BSD syscall#92
svc · unix #92
fcntl
Multiplexed file descriptor control call covering descriptor duplication, flag manipulation, locking and macOS-specific operations.
Prototype
int fcntl(int fd, int cmd, long arg);Returns: int
Arguments
| Name | Type | Dir | Description |
|---|---|---|---|
| fd | int | - | |
| cmd | int | - | |
| arg | long | - |
Version history
| XNU tag | macOS | # |
|---|---|---|
| xnu-1456.1.26 | macOS 10.6 Snow Leopard | 92 |
| xnu-1486.2.11 | — | 92 |
| xnu-1504.15.3 | — | 92 |
| xnu-1504.3.12 | — | 92 |
| xnu-1504.7.4 | — | 92 |
| xnu-1504.9.17 | — | 92 |
| xnu-1504.9.26 | — | 92 |
| xnu-1504.9.37 | — | 92 |
Examples
C — set close-on-exec
int fl = fcntl(fd, F_GETFD);
fcntl(fd, F_SETFD, fl | FD_CLOEXEC);C — durable flush
if (fcntl(fd, F_FULLFSYNC) == -1)
fsync(fd); // fall backNotes
macOS extends POSIX fcntl with a large set of F_* commands: F_PREALLOCATE, F_PUNCHHOLE, F_FULLFSYNC, F_NOCACHE, F_GETPATH, F_BARRIERFSYNC, F_SETBACKINGSTORE and many more. F_FULLFSYNC is required when callers need data on stable media; plain fsync only flushes to the drive cache. Locking commands F_GETLK/F_SETLK/F_SETLKW implement advisory POSIX locks per fileglob.
Detection
syscall::fcntl:entry in DTrace exposes the cmd argument. Endpoint Security does not break down fcntl variants, but holes punched via F_PUNCHHOLE leave VFS write events.
Related APIs
openopenatflockfsyncguarded_open_npdup