1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
|
.\" Copyright, the authors of the Linux man-pages project
.\"
.\" SPDX-License-Identifier: Linux-man-pages-copyleft
.\"
.TH KEYCTL_GET_PERSISTENT 2const 2025-05-17 "Linux man-pages (unreleased)"
.SH NAME
KEYCTL_GET_PERSISTENT
\-
get the persistent keyring for a user
.SH LIBRARY
Standard C library
.RI ( libc ,\~ \-lc )
.SH SYNOPSIS
.nf
.BR "#include <linux/keyctl.h>" " /* Definition of " KEY* " constants */"
.BR "#include <sys/syscall.h>" " /* Definition of " SYS_* " constants */"
.B #include <unistd.h>
.P
.BI "long syscall(SYS_keyctl, KEYCTL_GET_PERSISTENT, uid_t " uid ,
.BI " key_serial_t " keyring );
.fi
.SH DESCRIPTION
Get the persistent keyring
.RB ( persistent\-keyring (7))
for a specified user and link it to a specified keyring.
.P
The user ID is specified in
.IR uid .
If the value \-1 is specified, the caller's real user ID is used.
The ID of the destination keyring is specified in
.IR keyring .
.P
The caller must have the
.B CAP_SETUID
capability in its user namespace in order to fetch the persistent keyring
for a user ID that does not match either the real or effective user ID
of the caller.
.P
If the call is successful,
a link to the persistent keyring is added to the keyring
whose ID was specified in
.IR keyring .
.P
The caller must have
.I write
permission on the keyring.
.P
The persistent keyring will be created by the kernel
if it does not yet exist.
.P
Each time the
.B KEYCTL_GET_PERSISTENT
operation is performed, the persistent keyring will
have its expiration timeout reset to the value in:
.P
.in +4n
.EX
/proc/sys/kernel/keys/persistent_keyring_expiry
.EE
.in
.P
Should the timeout be reached,
the persistent keyring will be removed and
everything it pins can then be garbage collected.
.P
Persistent keyrings were added in Linux 3.13.
.SH RETURN VALUE
On success,
the ID of the persistent keyring.
.P
On error, \-1 is returned, and
.I errno
is set to indicate the error.
.SH ERRORS
.TP
.B EPERM
.I uid
specified a UID other than the calling thread's real or effective UID,
and the caller did not have the
.B CAP_SETUID
capability.
.SH VERSIONS
A wrapper is provided in the
.I libkeyutils
library:
.BR keyctl_get_persistent (3).
.SH STANDARDS
Linux.
.SH HISTORY
Linux 3.13.
.\" commit f36f8c75ae2e7d4da34f4c908cebdb4aa42c977e
.SH SEE ALSO
.BR keyctl (2),
.BR keyctl_get_persistent (3)
|
