---
name: "cap_fcntls_get"
section: "2"
platform: "freebsd"
package: "base"
version: "16.0-CURRENT-20261027-61c70dc16a79"
release: "FreeBSD 16.0-CURRENT (2026-10-27)"
platforms: ["freebsd"]
url: "https://new.carta.tech/cap_fcntls_get"
---

# cap\_fcntls\_get(2)

manage allowed fcntl commands

## NAME

**cap\_fcntls\_limit**, **cap\_fcntls\_get** – manage allowed fcntl commands

## LIBRARY

Standard C Library (libc, -lc)

## SYNOPSIS

**#include \<sys/capsicum.h\>**

*int*\

**cap\_fcntls\_limit**(*int fd*, *uint32\_t fcntlrights*);

*int*\

**cap\_fcntls\_get**(*int fd*, *uint32\_t \*fcntlrightsp*);

## DESCRIPTION

If a file descriptor is granted the CAP\_FCNTL capability right, the list of allowed [fcntl(2)](/fcntl/2.md) commands can be selectively reduced (but never expanded) with the **cap\_fcntls\_limit**() system call.

A bitmask of allowed fcntls commands for a given file descriptor can be obtained with the **cap\_fcntls\_get**() system call.

## FLAGS

The following flags may be specified in the *fcntlrights* argument or returned in the *fcntlrightsp* argument:

- CAP\_FCNTL\_GETFL

  Permit F\_GETFL command.

- CAP\_FCNTL\_SETFL

  Permit F\_SETFL command.

- CAP\_FCNTL\_GETOWN

  Permit F\_GETOWN command.

- CAP\_FCNTL\_SETOWN

  Permit F\_SETOWN command.

## RETURN VALUES

The **cap\_fcntls\_limit()** function returns the value 0 if successful; otherwise the value -1 is returned and the global variable errno is set to indicate the error.

## ERRORS

**cap\_fcntls\_limit**() succeeds unless:

- \[EBADF\]

  The *fd* argument is not a valid descriptor.

- \[EINVAL\]

  An invalid flag has been passed in *fcntlrights*.

- \[ENOTCAPABLE\]

  *fcntlrights* would expand the list of allowed [fcntl(2)](/fcntl/2.md) commands.

**cap\_fcntls\_get**() succeeds unless:

- \[EBADF\]

  The *fd* argument is not a valid descriptor.

- \[EFAULT\]

  The *fcntlrightsp* argument points at an invalid address.

- \[ENOSYS\]

  The running kernel was compiled without **options CAPABILITY\_MODE**.

## SEE ALSO

[cap\_ioctls\_limit(2)](/cap_ioctls_limit/2.md), [cap\_rights\_limit(2)](/cap_rights_limit/2.md), [fcntl(2)](/fcntl/2.md)

## HISTORY

The **cap\_fcntls\_get**() and **cap\_fcntls\_limit**() system calls first appeared in FreeBSD 8.3. Support for capabilities and capabilities mode was developed as part of the TrustedBSD Project.

## AUTHORS

This function was created by Pawel Jakub Dawidek ⟨*pawel@dawidek.net*⟩ under sponsorship of the FreeBSD Foundation.