---
name: "mac_get"
section: "3"
platform: "freebsd"
package: "base"
version: "16.0-CURRENT-20261027-61c70dc16a79"
release: "FreeBSD 16.0-CURRENT (2026-10-27)"
platforms: ["freebsd"]
url: "https://new.carta.tech/mac_get"
---

# mac\_get(3)

get the label of a file, socket, socket peer or process

## NAME

**mac\_get\_file**, **mac\_get\_link**, **mac\_get\_fd**, **mac\_get\_peer**, **mac\_get\_pid**, **mac\_get\_proc** – get the label of a file, socket, socket peer or process

## LIBRARY

Standard C Library (libc, -lc)

## SYNOPSIS

**#include \<sys/mac.h\>**

*int*\

**mac\_get\_file**(*const char \*path*, *mac\_t label*);

*int*\

**mac\_get\_link**(*const char \*path*, *mac\_t label*);

*int*\

**mac\_get\_fd**(*int fd*, *mac\_t label*);

*int*\

**mac\_get\_peer**(*int fd*, *mac\_t label*);

*int*\

**mac\_get\_pid**(*pid\_t pid*, *mac\_t label*);

*int*\

**mac\_get\_proc**(*mac\_t label*);

## DESCRIPTION

The **mac\_get\_file**() system call returns the label associated with a file specified by pathname. The **mac\_get\_link**() function is the same as **mac\_get\_file**(), except that it does not follow symlinks.

The **mac\_get\_fd**() system call returns the label associated with an object referenced by the specified file descriptor. Note that in the case of a file system socket, the label returned will be the socket label, which may be different from the label of the on-disk node acting as a rendezvous for the socket. The **mac\_get\_peer**() system call returns the label associated with the remote endpoint of a socket; the exact semantics of this call will depend on the protocol domain, communications type, and endpoint; typically this label will be cached when a connection-oriented protocol instance is first set up, and is undefined for datagram protocols.

The **mac\_get\_pid**() and **mac\_get\_proc**() system calls return the process label associated with an arbitrary process ID, or the current process.

Label storage for use with these calls must first be allocated and prepared using the [mac\_prepare(3)](/mac_prepare/3.md) functions. When an application is done using a label, the memory may be returned using [mac\_free(3)](/mac_free/3.md).

## ERRORS

- \[EACCES\]

  A component of *path* is not searchable, or MAC read access to the file is denied.

- \[EINVAL\]

  The requested label operation is not valid for the object referenced by *fd*.

- \[ENAMETOOLONG\]

  The pathname pointed to by *path* exceeds PATH\_MAX, or a component of the pathname exceeds NAME\_MAX.

- \[ENOENT\]

  A component of *path* does not exist.

- \[ENOMEM\]

  Insufficient memory is available to allocate a new MAC label structure.

- \[ENOTDIR\]

  A component of *path* is not a directory.

## SEE ALSO

[mac(3)](/mac/3.md), [mac\_free(3)](/mac_free/3.md), [mac\_prepare(3)](/mac_prepare/3.md), [mac\_set(3)](/mac_set/3.md), [mac\_text(3)](/mac_text/3.md), [posix1e(3)](/posix1e/3.md), [mac(4)](/mac/4.md), [mac(9)](/mac/9.md)

## STANDARDS

POSIX.1e is described in IEEE POSIX.1e draft 17.

## HISTORY

Support for Mandatory Access Control was introduced in FreeBSD 5.0 as part of the TrustedBSD Project.