KEYCTL\_SETPERM(3) Linux Key Management Calls KEYCTL\_SETPERM(3) # [NAME](#NAME) keyctl\_setperm - change the permissions mask on a key # [SYNOPSIS](#SYNOPSIS) ``` #include long keyctl_setperm(key_serial_t key, key_perm_t perm); ``` # [DESCRIPTION](#DESCRIPTION) **keyctl\_setperm**() changes the permissions mask on a key. A process that does not have the **SysAdmin** capability may not change the permissions mask on a key that doesn't have the same UID as the caller. The caller must have **setattr** permission on a key to be able to change its permissions mask. The permissions mask is a bitwise-OR of the following flags: [**KEY\_xxx\_VIEW**](#KEY_xxx_VIEW) Grant permission to view the attributes of a key. [**KEY\_xxx\_READ**](#KEY_xxx_READ) Grant permission to read the payload of a key or to list a keyring. [**KEY\_xxx\_WRITE**](#KEY_xxx_WRITE) Grant permission to modify the payload of a key or to add or remove links to/from a keyring. [**KEY\_xxx\_SEARCH**](#KEY_xxx_SEARCH) Grant permission to find a key or to search a keyring. [**KEY\_xxx\_LINK**](#KEY_xxx_LINK) Grant permission to make links to a key. [**KEY\_xxx\_SETATTR**](#KEY_xxx_SETATTR) Grant permission to change the ownership and permissions attributes of a key. [**KEY\_xxx\_ALL**](#KEY_xxx_ALL) Grant all the above. The '**xxx**' in the above should be replaced by one of: [**POS**](#POS) Grant the permission to a process that possesses the key (has it attached searchably to one of the process's keyrings). [**USR**](#USR) Grant the permission to a process with the same UID as the key. [**GRP**](#GRP) Grant the permission to a process with the same GID as the key, or with a match for the key's GID amongst that process's Groups list. [**OTH**](#OTH) Grant the permission to any other process. Examples include: **KEY\_POS\_VIEW**, **KEY\_USR\_READ**, **KEY\_GRP\_SEARCH** and **KEY\_OTH\_ALL**. User, group and other grants are exclusive: if a process qualifies in the 'user' category, it will not qualify in the 'groups' category; and if a process qualifies in either 'user' or 'groups' then it will not qualify in the 'other' category. Possessor grants are cumulative with the grants from the 'user', 'groups' and 'other' categories. # [RETURN VALUE](#RETURN_VALUE) On success **keyctl\_setperm**() returns **0 .** On error, the value **-1** will be returned and *errno* will have been set to an appropriate error. # [ERRORS](#ERRORS) [**ENOKEY**](#ENOKEY) The specified key does not exist. [**EKEYEXPIRED**](#EKEYEXPIRED) The specified key has expired. [**EKEYREVOKED**](#EKEYREVOKED) The specified key has been revoked. [**EACCES**](#EACCES) The named key exists, but does not grant **setattr** permission to the calling process. # [LINKING](#LINKING) This is a library function that can be found in *libkeyutils*. When linking, **-lkeyutils** should be specified to the linker. # [SEE ALSO](#SEE_ALSO) [**keyctl**(1)](/man/os/keyutils/keyctl.1), [**add\_key**(2)](/man/os/keyutils/add_key.2), [**keyctl**(2)](/man/os/keyutils/keyctl.2), [**request\_key**(2)](/man/os/keyutils/request_key.2), [**keyctl**(3)](/man/os/keyutils/keyctl.3), [**keyrings**(7)](/man/os/keyutils/keyrings.7), [**keyutils**(7)](/man/os/keyutils/keyutils.7) 4 May 2006 Linux --- Document: keyctl_setperm(3) from keyutils 1.6.3-r41 (Chainguard OS) Source: https://kernel.googlesource.com/pub/scm/linux/kernel/git/dhowells/keyutils.git