Index: head/lib/libc/sys/mq_open.2
===================================================================
--- head/lib/libc/sys/mq_open.2	(revision 352845)
+++ head/lib/libc/sys/mq_open.2	(revision 352846)
@@ -1,329 +1,336 @@
 .\" Copyright (c) 2005 David Xu <davidxu@FreeBSD.org>
 .\" All rights reserved.
 .\"
 .\" Redistribution and use in source and binary forms, with or without
 .\" modification, are permitted provided that the following conditions
 .\" are met:
 .\" 1. Redistributions of source code must retain the above copyright
 .\"    notice(s), this list of conditions and the following disclaimer as
 .\"    the first lines of this file unmodified other than the possible
 .\"    addition of one or more copyright notices.
 .\" 2. Redistributions in binary form must reproduce the above copyright
 .\"    notice(s), this list of conditions and the following disclaimer in
 .\"    the documentation and/or other materials provided with the
 .\"    distribution.
 .\"
 .\" THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDER(S) ``AS IS'' AND ANY
 .\" EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 .\" PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) BE
 .\" LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 .\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 .\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
 .\" BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
 .\" WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
 .\" OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
 .\" EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
 .\" Portions of this text are reprinted and reproduced in electronic form
 .\" from IEEE Std 1003.1, 2004 Edition, Standard for Information Technology --
 .\" Portable Operating System Interface (POSIX), The Open Group Base
 .\" Specifications Issue 6, Copyright (C) 2001-2004 by the Institute of
 .\" Electrical and Electronics Engineers, Inc and The Open Group.  In the
 .\" event of any discrepancy between this version and the original IEEE and
 .\" The Open Group Standard, the original IEEE and The Open Group Standard is
 .\" the referee document.  The original Standard can be obtained online at
 .\"	http://www.opengroup.org/unix/online.html.
 .\"
 .\" $FreeBSD$
 .\"
-.Dd September 15, 2014
+.Dd September 28, 2019
 .Dt MQ_OPEN 2
 .Os
 .Sh NAME
 .Nm mq_open
 .Nd "open a message queue (REALTIME)"
 .Sh LIBRARY
 .Lb librt
 .Sh SYNOPSIS
 .In mqueue.h
 .Ft mqd_t
 .Fn mq_open "const char *name" "int oflag" "..."
 .Sh DESCRIPTION
 The
 .Fn mq_open
 system call establishes the connection between a process and a message queue
 with a message queue descriptor.
 It creates an open message queue
 description that refers to the message queue, and a message queue descriptor
 that refers to that open message queue description.
 The message queue
 descriptor is used by other functions to refer to that message queue.
 The
 .Fa name
 argument points to a string naming a message queue.
 The
 .Fa name
 argument should conform to the construction rules for a pathname.
 The
 .Fa name
 should begin with a slash character.
 Processes calling
 .Fn mq_open
 with the same value of
 .Fa name
 refers to the same message queue object, as long as that name has not been
 removed.
 If the
 .Fa name
 argument is not the name of an existing message queue and creation is not
 requested,
 .Fn mq_open
 will fail and return an error.
 .Pp
 The
 .Fa oflag
 argument requests the desired receive and/or send access to the message
 queue.
 The requested access permission to receive messages or send messages
 would be granted if the calling process would be granted read or write access,
 respectively, to an equivalently protected file.
 .Pp
 The value of
 .Fa oflag
 is the bitwise-inclusive OR of values from the following list.
 Applications should specify exactly one of the first three values (access
 modes) below in the value of
 .Fa oflag :
 .Bl -tag -width ".Dv O_NONBLOCK"
 .It Dv O_RDONLY
 Open the message queue for receiving messages.
 The process can use the
 returned message queue descriptor with
 .Fn mq_receive ,
 but not
 .Fn mq_send .
 A message queue may be open multiple times in the same or different processes
 for receiving messages.
 .It Dv O_WRONLY
 Open the queue for sending messages.
 The process can use the returned
 message queue descriptor with
 .Fn mq_send
 but not
 .Fn mq_receive .
 A message queue may be open multiple times in the same or different processes
 for sending messages.
 .It Dv O_RDWR
 Open the queue for both receiving and sending messages.
 The process can use
 any of the functions allowed for
 .Dv O_RDONLY
 and
 .Dv O_WRONLY .
 A message queue may be open multiple times in the same or different processes
 for sending messages.
 .El
 .Pp
 Any combination of the remaining flags may be specified in the value of
 .Fa oflag :
 .Bl -tag -width ".Dv O_NONBLOCK"
 .It Dv O_CREAT
 Create a message queue.
 It requires two additional arguments:
 .Fa mode ,
 which is of type
-.Vt int ,
+.Vt mode_t ,
 and
 .Fa attr ,
 which is a pointer to an
 .Vt mq_attr
 structure.
 If the pathname
 .Fa name
 has already been used to create a message queue that still exists, then
 this flag has no effect, except as noted under
 .Dv O_EXCL .
 Otherwise, a message queue will be created without any messages
 in it.
 The user ID of the message queue will be set to the effective user ID
 of the process, and the group ID of the message queue will be set to the
 effective group ID of the process.
 The permission bits of the message queue
 will be set to the value of the
 .Fa mode
 argument, except those set in the file mode creation mask of the process.
 When bits in
 .Fa mode
 other than the file permission bits are specified, the effect is
 unspecified.
 If
 .Fa attr
 is
 .Dv NULL ,
 the message queue is created with implementation-defined default message
 queue attributes.
 If attr is
 .Pf non- Dv NULL
 and the calling process has the
 appropriate privilege on name, the message queue
 .Va mq_maxmsg
 and
 .Va mq_msgsize
 attributes will be set to the values of the corresponding members in the
 .Vt mq_attr
 structure referred to by
 .Fa attr .
 If
 .Fa attr
 is
 .Pf non- Dv NULL ,
 but the calling process does not have the appropriate privilege
 on name, the
 .Fn mq_open
 function will fail and return an error without creating the message queue.
 .It Dv O_EXCL
 If
 .Dv O_EXCL
 and
 .Dv O_CREAT
 are set,
 .Fn mq_open
 will fail if the message queue name exists.
 .It Dv O_NONBLOCK
 Determines whether an
 .Fn mq_send
 or
 .Fn mq_receive
 waits for resources or messages that are not currently available, or fails
 with
 .Va errno
 set to
 .Er EAGAIN ;
 see
 .Xr mq_send 2
 and
 .Xr mq_receive 2
 for details.
 .El
 .Pp
 The
 .Fn mq_open
 system call does not add or remove messages from the queue.
 .Sh NOTES
 .Fx
 implements message queue based on file descriptor.
 The descriptor
 is inherited by child after
 .Xr fork 2 .
 The descriptor is closed in a new image after
 .Xr exec 3 .
 The
 .Xr select 2
 and
 .Xr kevent 2
 system calls are supported for message queue descriptor.
 .Pp
 Please see the
 .Xr mqueuefs 5
 man page for instructions on loading the module or compiling the service into
 the kernel.
 .Sh RETURN VALUES
 Upon successful completion, the function returns a message queue
 descriptor; otherwise, the function returns
 .Po Vt mqd_t Pc Ns \-1
 and sets the global variable
 .Va errno
 to indicate the error.
 .Sh ERRORS
 The
 .Fn mq_open
 system call
 will fail if:
 .Bl -tag -width Er
 .It Bq Er EACCES
 The message queue exists and the permissions specified by
 .Fa oflag
 are denied, or the message queue does not exist and permission to create the
 message queue is denied.
 .It Bq Er EEXIST
 .Dv O_CREAT
 and
 .Dv O_EXCL
 are set and the named message queue already exists.
 .It Bq Er EINTR
 The
 .Fn mq_open
 function was interrupted by a signal.
 .It Bq Er EINVAL
 The
 .Fn mq_open
 function is not supported for the given name.
 .It Bq Er EINVAL
 .Dv O_CREAT
 was specified in
 .Fa oflag ,
 the value of
 .Fa attr
 is not
 .Dv NULL ,
 and either
 .Va mq_maxmsg
 or
 .Va mq_msgsize
 was less than or equal to zero.
 .It Bq Er EMFILE
 Too many message queue descriptors or file descriptors are currently in use
 by this process.
 .It Bq Er ENAMETOOLONG
 The length of the
 .Fa name
 argument exceeds
 .Brq Dv PATH_MAX
 or a pathname component
 is longer than
 .Brq Dv NAME_MAX .
 .It Bq Er ENFILE
 Too many message queues are currently open in the system.
 .It Bq Er ENOENT
 .Dv O_CREAT
 is not set and the named message queue does not exist.
 .It Bq Er ENOSPC
 There is insufficient space for the creation of the new message queue.
 .El
 .Sh SEE ALSO
 .Xr mq_close 2 ,
 .Xr mq_getattr 2 ,
 .Xr mq_receive 2 ,
 .Xr mq_send 2 ,
 .Xr mq_setattr 2 ,
 .Xr mq_timedreceive 3 ,
 .Xr mq_timedsend 3 ,
 .Xr mq_unlink 3 ,
 .Xr mqueuefs 5
 .Sh STANDARDS
 The
 .Fn mq_open
 system call conforms to
 .St -p1003.1-2004 .
 .Sh HISTORY
 Support for
 .Tn POSIX
 message queues first appeared in
 .Fx 7.0 .
 .Sh BUGS
 This implementation places strict requirements on the value of
 .Fa name :
 it must begin with a slash
 .Pq Ql /
 and contain no other slash characters.
+.Pp
+The
+.Fa mode
+and
+.Fa attr
+arguments are variadic and may result in different calling conventions
+than might otherwise be expected.
 .Sh COPYRIGHT
 Portions of this text are reprinted and reproduced in electronic form
 from IEEE Std 1003.1, 2004 Edition, Standard for Information Technology --
 Portable Operating System Interface (POSIX), The Open Group Base
 Specifications Issue 6, Copyright (C) 2001-2004 by the Institute of
 Electrical and Electronics Engineers, Inc and The Open Group.  In the
 event of any discrepancy between this version and the original IEEE and
 The Open Group Standard, the original IEEE and The Open Group Standard is
 the referee document.  The original Standard can be obtained online at
 http://www.opengroup.org/unix/online.html.
Index: head/lib/libc/sys/open.2
===================================================================
--- head/lib/libc/sys/open.2	(revision 352845)
+++ head/lib/libc/sys/open.2	(revision 352846)
@@ -1,617 +1,622 @@
 .\" Copyright (c) 1980, 1991, 1993
 .\"	The Regents of the University of California.  All rights reserved.
 .\"
 .\" Redistribution and use in source and binary forms, with or without
 .\" modification, are permitted provided that the following conditions
 .\" are met:
 .\" 1. Redistributions of source code must retain the above copyright
 .\"    notice, this list of conditions and the following disclaimer.
 .\" 2. Redistributions in binary form must reproduce the above copyright
 .\"    notice, this list of conditions and the following disclaimer in the
 .\"    documentation and/or other materials provided with the distribution.
 .\" 3. Neither the name of the University nor the names of its contributors
 .\"    may be used to endorse or promote products derived from this software
 .\"    without specific prior written permission.
 .\"
 .\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 .\" ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
 .\"     @(#)open.2	8.2 (Berkeley) 11/16/93
 .\" $FreeBSD$
 .\"
-.Dd September 17, 2019
+.Dd September 28, 2019
 .Dt OPEN 2
 .Os
 .Sh NAME
 .Nm open , openat
 .Nd open or create a file for reading, writing or executing
 .Sh LIBRARY
 .Lb libc
 .Sh SYNOPSIS
 .In fcntl.h
 .Ft int
 .Fn open "const char *path" "int flags" "..."
 .Ft int
 .Fn openat "int fd" "const char *path" "int flags" "..."
 .Sh DESCRIPTION
 The file name specified by
 .Fa path
 is opened
 for either execution or reading and/or writing as specified by the
 argument
 .Fa flags
 and the file descriptor returned to the calling process.
 The
 .Fa flags
 argument may indicate the file is to be
 created if it does not exist (by specifying the
 .Dv O_CREAT
 flag).
 In this case
 .Fn open
 and
 .Fn openat
 require an additional argument
-.Fa "int mode" ,
+.Fa "mode_t mode" ,
 and the file is created with mode
 .Fa mode
 as described in
 .Xr chmod 2
 and modified by the process' umask value (see
 .Xr umask 2 ) .
 .Pp
 The
 .Fn openat
 function is equivalent to the
 .Fn open
 function except in the case where the
 .Fa path
 specifies a relative path, or the
 .Dv O_BENEATH
 flag is provided.
 For
 .Fn openat
 and relative
 .Fa path ,
 the file to be opened is determined relative to the directory
 associated with the file descriptor
 .Fa fd
 instead of the current working directory.
 The
 .Fa flag
 parameter and the optional fourth parameter correspond exactly to
 the parameters of
 .Fn open .
 If
 .Fn openat
 is passed the special value
 .Dv AT_FDCWD
 in the
 .Fa fd
 parameter, the current working directory is used
 and the behavior is identical to a call to
 .Fn open .
 .Pp
 When
 .Fn openat
 is called with an absolute
 .Fa path
 without the
 .Dv O_BENEATH
 flag, it ignores the
 .Fa fd
 argument.
 When
 .Dv O_BENEATH
 is specified with an absolute
 .Fa path ,
 a directory passed by the
 .Fa fd
 argument is used as the topping point for the resolution.
 See the definition of the
 .Dv O_BENEATH
 flag below.
 .Pp
 In
 .Xr capsicum 4
 capability mode,
 .Fn open
 is not permitted.
 The
 .Fa path
 argument to
 .Fn openat
 must be strictly relative to a file descriptor
 .Fa fd ,
 as defined in
 .Pa sys/kern/vfs_lookup.c .
 .Fa path
 must not be an absolute path and must not contain ".." components
 which cause the path resolution to escape the directory hierarchy
 starting at
 .Fa fd .
 Additionally, no symbolic link in
 .Fa path
 may target absolute path or contain escaping ".." components.
 .Fa fd
 must not be
 .Dv AT_FDCWD .
 .Pp
 If the
 .Dv vfs.lookup_cap_dotdot
 .Xr sysctl 3
 MIB is set to zero, ".." components in the paths,
 used in capability mode, or with the
 .Dv O_BENEATH
 flag, are completely disabled.
 If the
 .Dv vfs.lookup_cap_dotdot_nonlocal
 MIB is set to zero, ".." is not allowed if found on non-local filesystem.
 .Pp
 The flags specified are formed by
 .Em or Ns 'ing
 the following values
 .Pp
 .Bd -literal -offset indent -compact
 O_RDONLY	open for reading only
 O_WRONLY	open for writing only
 O_RDWR		open for reading and writing
 O_EXEC		open for execute only
 O_NONBLOCK	do not block on open
 O_APPEND	append on each write
 O_CREAT		create file if it does not exist
 O_TRUNC		truncate size to 0
 O_EXCL		error if create and file exists
 O_SHLOCK	atomically obtain a shared lock
 O_EXLOCK	atomically obtain an exclusive lock
 O_DIRECT	eliminate or reduce cache effects
 O_FSYNC		synchronous writes
 O_SYNC		synchronous writes
 O_NOFOLLOW	do not follow symlinks
 O_NOCTTY	ignored
 O_TTY_INIT	ignored
 O_DIRECTORY	error if file is not a directory
 O_CLOEXEC	set FD_CLOEXEC upon open
 O_VERIFY	verify the contents of the file
 O_BENEATH	require path to be strictly relative to topping directory
 .Ed
 .Pp
 Opening a file with
 .Dv O_APPEND
 set causes each write on the file
 to be appended to the end.
 If
 .Dv O_TRUNC
 is specified and the
 file exists, the file is truncated to zero length.
 If
 .Dv O_EXCL
 is set with
 .Dv O_CREAT
 and the file already
 exists,
 .Fn open
 returns an error.
 This may be used to
 implement a simple exclusive access locking mechanism.
 If
 .Dv O_EXCL
 is set and the last component of the pathname is
 a symbolic link,
 .Fn open
 will fail even if the symbolic
 link points to a non-existent name.
 If the
 .Dv O_NONBLOCK
 flag is specified and the
 .Fn open
 system call would result
 in the process being blocked for some reason (e.g., waiting for
 carrier on a dialup line),
 .Fn open
 returns immediately.
 The descriptor remains in non-blocking mode for subsequent operations.
 .Pp
 If
 .Dv O_FSYNC
 is used in the mask, all writes will
 immediately and synchronously be written to disk.
 .Pp
 .Dv O_SYNC
 is a synonym for
 .Dv O_FSYNC
 required by
 .Tn POSIX .
 .Pp
 If
 .Dv O_NOFOLLOW
 is used in the mask and the target file passed to
 .Fn open
 is a symbolic link then the
 .Fn open
 will fail.
 .Pp
 When opening a file, a lock with
 .Xr flock 2
 semantics can be obtained by setting
 .Dv O_SHLOCK
 for a shared lock, or
 .Dv O_EXLOCK
 for an exclusive lock.
 If creating a file with
 .Dv O_CREAT ,
 the request for the lock will never fail
 (provided that the underlying file system supports locking).
 .Pp
 .Dv O_DIRECT
 may be used to minimize or eliminate the cache effects of reading and writing.
 The system will attempt to avoid caching the data you read or write.
 If it cannot avoid caching the data,
 it will minimize the impact the data has on the cache.
 Use of this flag can drastically reduce performance if not used with care.
 .Pp
 .Dv O_NOCTTY
 may be used to ensure the OS does not assign this file as the
 controlling terminal when it opens a tty device.
 This is the default on
 .Fx ,
 but is present for
 .Tn POSIX
 compatibility.
 The
 .Fn open
 system call will not assign controlling terminals on
 .Fx .
 .Pp
 .Dv O_TTY_INIT
 may be used to ensure the OS restores the terminal attributes when
 initially opening a TTY.
 This is the default on
 .Fx ,
 but is present for
 .Tn POSIX
 compatibility.
 The initial call to
 .Fn open
 on a TTY will always restore default terminal attributes on
 .Fx .
 .Pp
 .Dv O_DIRECTORY
 may be used to ensure the resulting file descriptor refers to a
 directory.
 This flag can be used to prevent applications with elevated privileges
 from opening files which are even unsafe to open with
 .Dv O_RDONLY ,
 such as device nodes.
 .Pp
 .Dv O_CLOEXEC
 may be used to set
 .Dv FD_CLOEXEC
 flag for the newly returned file descriptor.
 .Pp
 .Dv O_VERIFY
 may be used to indicate to the kernel that the contents of the file should
 be verified before allowing the open to proceed.
 The details of what
 .Dq verified
 means is implementation specific.
 The run-time linker (rtld) uses this flag to ensure shared objects have
 been verified before operating on them.
 .Pp
 .Dv O_BENEATH
 returns
 .Er ENOTCAPABLE
 if the specified relative path, after resolving all symlinks and ".."
 references, does not reside in the directory hierarchy of
 children beneath the topping directory.
 Topping directory is the process current directory if relative
 .Fa path
 is used for
 .Fn open ,
 and the directory referenced by the
 .Fa fd
 argument when using
 .Fn openat .
 If the specified path is absolute,
 .Dv O_BENEATH
 allows arbitrary prefix that ends up at the topping directory,
 after which all further resolved components must be under it.
 .Pp
 If successful,
 .Fn open
 returns a non-negative integer, termed a file descriptor.
 It returns \-1 on failure.
 The file pointer used to mark the current position within the
 file is set to the beginning of the file.
 .Pp
 If a sleeping open of a device node from
 .Xr devfs 5
 is interrupted by a signal, the call always fails with
 .Er EINTR ,
 even if the
 .Dv SA_RESTART
 flag is set for the signal.
 A sleeping open of a fifo (see
 .Xr mkfifo 2 )
 is restarted as normal.
 .Pp
 When a new file is created it is given the group of the directory
 which contains it.
 .Pp
 Unless
 .Dv O_CLOEXEC
 flag was specified,
 the new descriptor is set to remain open across
 .Xr execve 2
 system calls; see
 .Xr close 2 ,
 .Xr fcntl 2
 and
 .Dv O_CLOEXEC
 description.
 .Pp
 The system imposes a limit on the number of file descriptors
 open simultaneously by one process.
 The
 .Xr getdtablesize 2
 system call returns the current system limit.
 .Sh RETURN VALUES
 If successful,
 .Fn open
 and
 .Fn openat
 return a non-negative integer, termed a file descriptor.
 They return \-1 on failure, and set
 .Va errno
 to indicate the error.
 .Sh ERRORS
 The named file is opened unless:
 .Bl -tag -width Er
 .It Bq Er ENOTDIR
 A component of the path prefix is not a directory.
 .It Bq Er ENAMETOOLONG
 A component of a pathname exceeded 255 characters,
 or an entire path name exceeded 1023 characters.
 .It Bq Er ENOENT
 .Dv O_CREAT
 is not set and the named file does not exist.
 .It Bq Er ENOENT
 A component of the path name that must exist does not exist.
 .It Bq Er EACCES
 Search permission is denied for a component of the path prefix.
 .It Bq Er EACCES
 The required permissions (for reading and/or writing)
 are denied for the given flags.
 .It Bq Er EACCES
 .Dv O_TRUNC
 is specified and write permission is denied.
 .It Bq Er EACCES
 .Dv O_CREAT
 is specified,
 the file does not exist,
 and the directory in which it is to be created
 does not permit writing.
 .It Bq Er EPERM
 .Dv O_CREAT
 is specified, the file does not exist, and the directory in which it is to be
 created has its immutable flag set, see the
 .Xr chflags 2
 manual page for more information.
 .It Bq Er EPERM
 The named file has its immutable flag set and the file is to be modified.
 .It Bq Er EPERM
 The named file has its append-only flag set, the file is to be modified, and
 .Dv O_TRUNC
 is specified or
 .Dv O_APPEND
 is not specified.
 .It Bq Er ELOOP
 Too many symbolic links were encountered in translating the pathname.
 .It Bq Er EISDIR
 The named file is a directory, and the arguments specify
 it is to be modified.
 .It Bq Er EISDIR
 The named file is a directory, and the flags specified
 .Dv O_CREAT
 without
 .Dv O_DIRECTORY .
 .It Bq Er EROFS
 The named file resides on a read-only file system,
 and the file is to be modified.
 .It Bq Er EROFS
 .Dv O_CREAT
 is specified and the named file would reside on a read-only file system.
 .It Bq Er EMFILE
 The process has already reached its limit for open file descriptors.
 .It Bq Er ENFILE
 The system file table is full.
 .It Bq Er EMLINK
 .Dv O_NOFOLLOW
 was specified and the target is a symbolic link.
 .It Bq Er ENXIO
 The named file is a character special or block
 special file, and the device associated with this special file
 does not exist.
 .It Bq Er ENXIO
 .Dv O_NONBLOCK
 is set, the named file is a fifo,
 .Dv O_WRONLY
 is set, and no process has the file open for reading.
 .It Bq Er EINTR
 The
 .Fn open
 operation was interrupted by a signal.
 .It Bq Er EOPNOTSUPP
 .Dv O_SHLOCK
 or
 .Dv O_EXLOCK
 is specified but the underlying file system does not support locking.
 .It Bq Er EOPNOTSUPP
 The named file is a special file mounted through a file system that
 does not support access to it (e.g.\& NFS).
 .It Bq Er EWOULDBLOCK
 .Dv O_NONBLOCK
 and one of
 .Dv O_SHLOCK
 or
 .Dv O_EXLOCK
 is specified and the file is locked.
 .It Bq Er ENOSPC
 .Dv O_CREAT
 is specified,
 the file does not exist,
 and the directory in which the entry for the new file is being placed
 cannot be extended because there is no space left on the file
 system containing the directory.
 .It Bq Er ENOSPC
 .Dv O_CREAT
 is specified,
 the file does not exist,
 and there are no free inodes on the file system on which the
 file is being created.
 .It Bq Er EDQUOT
 .Dv O_CREAT
 is specified,
 the file does not exist,
 and the directory in which the entry for the new file
 is being placed cannot be extended because the
 user's quota of disk blocks on the file system
 containing the directory has been exhausted.
 .It Bq Er EDQUOT
 .Dv O_CREAT
 is specified,
 the file does not exist,
 and the user's quota of inodes on the file system on
 which the file is being created has been exhausted.
 .It Bq Er EIO
 An I/O error occurred while making the directory entry or
 allocating the inode for
 .Dv O_CREAT .
 .It Bq Er ETXTBSY
 The file is a pure procedure (shared text) file that is being
 executed and the
 .Fn open
 system call requests write access.
 .It Bq Er EFAULT
 The
 .Fa path
 argument
 points outside the process's allocated address space.
 .It Bq Er EEXIST
 .Dv O_CREAT
 and
 .Dv O_EXCL
 were specified and the file exists.
 .It Bq Er EOPNOTSUPP
 An attempt was made to open a socket (not currently implemented).
 .It Bq Er EINVAL
 An attempt was made to open a descriptor with an illegal combination
 of
 .Dv O_RDONLY ,
 .Dv O_WRONLY ,
 .Dv O_RDWR
 and
 .Dv O_EXEC .
 .It Bq Er EBADF
 The
 .Fa path
 argument does not specify an absolute path and the
 .Fa fd
 argument is
 neither
 .Dv AT_FDCWD
 nor a valid file descriptor open for searching.
 .It Bq Er ENOTDIR
 The
 .Fa path
 argument is not an absolute path and
 .Fa fd
 is neither
 .Dv AT_FDCWD
 nor a file descriptor associated with a directory.
 .It Bq Er ENOTDIR
 .Dv O_DIRECTORY
 is specified and the file is not a directory.
 .It Bq Er ECAPMODE
 .Dv AT_FDCWD
 is specified and the process is in capability mode.
 .It Bq Er ECAPMODE
 .Fn open
 was called and the process is in capability mode.
 .It Bq Er ENOTCAPABLE
 .Fa path
 is an absolute path,
 or contained a ".." component leading to a
 directory outside of the directory hierarchy specified by
 .Fa fd ,
 and the process is in capability mode.
 .It Bq Er ENOTCAPABLE
 The
 .Dv O_BENEATH
 flag was provided, and the absolute
 .Fa path
 does not have its tail fully contained under the topping directory,
 or the relative
 .Fa path
 escapes it.
 .El
 .Sh SEE ALSO
 .Xr chmod 2 ,
 .Xr close 2 ,
 .Xr dup 2 ,
 .Xr fexecve 2 ,
 .Xr fhopen 2 ,
 .Xr getdtablesize 2 ,
 .Xr getfh 2 ,
 .Xr lgetfh 2 ,
 .Xr lseek 2 ,
 .Xr read 2 ,
 .Xr umask 2 ,
 .Xr write 2 ,
 .Xr fopen 3 ,
 .Xr capsicum 4
 .Sh STANDARDS
 These functions are specified by
 .St -p1003.1-2008 .
 .Fx
 sets
 .Va errno
 to
 .Er EMLINK instead of
 .Er ELOOP
 as specified by
 .Tn POSIX
 when
 .Dv O_NOFOLLOW
 is set in flags and the final component of pathname is a symbolic link
 to distinguish it from the case of too many symbolic link traversals
 in one of its non-final components.
 .Sh HISTORY
 The
 .Fn open
 function appeared in
 .At v1 .
 The
 .Fn openat
 function was introduced in
 .Fx 8.0 .
 .Sh BUGS
 The Open Group Extended API Set 2 specification requires that the test
 for whether
 .Fa fd
 is searchable is based on whether
 .Fa fd
 is open for searching, not whether the underlying directory currently
 permits searches.
 The present implementation of the
 .Fa openat
 checks the current permissions of directory instead.
+.Pp
+The
+.Fa mode
+argument is variadic and may result in different calling conventions
+than might otherwise be expected.