1 Reply
      Latest reply on Dec 10, 2019 12:26 AM by eskimo
      THeberlein Level 1 Level 1 (0 points)

        Watching the system calls via Apple's new endoint API, I see a common pattern of


        "launchd" executes "xpc" which executes "some app" (e.g., com.apple.WebKit.Networking)


        Is there a way to determine which application requested this new program (e.g., com.apple.WebKit.Networking) to launch? That is, what started this chain of executions?



        • Re: ?? > launchd > xpc > new_program
          eskimo Apple Staff Apple Staff (13,325 points)

          Not reliably.  macOS does keep track of this info — it’s known as the responsibility mechanism, and you can see it in action in Activity Monitor, amongst other places — but, last I checked, there’s no public API to get at it.

          My recommendation is that you make your case for this in an enhancement request.  Please post your bug number, just for the record.

          Share and Enjoy

          Quinn “The Eskimo!”
          Apple Developer Relations, Developer Technical Support, Core OS/Hardware
          let myEmail = "eskimo" + "1" + "@apple.com"