---
name: "rights"
section: "4"
platform: "freebsd"
package: "base"
version: "16.0-CURRENT-20261027-61c70dc16a79"
release: "FreeBSD 16.0-CURRENT (2026-10-27)"
platforms: ["freebsd"]
url: "https://new.carta.tech/rights"
---

# rights(4)

Capsicum capability rights for file descriptors

## NAME

**Capability** **rights** – Capsicum capability rights for file descriptors

## DESCRIPTION

When a file descriptor is created by a function such as [fhopen(2)](/fhopen/2.md), [kqueue(2)](/kqueue/2.md), [mq\_open(2)](/mq_open/2.md), [open(2)](/open/2.md), [pdfork(2)](/pdfork/2.md), [pipe(2)](/pipe/2.md), [shm\_open(2)](/shm_open/2.md), [socket(2)](/socket/2.md) or [socketpair(2)](/socketpair/2.md), it is assigned all capability rights; for [accept(2)](/accept/2.md), [accept4(2)](/accept4/2.md) or [openat(2)](/openat/2.md), it inherits capability rights from the "parent" file descriptor. Those rights can be reduced (but never expanded) by using the [cap\_rights\_limit(2)](/cap_rights_limit/2.md), [cap\_fcntls\_limit(2)](/cap_fcntls_limit/2.md) and [cap\_ioctls\_limit(2)](/cap_ioctls_limit/2.md) system calls. Once capability rights are reduced, operations on the file descriptor will be limited to those permitted by rights.

The complete list of capability rights is provided below. The *cap\_rights\_t* type is used to store list of capability rights. The [cap\_rights\_init(3)](/cap_rights_init/3.md) family of functions should be used to manage the structure.

## RIGHTS

Note that rights are not simple bitmasks (and cannot be bitwise-ORed together). See [cap\_rights\_init(3)](/cap_rights_init/3.md) for details.

The following rights are available:

- CAP\_ACCEPT

  Permit [accept(2)](/accept/2.md) and [accept4(2)](/accept4/2.md).

- CAP\_ACL\_CHECK

  Permit [acl\_valid\_fd\_np(3)](/acl_valid_fd_np/3.md).

- CAP\_ACL\_DELETE

  Permit [acl\_delete\_fd\_np(3)](/acl_delete_fd_np/3.md).

- CAP\_ACL\_GET

  Permit [acl\_get\_fd(3)](/acl_get_fd/3.md) and [acl\_get\_fd\_np(3)](/acl_get_fd_np/3.md).

- CAP\_ACL\_SET

  Permit [acl\_set\_fd(3)](/acl_set_fd/3.md) and [acl\_set\_fd\_np(3)](/acl_set_fd_np/3.md).

- CAP\_BIND

  When not in capabilities mode, permit [bind(2)](/bind/2.md) and [bindat(2)](/bindat/2.md) with special value AT\_FDCWD in the *fd* parameter. Note that sockets can also become bound implicitly as a result of [connect(2)](/connect/2.md) or [send(2)](/send/2.md), and that socket options set with [setsockopt(2)](/setsockopt/2.md) may also affect binding behavior.

- CAP\_BINDAT

  Permit [bindat(2)](/bindat/2.md). This right has to be present on the directory descriptor. This right includes the CAP\_LOOKUP right.

- CAP\_CHFLAGSAT

  An alias to CAP\_FCHFLAGS and CAP\_LOOKUP.

- CAP\_CONNECT

  When not in capabilities mode, permit [connect(2)](/connect/2.md) and [connectat(2)](/connectat/2.md) with special value AT\_FDCWD in the *fd* parameter. This right is also required for [sendto(2)](/sendto/2.md) with a non-NULL destination address.

- CAP\_CONNECTAT

  Permit [connectat(2)](/connectat/2.md). This right has to be present on the directory descriptor. This right includes the CAP\_LOOKUP right.

- CAP\_CREATE

  Permit [openat(2)](/openat/2.md) with the O\_CREAT flag.

- CAP\_EVENT

  Permit [select(2)](/select/2.md), [poll(2)](/poll/2.md), and [kevent(2)](/kevent/2.md) to be used in monitoring the file descriptor for events.

- CAP\_EXTATTR\_DELETE

  Permit [extattr\_delete\_fd(2)](/extattr_delete_fd/2.md).

- CAP\_EXTATTR\_GET

  Permit [extattr\_get\_fd(2)](/extattr_get_fd/2.md).

- CAP\_EXTATTR\_LIST

  Permit [extattr\_list\_fd(2)](/extattr_list_fd/2.md).

- CAP\_EXTATTR\_SET

  Permit [extattr\_set\_fd(2)](/extattr_set_fd/2.md).

- CAP\_FCHDIR

  Permit [fchdir(2)](/fchdir/2.md).

- CAP\_FCHFLAGS

  Permit [fchflags(2)](/fchflags/2.md) and [chflagsat(2)](/chflagsat/2.md) if the CAP\_LOOKUP right is also present.

- CAP\_FCHMOD

  Permit [fchmod(2)](/fchmod/2.md) and [fchmodat(2)](/fchmodat/2.md) if the CAP\_LOOKUP right is also present.

- CAP\_FCHMODAT

  An alias to CAP\_FCHMOD and CAP\_LOOKUP.

- CAP\_FCHOWN

  Permit [fchown(2)](/fchown/2.md) and [fchownat(2)](/fchownat/2.md) if the CAP\_LOOKUP right is also present.

- CAP\_FCHOWNAT

  An alias to CAP\_FCHOWN and CAP\_LOOKUP.

- CAP\_FCHROOT

  Permit [fchroot(2)](/fchroot/2.md).

- CAP\_FCNTL

  Permit [fcntl(2)](/fcntl/2.md). Note that only the F\_GETFL, F\_SETFL, F\_GETOWN and F\_SETOWN commands require this capability right. Also note that the list of permitted commands can be further limited with the [cap\_fcntls\_limit(2)](/cap_fcntls_limit/2.md) system call.

- CAP\_FEXECVE

  Permit [fexecve(2)](/fexecve/2.md) and [openat(2)](/openat/2.md) with the O\_EXEC flag; CAP\_READ is also required.

- CAP\_FLOCK

  Permit [flock(2)](/flock/2.md), [fcntl(2)](/fcntl/2.md) (with F\_GETLK, F\_SETLK, F\_SETLKW or F\_SETLK\_REMOTE flag) and [openat(2)](/openat/2.md) (with O\_EXLOCK or O\_SHLOCK flag).

- CAP\_FPATHCONF

  Permit [fpathconf(2)](/fpathconf/2.md).

- CAP\_FSCK

  Permit UFS background-fsck operations on the descriptor.

- CAP\_FSTAT

  Permit [fstat(2)](/fstat/2.md) and [fstatat(2)](/fstatat/2.md) if the CAP\_LOOKUP right is also present.

- CAP\_FSTATAT

  An alias to CAP\_FSTAT and CAP\_LOOKUP.

- CAP\_FSTATFS

  Permit [fstatfs(2)](/fstatfs/2.md).

- CAP\_FSYNC

  Permit [aio\_fsync(2)](/aio_fsync/2.md), [fdatasync(2)](/fdatasync/2.md), [fsync(2)](/fsync/2.md) and [openat(2)](/openat/2.md) with O\_DSYNC, O\_FSYNC, or O\_SYNC flag.

- CAP\_FTRUNCATE

  Permit [ftruncate(2)](/ftruncate/2.md) and [openat(2)](/openat/2.md) with the O\_TRUNC flag.

- CAP\_FUTIMES

  Permit [futimens(2)](/futimens/2.md) and [futimes(2)](/futimes/2.md), and permit [futimesat(2)](/futimesat/2.md) and [utimensat(2)](/utimensat/2.md) if the CAP\_LOOKUP right is also present.

- CAP\_FUTIMESAT

  An alias to CAP\_FUTIMES and CAP\_LOOKUP.

- CAP\_GETPEERNAME

  Permit [getpeername(2)](/getpeername/2.md).

- CAP\_GETSOCKNAME

  Permit [getsockname(2)](/getsockname/2.md).

- CAP\_GETSOCKOPT

  Permit [getsockopt(2)](/getsockopt/2.md).

- CAP\_INOTIFY\_ADD

  Permit [inotify\_add\_watch(2)](/inotify_add_watch/2.md) and [inotify\_add\_watch\_at(2)](/inotify_add_watch_at/2.md).

- CAP\_INOTIFY\_RM

  Permit [inotify\_rm\_watch(2)](/inotify_rm_watch/2.md).

- CAP\_IOCTL

  Permit [ioctl(2)](/ioctl/2.md). Be aware that this system call has enormous scope, including potentially global scope for some objects. The list of permitted ioctl commands can be further limited with the [cap\_ioctls\_limit(2)](/cap_ioctls_limit/2.md) system call.

- CAP\_KQUEUE

  An alias to CAP\_KQUEUE\_CHANGE and CAP\_KQUEUE\_EVENT.

- CAP\_KQUEUE\_CHANGE

  Permit [kevent(2)](/kevent/2.md) on a [kqueue(2)](/kqueue/2.md) descriptor that modifies list of monitored events (the *changelist* argument is non-NULL).

- CAP\_KQUEUE\_EVENT

  Permit [kevent(2)](/kevent/2.md) on a [kqueue(2)](/kqueue/2.md) descriptor that monitors events (the *eventlist* argument is non-NULL). CAP\_EVENT is also required on file descriptors that will be monitored using [kevent(2)](/kevent/2.md).

- CAP\_LINKAT\_SOURCE

  Permit [linkat(2)](/linkat/2.md) on the source directory descriptor. This right includes the CAP\_LOOKUP right.

  Warning: CAP\_LINKAT\_SOURCE makes it possible to link files in a directory for which file descriptors exist that have additional rights. For example, a file stored in a directory that does not allow CAP\_READ may be linked in another directory that does allow CAP\_READ, thereby granting read access to a file that is otherwise unreadable.

- CAP\_LINKAT\_TARGET

  Permit [linkat(2)](/linkat/2.md) on the target directory descriptor. This right includes the CAP\_LOOKUP right.

- CAP\_LISTEN

  Permit [listen(2)](/listen/2.md); not much use (generally) without CAP\_BIND.

- CAP\_LOOKUP

  Permit the file descriptor to be used as a starting directory for calls such as [linkat(2)](/linkat/2.md), [openat(2)](/openat/2.md), and [unlinkat(2)](/unlinkat/2.md).

- CAP\_MAC\_GET

  Permit [mac\_get\_fd(3)](/mac_get_fd/3.md).

- CAP\_MAC\_SET

  Permit [mac\_set\_fd(3)](/mac_set_fd/3.md).

- CAP\_MKDIRAT

  Permit [mkdirat(2)](/mkdirat/2.md). This right includes the CAP\_LOOKUP right.

- CAP\_MKFIFOAT

  Permit [mkfifoat(2)](/mkfifoat/2.md). This right includes the CAP\_LOOKUP right.

- CAP\_MKNODAT

  Permit [mknodat(2)](/mknodat/2.md). This right includes the CAP\_LOOKUP right.

- CAP\_MMAP

  Permit [mmap(2)](/mmap/2.md) with the PROT\_NONE protection.

- CAP\_MMAP\_R

  Permit [mmap(2)](/mmap/2.md) with the PROT\_READ protection. This right includes the CAP\_READ and CAP\_SEEK rights.

- CAP\_MMAP\_RW

  An alias to CAP\_MMAP\_R and CAP\_MMAP\_W.

- CAP\_MMAP\_RWX

  An alias to CAP\_MMAP\_R, CAP\_MMAP\_W and CAP\_MMAP\_X.

- CAP\_MMAP\_RX

  An alias to CAP\_MMAP\_R and CAP\_MMAP\_X.

- CAP\_MMAP\_W

  Permit [mmap(2)](/mmap/2.md) with the PROT\_WRITE protection. This right includes the CAP\_WRITE and CAP\_SEEK rights.

- CAP\_MMAP\_WX

  An alias to CAP\_MMAP\_W and CAP\_MMAP\_X.

- CAP\_MMAP\_X

  Permit [mmap(2)](/mmap/2.md) with the PROT\_EXEC protection. This right includes the CAP\_SEEK right.

- CAP\_PDGETPID

  Permit [pdgetpid(2)](/pdgetpid/2.md).

- CAP\_PDKILL

  Permit [pdkill(2)](/pdkill/2.md).

- CAP\_PTRACE

  Permit debugging using pdptrace(2).

- CAP\_PDWAIT

  Permit [pdwait(2)](/pdwait/2.md).

- CAP\_PEELOFF

  Permit [sctp\_peeloff(2)](/sctp_peeloff/2.md).

- CAP\_PREAD

  An alias to CAP\_READ and CAP\_SEEK.

- CAP\_PWRITE

  An alias to CAP\_SEEK and CAP\_WRITE.

- CAP\_READ

  Permit [aio\_read(2)](/aio_read/2.md) (CAP\_SEEK is also required), [openat(2)](/openat/2.md) with the O\_RDONLY flag, [read(2)](/read/2.md), [readv(2)](/readv/2.md), [recv(2)](/recv/2.md), [recvfrom(2)](/recvfrom/2.md), [recvmsg(2)](/recvmsg/2.md), [pread(2)](/pread/2.md) (CAP\_SEEK is also required), [preadv(2)](/preadv/2.md) (CAP\_SEEK is also required), [getdents(2)](/getdents/2.md), [getdirentries(2)](/getdirentries/2.md), and related system calls.

- CAP\_RECV

  An alias to CAP\_READ.

- CAP\_RENAMEAT\_SOURCE

  Permit [renameat(2)](/renameat/2.md) on the source directory descriptor. This right includes the CAP\_LOOKUP right.

  Warning: CAP\_RENAMEAT\_SOURCE makes it possible to move files to a directory for which file descriptors exist that have additional rights. For example, a file stored in a directory that does not allow CAP\_READ may be moved to another directory that does allow CAP\_READ, thereby granting read access to a file that is otherwise unreadable.

- CAP\_RENAMEAT\_TARGET

  Permit [renameat(2)](/renameat/2.md) on the target directory descriptor. This right includes the CAP\_LOOKUP right.

- CAP\_SEEK

  Permit operations that seek on the file descriptor, such as [lseek(2)](/lseek/2.md), but also required for I/O system calls that can read or write at any position in the file, such as [pread(2)](/pread/2.md) and [pwrite(2)](/pwrite/2.md).

- CAP\_SEM\_GETVALUE

  Permit [sem\_getvalue(3)](/sem_getvalue/3.md).

- CAP\_SEM\_POST

  Permit [sem\_post(3)](/sem_post/3.md).

- CAP\_SEM\_WAIT

  Permit [sem\_wait(3)](/sem_wait/3.md) and [sem\_trywait(3)](/sem_trywait/3.md).

- CAP\_SEND

  An alias to CAP\_WRITE.

- CAP\_SETSOCKOPT

  Permit [setsockopt(2)](/setsockopt/2.md); this controls various aspects of socket behavior and may affect binding, connecting, and other behaviors with global scope.

- CAP\_SHUTDOWN

  Permit explicit [shutdown(2)](/shutdown/2.md); closing the socket will also generally shut down any connections on it.

- CAP\_SYMLINKAT

  Permit [symlinkat(2)](/symlinkat/2.md). This right includes the CAP\_LOOKUP right.

- CAP\_TTYHOOK

  Allow configuration of TTY hooks, such as [snp(4)](/snp/4.md), on the file descriptor.

- CAP\_UNLINKAT

  Permit [unlinkat(2)](/unlinkat/2.md) and [renameat(2)](/renameat/2.md). This right is only required for [renameat(2)](/renameat/2.md) on the destination directory descriptor if the destination object already exists and will be removed by the rename. This right includes the CAP\_LOOKUP right.

- CAP\_WRITE

  Allow [aio\_write(2)](/aio_write/2.md), [openat(2)](/openat/2.md) with O\_WRONLY and O\_APPEND flags set, [send(2)](/send/2.md), [sendmsg(2)](/sendmsg/2.md), [sendto(2)](/sendto/2.md), [write(2)](/write/2.md), [writev(2)](/writev/2.md), [pwrite(2)](/pwrite/2.md), [pwritev(2)](/pwritev/2.md) and related system calls. For [sendto(2)](/sendto/2.md) with a non-NULL connection address, CAP\_CONNECT is also required. For [openat(2)](/openat/2.md) with the O\_WRONLY flag, but without the O\_APPEND or O\_TRUNC flag, CAP\_SEEK is also required. For [aio\_write(2)](/aio_write/2.md), [pwrite(2)](/pwrite/2.md) and [pwritev(2)](/pwritev/2.md) CAP\_SEEK is also required.

## SEE ALSO

[accept(2)](/accept/2.md), [accept4(2)](/accept4/2.md), [aio\_fsync(2)](/aio_fsync/2.md), [aio\_read(2)](/aio_read/2.md), [aio\_write(2)](/aio_write/2.md), [bind(2)](/bind/2.md), [bindat(2)](/bindat/2.md), [cap\_enter(2)](/cap_enter/2.md), [cap\_fcntls\_limit(2)](/cap_fcntls_limit/2.md), [cap\_ioctls\_limit(2)](/cap_ioctls_limit/2.md), [cap\_rights\_limit(2)](/cap_rights_limit/2.md), [chflagsat(2)](/chflagsat/2.md), [connect(2)](/connect/2.md), [connectat(2)](/connectat/2.md), [extattr\_delete\_fd(2)](/extattr_delete_fd/2.md), [extattr\_get\_fd(2)](/extattr_get_fd/2.md), [extattr\_list\_fd(2)](/extattr_list_fd/2.md), [extattr\_set\_fd(2)](/extattr_set_fd/2.md), [fchflags(2)](/fchflags/2.md), [fchmod(2)](/fchmod/2.md), [fchmodat(2)](/fchmodat/2.md), [fchown(2)](/fchown/2.md), [fchownat(2)](/fchownat/2.md), [fcntl(2)](/fcntl/2.md), [fexecve(2)](/fexecve/2.md), [fhopen(2)](/fhopen/2.md), [flock(2)](/flock/2.md), [fpathconf(2)](/fpathconf/2.md), [fstat(2)](/fstat/2.md), [fstatat(2)](/fstatat/2.md), [fstatfs(2)](/fstatfs/2.md), [fsync(2)](/fsync/2.md), [ftruncate(2)](/ftruncate/2.md), [futimes(2)](/futimes/2.md), [getdents(2)](/getdents/2.md), [getdirentries(2)](/getdirentries/2.md), [getpeername(2)](/getpeername/2.md), [getsockname(2)](/getsockname/2.md), [getsockopt(2)](/getsockopt/2.md), [ioctl(2)](/ioctl/2.md), [kevent(2)](/kevent/2.md), [kqueue(2)](/kqueue/2.md), [linkat(2)](/linkat/2.md), [listen(2)](/listen/2.md), [mmap(2)](/mmap/2.md), [mq\_open(2)](/mq_open/2.md), [open(2)](/open/2.md), [openat(2)](/openat/2.md), [pdfork(2)](/pdfork/2.md), [pdgetpid(2)](/pdgetpid/2.md), [pdkill(2)](/pdkill/2.md), pdwait4(2), [pipe(2)](/pipe/2.md), [poll(2)](/poll/2.md), [pread(2)](/pread/2.md), [preadv(2)](/preadv/2.md), [pwrite(2)](/pwrite/2.md), [pwritev(2)](/pwritev/2.md), [read(2)](/read/2.md), [readv(2)](/readv/2.md), [recv(2)](/recv/2.md), [recvfrom(2)](/recvfrom/2.md), [recvmsg(2)](/recvmsg/2.md), [renameat(2)](/renameat/2.md), [sctp\_peeloff(2)](/sctp_peeloff/2.md), [select(2)](/select/2.md), [send(2)](/send/2.md), [sendmsg(2)](/sendmsg/2.md), [sendto(2)](/sendto/2.md), [setsockopt(2)](/setsockopt/2.md), [shm\_open(2)](/shm_open/2.md), [shutdown(2)](/shutdown/2.md), [socket(2)](/socket/2.md), [socketpair(2)](/socketpair/2.md), [symlinkat(2)](/symlinkat/2.md), [unlinkat(2)](/unlinkat/2.md), [write(2)](/write/2.md), [writev(2)](/writev/2.md), [acl\_delete\_fd\_np(3)](/acl_delete_fd_np/3.md), [acl\_get\_fd(3)](/acl_get_fd/3.md), [acl\_get\_fd\_np(3)](/acl_get_fd_np/3.md), [acl\_set\_fd(3)](/acl_set_fd/3.md), [acl\_set\_fd\_np(3)](/acl_set_fd_np/3.md), [acl\_valid\_fd\_np(3)](/acl_valid_fd_np/3.md), [mac\_get\_fd(3)](/mac_get_fd/3.md), [mac\_set\_fd(3)](/mac_set_fd/3.md), [sem\_getvalue(3)](/sem_getvalue/3.md), [sem\_post(3)](/sem_post/3.md), [sem\_trywait(3)](/sem_trywait/3.md), [sem\_wait(3)](/sem_wait/3.md), [capsicum(4)](/capsicum/4.md), [snp(4)](/snp/4.md)

## HISTORY

Support for capabilities and capabilities mode was developed as part of the TrustedBSD Project.

## AUTHORS

This manual page was created by Pawel Jakub Dawidek ⟨*pawel@dawidek.net*⟩ under sponsorship from the FreeBSD Foundation based on the cap\_new(2) manual page by Robert Watson ⟨*rwatson@FreeBSD.org*⟩.