---
name: "cr_bsd_visible"
section: "9"
platform: "freebsd"
package: "base"
version: "16.0-CURRENT-20261027-61c70dc16a79"
release: "FreeBSD 16.0-CURRENT (2026-10-27)"
platforms: ["freebsd"]
url: "https://new.carta.tech/cr_bsd_visible"
---

# cr\_bsd\_visible(9)

determine if subjects may see entities according to BSD security policies

## NAME

**cr\_bsd\_visible** – determine if subjects may see entities according to BSD security policies

## SYNOPSIS

**#include \<sys/proc.h\>**

*int*\

**cr\_bsd\_visible**(*struct ucred \*u1*, *struct ucred \*u2*);

## DESCRIPTION

This function determines if a subject with credentials *u1* is denied seeing an object or subject associated to credentials *u2* by the following policies and associated [sysctl(8)](/sysctl/8.md) knobs:

- *security.bsd.seeotheruids*

  If set to 0, subjects cannot see other subjects or objects if they are not associated with the same real user ID. The corresponding internal function is [cr\_canseeotheruids(9)](/cr_canseeotheruids/9.md).

- *security.bsd.seeothergids*

  If set to 0, subjects cannot see other subjects or objects if they are not both a member of at least one common group. The corresponding internal function is [cr\_canseeothergids(9)](/cr_canseeothergids/9.md).

- *security.bsd.see\_jail\_proc*

  If set to 0, subjects cannot see other subjects or objects that are not associated with the same jail as they are. The corresponding internal function is [cr\_canseejailproc(9)](/cr_canseejailproc/9.md).

As usual, the superuser (effective user ID 0) is exempt from any of these policies provided that the [sysctl(8)](/sysctl/8.md) variable *security.bsd.suser\_enabled* is non-zero and no active MAC policy explicitly denies the exemption( see [priv\_check\_cred(9)](/priv_check_cred/9.md)).

This function is intended to be used as a helper to implement [cr\_cansee(9)](/cr_cansee/9.md) and similar functions.

## RETURN VALUES

This function returns zero if a subject with credentials *u1* may see a subject or object with credentials *u2* by the active above-mentioned policies, or ESRCH otherwise.

## ERRORS

- \[ESRCH\]

  Credentials *u1* and *u2* do not have the same real user ID.

- \[ESRCH\]

  Credentials *u1* and *u2* are not members of any common group( as determined by [realgroupmember(9)](/realgroupmember/9.md)).

- \[ESRCH\]

  Credentials *u1* and *u2* are not in the same jail.

## SEE ALSO

[cr\_cansee(9)](/cr_cansee/9.md), [cr\_canseejailproc(9)](/cr_canseejailproc/9.md), [cr\_canseeothergids(9)](/cr_canseeothergids/9.md), [cr\_canseeotheruids(9)](/cr_canseeotheruids/9.md), [priv\_check\_cred(9)](/priv_check_cred/9.md)

## AUTHORS

This function and its manual page were written by Olivier Certner ⟨*olce.freebsd@certner.fr*⟩.