Skip to content
BSD syscall#131

svc · unix #131

flock

Applies or removes a BSD advisory whole-file lock on an open file descriptor.

Prototype

int flock(int fd, int how);

Returns: int

Arguments

NameTypeDirDescription
fdint-
howint-

Version history

XNU tagmacOS#
xnu-1456.1.26macOS 10.6 Snow Leopard131
xnu-1699.24.8macOS 10.7 Lion131
xnu-2050.18.24macOS 10.8 Mountain Lion131
xnu-2422.115.4macOS 10.9 Mavericks131
xnu-2782.40.9macOS 10.10 Yosemite131
xnu-3247.1.106macOS 10.11 El Capitan131
xnu-3789.1.32macOS 10.12 Sierra131
xnu-4570.1.46macOS 10.13 High Sierra131
xnu-4903.221.2macOS 10.14 Mojave131
xnu-6153.11.26macOS 10.15 Catalina131
xnu-1486.2.11—131
xnu-1504.15.3—131
xnu-1504.3.12—131
xnu-1504.7.4—131
xnu-1504.9.17—131
xnu-1504.9.26—131
xnu-1504.9.37—131
xnu-1699.22.73—131
xnu-1699.22.81—131
xnu-1699.24.23—131
xnu-1699.26.8—131
xnu-1699.32.7—131
xnu-2050.22.13—131
xnu-2050.24.15—131
xnu-2050.48.11—131
xnu-2050.7.9—131
xnu-2050.9.2—131
xnu-2422.1.72—131
xnu-2422.100.13—131
xnu-2422.110.17—131
xnu-2422.90.20—131
xnu-2782.1.97—131
xnu-2782.10.72—131
xnu-2782.20.48—131
xnu-2782.30.5—131
xnu-3247.10.11—131
xnu-3248.20.55—131
xnu-3248.30.4—131
xnu-3248.40.184—131
xnu-3248.50.21—131
xnu-3248.60.10—131
xnu-3789.21.4—131
xnu-3789.31.2—131
xnu-3789.41.3—131
xnu-3789.51.2—131
xnu-3789.60.24—131
xnu-3789.70.16—131
xnu-4570.20.62—131
xnu-4570.31.3—131
xnu-4570.41.2—131
xnu-4570.51.1—131
xnu-4570.61.1—131
xnu-4570.71.2—131
xnu-4903.231.4—131
xnu-4903.241.1—131
xnu-4903.270.47—131
xnu-6153.101.6—131
xnu-6153.121.1—131
xnu-6153.141.1—131
xnu-6153.41.3—131
xnu-6153.61.1—131
xnu-6153.81.5—131

Examples

C — non-blocking exclusive lock

if (flock(fd, LOCK_EX | LOCK_NB) == -1) {
    if (errno == EWOULDBLOCK) /* another holder */;
}

Notes

flock(2) places a shared (LOCK_SH) or exclusive (LOCK_EX) advisory lock on the fileglob behind the fd; LOCK_UN releases it. The lock is associated with the fileglob, not the process, so two fds from a single dup share state. macOS implements flock on regular files, FIFOs and devices but not on most network filesystems. The lock is advisory — only cooperating processes that also call flock will block. LOCK_NB makes the call non-blocking, returning EWOULDBLOCK instead of waiting.

Detection

syscall::flock:entry exposes the operation flags. Endpoint Security has no flock event. Long-held locks usually show up as application contention rather than as a dedicated kernel-side signal.

Related APIs

fcntlopenopenatguarded_open_npsys_flock