---
name: "mbr_check_membership"
section: "3"
platform: "macos"
package: "Libinfo"
version: "600"
release: "macOS 26.5"
platforms: ["macos"]
url: "https://new.carta.tech/mbr_check_membership"
---

# mbr\_check\_membership(3)

check whether a user is a member of a group or service ACL

## NAME

**mbr\_check\_membership,** **mbr\_check\_service\_membership** – check whether a user is a member of a group or service ACL

## SYNOPSIS

**#include \<membership.h\>**

*int*\

**mbr\_check\_membership**(*uuid\_t user*, *uuid\_t group*, *int \*ismember*);

*int*\

**mbr\_check\_service\_membership**(*uuid\_t user*, *const char \*service*, *int \*ismember*);

## DESCRIPTION

**mbr\_check\_membership**() tests if a given user is a member of a group (either direct or indirect via a nested group). *ismember* is set to 1 if the user is a member or 0 if not a member of the group.   **mbr\_check\_service\_membership**() similarly tests if a given user is a member of a service ACL group.  Service ACLs are special groups defined with the prefix "com.apple.access\_".  The service is then prefixed (e.g., "afp" would check "com.apple.access\_afp"). There is a special group that grants accessto all services called "com.apple.access\_all\_services".

Users may belong to any number of groups. **mbr\_check\_membership**() should always be used to check group membership, rather than calling [getgroups(2)](/getgroups/2.md) or getgrouplist(2). The [setgroups(2)](/setgroups/2.md) and [getgroups(2)](/getgroups/2.md) routines are limited to a fixed number of gids, and so may not include all of a user's groups.

There are two special cases. If the two uuids are equal, then  *ismember* is set to 1. If the *group* uuid is equal to the reserved "everyone" uuid (ABCDEFAB-CDEF-ABCD-EFAB-CDEF0000000C), then *ismember* will be set to 1 for any valid user.

Group membership information is managed by opendirectoryd(8).

## RETURN VALUES

**mbr\_check\_membership**() does not test whether *group* exists or not. Querying membership for a nonexistent group will result in *ismember* being set to 0.  The function returns 0 on success or one of the following error codes on failure:

- \[EIO\]

  Communication with opendirectoryd(8) failed.

- \[ENOENT\]

  *user* can not be found.

**mbr\_check\_service\_membership**() is identical to **mbr\_check\_membership**() except that ENOENT means no service ACL has been defined.

## SEE ALSO

odutil(1), [setgroups(2)](/setgroups/2.md), [getgroups(2)](/getgroups/2.md), [mbr\_uid\_to\_uuid(3)](/mbr_uid_to_uuid/3.md), opendirectoryd(8)