---
name: "rights"
section: "4"
platform: "freebsd"
package: "base"
version: "16.0-CURRENT-20261027-61c70dc16a79"
release: "FreeBSD 16.0-CURRENT (2026-10-27)"
platforms: ["freebsd"]
url: "https://carta.tech/man/rights"
---

# rights(4)

Capsicum capability rights for file descriptors

## NAME

**Capability** **rights** – Capsicum capability rights for file descriptors

## DESCRIPTION

When a file descriptor is created by a function such as [fhopen(2)](/man/fhopen/2.md), [kqueue(2)](/man/kqueue/2.md), [mq\_open(2)](/man/mq_open/2.md), [open(2)](/man/open/2.md), [pdfork(2)](/man/pdfork/2.md), [pipe(2)](/man/pipe/2.md), [shm\_open(2)](/man/shm_open/2.md), [socket(2)](/man/socket/2.md) or [socketpair(2)](/man/socketpair/2.md), it is assigned all capability rights; for [accept(2)](/man/accept/2.md), [accept4(2)](/man/accept4/2.md) or [openat(2)](/man/openat/2.md), it inherits capability rights from the "parent" file descriptor. Those rights can be reduced (but never expanded) by using the [cap\_rights\_limit(2)](/man/cap_rights_limit/2.md), [cap\_fcntls\_limit(2)](/man/cap_fcntls_limit/2.md) and [cap\_ioctls\_limit(2)](/man/cap_ioctls_limit/2.md) system calls. Once capability rights are reduced, operations on the file descriptor will be limited to those permitted by rights.

The complete list of capability rights is provided below. The *cap\_rights\_t* type is used to store list of capability rights. The [cap\_rights\_init(3)](/man/cap_rights_init/3.md) family of functions should be used to manage the structure.

## RIGHTS

Note that rights are not simple bitmasks (and cannot be bitwise-ORed together). See [cap\_rights\_init(3)](/man/cap_rights_init/3.md) for details.

The following rights are available:

- CAP\_ACCEPT

  Permit [accept(2)](/man/accept/2.md) and [accept4(2)](/man/accept4/2.md).

- CAP\_ACL\_CHECK

  Permit [acl\_valid\_fd\_np(3)](/man/acl_valid_fd_np/3.md).

- CAP\_ACL\_DELETE

  Permit [acl\_delete\_fd\_np(3)](/man/acl_delete_fd_np/3.md).

- CAP\_ACL\_GET

  Permit [acl\_get\_fd(3)](/man/acl_get_fd/3.md) and [acl\_get\_fd\_np(3)](/man/acl_get_fd_np/3.md).

- CAP\_ACL\_SET

  Permit [acl\_set\_fd(3)](/man/acl_set_fd/3.md) and [acl\_set\_fd\_np(3)](/man/acl_set_fd_np/3.md).

- CAP\_BIND

  When not in capabilities mode, permit [bind(2)](/man/bind/2.md) and [bindat(2)](/man/bindat/2.md) with special value AT\_FDCWD in the *fd* parameter. Note that sockets can also become bound implicitly as a result of [connect(2)](/man/connect/2.md) or [send(2)](/man/send/2.md), and that socket options set with [setsockopt(2)](/man/setsockopt/2.md) may also affect binding behavior.

- CAP\_BINDAT

  Permit [bindat(2)](/man/bindat/2.md). This right has to be present on the directory descriptor. This right includes the CAP\_LOOKUP right.

- CAP\_CHFLAGSAT

  An alias to CAP\_FCHFLAGS and CAP\_LOOKUP.

- CAP\_CONNECT

  When not in capabilities mode, permit [connect(2)](/man/connect/2.md) and [connectat(2)](/man/connectat/2.md) with special value AT\_FDCWD in the *fd* parameter. This right is also required for [sendto(2)](/man/sendto/2.md) with a non-NULL destination address.

- CAP\_CONNECTAT

  Permit [connectat(2)](/man/connectat/2.md). This right has to be present on the directory descriptor. This right includes the CAP\_LOOKUP right.

- CAP\_CREATE

  Permit [openat(2)](/man/openat/2.md) with the O\_CREAT flag.

- CAP\_EVENT

  Permit [select(2)](/man/select/2.md), [poll(2)](/man/poll/2.md), and [kevent(2)](/man/kevent/2.md) to be used in monitoring the file descriptor for events.

- CAP\_EXTATTR\_DELETE

  Permit [extattr\_delete\_fd(2)](/man/extattr_delete_fd/2.md).

- CAP\_EXTATTR\_GET

  Permit [extattr\_get\_fd(2)](/man/extattr_get_fd/2.md).

- CAP\_EXTATTR\_LIST

  Permit [extattr\_list\_fd(2)](/man/extattr_list_fd/2.md).

- CAP\_EXTATTR\_SET

  Permit [extattr\_set\_fd(2)](/man/extattr_set_fd/2.md).

- CAP\_FCHDIR

  Permit [fchdir(2)](/man/fchdir/2.md).

- CAP\_FCHFLAGS

  Permit [fchflags(2)](/man/fchflags/2.md) and [chflagsat(2)](/man/chflagsat/2.md) if the CAP\_LOOKUP right is also present.

- CAP\_FCHMOD

  Permit [fchmod(2)](/man/fchmod/2.md) and [fchmodat(2)](/man/fchmodat/2.md) if the CAP\_LOOKUP right is also present.

- CAP\_FCHMODAT

  An alias to CAP\_FCHMOD and CAP\_LOOKUP.

- CAP\_FCHOWN

  Permit [fchown(2)](/man/fchown/2.md) and [fchownat(2)](/man/fchownat/2.md) if the CAP\_LOOKUP right is also present.

- CAP\_FCHOWNAT

  An alias to CAP\_FCHOWN and CAP\_LOOKUP.

- CAP\_FCHROOT

  Permit [fchroot(2)](/man/fchroot/2.md).

- CAP\_FCNTL

  Permit [fcntl(2)](/man/fcntl/2.md). Note that only the F\_GETFL, F\_SETFL, F\_GETOWN and F\_SETOWN commands require this capability right. Also note that the list of permitted commands can be further limited with the [cap\_fcntls\_limit(2)](/man/cap_fcntls_limit/2.md) system call.

- CAP\_FEXECVE

  Permit [fexecve(2)](/man/fexecve/2.md) and [openat(2)](/man/openat/2.md) with the O\_EXEC flag; CAP\_READ is also required.

- CAP\_FLOCK

  Permit [flock(2)](/man/flock/2.md), [fcntl(2)](/man/fcntl/2.md) (with F\_GETLK, F\_SETLK, F\_SETLKW or F\_SETLK\_REMOTE flag) and [openat(2)](/man/openat/2.md) (with O\_EXLOCK or O\_SHLOCK flag).

- CAP\_FPATHCONF

  Permit [fpathconf(2)](/man/fpathconf/2.md).

- CAP\_FSCK

  Permit UFS background-fsck operations on the descriptor.

- CAP\_FSTAT

  Permit [fstat(2)](/man/fstat/2.md) and [fstatat(2)](/man/fstatat/2.md) if the CAP\_LOOKUP right is also present.

- CAP\_FSTATAT

  An alias to CAP\_FSTAT and CAP\_LOOKUP.

- CAP\_FSTATFS

  Permit [fstatfs(2)](/man/fstatfs/2.md).

- CAP\_FSYNC

  Permit [aio\_fsync(2)](/man/aio_fsync/2.md), [fdatasync(2)](/man/fdatasync/2.md), [fsync(2)](/man/fsync/2.md) and [openat(2)](/man/openat/2.md) with O\_DSYNC, O\_FSYNC, or O\_SYNC flag.

- CAP\_FTRUNCATE

  Permit [ftruncate(2)](/man/ftruncate/2.md) and [openat(2)](/man/openat/2.md) with the O\_TRUNC flag.

- CAP\_FUTIMES

  Permit [futimens(2)](/man/futimens/2.md) and [futimes(2)](/man/futimes/2.md), and permit [futimesat(2)](/man/futimesat/2.md) and [utimensat(2)](/man/utimensat/2.md) if the CAP\_LOOKUP right is also present.

- CAP\_FUTIMESAT

  An alias to CAP\_FUTIMES and CAP\_LOOKUP.

- CAP\_GETPEERNAME

  Permit [getpeername(2)](/man/getpeername/2.md).

- CAP\_GETSOCKNAME

  Permit [getsockname(2)](/man/getsockname/2.md).

- CAP\_GETSOCKOPT

  Permit [getsockopt(2)](/man/getsockopt/2.md).

- CAP\_INOTIFY\_ADD

  Permit [inotify\_add\_watch(2)](/man/inotify_add_watch/2.md) and [inotify\_add\_watch\_at(2)](/man/inotify_add_watch_at/2.md).

- CAP\_INOTIFY\_RM

  Permit [inotify\_rm\_watch(2)](/man/inotify_rm_watch/2.md).

- CAP\_IOCTL

  Permit [ioctl(2)](/man/ioctl/2.md). Be aware that this system call has enormous scope, including potentially global scope for some objects. The list of permitted ioctl commands can be further limited with the [cap\_ioctls\_limit(2)](/man/cap_ioctls_limit/2.md) system call.

- CAP\_KQUEUE

  An alias to CAP\_KQUEUE\_CHANGE and CAP\_KQUEUE\_EVENT.

- CAP\_KQUEUE\_CHANGE

  Permit [kevent(2)](/man/kevent/2.md) on a [kqueue(2)](/man/kqueue/2.md) descriptor that modifies list of monitored events (the *changelist* argument is non-NULL).

- CAP\_KQUEUE\_EVENT

  Permit [kevent(2)](/man/kevent/2.md) on a [kqueue(2)](/man/kqueue/2.md) descriptor that monitors events (the *eventlist* argument is non-NULL). CAP\_EVENT is also required on file descriptors that will be monitored using [kevent(2)](/man/kevent/2.md).

- CAP\_LINKAT\_SOURCE

  Permit [linkat(2)](/man/linkat/2.md) on the source directory descriptor. This right includes the CAP\_LOOKUP right.

  Warning: CAP\_LINKAT\_SOURCE makes it possible to link files in a directory for which file descriptors exist that have additional rights. For example, a file stored in a directory that does not allow CAP\_READ may be linked in another directory that does allow CAP\_READ, thereby granting read access to a file that is otherwise unreadable.

- CAP\_LINKAT\_TARGET

  Permit [linkat(2)](/man/linkat/2.md) on the target directory descriptor. This right includes the CAP\_LOOKUP right.

- CAP\_LISTEN

  Permit [listen(2)](/man/listen/2.md); not much use (generally) without CAP\_BIND.

- CAP\_LOOKUP

  Permit the file descriptor to be used as a starting directory for calls such as [linkat(2)](/man/linkat/2.md), [openat(2)](/man/openat/2.md), and [unlinkat(2)](/man/unlinkat/2.md).

- CAP\_MAC\_GET

  Permit [mac\_get\_fd(3)](/man/mac_get_fd/3.md).

- CAP\_MAC\_SET

  Permit [mac\_set\_fd(3)](/man/mac_set_fd/3.md).

- CAP\_MKDIRAT

  Permit [mkdirat(2)](/man/mkdirat/2.md). This right includes the CAP\_LOOKUP right.

- CAP\_MKFIFOAT

  Permit [mkfifoat(2)](/man/mkfifoat/2.md). This right includes the CAP\_LOOKUP right.

- CAP\_MKNODAT

  Permit [mknodat(2)](/man/mknodat/2.md). This right includes the CAP\_LOOKUP right.

- CAP\_MMAP

  Permit [mmap(2)](/man/mmap/2.md) with the PROT\_NONE protection.

- CAP\_MMAP\_R

  Permit [mmap(2)](/man/mmap/2.md) with the PROT\_READ protection. This right includes the CAP\_READ and CAP\_SEEK rights.

- CAP\_MMAP\_RW

  An alias to CAP\_MMAP\_R and CAP\_MMAP\_W.

- CAP\_MMAP\_RWX

  An alias to CAP\_MMAP\_R, CAP\_MMAP\_W and CAP\_MMAP\_X.

- CAP\_MMAP\_RX

  An alias to CAP\_MMAP\_R and CAP\_MMAP\_X.

- CAP\_MMAP\_W

  Permit [mmap(2)](/man/mmap/2.md) with the PROT\_WRITE protection. This right includes the CAP\_WRITE and CAP\_SEEK rights.

- CAP\_MMAP\_WX

  An alias to CAP\_MMAP\_W and CAP\_MMAP\_X.

- CAP\_MMAP\_X

  Permit [mmap(2)](/man/mmap/2.md) with the PROT\_EXEC protection. This right includes the CAP\_SEEK right.

- CAP\_PDGETPID

  Permit [pdgetpid(2)](/man/pdgetpid/2.md).

- CAP\_PDKILL

  Permit [pdkill(2)](/man/pdkill/2.md).

- CAP\_PTRACE

  Permit debugging using pdptrace(2).

- CAP\_PDWAIT

  Permit [pdwait(2)](/man/pdwait/2.md).

- CAP\_PEELOFF

  Permit [sctp\_peeloff(2)](/man/sctp_peeloff/2.md).

- CAP\_PREAD

  An alias to CAP\_READ and CAP\_SEEK.

- CAP\_PWRITE

  An alias to CAP\_SEEK and CAP\_WRITE.

- CAP\_READ

  Permit [aio\_read(2)](/man/aio_read/2.md) (CAP\_SEEK is also required), [openat(2)](/man/openat/2.md) with the O\_RDONLY flag, [read(2)](/man/read/2.md), [readv(2)](/man/readv/2.md), [recv(2)](/man/recv/2.md), [recvfrom(2)](/man/recvfrom/2.md), [recvmsg(2)](/man/recvmsg/2.md), [pread(2)](/man/pread/2.md) (CAP\_SEEK is also required), [preadv(2)](/man/preadv/2.md) (CAP\_SEEK is also required), [getdents(2)](/man/getdents/2.md), [getdirentries(2)](/man/getdirentries/2.md), and related system calls.

- CAP\_RECV

  An alias to CAP\_READ.

- CAP\_RENAMEAT\_SOURCE

  Permit [renameat(2)](/man/renameat/2.md) on the source directory descriptor. This right includes the CAP\_LOOKUP right.

  Warning: CAP\_RENAMEAT\_SOURCE makes it possible to move files to a directory for which file descriptors exist that have additional rights. For example, a file stored in a directory that does not allow CAP\_READ may be moved to another directory that does allow CAP\_READ, thereby granting read access to a file that is otherwise unreadable.

- CAP\_RENAMEAT\_TARGET

  Permit [renameat(2)](/man/renameat/2.md) on the target directory descriptor. This right includes the CAP\_LOOKUP right.

- CAP\_SEEK

  Permit operations that seek on the file descriptor, such as [lseek(2)](/man/lseek/2.md), but also required for I/O system calls that can read or write at any position in the file, such as [pread(2)](/man/pread/2.md) and [pwrite(2)](/man/pwrite/2.md).

- CAP\_SEM\_GETVALUE

  Permit [sem\_getvalue(3)](/man/sem_getvalue/3.md).

- CAP\_SEM\_POST

  Permit [sem\_post(3)](/man/sem_post/3.md).

- CAP\_SEM\_WAIT

  Permit [sem\_wait(3)](/man/sem_wait/3.md) and [sem\_trywait(3)](/man/sem_trywait/3.md).

- CAP\_SEND

  An alias to CAP\_WRITE.

- CAP\_SETSOCKOPT

  Permit [setsockopt(2)](/man/setsockopt/2.md); this controls various aspects of socket behavior and may affect binding, connecting, and other behaviors with global scope.

- CAP\_SHUTDOWN

  Permit explicit [shutdown(2)](/man/shutdown/2.md); closing the socket will also generally shut down any connections on it.

- CAP\_SYMLINKAT

  Permit [symlinkat(2)](/man/symlinkat/2.md). This right includes the CAP\_LOOKUP right.

- CAP\_TTYHOOK

  Allow configuration of TTY hooks, such as [snp(4)](/man/snp/4.md), on the file descriptor.

- CAP\_UNLINKAT

  Permit [unlinkat(2)](/man/unlinkat/2.md) and [renameat(2)](/man/renameat/2.md). This right is only required for [renameat(2)](/man/renameat/2.md) on the destination directory descriptor if the destination object already exists and will be removed by the rename. This right includes the CAP\_LOOKUP right.

- CAP\_WRITE

  Allow [aio\_write(2)](/man/aio_write/2.md), [openat(2)](/man/openat/2.md) with O\_WRONLY and O\_APPEND flags set, [send(2)](/man/send/2.md), [sendmsg(2)](/man/sendmsg/2.md), [sendto(2)](/man/sendto/2.md), [write(2)](/man/write/2.md), [writev(2)](/man/writev/2.md), [pwrite(2)](/man/pwrite/2.md), [pwritev(2)](/man/pwritev/2.md) and related system calls. For [sendto(2)](/man/sendto/2.md) with a non-NULL connection address, CAP\_CONNECT is also required. For [openat(2)](/man/openat/2.md) with the O\_WRONLY flag, but without the O\_APPEND or O\_TRUNC flag, CAP\_SEEK is also required. For [aio\_write(2)](/man/aio_write/2.md), [pwrite(2)](/man/pwrite/2.md) and [pwritev(2)](/man/pwritev/2.md) CAP\_SEEK is also required.

## SEE ALSO

[accept(2)](/man/accept/2.md), [accept4(2)](/man/accept4/2.md), [aio\_fsync(2)](/man/aio_fsync/2.md), [aio\_read(2)](/man/aio_read/2.md), [aio\_write(2)](/man/aio_write/2.md), [bind(2)](/man/bind/2.md), [bindat(2)](/man/bindat/2.md), [cap\_enter(2)](/man/cap_enter/2.md), [cap\_fcntls\_limit(2)](/man/cap_fcntls_limit/2.md), [cap\_ioctls\_limit(2)](/man/cap_ioctls_limit/2.md), [cap\_rights\_limit(2)](/man/cap_rights_limit/2.md), [chflagsat(2)](/man/chflagsat/2.md), [connect(2)](/man/connect/2.md), [connectat(2)](/man/connectat/2.md), [extattr\_delete\_fd(2)](/man/extattr_delete_fd/2.md), [extattr\_get\_fd(2)](/man/extattr_get_fd/2.md), [extattr\_list\_fd(2)](/man/extattr_list_fd/2.md), [extattr\_set\_fd(2)](/man/extattr_set_fd/2.md), [fchflags(2)](/man/fchflags/2.md), [fchmod(2)](/man/fchmod/2.md), [fchmodat(2)](/man/fchmodat/2.md), [fchown(2)](/man/fchown/2.md), [fchownat(2)](/man/fchownat/2.md), [fcntl(2)](/man/fcntl/2.md), [fexecve(2)](/man/fexecve/2.md), [fhopen(2)](/man/fhopen/2.md), [flock(2)](/man/flock/2.md), [fpathconf(2)](/man/fpathconf/2.md), [fstat(2)](/man/fstat/2.md), [fstatat(2)](/man/fstatat/2.md), [fstatfs(2)](/man/fstatfs/2.md), [fsync(2)](/man/fsync/2.md), [ftruncate(2)](/man/ftruncate/2.md), [futimes(2)](/man/futimes/2.md), [getdents(2)](/man/getdents/2.md), [getdirentries(2)](/man/getdirentries/2.md), [getpeername(2)](/man/getpeername/2.md), [getsockname(2)](/man/getsockname/2.md), [getsockopt(2)](/man/getsockopt/2.md), [ioctl(2)](/man/ioctl/2.md), [kevent(2)](/man/kevent/2.md), [kqueue(2)](/man/kqueue/2.md), [linkat(2)](/man/linkat/2.md), [listen(2)](/man/listen/2.md), [mmap(2)](/man/mmap/2.md), [mq\_open(2)](/man/mq_open/2.md), [open(2)](/man/open/2.md), [openat(2)](/man/openat/2.md), [pdfork(2)](/man/pdfork/2.md), [pdgetpid(2)](/man/pdgetpid/2.md), [pdkill(2)](/man/pdkill/2.md), pdwait4(2), [pipe(2)](/man/pipe/2.md), [poll(2)](/man/poll/2.md), [pread(2)](/man/pread/2.md), [preadv(2)](/man/preadv/2.md), [pwrite(2)](/man/pwrite/2.md), [pwritev(2)](/man/pwritev/2.md), [read(2)](/man/read/2.md), [readv(2)](/man/readv/2.md), [recv(2)](/man/recv/2.md), [recvfrom(2)](/man/recvfrom/2.md), [recvmsg(2)](/man/recvmsg/2.md), [renameat(2)](/man/renameat/2.md), [sctp\_peeloff(2)](/man/sctp_peeloff/2.md), [select(2)](/man/select/2.md), [send(2)](/man/send/2.md), [sendmsg(2)](/man/sendmsg/2.md), [sendto(2)](/man/sendto/2.md), [setsockopt(2)](/man/setsockopt/2.md), [shm\_open(2)](/man/shm_open/2.md), [shutdown(2)](/man/shutdown/2.md), [socket(2)](/man/socket/2.md), [socketpair(2)](/man/socketpair/2.md), [symlinkat(2)](/man/symlinkat/2.md), [unlinkat(2)](/man/unlinkat/2.md), [write(2)](/man/write/2.md), [writev(2)](/man/writev/2.md), [acl\_delete\_fd\_np(3)](/man/acl_delete_fd_np/3.md), [acl\_get\_fd(3)](/man/acl_get_fd/3.md), [acl\_get\_fd\_np(3)](/man/acl_get_fd_np/3.md), [acl\_set\_fd(3)](/man/acl_set_fd/3.md), [acl\_set\_fd\_np(3)](/man/acl_set_fd_np/3.md), [acl\_valid\_fd\_np(3)](/man/acl_valid_fd_np/3.md), [mac\_get\_fd(3)](/man/mac_get_fd/3.md), [mac\_set\_fd(3)](/man/mac_set_fd/3.md), [sem\_getvalue(3)](/man/sem_getvalue/3.md), [sem\_post(3)](/man/sem_post/3.md), [sem\_trywait(3)](/man/sem_trywait/3.md), [sem\_wait(3)](/man/sem_wait/3.md), [capsicum(4)](/man/capsicum/4.md), [snp(4)](/man/snp/4.md)

## HISTORY

Support for capabilities and capabilities mode was developed as part of the TrustedBSD Project.

## AUTHORS

This manual page was created by Pawel Jakub Dawidek ⟨*pawel@dawidek.net*⟩ under sponsorship from the FreeBSD Foundation based on the cap\_new(2) manual page by Robert Watson ⟨*rwatson@FreeBSD.org*⟩.