8

When an application process launches an XPC helper process, it doesn't actually do the fork()/exec() itself in the classic UNIX style. Instead, it sends a message to launchd, which does the dirty work for it. Thus, if you query the parent process on the XPC process, it comes back as the launchd process.

However, if you open Activity Monitor in the hierarchical process view, the XPC helper processes are all shown below the original application that requested them, for example:

Example of XPC helper for Safari showing launchd as parent process

In the software I'm working on, knowing this relationship between processes would be extremely useful. So far we've been using the regular BSD parent process information, but as everything moves towards XPC, this isn't much use anymore.

So:

  • Where is the "original" parent process information stored for XPC processes?
  • How does Activity Monitor access it?

There is a kext involved, so I'd be happy to pull this information straight out in the kernel instead of userspace, but I can't seem to even figure out where it's stored.

Update: Discussion on Apple's darwin-kernel mailing list: http://lists.apple.com/archives/darwin-kernel/2015/Mar/msg00001.html

pmdj
  • 22,018
  • 3
  • 52
  • 103

1 Answers1

0

I imagine that launchd knows what you are looking for.

The Service Management framework has a method that might give you what you are looking for easily.

CFDictionaryRef SMJobCopyDictionary(CFStringRef domain, CFStringRef jobLabel); function.

Richard H.
  • 304
  • 3
  • 6
  • Note that from the OSX pre-release docs, it looks like that function may be deprecated in Yosemite (10.10): https://developer.apple.com/library/prerelease/mac/documentation/ServiceManagement/Reference/ServiceManagement_header_reference/index.html#//apple_ref/c/func/SMJobCopyDictionary – TheDarkKnight Jun 17 '14 at 13:01
  • 2
    I don't think SMJobCopyDictionary will help here. As you can see, these are the entries in the dictionary for Safari: http://pastebin.com/QAgDEUim – TheDarkKnight Jun 17 '14 at 13:21
  • Yeah, I'm not having much luck with that function either. – pmdj Jun 17 '14 at 14:11