persistent**(3)](/keyctl_get_persistent/3.md).

## STANDARDS

Linux.

## HISTORY

Linux 3.13.

## SEE ALSO

[**keyctl**(2)](/keyctl/2.md), [**keyctl\_get\_persistent**(3)](/keyctl_get_persistent/3.md)