How does OSX Activity Monitor match XPC tasks to their initiator process?

Question

When an application process launches an XPC helper process, it doesn't actually do the fork()/exec() itself in the classic UNIX style. Instead, it sends a message to launchd, which does the dirty work for it. Thus, if you query the parent process on the XPC process, it comes back as the launchd process.

However, if you open Activity Monitor in the hierarchical process view, the XPC helper processes are all shown below the original application that requested them, for example:

In the software I'm working on, knowing this relationship between processes would be extremely useful. So far we've been using the regular BSD parent process information, but as everything moves towards XPC, this isn't much use anymore.

So:

• Where is the "original" parent process information stored for XPC processes?
• How does Activity Monitor access it?

There is a kext involved, so I'd be happy to pull this information straight out in the kernel instead of userspace, but I can't seem to even figure out where it's stored.

Update: Discussion on Apple's darwin-kernel mailing list: http://lists.apple.com/archives/darwin-kernel/2015/Mar/msg00001.html

Evolutionary

+1 Interesting question on this site for once! – Krissykrista

I've been trying to work this out too! – Ethnocentrism

This might be relevant to you: apple.stackexchange.com/questions/327290/… – Closing

Answer 1

I imagine that launchd knows what you are looking for.

The Service Management framework has a method that might give you what you are looking for easily.

CFDictionaryRef SMJobCopyDictionary(CFStringRef domain, CFStringRef jobLabel); function.

Fregger

Note that from the OSX pre-release docs, it looks like that function may be deprecated in Yosemite (10.10): developer.apple.com/library/prerelease/mac/documentation/… – Ethnocentrism

I don't think SMJobCopyDictionary will help here. As you can see, these are the entries in the dictionary for Safari: pastebin.com/QAgDEUim – Ethnocentrism

Yeah, I'm not having much luck with that function either. – Evolutionary