---
name: "keyctl_setperm"
section: "3"
platform: "linux"
package: "keyutils"
version: "1.6.3-4"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/keyctl_setperm"
---

# keyctl\_setperm(3)

change the permissions mask on a key

## NAME

keyctl\_setperm - change the permissions mask on a key

## SYNOPSIS

```
#include <keyutils.h>

long keyctl_setperm(key_serial_t key, key_perm_t perm);
```

## DESCRIPTION

**keyctl\_setperm**() changes the permissions mask on a key.

A process that does not have the **SysAdmin** capability may not change the permissions mask on a key that doesn't have the same UID as the caller.

The caller must have **setattr** permission on a key to be able to change its permissions mask.

The permissions mask is a bitwise-OR of the following flags:

- **KEY\_xxx\_VIEW**

  Grant permission to view the attributes of a key.

- **KEY\_xxx\_READ**

  Grant permission to read the payload of a key or to list a keyring.

- **KEY\_xxx\_WRITE**

  Grant permission to modify the payload of a key or to add or remove links to/from a keyring.

- **KEY\_xxx\_SEARCH**

  Grant permission to find a key or to search a keyring.

- **KEY\_xxx\_LINK**

  Grant permission to make links to a key.

- **KEY\_xxx\_SETATTR**

  Grant permission to change the ownership and permissions attributes of a key.

- **KEY\_xxx\_ALL**

  Grant all the above.

The '**xxx**' in the above should be replaced by one of:

- **POS**

  Grant the permission to a process that possesses the key (has it attached searchably to one of the process's keyrings).

- **USR**

  Grant the permission to a process with the same UID as the key.

- **GRP**

  Grant the permission to a process with the same GID as the key, or with a match for the key's GID amongst that process's Groups list.

- **OTH**

  Grant the permission to any other process.

Examples include: **KEY\_POS\_VIEW**, **KEY\_USR\_READ**, **KEY\_GRP\_SEARCH** and **KEY\_OTH\_ALL**.

User, group and other grants are exclusive: if a process qualifies in the 'user' category, it will not qualify in the 'groups' category; and if a process qualifies in either 'user' or 'groups' then it will not qualify in the 'other' category.

Possessor grants are cumulative with the grants from the 'user', 'groups' and 'other' categories.

## RETURN VALUE

On success **keyctl\_setperm**() returns **0 .** On error, the value **-1** will be returned and *errno* will have been set to an appropriate error.

## ERRORS

- **ENOKEY**

  The specified key does not exist.

- **EKEYEXPIRED**

  The specified key has expired.

- **EKEYREVOKED**

  The specified key has been revoked.

- **EACCES**

  The named key exists, but does not grant **setattr** permission to the calling process.

## LINKING

This is a library function that can be found in *libkeyutils*. When linking, **-lkeyutils** should be specified to the linker.

## SEE ALSO

[**keyctl**(1)](/keyctl/1.md), [**add\_key**(2)](/add_key/2.md), [**keyctl**(2)](/keyctl/2.md), [**request\_key**(2)](/request_key/2.md), [**keyctl**(3)](/keyctl/3.md), [**keyrings**(7)](/keyrings/7.md), [**keyutils**(7)](/keyutils/7.md)