---
name: "KEYCTL_RESTRICT_KEYRING"
section: "2const"
platform: "linux"
package: "man-pages"
version: "6.19-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/KEYCTL_RESTRICT_KEYRING"
---

# KEYCTL\_RESTRICT\_KEYRING(2const)

restrict keys that may be linked to a keyring

## NAME

KEYCTL\_RESTRICT\_KEYRING - restrict keys that may be linked to a keyring

## LIBRARY

Standard C library (*libc*, *-lc*)

## SYNOPSIS

```
#include <linux/keyctl.h>  /* Definition of KEY* constants */
#include <sys/syscall.h>   /* Definition of SYS_* constants */
#include <unistd.h>
```

**long syscall(SYS\_keyctl, KEYCTL\_RESTRICT\_KEYRING, key\_serial\_t** *keyring***,**              **const char \*\_Nullable** *type***, const char \****restriction***);**

## DESCRIPTION

Apply a key-linking restriction to the keyring with the ID provided in *keyring*. The caller must have *setattr* permission on the key. If *type* is NULL, any attempt to add a key to the keyring is blocked; otherwise it contains a pointer to a string with a key type name and *restriction* contains a pointer to string that describes the type-specific restriction. As of Linux 4.12, only the type "asymmetric" has restrictions defined:

- **builtin\_trusted**

  Allows only keys that are signed by a key linked to the built-in keyring (".builtin\_trusted\_keys").

- **builtin\_and\_secondary\_trusted**

  Allows only keys that are signed by a key linked to the secondary keyring (".secondary\_trusted\_keys") or, by extension, a key in a built-in keyring, as the latter is linked to the former.

- **key\_or\_keyring:***key* **key\_or\_keyring:***key***:chain**

  If *key* specifies the ID of a key of type "asymmetric", then only keys that are signed by this key are allowed.

-

  If *key* specifies the ID of a keyring, then only keys that are signed by a key linked to this keyring are allowed.

-

  If ":chain" is specified, keys that are signed by a keys linked to the destination keyring (that is, the keyring with the ID specified in the *keyring* argument) are also allowed.

Note that a restriction can be configured only once for the specified keyring; once a restriction is set, it can't be overridden.

## RETURN VALUE

On success, 0 is returned.

On error, -1 is returned, and *errno* is set to indicate the error.

## ERRORS

- **EDEADLK**

  The requested keyring restriction would result in a cycle.

- **EEXIST**

  *keyring* already has a restriction set.

- **ENOENT**

  The type provided in *type* argument doesn't support setting key linking restrictions.

- **EOPNOTSUPP**

  *type* was "asymmetric", and the key specified in the restriction specification provided in *restriction* has type other than "asymmetric" or "keyring".

## VERSIONS

A wrapper is provided in the *libkeyutils* library: [**keyctl\_restrict\_keyring**(3)](/keyctl_restrict_keyring/3.md).

## STANDARDS

Linux.

## HISTORY

Linux 4.12.

## SEE ALSO

[**keyctl**(2)](/keyctl/2.md), [**keyctl\_restrict\_keyring**(3)](/keyctl_restrict_keyring/3.md)