keyctl: Key Has Been Revoked

If you are working with the Linux kernel keyring and suddenly see a revoked key blocking your session, the fix is usually a simple session reload. This post walks through the exact keyctl commands to diagnose the problem and restore access.

The Problem

When a key in your session keyring has been revoked, commands that depend on it will fail. You will typically see output like this:

# keyctl show
Session Keyring   -3: key inaccessible (Key has been revoked)

The -3 status code indicates the key is no longer usable. This can happen after a system update, a manual revocation, or a session timeout.

Diagnosing the Session

First, confirm the current state of your session keyring:

# keyctl show

If the output shows a revoked or inaccessible key, the session needs to be reloaded.

Rejoining the Session Keyring

Use keyctl session to join a fresh session keyring:

# keyctl session
Joined session keyring: 450812569

After the command succeeds, verify the new session looks healthy:

# keyctl show
Session Keyring
-3 --alswrv 0 0  keyring: _ses

A clean session keyring with no revoked entries means you are back in business.

Tips to Avoid Recurrence

• Avoid manually revoking keys that active services depend on.
• If you are scripting against the keyring, add a check for key status before assuming the session is valid.
• After system updates that touch the key management stack, re-verify your session keyring.

• Security
• How-To

• SysAdmin
• Troubleshooting