--- name: "semget_secure" section: "2" platform: "linux" package: "libselinux-dev" version: "2002031409-4" release: "Debian 3.0 (Woody)" platforms: ["linux"] url: "https://new.carta.tech/semget/2" --- # semget\_secure(2) get a semaphore set identifier Part of [semget(2)](/semget/2.md). ## NAME semget, semget\_secure - get a semaphore set identifier ## SYNOPSIS ``` # include # include # include # include /* for semget_secure */ ``` **int semget ( key\_t** *key***,** **int** *nsems***,** **int** *semflg* **)** **int semget\_secure ( key\_t** *key***,** **int** *nsems***,** **int** *semflg***,** **security\_id\_t** *sid* **)** ## DESCRIPTION The functions return the semaphore set identifier associated to the value of the argument *key*. A new set of *nsems* semaphores is created if *key* has value **IPC\_PRIVATE** or *key* isn't **IPC\_PRIVATE**, no existing message queue is associated to *key*, and **IPC\_CREAT** is asserted in *semflg* (i.e. *semflg* & **IPC\_CREAT** isn't zero). The presence in *semflg* of the fields **IPC\_CREAT** and **IPC\_EXCL** plays the same role, with respect to the existence of the semaphore set, as the presence of **O\_CREAT** and **O\_EXCL** in the mode argument of the [**open**(2)](/open/2.md) system call: i.e. the **semget** function fails if *semflg* asserts both **IPC\_CREAT** and **IPC\_EXCL** and a semaphore set already exists for *key*. Upon creation, the lower 9 bits of the argument *semflg* define the access permissions (for owner, group and others) to the semaphore set in the same format, and with the same meaning, as for the access permissions parameter in the [**open**(2)](/open/2.md) or [**creat**(2)](/creat/2.md) system calls (though the execute permissions are not used by the system, and write permissions, for a semaphore set, effectively means alter permissions). Furthermore, while creating, the system call initializes the system semaphore set data structure **semid\_ds** as follows: - **sem\_perm.cuid** and **sem\_perm.uid** are set to the effective user-ID of the calling process. - **sem\_perm.cgid** and **sem\_perm.gid** are set to the effective group-ID of the calling process. - The lowest order 9 bits of **sem\_perm.mode** are set to the lowest order 9 bit of *semflg*. - **sem\_nsems** is set to the value of *nsems*. - **sem\_otime** is set to 0. - **sem\_ctime** is set to the current time. The argument *nsems* can be **0** (a don't care) when the system call isn't a create one. Otherwise *nsems* must be greater than **0** and less or equal to the maximum number of semaphores per semid, (**SEMMSL**). If the semaphore set already exists, the access permissions are verified, and a check is made to see if it is marked for destruction. If [**semget\_secure**(2)](/semget_secure/2.md) is used the *sid* argument must match the value of the existing semaphore set in addition to the access permissions being checked. ## RETURN VALUE If successful, the return value will be the semaphore set identifier (a positive integer), otherwise **-1** with **errno** indicating the error. ## ERRORS For a failing return, **errno** will be set to one among the following values: - **EACCES** A semaphore set exists for *key*, but the calling process has no access permissions to the set or the calling process lacks permission to create a semaphore set with the specified *sid.* - **EEXIST** A semaphore set exists for **key** and *semflg* was asserting both **IPC\_CREAT** and **IPC\_EXCL**. - **EIDRM** The semaphore set is marked as to be deleted. - **ENOENT** No semaphore set exists for *key* and *semflg* wasn't asserting **IPC\_CREAT**. - **ENOMEM** A semaphore set has to be created but the system has not enough memory for the new data structure. - **ENOSPC** A semaphore set has to be created but the system limit for the maximum number of semaphore sets (**SEMMNI**), or the system wide maximum number of semaphores (**SEMMNS**), would be exceeded. ## NOTES **IPC\_PRIVATE** isn't a flag field but a **key\_t** type. If this special value is used for *key*, the system call ignores everything but the lowest order 9 bits of *semflg* and creates a new semaphore set (on success). The followings are limits on semaphore set resources affecting a **semget** call: - **SEMMNI** System wide maximum number of semaphore sets: policy dependent. - **SEMMSL** Maximum number of semaphores per semid: implementation dependent (500 currently). - **SEMMNS** System wide maximum number of semaphores: policy dependent. Values greater than **SEMMSL \* SEMMNI** makes it irrelevant. ## BUGS Use of **IPC\_PRIVATE** doesn't inhibit to other processes the access to the allocated semaphore set. As for the files, there is currently no intrinsic way for a process to ensure exclusive access to a semaphore set. Asserting both **IPC\_CREAT** and **IPC\_EXCL** in *semflg* only ensures (on success) that a new semaphore set will be created, it doesn't imply exclusive access to the semaphore set. The data structure associated with each semaphore in the set isn't initialized by the system call. In order to initialize those data structures, one has to execute a subsequent call to [**semctl**(2)](/semctl/2.md) to perform a **SETVAL** or a **SETALL** command on the semaphore set. ## CONFORMING TO SVr4, SVID. SVr4 documents additional error conditions EINVAL, EFBIG, E2BIG, EAGAIN, ERANGE, EFAULT. ## SEE ALSO [**ftok**(3)](/ftok/3.md), [**ipc**(5)](/ipc/5.md), [**semctl**(2)](/semctl/2.md), [**semop**(2)](/semop/2.md), [**semsid**(2)](/semsid/2.md).