---
name: "cr_canseeothergids"
section: "9"
platform: "freebsd"
package: "base"
version: "16.0-CURRENT-20261027-61c70dc16a79"
release: "FreeBSD 16.0-CURRENT (2026-10-27)"
platforms: ["freebsd"]
url: "https://new.carta.tech/cr_canseeothergids"
---

# cr\_canseeothergids(9)

determine if subjects may see entities in a disjoint group set

## NAME

**cr\_canseeothergids** – determine if subjects may see entities in a disjoint group set

## SYNOPSIS

*int*\

**cr\_canseeothergids**(*struct ucred \*u1*, *struct ucred \*u2*);

## DESCRIPTION

This function is internal. Its functionality is integrated into the function [cr\_bsd\_visible(9)](/cr_bsd_visible/9.md), which should be called instead.

This function checks if a subject associated to credentials *u1* is denied seeing a subject or object associated to credentials *u2* by a policy that requires both credentials to have at least one group in common. For this determination, the real and supplementary group IDs are used, but not the effective group IDs, as per [realgroupmember(9)](/realgroupmember/9.md).

This policy is active if and only if the [sysctl(8)](/sysctl/8.md) variable *security.bsd.see\_other\_gids* is set to zero.

As usual, the superuser (effective user ID 0) is exempt from this policy provided that the [sysctl(8)](/sysctl/8.md) variable *security.bsd.suser\_enabled* is non-zero and no active MAC policy explicitly denies the exemption( see [priv\_check\_cred(9)](/priv_check_cred/9.md)).

## RETURN VALUES

The **cr\_canseeothergids**() function returns 0 if the policy is disabled, the credentials share at least one common group, or if *u1* has privilege exempting it from the policy. Otherwise, it returns ESRCH.

## SEE ALSO

[cr\_bsd\_visible(9)](/cr_bsd_visible/9.md), [priv\_check\_cred(9)](/priv_check_cred/9.md), [realgroupmember(9)](/realgroupmember/9.md)