---
title: sf_attach_func
framework: Kernel
role: symbol
role_heading: Type Alias
platforms: [macOS 10.4+]
path: kernel/sf_attach_func
---

# sf_attach_func

## Declaration

```occ
typedef errno_t (*sf_attach_func)(void **cookie, socket_t so);
```

## Parameters

- `cookie`: Used to allow the socket filter to set the cookie for this attachment.
- `so`: The socket the filter is being attached to.

## Return Value

Return Value If you return a non-zero value, your filter will not be attached to this socket.

## Discussion

Discussion sf_attach_func is called to notify the filter it has been attached to a socket. The filter may allocate memory for this attachment and use the cookie to track it. This filter is called in one of two cases: You've installed a global filter and a new socket was created. Your non-global socket filter is being attached using the SO_NKE socket option.