msgctl(2)

💖 msgctl (2) — System V message control ops 💖

okay bestie, sit down, hydrate, because today we're doing message queue control and honestly? it's giving kernel plumbing realness ✨

this is page msgctl(2) from the System Calls Manual — yes, we're in the big-kid section, section 2, the syscall zone 💅

---

🌸 LIBRARY 🌸

Standard C library (libc, -lc) 🫶

---

✨ SYNOPSIS ✨

#include <sys/msg.h>

int msgctl(int msqid, int op, struct msqid_ds *buf);

---

🦋 DESCRIPTION 🦋

so msgctl() does the control operation you asked for with op on the System V message queue that has the identifier msqid. that's it. that's the whole job. she's a handler 💅

the msqid_ds data structure lives in <sys/msg.h> and it looks exactly like this, no notes:

struct msqid_ds {
    struct ipc_perm msg_perm;   /* Ownership and permissions */
    time_t          msg_stime;  /* Time of last msgsnd(2) */
    time_t          msg_rtime;  /* Time of last msgrcv(2) */
    time_t          msg_ctime;  /* Time of creation or last
                                   modification by msgctl() */
    unsigned long   msg_cbytes; /* # of bytes in queue */
    msgqnum_t       msg_qnum;   /* # number of messages in queue */
    msglen_t        msg_qbytes; /* Maximum # of bytes in queue */
    pid_t           msg_lspid;  /* PID of last msgsnd(2) */
    pid_t           msg_lrpid;  /* PID of last msgrcv(2) */
};

and here's what every single field of msqid_ds is actually doing with its life:

• msg_perm — this is the ipc_perm structure (we get to it below, don't rush me) and it specifies the access permissions on the message queue. she's the bouncer 🚪
• msg_stime — time of the last msgsnd(2) system call.
• msg_rtime — time of the last msgrcv(2) system call.
• msg_ctime — time of creation of the queue, or the time of the last msgctl() IPC_SET operation.
• msg_cbytes — number of bytes in all messages currently on the message queue. heads up bestie, this is a nonstandard Linux extension that is not specified in POSIX ⚠️
• msg_qnum — number of messages currently on the message queue.
• msg_qbytes — maximum number of bytes of message text allowed on the message queue.
• msg_lspid — ID of the process that performed the last msgsnd(2) system call.
• msg_lrpid — ID of the process that performed the last msgrcv(2) system call.

now the ipc_perm structure, defined like this (and yes, the highlighted fields are the ones you can set with IPC_SET):

struct ipc_perm {
    key_t          __key;       /* Key supplied to msgget(2) */
    uid_t          uid;         /* Effective UID of owner */
    gid_t          gid;         /* Effective GID of owner */
    uid_t          cuid;        /* Effective UID of creator */
    gid_t          cgid;        /* Effective GID of creator */
    unsigned short mode;        /* Permissions */
    unsigned short __seq;       /* Sequence number */
};

the least significant 9 bits of the mode field of the ipc_perm structure define the access permissions for the message queue. the permission bits are, queen by queen:

0400   Read by user
0200   Write by user
0040   Read by group
0020   Write by group
0004   Read by others
0002   Write by others

and bits 0100, 0010, and 0001 (the execute bits) are unused by the system. they're just there. decorative. unemployed. 💀

---

👑 valid values for op 👑

• IPC_STAT — copy information from the kernel data structure associated with msqid into the msqid_ds structure pointed to by buf. the caller must have read permission on the message queue. no read perms, no info, no discussion 🫶
• IPC_SET — write the values of some members of the msqid_ds structure pointed to by buf to the kernel data structure associated with this message queue, and update its msg_ctime member while you're at it.

the members that actually get updated are: msg_qbytes, msg_perm.uid, msg_perm.gid, and (the least significant 9 bits of) msg_perm.mode.

the effective UID of the calling process must match the owner (msg_perm.uid) or the creator (msg_perm.cuid) of the message queue, or the caller must be privileged. and if you wanna raise the msg_qbytes value beyond the system parameter MSGMNB, you need appropriate privilege (on Linux: the CAP_SYS_RESOURCE capability). periodt.

• IPC_RMID — immediately remove the message queue, awakening all waiting reader and writer processes (they get an error return and errno set to EIDRM). the calling process must have appropriate privileges, or its effective user ID must be either that of the creator or the owner of the message queue. the third argument to msgctl() is ignored in this case — buf who? never met her 🙈
• IPC_INFO (Linux-specific) — return information about system-wide message queue limits and parameters in the structure pointed to by buf. that structure is of type msginfo (so yeah, a cast is required), defined in <sys/msg.h> if the _GNU_SOURCE feature test macro is defined:

struct msginfo {
    int msgpool; /* Size in kibibytes of buffer pool
                    used to hold message data;
                    unused within kernel */
    int msgmap;  /* Maximum number of entries in message
                    map; unused within kernel */
    int msgmax;  /* Maximum number of bytes that can be
                    written in a single message */
    int msgmnb;  /* Maximum number of bytes that can be
                    written to queue; used to initialize
                    msg_qbytes during queue creation
                    (msgget(2)) */
    int msgmni;  /* Maximum number of message queues */
    int msgssz;  /* Message segment size;
                    unused within kernel */
    int msgtql;  /* Maximum number of messages on all queues
                    in system; unused within kernel */
    unsigned short msgseg;
                 /* Maximum number of segments;
                    unused within kernel */
};

the msgmni, msgmax, and msgmnb settings can be changed via /proc files of the same name; see proc(5) for details 🔍

• MSG_INFO (Linux-specific) — return a msginfo structure containing the same information as for IPC_INFO, except that these fields come back with info about system resources consumed by message queues: the msgpool field returns the number of message queues that currently exist on the system; the msgmap field returns the total number of messages in all queues on the system; and the msgtql field returns the total number of bytes in all messages in all queues on the system. it's the ~consumption report~ 📊
• MSG_STAT (Linux-specific) — return a msqid_ds structure as for IPC_STAT. however, the msqid argument is not a queue identifier here — instead it's an index into the kernel's internal array that maintains information about all message queues on the system. plot twist, she's an index now 🌀
• MSG_STAT_ANY (Linux-specific, since Linux 4.17) — return a msqid_ds structure as for MSG_STAT. however, msg_perm.mode is not checked for read access for msqid, meaning that any user can employ this operation (just as any user may read /proc/sysvipc/msg to obtain the same information). no permission check, no problem, she's open to everyone 👀

---

⭐ RETURN VALUE ⭐

on success, IPC_STAT, IPC_SET, and IPC_RMID return 0. slay.

a successful IPC_INFO or MSG_INFO operation returns the index of the highest used entry in the kernel's internal array recording information about all message queues. (you can use this info with repeated MSG_STAT or MSG_STAT_ANY operations to obtain information about all queues on the system — cute little looping hack 🫶)

a successful MSG_STAT or MSG_STAT_ANY operation returns the identifier of the queue whose index was given in msqid.

and on failure? -1 is returned and errno is set to indicate the error. classic 😭

---

💀 ERRORS 💀

• EACCES — the argument op is equal to IPC_STAT or MSG_STAT, but the calling process does not have read permission on the message queue msqid, and does not have the CAP_IPC_OWNER capability in the user namespace that governs its IPC namespace.
• EFAULT — the argument op has the value IPC_SET or IPC_STAT, but the address pointed to by buf isn't accessible. she's not reachable, bestie 📵
• EIDRM — the message queue was removed. gone. deleted. no cap.
• EINVAL — invalid value for op or msqid. or: for a MSG_STAT operation, the index value specified in msqid referred to an array slot that is currently unused. empty slot energy 🕳️
• EPERM — the argument op has the value IPC_SET or IPC_RMID, but the effective user ID of the calling process is not the creator (as found in msg_perm.cuid) or the owner (as found in msg_perm.uid) of the message queue, and the caller is not privileged (on Linux: does not have the CAP_SYS_ADMIN capability). you are not her, and you have no badge 🚫
• EPERM — an attempt (IPC_SET) was made to increase msg_qbytes beyond the system parameter MSGMNB, but the caller is not privileged (on Linux: does not have the CAP_SYS_RESOURCE capability). dream big, get blocked 💔

---

🌈 STANDARDS 🌈

POSIX.1-2024 XSI.

---

🕰️ HISTORY 🕰️

SVr4, SUSv1, POSIX.1-2001 XSI.

various fields in the struct msqid_ds were typed as short under Linux 2.2 and have become long under Linux 2.4. to take advantage of this, a recompilation under glibc-2.1.91 or later should suffice. (the kernel distinguishes old and new calls by an IPC_64 flag in op.) so yeah, recompile and she'll glow up ✨

---

🧚 NOTES 🧚

the IPC_INFO, MSG_STAT, and MSG_INFO operations are used by the ipcs(1) program to provide information on allocated resources. in the future these may be modified or moved to a /proc filesystem interface. future plans, bestie, we'll see 🔮

---

🎀 SEE ALSO 🎀

msgget(2), msgrcv(2), msgsnd(2), capabilities(7), mq_overview(7), sysvipc(7)

---

lowkey the whole friend group's here, go read all of them 💖

and that's the tea 🍓 — this page is from Linux man-pages 6.20, dated 2026-02-11. stay hydrated, check your CAP_SYS_RESOURCE, and go msgsnd(2) responsibly 👑💅✨