Watching the system calls via Apple's new endoint API, I see a common pattern of
"launchd" executes "xpc" which executes "some app" (e.g., com.apple.WebKit.Networking)
Is there a way to determine which application requested this new program (e.g., com.apple.WebKit.Networking) to launch? That is, what started this chain of executions?
Thanks
Not reliably. macOS does keep track of this info — it’s known as the responsibility mechanism, and you can see it in action in Activity Monitor, amongst other places — but, last I checked, there’s no public API to get at it.
My recommendation is that you make your case for this in an enhancement request. Please post your bug number, just for the record.
Share and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware
let myEmail = "eskimo" + "1" + "@apple.com"