site_archiver@lists.apple.com Delivered-To: darwin-dev@lists.apple.com I want to track forked children of a given pid. For the purpose of this discussion, I am userspace code (I could be kernelspace code if it helped) [ ... ] If I can really not have this, Launchd seems to use a sysctl to enumerate children on a fork: int mib[] = { CTL_KERN, KERN_PROC, KERN_PROC_ALL, j->p }; (KERN_PROC_PPID seems to not be implemented in xnu-1456.1.26) -- Terry _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev@lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.appl... On Feb 19, 2010, at 9:45 AM, Derrick Brashear wrote: Am I really reduced to this? It seems very likely to be racy. It is. It is also SPI (System Private Interface), subject to change on every software update (SPI can be thought of as a contract between system components which all agree to be updated in lock-step with each other when updates happen). Please do not use this sysctl. A better way is to use ptrace (for some definition of "better"; it's still not a good idea to need to know this, and ptrace has its own issues). This is what gdb and other debuggers do. If you are denied the rights to do this via ptrace, it's probably because you aren't supposed to be doing it. If so, then you should expect that the sysctl-based enumeration will probably also deny you that right at some point in the future, so even if you can hack it so that it works now, it will probably break at some later date. This email sent to site_archiver@lists.apple.com