diff --git a/keyctl.c b/keyctl.c
index 801a864..0ac95fd 100644
--- a/keyctl.c
+++ b/keyctl.c
@@ -67,6 +67,7 @@
 static nr void act_keyctl_invalidate(int argc, char *argv[]);
 static nr void act_keyctl_get_persistent(int argc, char *argv[]);
 static nr void act_keyctl_dh_compute(int argc, char *argv[]);
+static nr void act_keyctl_restrict_keyring(int argc, char *argv[]);
 
 const struct command commands[] = {
 	{ act_keyctl___version,	"--version",	"" },
@@ -99,6 +100,7 @@
 	{ act_keyctl_reject,	"reject",	"<key> <timeout> <error> <keyring>" },
 	{ act_keyctl_request,	"request",	"<type> <desc> [<dest_keyring>]" },
 	{ act_keyctl_request2,	"request2",	"<type> <desc> <info> [<dest_keyring>]" },
+	{ act_keyctl_restrict_keyring, "restrict_keyring", "<keyring> [<type> [<restriction>]]" },
 	{ act_keyctl_revoke,	"revoke",	"<key>" },
 	{ act_keyctl_rlist,	"rlist",	"<keyring>" },
 	{ act_keyctl_search,	"search",	"<keyring> <type> <desc> [<dest_keyring>]" },
@@ -1679,6 +1681,35 @@
 
 /*****************************************************************************/
 /*
+ * Restrict the keys that may be added to a keyring
+ */
+static void act_keyctl_restrict_keyring(int argc, char *argv[])
+{
+	key_serial_t keyring;
+	char *type = NULL;
+	char *restriction = NULL;
+	long ret;
+
+	if (argc < 2 || argc > 4)
+		format();
+
+	keyring = get_key_id(argv[1]);
+
+	if (argc > 2)
+		type = argv[2];
+
+	if (argc == 4)
+		restriction = argv[3];
+
+	ret = keyctl_restrict_keyring(keyring, type, restriction);
+	if (ret < 0)
+		error("keyctl_restrict_keyring");
+
+	exit(0);
+}
+
+/*****************************************************************************/
+/*
  * parse a key identifier
  */
 static key_serial_t get_key_id(char *arg)
diff --git a/keyutils.c b/keyutils.c
index a6325d0..b7bd272 100644
--- a/keyutils.c
+++ b/keyutils.c
@@ -244,6 +244,12 @@
 	return keyctl(KEYCTL_DH_COMPUTE, &params, buffer, buflen, 0);
 }
 
+long keyctl_restrict_keyring(key_serial_t keyring, const char *type,
+			     const char *restriction)
+{
+	return keyctl(KEYCTL_RESTRICT_KEYRING, keyring, type, restriction);
+}
+
 /*****************************************************************************/
 /*
  * fetch key description into an allocated buffer
diff --git a/keyutils.h b/keyutils.h
index a69fa7a..35a5aa0 100644
--- a/keyutils.h
+++ b/keyutils.h
@@ -100,6 +100,7 @@
 #define KEYCTL_INVALIDATE		21	/* invalidate a key */
 #define KEYCTL_GET_PERSISTENT		22	/* get a user's persistent keyring */
 #define KEYCTL_DH_COMPUTE		23	/* Compute Diffie-Hellman values */
+#define KEYCTL_RESTRICT_KEYRING		29	/* Restrict keys allowed to link to a keyring */
 
 /* keyctl structures */
 struct keyctl_dh_params {
@@ -163,6 +164,8 @@
 extern long keyctl_get_persistent(uid_t uid, key_serial_t id);
 extern long keyctl_dh_compute(key_serial_t priv, key_serial_t prime,
 			      key_serial_t base, char *buffer, size_t buflen);
+extern long keyctl_restrict_keyring(key_serial_t keyring, const char *type,
+				    const char *restriction);
 
 /*
  * utilities
diff --git a/version.lds b/version.lds
index f97f521..e522640 100644
--- a/version.lds
+++ b/version.lds
@@ -70,5 +70,7 @@
 } KEYUTILS_1.5;
 
 KEYUTILS_1.7 {
+	/* management functions */
+	keyctl_restrict;
 
 } KEYUTILS_1.6;