BSD syscall#389
svc · unix #389
__mac_set_fd
Writes a MAC label to the object referenced by an open file descriptor.
Prototype
int __mac_set_fd(int fd, struct mac *mac_p);Returns: int
Arguments
| Name | Type | Dir | Description |
|---|---|---|---|
| fd | int | - | |
| mac_p | struct mac | - |
Version history
| XNU tag | macOS | # |
|---|---|---|
| xnu-1456.1.26 | macOS 10.6 Snow Leopard | 389 |
| xnu-1699.24.8 | macOS 10.7 Lion | 389 |
| xnu-2050.18.24 | macOS 10.8 Mountain Lion | 389 |
| xnu-2422.115.4 | macOS 10.9 Mavericks | 389 |
| xnu-2782.40.9 | macOS 10.10 Yosemite | 389 |
| xnu-3247.1.106 | macOS 10.11 El Capitan | 389 |
| xnu-3789.1.32 | macOS 10.12 Sierra | 389 |
| xnu-4570.1.46 | macOS 10.13 High Sierra | 389 |
| xnu-4903.221.2 | macOS 10.14 Mojave | 389 |
| xnu-6153.11.26 | macOS 10.15 Catalina | 389 |
| xnu-7195.50.7.100.1 | macOS 11.0 Big Sur | 389 |
| xnu-8019.41.5 | macOS 12.0 Monterey | 389 |
| xnu-8792.41.9 | macOS 13.0 Ventura | 389 |
| xnu-10002.1.13 | macOS 14.0 Sonoma | 389 |
| xnu-11215.1.10 | macOS 15.0 Sequoia | 389 |
| xnu-11417.101.15 | macOS 15.4 Sequoia | 389 |
| xnu-12377.1.9 | macOS 26.0 Tahoe | 389 |
| xnu-10002.41.9 | — | 389 |
| xnu-10002.61.3 | — | 389 |
| xnu-10002.81.5 | — | 389 |
| xnu-10063.101.15 | — | 389 |
| xnu-10063.121.3 | — | 389 |
| xnu-10063.141.1 | — | 389 |
| xnu-11215.41.3 | — | 389 |
| xnu-11215.61.5 | — | 389 |
| xnu-11215.81.4 | — | 389 |
| xnu-11417.121.6 | — | 389 |
| xnu-11417.140.69 | — | 389 |
| xnu-12377.101.15 | — | 389 |
| xnu-12377.41.6 | — | 389 |
| xnu-12377.61.12 | — | 389 |
| xnu-12377.81.4 | — | 389 |
| xnu-1486.2.11 | — | 389 |
| xnu-1504.15.3 | — | 389 |
| xnu-1504.3.12 | — | 389 |
| xnu-1504.7.4 | — | 389 |
| xnu-1504.9.17 | — | 389 |
| xnu-1504.9.26 | — | 389 |
| xnu-1504.9.37 | — | 389 |
| xnu-1699.22.73 | — | 389 |
| xnu-1699.22.81 | — | 389 |
| xnu-1699.24.23 | — | 389 |
| xnu-1699.26.8 | — | 389 |
| xnu-1699.32.7 | — | 389 |
| xnu-2050.22.13 | — | 389 |
| xnu-2050.24.15 | — | 389 |
| xnu-2050.48.11 | — | 389 |
| xnu-2050.7.9 | — | 389 |
| xnu-2050.9.2 | — | 389 |
| xnu-2422.1.72 | — | 389 |
| xnu-2422.100.13 | — | 389 |
| xnu-2422.110.17 | — | 389 |
| xnu-2422.90.20 | — | 389 |
| xnu-2782.1.97 | — | 389 |
| xnu-2782.10.72 | — | 389 |
| xnu-2782.20.48 | — | 389 |
| xnu-2782.30.5 | — | 389 |
| xnu-3247.10.11 | — | 389 |
| xnu-3248.20.55 | — | 389 |
| xnu-3248.30.4 | — | 389 |
| xnu-3248.40.184 | — | 389 |
| xnu-3248.50.21 | — | 389 |
| xnu-3248.60.10 | — | 389 |
| xnu-3789.21.4 | — | 389 |
| xnu-3789.31.2 | — | 389 |
| xnu-3789.41.3 | — | 389 |
| xnu-3789.51.2 | — | 389 |
| xnu-3789.60.24 | — | 389 |
| xnu-3789.70.16 | — | 389 |
| xnu-4570.20.62 | — | 389 |
| xnu-4570.31.3 | — | 389 |
| xnu-4570.41.2 | — | 389 |
| xnu-4570.51.1 | — | 389 |
| xnu-4570.61.1 | — | 389 |
| xnu-4570.71.2 | — | 389 |
| xnu-4903.231.4 | — | 389 |
| xnu-4903.241.1 | — | 389 |
| xnu-4903.270.47 | — | 389 |
| xnu-6153.101.6 | — | 389 |
| xnu-6153.121.1 | — | 389 |
| xnu-6153.141.1 | — | 389 |
| xnu-6153.41.3 | — | 389 |
| xnu-6153.61.1 | — | 389 |
| xnu-6153.81.5 | — | 389 |
| xnu-7195.101.1 | — | 389 |
| xnu-7195.121.3 | — | 389 |
| xnu-7195.141.2 | — | 389 |
| xnu-7195.60.75 | — | 389 |
| xnu-7195.81.3 | — | 389 |
| xnu-8019.61.5 | — | 389 |
| xnu-8019.80.24 | — | 389 |
| xnu-8020.101.4 | — | 389 |
| xnu-8020.121.3 | — | 389 |
| xnu-8020.140.41 | — | 389 |
| xnu-8792.61.2 | — | 389 |
| xnu-8792.81.2 | — | 389 |
| xnu-8796.101.5 | — | 389 |
| xnu-8796.121.2 | — | 389 |
| xnu-8796.141.3 | — | 389 |
Notes
Counterpart of __mac_get_fd. The kernel resolves the descriptor, looks up each registered policy that owns one of the label elements, and dispatches to its label setter. Policies typically refuse the update unless the caller has the corresponding capability (root, entitlement, or sandbox permission).
Detection
Triggers mpo_vnode_check_label_update before commit and mpo_vnode_label_update_extattr after. Label writes on system-owned files are a strong tampering signal.
Related APIs
__mac_get_fd__mac_set_file__mac_set_linkmac_set_fd