I’m looking for clarification on supported public API semantics on macOS.
Target runtime:
- arm64 macOS 15.4.1
- build 24E263
The question is whether macOS provides a supported public API, or a supported composition of public APIs, that allows an external launcher or OS observer to:
-
Obtain and freeze an identifier I(P) for the exact post-exec occurrence of a process P before P sends a security-sensitive IPC request.
-
Later obtain OS-supplied sender identity J(M) for an individual XPC or raw Mach message M.
-
Determine, using documented comparison semantics, whether J(M) identifies the same process-image occurrence as I(P).
The comparison needs to distinguish cases such as:
- two concurrent processes with the same UID and signed code;
- exec replacement while retaining a PID;
- exit, restart, and PID reuse;
- stale or queued messages;
- a transferred XPC endpoint or Mach send right;
- an undelegated proxy.
PID, UID, code-signing identity, launch labels, connection/right possession, or “first message wins” are not sufficient by themselves for this requirement.
I have looked at mechanisms including:
- suspended process launch;
- task identity tokens;
- Endpoint Security AUTH_EXEC process identity;
- XPC per-message sender identity;
- SecCodeCreateWithXPCMessage;
- Mach audit trailers.
What I have not found is public documentation defining a common process-occurrence identity and a supported comparison procedure across the pre-IPC and later message-sender surfaces.
A token generated by the target and sent in its first message also would not solve this specific problem, because the process claiming the token has already selected itself before the external observer binds the expected occurrence.
Is there a supported public way to achieve this?
If so, I would appreciate pointers to:
- the relevant public APIs;
- the canonical comparison procedure;
- required entitlements, task rights, TCC permissions, root privileges, or system-extension requirements;
- documented behavior across exec, exit, restart, and PID reuse;
- relevant Apple documentation or sample code.
If there is no supported public API that provides this property, confirmation of that would also be very helpful.
I’m specifically interested in documented, supported public API semantics rather than private SPI or undocumented implementation behavior.