---
name: "cr_canseejailproc"
section: "9"
platform: "freebsd"
package: "base"
version: "16.0-CURRENT-20261027-61c70dc16a79"
release: "FreeBSD 16.0-CURRENT (2026-10-27)"
platforms: ["freebsd"]
url: "https://new.carta.tech/cr_canseejailproc"
---

# cr\_canseejailproc(9)

determine if subjects may see entities in sub-jails

## NAME

**cr\_canseejailproc** – determine if subjects may see entities in sub-jails

## SYNOPSIS

*int*\

**cr\_canseejailproc**(*struct ucred \*u1*, *struct ucred \*u2*);

## DESCRIPTION

This function is internal. Its functionality is integrated into the function [cr\_bsd\_visible(9)](/cr_bsd_visible/9.md), which should be called instead.

This function checks if a subject associated to credentials *u1* is denied seeing a subject or object associated to credentials *u2* by a policy that requires both credentials to be associated to the same jail. This is a restriction to the baseline jail policy that a subject can see subjects or objects in its own jail or any sub-jail of it.

This policy is active if and only if the [sysctl(8)](/sysctl/8.md) variable *security.bsd.see\_jail\_proc* is set to zero.

As usual, the superuser (effective user ID 0) is exempt from this policy provided that the [sysctl(8)](/sysctl/8.md) variable *security.bsd.suser\_enabled* is non-zero and no active MAC policy explicitly denies the exemption( see [priv\_check\_cred(9)](/priv_check_cred/9.md)).

## RETURN VALUES

The **cr\_canseejailproc**() function returns 0 if the policy is disabled, both credentials are associated to the same jail, or if *u1* has privilege exempting it from the policy. Otherwise, it returns ESRCH.

## SEE ALSO

[cr\_bsd\_visible(9)](/cr_bsd_visible/9.md), [priv\_check\_cred(9)](/priv_check_cred/9.md)

## AUTHORS

This manual page was written by Olivier Certner ⟨*olce.freebsd@certner.fr*⟩.