BSD syscall#6
svc · unix #6
close
Releases a file descriptor and decrements the reference count on the underlying open-file table entry.
Prototype
int close(int fd);Returns: int
Arguments
| Name | Type | Dir | Description |
|---|---|---|---|
| fd | int | - |
Version history
| XNU tag | macOS | # |
|---|---|---|
| xnu-1456.1.26 | macOS 10.6 Snow Leopard | 6 |
| xnu-1699.24.8 | macOS 10.7 Lion | 6 |
| xnu-2050.18.24 | macOS 10.8 Mountain Lion | 6 |
| xnu-2422.115.4 | macOS 10.9 Mavericks | 6 |
| xnu-2782.40.9 | macOS 10.10 Yosemite | 6 |
| xnu-3247.1.106 | macOS 10.11 El Capitan | 6 |
| xnu-3789.1.32 | macOS 10.12 Sierra | 6 |
| xnu-4570.1.46 | macOS 10.13 High Sierra | 6 |
| xnu-4903.221.2 | macOS 10.14 Mojave | 6 |
| xnu-6153.11.26 | macOS 10.15 Catalina | 6 |
| xnu-1486.2.11 | — | 6 |
| xnu-1504.15.3 | — | 6 |
| xnu-1504.3.12 | — | 6 |
| xnu-1504.7.4 | — | 6 |
| xnu-1504.9.17 | — | 6 |
| xnu-1504.9.26 | — | 6 |
| xnu-1504.9.37 | — | 6 |
| xnu-1699.22.73 | — | 6 |
| xnu-1699.22.81 | — | 6 |
| xnu-1699.24.23 | — | 6 |
| xnu-1699.26.8 | — | 6 |
| xnu-1699.32.7 | — | 6 |
| xnu-2050.22.13 | — | 6 |
| xnu-2050.24.15 | — | 6 |
| xnu-2050.48.11 | — | 6 |
| xnu-2050.7.9 | — | 6 |
| xnu-2050.9.2 | — | 6 |
| xnu-2422.1.72 | — | 6 |
| xnu-2422.100.13 | — | 6 |
| xnu-2422.110.17 | — | 6 |
| xnu-2422.90.20 | — | 6 |
| xnu-2782.1.97 | — | 6 |
| xnu-2782.10.72 | — | 6 |
| xnu-2782.20.48 | — | 6 |
| xnu-2782.30.5 | — | 6 |
| xnu-3247.10.11 | — | 6 |
| xnu-3248.20.55 | — | 6 |
| xnu-3248.30.4 | — | 6 |
| xnu-3248.40.184 | — | 6 |
| xnu-3248.50.21 | — | 6 |
| xnu-3248.60.10 | — | 6 |
| xnu-3789.21.4 | — | 6 |
| xnu-3789.31.2 | — | 6 |
| xnu-3789.41.3 | — | 6 |
| xnu-3789.51.2 | — | 6 |
| xnu-3789.60.24 | — | 6 |
| xnu-3789.70.16 | — | 6 |
| xnu-4570.20.62 | — | 6 |
| xnu-4570.31.3 | — | 6 |
| xnu-4570.41.2 | — | 6 |
| xnu-4570.51.1 | — | 6 |
| xnu-4570.61.1 | — | 6 |
| xnu-4570.71.2 | — | 6 |
| xnu-4903.231.4 | — | 6 |
| xnu-4903.241.1 | — | 6 |
| xnu-4903.270.47 | — | 6 |
| xnu-6153.101.6 | — | 6 |
| xnu-6153.121.1 | — | 6 |
| xnu-6153.141.1 | — | 6 |
| xnu-6153.41.3 | — | 6 |
| xnu-6153.61.1 | — | 6 |
| xnu-6153.81.5 | — | 6 |
Examples
C — close after use
close(fd);Notes
The kernel removes the fd from the process file table and drops a reference on the fileglob. When the last reference disappears the vnode is inactivated, pending writes are flushed and any advisory locks held on the file are released. Closing a guarded descriptor without close_guard set is rejected with EBADF.
Detection
Endpoint Security emits ES_EVENT_TYPE_NOTIFY_CLOSE with the vnode being released. DTrace's syscall::close:entry/return fires per invocation; fs.fileops kernel probes capture the vnode reference drop.
Related APIs
opendupdup2guarded_close_npfcntlopenat