---
name: "cap_rights_get"
section: "3"
platform: "freebsd"
package: "base"
version: "16.0-CURRENT-20261027-61c70dc16a79"
release: "FreeBSD 16.0-CURRENT (2026-10-27)"
platforms: ["freebsd"]
url: "https://new.carta.tech/cap_rights_get/3"
---

# cap\_rights\_get(3)

obtain capability rights

## NAME

**cap\_rights\_get** – obtain capability rights

## LIBRARY

Standard C Library (libc, -lc)

## SYNOPSIS

**#include \<sys/capsicum.h\>**

*int*\

**cap\_rights\_get**(*int fd*, *cap\_rights\_t \*rights*);

## DESCRIPTION

The **cap\_rights\_get** function allows to obtain current capability rights for the given descriptor. The function will fill the *rights* argument with all capability rights if they were not limited or capability rights configured during the last successful call of [cap\_rights\_limit(2)](/cap_rights_limit/2.md) on the given descriptor.

The *rights* argument can be inspected using [cap\_rights\_init(3)](/cap_rights_init/3.md) family of functions.

The complete list of the capability rights can be found in the [rights(4)](/rights/4.md) manual page.

## RETURN VALUES

The **cap\_rights\_get()** function returns the value 0 if successful; otherwise the value -1 is returned and the global variable errno is set to indicate the error.

## EXAMPLES

The following example demonstrates how to limit file descriptor capability rights and how to obtain them.

```
cap_rights_t setrights, getrights;
int fd;
memset(&setrights, 0, sizeof(setrights));
memset(&getrights, 0, sizeof(getrights));
fd = open("/tmp/foo", O_RDONLY);
if (fd < 0)
	err(1, "open() failed");
cap_rights_init(&setrights, CAP_FSTAT, CAP_READ);
if (cap_rights_limit(fd, &setrights) < 0 && errno != ENOSYS)
	err(1, "cap_rights_limit() failed");
if (cap_rights_get(fd, &getrights) < 0 && errno != ENOSYS)
	err(1, "cap_rights_get() failed");
assert(memcmp(&setrights, &getrights, sizeof(setrights)) == 0);
```

## ERRORS

**cap\_rights\_get**() succeeds unless:

- \[EBADF\]

  The *fd* argument is not a valid active descriptor.

- \[EFAULT\]

  The *rights* argument points at an invalid address.

## SEE ALSO

[cap\_rights\_limit(2)](/cap_rights_limit/2.md), [errno(2)](/errno/2.md), [open(2)](/open/2.md), [assert(3)](/assert/3.md), [cap\_rights\_init(3)](/cap_rights_init/3.md), [err(3)](/err/3.md), [memcmp(3)](/memcmp/3.md), [memset(3)](/memset/3.md), [capsicum(4)](/capsicum/4.md), [rights(4)](/rights/4.md)

## HISTORY

The **cap\_rights\_get**() function first appeared in FreeBSD 9.2. Support for capabilities and capabilities mode was developed as part of the TrustedBSD Project.

## AUTHORS

This function was created by Pawel Jakub Dawidek ⟨*pawel@dawidek.net*⟩ under sponsorship of the FreeBSD Foundation.