Syscall reference
Every syscall in the XNU kernel, with prototype, arguments, version history, and security notes.
456 / 456
- #1exitTerminates the calling process and returns an 8-bit status to the parent via wait().BSD syscall
- #2forkDuplicates the calling process, returning the child PID in the parent and 0 in the child.BSD syscall
- #3readReads up to nbyte bytes from a file descriptor into a user buffer.BSD syscall
- #4writeWrites up to nbyte bytes from a user buffer to a file descriptor.BSD syscall
- #5openOpens or creates a file at the given path and returns a file descriptor referring to it.BSD syscall
- #6closeReleases a file descriptor and decrements the reference count on the underlying open-file table entry.BSD syscall
- #6sys_closeInternal XNU symbol name for the close(2) syscall; the public wrapper is close(2).BSD syscall
- #7wait4Waits for a child process to change state, returning status and rusage.BSD syscall
- #9linkCreates a hard link to an existing file under a new path.BSD syscall
- #10unlinkRemoves a directory entry, releasing the associated inode when its link count reaches zero.BSD syscall
- #12chdirChanges the calling process's current working directory.BSD syscall
- #12sys_chdirInternal XNU symbol name for the chdir(2) syscall; the public wrapper is chdir(2).BSD syscall
- #13fchdirChanges the current working directory using an open directory file descriptor.BSD syscall
- #13sys_fchdirInternal XNU symbol name for the fchdir(2) syscall; the public wrapper is fchdir(2).BSD syscall
- #14mknodCreates a filesystem node — typically a device or FIFO — at the given path.BSD syscall
- #15chmodChanges the permission bits of a file referenced by path.BSD syscall
- #16chownChanges the owner and/or group of a file referenced by path.BSD syscall
- #18getfsstatReturns information for every currently-mounted filesystem.BSD syscall
- #20getpidReturns the process ID of the calling process.BSD syscall
- #23setuidSets the real, effective, and (when privileged) saved-set user ID of the process.BSD syscall
- #24getuidReturns the real user ID of the calling process.BSD syscall
- #25geteuidReturns the effective user ID used for most permission checks.BSD syscall
- #26ptraceProvides a minimal subset of the classic ptrace(2) interface used by macOS debuggers to attach to, control, and detach from a target process.BSD syscall
- #27recvmsgReceives a message and any ancillary control data into a scatter-gather buffer.BSD syscall
- #28sendmsgSends a message together with optional ancillary control data using a scatter-gather buffer.BSD syscall
- #29recvfromReceives a datagram or stream segment and optionally records the sender's address.BSD syscall
- #30acceptDequeues the first completed connection from a listening socket and returns a new descriptor.BSD syscall
- #31getpeernameReturns the address of the peer connected to a socket.BSD syscall
- #32getsocknameReturns the locally bound address of a socket.BSD syscall
- #33accessTests permissions of a path against the calling process's real uid and gid.BSD syscall
- #34chflagsSets BSD-style file flags such as immutable, append-only or hidden on a path.BSD syscall
- #35fchflagsSets BSD-style file flags on a file referenced by an open descriptor.BSD syscall
- #36syncSchedules all dirty buffers and inodes to be written back to their underlying devices.BSD syscall
- #37killSends a signal to a process or process group identified by PID.BSD syscall
- #39getppidReturns the PID of the parent process.BSD syscall
- #41dupDuplicates a file descriptor onto the lowest-numbered unused fd in the calling process.BSD syscall
- #41sys_dupInternal XNU symbol name for the dup(2) syscall; the public wrapper is dup(2).BSD syscall
- #42pipeCreates a unidirectional byte-stream channel and returns two connected file descriptors.BSD syscall
- #43getegidReturns the effective group ID used for permission checks.BSD syscall
- #44profilLegacy BSD PC sampling profiler; deprecated in favour of Instruments and DTrace.BSD syscall
- #46sigactionInstalls or queries the disposition of a signal, including handler and flags.BSD syscall
- #47getgidReturns the real group ID of the calling process.BSD syscall
- #48sigprocmaskExamines or changes the per-process signal mask blocking delivery of signals.BSD syscall
- #49getloginReturns the login name associated with the controlling terminal session.BSD syscall
- #50setloginSets the login name of the current session.BSD syscall
- #51acctEnables or disables BSD process accounting by pointing the kernel at a file that will receive an acct record for every exiting process.BSD syscall
- #52sigpendingReturns the set of signals pending for the calling thread or process.BSD syscall
- #53sigaltstackSets or queries the alternate signal stack used for handlers with SA_ONSTACK.BSD syscall
- #54ioctlIssues a device-specific control request against the kernel object behind a file descriptor.BSD syscall
- #55rebootRequests an immediate system reboot, halt or panic from the kernel; restricted to the superuser.BSD syscall
- #56revokeForcibly invalidates all open references to a special file (typically a tty).BSD syscall
- #57symlinkCreates a symbolic link whose target is an arbitrary string interpreted at lookup time.BSD syscall
- #58readlinkReads the target string of a symbolic link without dereferencing it.BSD syscall
- #59execveReplaces the current process image with a new program loaded from a file.BSD syscall
- #60umaskSets the file-creation mode mask for the calling process and returns the previous value.BSD syscall
- #61chrootChanges the apparent root directory for the calling process and its children.BSD syscall
- #65msyncFlushes dirty pages of a file-backed mapping back to the underlying vnode.BSD syscall
- #66vforkCreates a child process that shares the parent's address space until exec() or _exit().BSD syscall
- #73munmapUnmaps a range of pages previously created by mmap from the process address space.BSD syscall
- #74mprotectChanges the protection (read / write / execute) of a range of mapped pages.BSD syscall
- #75madviseHints to the kernel about expected access patterns for a range of mapped pages.BSD syscall
- #78mincoreReports which pages of a mapping are currently resident in physical memory.BSD syscall
- #79getgroupsReturns the supplementary group list of the calling process.BSD syscall
- #80setgroupsReplaces the supplementary group list of the calling process.BSD syscall
- #81getpgrpReturns the process group ID of the calling process.BSD syscall
- #82setpgidJoins or creates a process group for the specified process.BSD syscall
- #83setitimerArms or disarms one of the per-process interval timers.BSD syscall
- #85swaponHistorical BSD call to enable a swap device; non-functional on modern macOS.BSD syscall
- #86getitimerReturns the current value of an interval timer (REAL, VIRTUAL, or PROF).BSD syscall
- #89getdtablesizeReturns the maximum number of file descriptors the calling process may open.BSD syscall
- #89sys_getdtablesizeInternal XNU symbol name for the getdtablesize(2) syscall; the public wrapper is getdtablesize(2).BSD syscall
- #90dup2Duplicates a file descriptor onto a specific target fd, atomically closing the target first if necessary.BSD syscall
- #90sys_dup2Internal XNU symbol name for the dup2(2) syscall; the public wrapper is dup2(2).BSD syscall
- #92fcntlMultiplexed file descriptor control call covering descriptor duplication, flag manipulation, locking and macOS-specific operations.BSD syscall
- #93selectWaits for read, write or exceptional conditions on a set of file descriptors until a timeout expires.BSD syscall
- #95fsyncFlushes a file's in-core data and metadata to the storage device's cache.BSD syscall
- #96setprioritySets the scheduling nice value for a process, group, or user.BSD syscall
- #97socketCreates a new communication endpoint and returns a file descriptor referring to it.BSD syscall
- #98connectInitiates a connection on a socket to the specified peer address.BSD syscall
- #100getpriorityReturns the scheduling nice value for a process, group, or user.BSD syscall
- #104bindAssigns a local protocol address to an unbound socket.BSD syscall
- #105setsockoptSets an option associated with a socket at a specified protocol level.BSD syscall
- #106listenMarks a connection-oriented socket as passive, ready to accept incoming connections.BSD syscall
- #111sigsuspendAtomically replaces the signal mask and waits until a signal handler returns.BSD syscall
- #116gettimeofdayReturns the current wall-clock time and (legacy) timezone information.BSD syscall
- #117getrusageReturns resource usage statistics for the caller or its children.BSD syscall
- #118getsockoptRetrieves an option associated with a socket at a specified protocol level.BSD syscall
- #120readvPerforms a scatter read filling multiple buffers from a file descriptor in a single syscall.BSD syscall
- #121writevPerforms a gather write sending multiple buffers to a file descriptor in a single syscall.BSD syscall
- #122settimeofdaySets the system wall-clock time.BSD syscall
- #123fchownChanges the owner and/or group of the file referenced by an open descriptor.BSD syscall
- #124fchmodChanges the mode of a file referenced by an open descriptor.BSD syscall
- #126setreuidSets the real and effective user IDs simultaneously.BSD syscall
- #127setregidSets the real and effective group IDs simultaneously.BSD syscall
- #128renameAtomically renames a file or directory, possibly replacing an existing target on the same filesystem.BSD syscall
- #131flockApplies or removes a BSD advisory whole-file lock on an open file descriptor.BSD syscall
- #131sys_flockInternal XNU symbol name for the flock(2) syscall; the public wrapper is flock(2).BSD syscall
- #132mkfifoCreates a named pipe (FIFO) in the filesystem.BSD syscall
- #133sendtoSends a datagram or stream segment to a specified address.BSD syscall
- #134shutdownDisables further send and/or receive operations on a socket without closing the descriptor.BSD syscall
- #135socketpairCreates an unnamed, connected pair of sockets in the AF_UNIX domain for in-process IPC.BSD syscall
- #136mkdirCreates a directory at the given path with the requested mode, masked by the process umask.BSD syscall
- #137rmdirRemoves an empty directory by path.BSD syscall
- #138utimesSets the access and modification timestamps of a file referenced by path.BSD syscall
- #139futimesSets access and modification timestamps on a file referenced by an open descriptor.BSD syscall
- #140adjtimeGradually slews the system clock to correct a small time offset.BSD syscall
- #142gethostuuidReturns the platform UUID identifying the current Mac hardware.BSD syscall
- #147setsidCreates a new session and process group with the caller as leader.BSD syscall
- #151getpgidReturns the process group ID of the specified process.BSD syscall
- #152setprivexecMarks the process as 'privileged exec', altering credential handling across exec().BSD syscall
- #153preadReads from a file descriptor at an explicit offset without altering the file pointer.BSD syscall
- #154pwriteWrites to a file descriptor at an explicit offset without altering the file pointer.BSD syscall
- #155nfssvcManages NFS server kernel threads and configuration from a privileged daemon.BSD syscall
- #157statfsReturns filesystem-wide statistics (block size, free space, fstype) for the filesystem containing a path.BSD syscall
- #158fstatfsReturns filesystem-wide statistics for the filesystem containing an open file descriptor.BSD syscall
- #159unmountDetaches a filesystem from its mount point.BSD syscall
- #161getfhReturns an opaque NFS file handle for a path on a local filesystem.BSD syscall
- #164funmountfd-based variant of unmount.BSD syscall
- #165quotactlQueries or configures user/group disk quotas on a filesystem.BSD syscall
- #167mountAttaches a filesystem to a mount point in the global VFS namespace.BSD syscall
- #169csopsReads or modifies code-signing state for the calling or target process.BSD syscall
- #170csops_audittokencsops variant that authenticates the target via an audit token instead of a PID.BSD syscall
- #173waitidWaits for a child matching an id-type filter, returning detailed siginfo.BSD syscall
- #176add_profilAdds an additional PC-sampling region to an existing profil(2) session.BSD syscall
- #181setgidSets the real, effective, and (when privileged) saved-set group ID of the process.BSD syscall
- #182setegidChanges only the effective group ID of the process.BSD syscall
- #183seteuidChanges only the effective user ID, leaving real and saved-set unchanged.BSD syscall
- #185sys_panic_with_dataPrivileged syscall used to trigger a kernel panic with an attached userspace payload.BSD syscall
- #186thread_selfcountsReturns precise per-thread performance counters for the calling thread.BSD syscall
- #187fdatasyncFlushes a file's data (and only the metadata required to retrieve it) to the storage device.BSD syscall
- #188statReturns the metadata of the file located at a given path, following symbolic links.BSD syscall
- #189fstatReturns metadata for the object referenced by an open file descriptor.BSD syscall
- #189sys_fstatInternal XNU symbol name for the 32-bit-stat fstat(2) syscall; the public wrapper is fstat(2).BSD syscall
- #190lstatLike stat but reports information about the symbolic link itself when the path is a link.BSD syscall
- #191pathconfQueries a configurable filesystem limit (name max, link max, etc.) for a path.BSD syscall
- #192fpathconfQueries a configurable filesystem limit for the filesystem hosting an open fd.BSD syscall
- #192sys_fpathconfInternal XNU symbol name for the fpathconf(2) syscall; the public wrapper is fpathconf(2).BSD syscall
- #194getrlimitReturns the soft and hard limits for a resource.BSD syscall
- #195setrlimitSets the soft and hard limits for a resource.BSD syscall
- #196getdirentriesReads directory entries from a directory file descriptor into a caller-supplied buffer.BSD syscall
- #197mmapMaps files or anonymous memory into the calling process's address space.BSD syscall
- #199lseekRepositions the read/write offset of an open file descriptor.BSD syscall
- #200truncateSets the length of a file referenced by path, extending with zeros or discarding tail bytes as needed.BSD syscall
- #201ftruncateSets the length of a file referenced by an open descriptor.BSD syscall
- #202__sysctlRaw entry point for the BSD sysctl tree: reads or writes a kernel state variable identified by an integer-OID path.BSD syscall
- #203mlockPins a range of virtual memory into physical RAM, preventing it from being paged out.BSD syscall
- #204munlockReleases the wiring established by a previous mlock call on a memory range.BSD syscall
- #205undeleteRestores a recently-deleted whiteout entry on filesystems that support it.BSD syscall
- #206ATsocketLegacy AppleTalk: creates a DDP socket. Removed from modern macOS — present in the syscall table for historical numbering only.BSD syscall
- #207ATgetmsgLegacy AppleTalk: reads a DDP/ADSP message. Removed in 10.8 and now returns ENOSYS.BSD syscall
- #208ATputmsgLegacy AppleTalk: writes a DDP/ADSP message. Removed in 10.8 and now returns ENOSYS.BSD syscall
- #209ATPsndreqLegacy AppleTalk Transaction Protocol: sends an ATP request. Removed in 10.8.BSD syscall
- #210ATPsndrspLegacy AppleTalk Transaction Protocol: sends an ATP response. Removed in 10.8.BSD syscall
- #211ATPgetreqLegacy AppleTalk Transaction Protocol: receives a pending ATP request. Removed in 10.8.BSD syscall
- #212ATPgetrspLegacy AppleTalk Transaction Protocol: receives an ATP response. Removed in 10.8.BSD syscall
- #216mkcomplexLegacy Carbon-era helper for creating complex HFS+ resource/data-fork pairs.BSD syscall
- #217statvReturns extended (per-vnode) metadata for a path on filesystems that support it.BSD syscall
- #217fsgetpath_extExtended variant of fsgetpath accepting additional resolution flags.BSD syscall
- #218lstatvlstat variant returning extended per-vnode metadata.BSD syscall
- #219fstatvfstat variant returning extended per-vnode metadata.BSD syscall
- #220getattrlistReads a selected set of file attributes in a single syscall using a packed attrlist (macOS-specific).BSD syscall
- #221setattrlistWrites a selected set of file attributes in a single syscall using a packed attrlist.BSD syscall
- #222getdirentriesattrBulk-reads directory entries together with selected attributes in a single syscall (macOS-specific).BSD syscall
- #223exchangedataAtomically swaps the data contents of two files on the same filesystem.BSD syscall
- #225searchfsPerforms a fast in-kernel search over file attributes (legacy HFS+ catalog search).BSD syscall
- #228fgetattrlistfd-based variant of getattrlist that operates on an open descriptor.BSD syscall
- #229fsetattrlistfd-based variant of setattrlist that writes attributes through an open descriptor.BSD syscall
- #230pollWaits for events on an array of file descriptors with no FD_SETSIZE limit.BSD syscall
- #231watcheventRegisters interest in events emitted by a BSD event driver; legacy precursor to kqueue, effectively unused on macOS.BSD syscall
- #232waiteventBlocks until one of the events registered via watchevent fires; legacy companion to watchevent.BSD syscall
- #233modwatchModifies a pending event registration created by watchevent; part of the obsolete BSD /dev/eventdev interface.BSD syscall
- #234getxattrReads an extended attribute value by name from a path.BSD syscall
- #235fgetxattrReads an extended attribute value by name from an open file descriptor.BSD syscall
- #236setxattrCreates, replaces or modifies an extended attribute on a path.BSD syscall
- #237fsetxattrSets an extended attribute on a file referenced by an open descriptor.BSD syscall
- #238removexattrRemoves a named extended attribute from a path.BSD syscall
- #239fremovexattrRemoves a named extended attribute from a file referenced by an open descriptor.BSD syscall
- #240listxattrLists the names of all extended attributes on a file path.BSD syscall
- #241flistxattrLists extended attribute names on a file referenced by an open descriptor.BSD syscall
- #242fsctlPath-based filesystem control call exposing per-filesystem ioctl-like operations.BSD syscall
- #243initgroupsInitialises the supplementary group list from the user database.BSD syscall
- #244posix_spawnCreates a new process running a specified program in a single atomic syscall.BSD syscall
- #245ffsctlIssues a filesystem-specific control request against a file descriptor.BSD syscall
- #247nfsclntConfigures NFS client behaviour from a privileged process.BSD syscall
- #248fhopenOpens a file identified by an NFS file handle returned by getfh.BSD syscall
- #250minheritSets the inheritance attribute of a mapped range across fork().BSD syscall
- #251semsysMultiplexed entry point dispatching the System V semaphore family.BSD syscall
- #252msgsysMultiplexed entry point dispatching the System V message-queue family.BSD syscall
- #253shmsysMultiplexed entry point dispatching the System V shared-memory family.BSD syscall
- #254semctlPerforms control operations on a System V semaphore set.BSD syscall
- #255semgetReturns the id of a System V semaphore set for a given key, creating it on demand.BSD syscall
- #256semopPerforms an atomic batch of P / V operations on a System V semaphore set.BSD syscall
- #258msgctlPerforms control operations on a System V message queue (stat, set, remove).BSD syscall
- #259msggetReturns the System V message-queue id for a given key, creating it if requested.BSD syscall
- #260msgsndSends a message onto a System V message queue, blocking if the queue is full.BSD syscall
- #261msgrcvReads a message from a System V message queue, blocking or returning EAGAIN.BSD syscall
- #262shmatAttaches a System V shared-memory segment into the calling process's address space.BSD syscall
- #263shmctlPerforms control operations (stat, set, remove) on a System V shared-memory segment.BSD syscall
- #264shmdtDetaches a previously attached System V shared-memory segment.BSD syscall
- #265shmgetReturns the id of a System V shared-memory segment for a given key, creating it on demand.BSD syscall
- #266shm_openOpens (or creates) a named POSIX shared-memory object and returns a file descriptor.BSD syscall
- #267shm_unlinkRemoves the name of a POSIX shared-memory object so it disappears at last close.BSD syscall
- #268sem_openOpens (or creates) a named POSIX semaphore and returns a sem_t* handle.BSD syscall
- #269sem_closeCloses the calling process's reference to a named POSIX semaphore.BSD syscall
- #270sem_unlinkRemoves the name of a POSIX semaphore so it disappears at last close.BSD syscall
- #271sem_waitDecrements a POSIX semaphore, blocking the caller while its value is zero.BSD syscall
- #272sem_trywaitNon-blocking decrement of a POSIX semaphore; fails with EAGAIN when the count is zero.BSD syscall
- #273sem_postIncrements a POSIX semaphore and wakes one waiter, if any.BSD syscall
- #274sem_getvalueReads the current value of a POSIX semaphore without modifying it.BSD syscall
- #275sem_initPOSIX entry point for unnamed semaphores; explicitly unsupported on Darwin.BSD syscall
- #276sem_destroyPOSIX entry point pairing with sem_init; also unsupported on Darwin.BSD syscall
- #296vm_pressure_monitorBlocks until the kernel reports a change in system-wide memory pressure level.BSD syscall
- #310getsidReturns the session ID of the specified or calling process.BSD syscall
- #313aio_fsyncAsynchronously requests a sync on a file descriptor via the AIO subsystem.BSD syscall
- #314aio_returnReturns the final byte count (or error) of a completed asynchronous I/O.BSD syscall
- #315aio_suspendBlocks the caller until one of a set of asynchronous I/O operations completes or a timeout expires.BSD syscall
- #316aio_cancelRequests cancellation of one or all in-flight asynchronous I/O operations on a file descriptor.BSD syscall
- #317aio_errorReturns the completion status of an asynchronous I/O operation.BSD syscall
- #318aio_readQueues an asynchronous read of up to nbytes from a file at the offset specified in the aiocb.BSD syscall
- #319aio_writeQueues an asynchronous write of nbytes from the aiocb buffer to a file descriptor.BSD syscall
- #320lio_listioSubmits a list of asynchronous I/O operations in a single call.BSD syscall
- #324mlockallPins all current (and optionally future) pages of the calling process into RAM.BSD syscall
- #325munlockallReleases all wirings previously established by mlockall on the calling process.BSD syscall
- #327issetugidReports whether the process has tainted credentials from setuid/setgid execution.BSD syscall
- #328__pthread_killDelivers a signal to a specific pthread within the current process; the kernel side of pthread_kill(3).BSD syscall
- #329__pthread_sigmaskPer-thread sigprocmask(2): atomically reads and/or modifies the signal mask of the calling pthread.BSD syscall
- #330__sigwaitSynchronously waits for one of a set of signals to be delivered to the thread.BSD syscall
- #331__disable_threadsignalAsks the kernel to stop delivering POSIX signals to the calling thread; used during thread teardown.BSD syscall
- #332__pthread_markcancelSets the kernel-side cancellation flag on a target pthread; the underlying mechanism of pthread_cancel(3).BSD syscall
- #333__pthread_canceledLibpthread helper that asks the kernel whether the calling thread has a pending cancellation, and optionally consumes it.BSD syscall
- #334__semwait_signalUnderlying syscall that parks a thread on a Mach semaphore with optional timeout.BSD syscall
- #337sendfileTransfers a file directly from a file descriptor to a socket without copying through user space.BSD syscall
- #338stat64Legacy 64-bit-inode variant of stat retained for ABI compatibility with older Mach-O binaries.BSD syscall
- #339fstat64Legacy 64-bit-inode variant of fstat kept for ABI compatibility.BSD syscall
- #339sys_fstat64Internal XNU symbol name for the fstat64(2) syscall; the public wrapper is fstat64(2).BSD syscall
- #340lstat64Legacy 64-bit-inode variant of lstat kept for ABI compatibility.BSD syscall
- #345statfs64Legacy 64-bit variant of statfs retained for ABI compatibility.BSD syscall
- #346fstatfs64Legacy 64-bit variant of fstatfs retained for ABI compatibility.BSD syscall
- #347getfsstat64Legacy 64-bit variant of getfsstat retained for ABI compatibility.BSD syscall
- #348__pthread_chdirPer-thread version of chdir(2): changes the working directory of the calling thread only, not the whole process.BSD syscall
- #349__pthread_fchdirPer-thread version of fchdir(2): sets the calling thread's working directory from an open file descriptor.BSD syscall
- #350auditSubmits a pre-formatted BSM audit record to the kernel audit queue.BSD syscall
- #351auditonConfigures the kernel BSM audit subsystem (policy, queue limits, preselection masks).BSD syscall
- #353getauidReturns the calling process's audit user id (auid).BSD syscall
- #354setauidSets the calling process's audit user id (auid).BSD syscall
- #355getauditLegacy 32-bit accessor for the calling process's audit information.BSD syscall
- #356setauditLegacy 32-bit setter for the calling process's audit information.BSD syscall
- #357getaudit_addrRetrieves the calling process's full audit information including a wide terminal id.BSD syscall
- #358setaudit_addrSets the calling process's audit information from a wide auditinfo_addr structure.BSD syscall
- #359auditctlOpens or rotates the kernel audit trail file used by auditd.BSD syscall
- #362kqueueAllocates a new kernel event queue and returns a file descriptor referring to it.BSD syscall
- #363keventClassic kqueue submission and retrieval call using struct kevent.BSD syscall
- #364lchownchown variant that operates on a symbolic link itself rather than its target.BSD syscall
- #369kevent64kevent variant using the wider struct kevent64_s with 64-bit udata and ext fields.BSD syscall
- #370__old_semwait_signalPre-XNU-2050 ABI of __semwait_signal kept for binary compatibility.BSD syscall
- #373ledgerReads or controls per-task resource ledgers (CPU, memory, energy, wakeups).BSD syscall
- #374kevent_qoskevent variant carrying QoS class and override information per event.BSD syscall
- #375kevent_idWorkloop variant of kevent that targets a dynamic kqueue identified by a 64-bit id.BSD syscall
- #380__mac_execveexecve variant that simultaneously applies a MAC label to the new process image.BSD syscall
- #381__mac_syscallGeneric dispatch entry point for policy-specific MAC operations.BSD syscall
- #382__mac_get_fileRetrieves a MAC label for a file identified by path.BSD syscall
- #383__mac_set_fileWrites a MAC label to a file identified by path.BSD syscall
- #384__mac_get_linkRetrieves a MAC label for a symbolic link without following it.BSD syscall
- #385__mac_set_linkWrites a MAC label to a symbolic link without following it.BSD syscall
- #386__mac_get_procRetrieves the MAC label attached to the calling process credential.BSD syscall
- #387__mac_set_procUpdates the MAC label on the calling process credential.BSD syscall
- #388__mac_get_fdRetrieves a MAC label associated with an open file descriptor.BSD syscall
- #389__mac_set_fdWrites a MAC label to the object referenced by an open file descriptor.BSD syscall
- #390__mac_get_pidRetrieves the MAC label attached to an arbitrary target process.BSD syscall
- #391__mac_get_lcidRetrieves the MAC label for a login context identifier.BSD syscall
- #392__mac_get_lctxRetrieves the MAC label of the calling thread's login context.BSD syscall
- #393__mac_set_lctxUpdates the MAC label of the calling thread's login context.BSD syscall
- #423__semwait_signal_nocancelNon-cancellable variant of __semwait_signal used by internal pthread code.BSD syscall
- #424__mac_mountMount syscall variant that carries MAC labels for the new mount point.BSD syscall
- #425__mac_get_mountRetrieves MAC labels associated with a mount point.BSD syscall
- #426__mac_getfsstatgetfsstat variant that returns MAC labels alongside the filesystem statistics.BSD syscall
- #427fsgetpathResolves an (fsid, inode) pair back into a path on the requested filesystem.BSD syscall
- #428audit_session_selfReturns a send right to the current process's audit session port.BSD syscall
- #429audit_session_joinJoins the calling process to the audit session identified by the given port.BSD syscall
- #430fileport_makeportWraps a file descriptor in a Mach port suitable for transfer across XPC or task ports.BSD syscall
- #430sys_fileport_makeportInternal XNU symbol name for the fileport_makeport(2) syscall; the public wrapper is fileport_makeport(2).BSD syscall
- #431fileport_makefdConverts a fileport Mach port received from another process back into a local file descriptor.BSD syscall
- #431sys_fileport_makefdInternal XNU symbol name for the fileport_makefd(2) syscall; the public wrapper is fileport_makefd(2).BSD syscall
- #432audit_session_portReturns a send right to the audit session port for an arbitrary session id.BSD syscall
- #433pid_suspendSuspends every thread of the target process, equivalent to sending SIGSTOP but without involving the signal machinery.BSD syscall
- #434pid_resumeDecrements the suspension count of the target process; when it reaches zero the threads resume execution.BSD syscall
- #435pid_hibernateAsks the kernel to compress or page out the dirty memory of the target process, putting it into a lightweight hibernated state.BSD syscall
- #436pid_shutdown_socketsForce-closes the open network sockets of the target process; used by the system to evict background apps from the network.BSD syscall
- #439kas_infoReturns the kernel address space layout slide and segment information.BSD syscall
- #440memorystatus_controlMultiplexed control interface for the Jetsam / memorystatus subsystem.BSD syscall
- #442guarded_close_npCloses a guarded file descriptor, asserting the expected guard value.BSD syscall
- #443guarded_kqueue_npCreates a kqueue file descriptor with a guard value attached at creation.BSD syscall
- #444change_fdguard_npAttaches, removes or rotates a guard value on an existing file descriptor.BSD syscall
- #445usrctlApple-private user-space control hook used by select system daemons.BSD syscall
- #446proc_rlimit_controlApple-private control for per-process resource limits, notably CPU usage monitors.BSD syscall
- #447connectxMultipath-aware connect that takes a list of source/destination endpoints and can return immediately for TFO.BSD syscall
- #448disconnectxDisconnects a specific subflow of a multipath association identified by its association ID.BSD syscall
- #449peeloffSplits an SCTP/MPTCP subflow off a parent association into a standalone socket.BSD syscall
- #450socket_delegateCreates a socket whose network activity is attributed to a delegate process for policy and accounting.BSD syscall
- #452proc_uuid_policyAdds, removes or queries per-binary-UUID security policies in the kernel.BSD syscall
- #453memorystatus_get_levelReturns the current system memory-pressure level.BSD syscall
- #454system_overrideTemporarily overrides system power and throttling policies for testing or critical work.BSD syscall
- #455vfs_purgePrivileged operation that flushes cached vnodes across the VFS layer.BSD syscall
- #460necp_match_policyResolves which NECP policy applies to a hypothetical flow described by a parameter blob.BSD syscall
- #461getattrlistbulkReads attributes for every entry of a directory in a single bulk syscall.BSD syscall
- #462clonefileatCreates a copy-on-write clone of a file or directory, sharing storage until the clone diverges (APFS).BSD syscall
- #466faccessatTests access permissions on a path relative to a directory descriptor.BSD syscall
- #467fchmodatChanges file mode relative to a directory descriptor with optional symlink-aware behaviour.BSD syscall
- #468fchownatChanges file ownership relative to a directory descriptor with optional symlink-aware behaviour.BSD syscall
- #469fstatatReturns file metadata relative to a directory descriptor, with optional symlink semantics.BSD syscall
- #470fstatat64Legacy 64-bit-inode variant of fstatat preserved for ABI compatibility.BSD syscall
- #471linkatCreates a hard link with both endpoints resolved relative to directory descriptors.BSD syscall
- #473readlinkatReads a symlink target relative to a directory descriptor.BSD syscall
- #474symlinkatCreates a symbolic link whose link path is resolved relative to a directory descriptor.BSD syscall
- #475mkdiratCreates a directory relative to a directory file descriptor.BSD syscall
- #476getattrlistatgetattrlist with path resolution relative to a directory descriptor.BSD syscall
- #477proc_trace_logEmits a kernel-trace marker recording a process lifecycle event.BSD syscall
- #479openbyid_npOpens a vnode by filesystem id and inode number rather than by path (macOS-specific).BSD syscall
- #480recvmsg_xApple extension that receives multiple messages in a single syscall, modeled after Linux recvmmsg.BSD syscall
- #481sendmsg_xApple extension that sends an array of messages in a single syscall, analogous to Linux sendmmsg.BSD syscall
- #485guarded_write_npwrite variant that asserts a guard value on the target descriptor.BSD syscall
- #486guarded_pwrite_nppwrite variant that asserts a guard value on the target descriptor.BSD syscall
- #487guarded_writev_npwritev variant that asserts a guard value on the target descriptor.BSD syscall
- #489mremap_encryptedApple-private syscall that re-maps a region of an already mapped file as encrypted text, enabling FairPlay-style code-signing of decrypted pages.BSD syscall
- #490netagent_triggerWakes a registered network agent so it can bring up an on-demand path such as a VPN or DNS proxy.BSD syscall
- #493grab_pgo_dataExtracts profile-guided optimization counters from a running kernel binary.BSD syscall
- #500getentropyFills a buffer with up to 256 bytes of high-quality random data from the kernel CSPRNG.BSD syscall
- #501necp_openOpens a Network Extension Control Policy file descriptor for registering per-flow policies.BSD syscall
- #502necp_client_actionIssues a command against a NECP client handle to add/remove parameters or fetch resolution results.BSD syscall
- #503__nexus_openOpens a control handle to a Skywalk nexus controller for creating and managing nexus instances.BSD syscall
- #504__nexus_registerRegisters a nexus provider with the kernel so instances of that type can later be created.BSD syscall
- #505__nexus_deregisterRemoves a previously registered nexus provider after all its instances have been destroyed.BSD syscall
- #506__nexus_createCreates a new nexus instance from a registered nexus provider, returning a uuid for clients to bind.BSD syscall
- #507__nexus_destroyTears down a previously created nexus instance, releasing its packet pool and rings.BSD syscall
- #508__nexus_get_optReads a provider- or instance-level Skywalk option from a nexus controller.BSD syscall
- #509__nexus_set_optWrites a provider- or instance-level Skywalk option to tune behavior such as packet-pool size.BSD syscall
- #510__channel_openOpens a Skywalk user-space channel into a kernel nexus for zero-copy packet I/O.BSD syscall
- #511__channel_get_infoReturns runtime information about a Skywalk channel: ring counts, buffer geometry, statistics.BSD syscall
- #512__channel_syncSynchronizes a Skywalk channel with the kernel, publishing produced slots and reaping completed ones.BSD syscall
- #513__channel_get_optGets a per-channel Skywalk option such as ring slot count or interrupt-coalescing parameters.BSD syscall
- #514__channel_set_optSets a per-channel Skywalk option, e.g. wake policy or scheduler class.BSD syscall
- #517fclonefileatClones an already-open file (CoW on APFS) into a new entry beneath a directory descriptor.BSD syscall
- #522necp_session_openOpens a privileged NECP session for installing system-wide policies and inspecting client state.BSD syscall
- #523necp_session_actionPerforms an administrative action (add/update/delete/list/apply) on an open NECP session.BSD syscall
- #524setattrlistatsetattrlist with path resolution relative to a directory descriptor.BSD syscall
- #525net_qos_guidelineAsks the kernel for a recommendation on whether a given network operation should run now under current QoS policy.BSD syscall
- #526fmountfd-based variant of mount that targets a directory file descriptor.BSD syscall
- #527ntp_adjtimePerforms NTP discipline adjustments on the system clock.BSD syscall
- #528ntp_gettimeReturns the current time along with NTP discipline state (maximum error, etc.).BSD syscall
- #529os_fault_with_payloadReports a non-fatal os_fault with a structured payload to ReportCrash.BSD syscall
- #531__mach_bridge_remote_timeReads the Mach bridge clock that converts the host's mach_absolute_time into the time domain of a paired bridge co-processor (Touch Bar / T2 / Apple Silicon SEP).BSD syscall
- #535objc_bp_assist_cfg_npConfigures kernel-assisted Objective-C breakpoint trampolines for the calling process.BSD syscall
- #537pivot_rootReserved Linux-style call to swap the root mount of a mount namespace; not implemented in XNU.BSD syscall
- #538task_inspect_for_pidReturns an inspect-flavor task port for the given PID — finer-grained query access than name but stricter than read.BSD syscall
- #539task_read_for_pidReturns a read-flavor task port for the given PID — sufficient for memory inspection but not modification.BSD syscall
- #540sys_preadvInternal XNU symbol name for the preadv(2) syscall; the public wrapper is preadv(2).BSD syscall
- #541sys_pwritevInternal XNU symbol name for the pwritev(2) syscall; the public wrapper is pwritev(2).BSD syscall
- #546nosysPlaceholder slot in the syscall table for an entry that has been removed or never implemented; always returns ENOSYS.BSD syscall
- #546tracker_actionApple-private syscall driving the NetworkExtension tracker / domain-resolution telemetry pipeline.BSD syscall
- #549graftdmgMounts a signed disk image as an overlay onto a directory subtree (modern macOS).BSD syscall
- #551freadlinkReads the target of a symbolic link referenced by an open file descriptor (macOS extension).BSD syscall
- #553mkfifoatCreates a named pipe relative to a directory descriptor.BSD syscall
- #554mknodatCreates a node (device, FIFO or regular file) relative to a directory descriptor.BSD syscall
- #555ungraftdmgDetaches a previously grafted disk image from the filesystem tree.BSD syscall
- #556sys_coalition_policy_setWrites policy bits onto a coalition (jetsam band, focal status, resource role).BSD syscall
- #557enosysAlias of nosys: the kernel stub used for unimplemented or retired syscall numbers, returning ENOSYS to the caller.BSD syscall
- #557sys_coalition_policy_getReads the policy attached to a coalition (a kernel grouping of related tasks).BSD syscall
- #-100iokit_user_client_trapFast-path trap for invoking selectors on an IOUserClient without going through MIG.Mach trap
- #-96debug_control_port_for_pidReturns the debug-control task port for a PID, enabling debugger-style control without the full task-control port.Mach trap
- #-95mk_timebase_info_trapTrap entry point for the legacy mk_timebase_info.Mach trap
- #-95mk_timer_arm_leeway_trapArm a kernel timer with a leeway window allowing the scheduler to coalesce wake-ups.Mach trap
- #-94mk_timebase_infoLegacy variant of mach_timebase_info that also returns a clock flag word.Mach trap
- #-94mk_timer_cancel_trapTrap form of mk_timer_cancel; clears a pending deadline on a timer port.Mach trap
- #-93mk_timer_cancelCancel a pending arm on a kernel timer and optionally return the previous deadline.Mach trap
- #-93mk_timer_arm_trapTrap entry point for mk_timer_arm; sets a strict absolute deadline.Mach trap
- #-92mk_timer_armArm a kernel timer to fire at an absolute mach_absolute_time() deadline.Mach trap
- #-92mk_timer_destroy_trapTrap form of mk_timer_destroy that releases the kernel timer backing a port.Mach trap
- #-91mk_timer_destroyTear down a previously created mk_timer port and release its kernel state.Mach trap
- #-91mk_timer_create_trapTrap entry point for mk_timer_create; returns a port name for a new kernel timer.Mach trap
- #-90mk_timer_createAllocate a kernel timer object that fires by sending a message to a Mach port.Mach trap
- #-90mach_wait_until_trapRaw trap entry point for mach_wait_until; sleeps until an absolute monotonic deadline.Mach trap
- #-89mach_wait_untilSleep the current thread until an absolute mach_absolute_time() deadline.Mach trap
- #-89mach_timebase_info_trapTrap form that returns the mach timebase numer/denom ratio.Mach trap
- #-88mach_timebase_infoReturn the numer/denom ratio used to convert mach_absolute_time ticks to nanoseconds.Mach trap
- #-88_exclaves_ctl_trapControl trap for communicating with Exclaves, the secure compartments introduced on Apple Silicon.Mach trap
- #-77_kernelrpc_mach_port_request_notification_trapTrap-level entry point that backs mach_port_request_notification — subscribes to dead-name, no-senders, send-possible, or port-destroyed events.Mach trap
- #-76_kernelrpc_mach_port_type_trapTrap-level entry point that backs mach_port_type — returns the bitmask of right flavors a name holds.Mach trap
- #-72mach_voucher_extract_attr_recipe_trapRead back an attribute recipe (QoS, importance, bank, etc.) from a Mach voucher.Mach trap
- #-70host_create_mach_voucher_trapCreate a Mach voucher carrying QoS, importance, bank, and user-data attributes for IPC attribution.Mach trap
- #-63mach_vm_reclaim_update_kernel_accounting_trapRefresh the kernel's view of a process's VM reclaim ring buffer accounting.Mach trap
- #-62clock_sleep_trapBlock the calling thread on a clock object until a wall-clock or monotonic deadline.Mach trap
- #-61thread_switchHand off the remaining time quantum to a specified thread, optionally with a depress timeout.Mach trap
- #-60swtchLegacy cooperative yield that hints the scheduler to run another runnable thread.Mach trap
- #-59swtch_priYield variant that temporarily depresses the caller's priority while giving up the CPU.Mach trap
- #-58pfz_exitInternal marker trap used to denote exit from the Preemption-Free Zone.Mach trap
- #-53macx_backing_store_recoveryLegacy trap that registered a recovery process for the default pager's backing store — obsolete.Mach trap
- #-52macx_backing_store_suspendLegacy trap that paused activity on the default pager's backing store — obsolete.Mach trap
- #-51macx_triggersLegacy trap for installing low-memory paging triggers — obsolete on modern macOS.Mach trap
- #-50thread_get_special_reply_portReturns the per-thread special reply port used by the kernel for sync-IPC priority inheritance.Mach trap
- #-49macx_swapoffLegacy trap that deactivated a previously activated swap file — obsolete.Mach trap
- #-48macx_swaponLegacy trap that activated a swap file at a given path — long since stubbed out.Mach trap
- #-46pid_for_taskReverse lookup that returns the BSD PID associated with a Mach task port.Mach trap
- #-45task_for_pidReturns a Mach task port for the process with the given PID — the keystone primitive for cross-process memory access on macOS.Mach trap
- #-44task_name_for_pidReturns a name-flavor task port for the given PID — read-only metadata access without memory or thread control.Mach trap
- #-43map_fdLegacy Mach trap that mapped a file descriptor's contents directly into the task's address space.Mach trap
- #-43mach_generate_activity_idAllocate a fresh os_activity_t identifier unique within the calling task.Mach trap
- #-42_kernelrpc_mach_port_unguard_trapTrap-level entry point that backs mach_port_unguard — removes the guard previously attached by mach_port_guard.Mach trap
- #-41init_processLegacy XNU syscall used during launchd bring-up to mark a process as PID 1-style init.Mach trap
- #-41_kernelrpc_mach_port_guard_trapTrap-level entry point that backs mach_port_guard — attaches a 64-bit guard value to a receive right so misuse triggers EXC_GUARD.Mach trap
- #-40_kernelrpc_mach_port_get_attributes_trapTrap-level entry point that backs mach_port_get_attributes — reads queue limits, message counts, and other per-port attributes.Mach trap
- #-39semaphore_timedwait_signal_trapAtomic signal-and-timedwait variant of the Mach semaphore hand-off primitive.Mach trap
- #-38semaphore_timedwait_trapWait on a Mach semaphore with a relative timeout, returning KERN_OPERATION_TIMED_OUT on expiry.Mach trap
- #-37semaphore_wait_signal_trapAtomically signal one semaphore and wait on another — the Mach hand-off primitive.Mach trap
- #-36semaphore_wait_trapDecrement a Mach semaphore, blocking the calling thread if the count is zero.Mach trap
- #-35semaphore_signal_thread_trapWake a specific named thread waiting on a Mach semaphore.Mach trap
- #-34semaphore_signal_all_trapWake every thread currently waiting on a Mach semaphore.Mach trap
- #-33semaphore_signal_trapIncrement a Mach semaphore, waking at most one waiter.Mach trap
- #-32mach_msg_overwrite_trapVariant of mach_msg that lets the caller supply a separate buffer for the received message instead of overwriting the send buffer.Mach trap
- #-31mach_msg2_trapSends and/or receives a Mach message on a port. The Ventura-era replacement for mach_msg_trap that takes its options as a single packed argument.Mach trap
- #-31mach_msg_trapLegacy single-buffer entry point that sends and/or receives a Mach message through the kernel.Mach trap
- #-29host_self_trapReturns a send right to the host name port — the unprivileged handle behind mach_host_self().Mach trap
- #-28task_self_trapReturns the send right naming the caller's own task port — the value behind mach_task_self().Mach trap
- #-27thread_self_trapReturns the send right naming the caller's own thread control port — the value behind mach_thread_self().Mach trap
- #-26mach_reply_portAllocates a one-shot receive right in the caller's IPC space for use as the reply port in a Mach RPC.Mach trap
- #-25_kernelrpc_mach_port_destruct_trapTrap-level entry point that backs mach_port_destruct — tears down a port created with mach_port_construct, validating the guard.Mach trap
- #-24_kernelrpc_mach_port_construct_trapTrap-level entry point that backs mach_port_construct — atomically creates a port with optional guard, queue limit, and other attributes.Mach trap
- #-23_kernelrpc_mach_port_extract_member_trapTrap-level entry point that backs mach_port_extract_member — removes a receive right from a port set.Mach trap
- #-22_kernelrpc_mach_port_insert_member_trapTrap-level entry point that backs mach_port_insert_member — adds a receive right to a port set.Mach trap
- #-21_kernelrpc_mach_port_insert_right_trapTrap-level entry point that backs mach_port_insert_right — installs an existing port right into the IPC space under a chosen name.Mach trap
- #-20_kernelrpc_mach_port_move_member_trapTrap-level entry point that backs mach_port_move_member — atomically moves a receive right between port sets (or in/out of one).Mach trap
- #-19_kernelrpc_mach_port_mod_refs_trapTrap-level entry point that backs mach_port_mod_refs — adjusts the userspace refcount of a port right by a signed delta.Mach trap
- #-18_kernelrpc_mach_port_deallocate_trapTrap-level entry point that backs mach_port_deallocate — drops one user reference on a send or send-once right.Mach trap
- #-17_kernelrpc_mach_port_destroy_trapTrap-level entry point that backs mach_port_destroy — removes all rights for a port name in one call.Mach trap
- #-16_kernelrpc_mach_port_allocate_trapTrap-level entry point that backs mach_port_allocate — creates a new port right of the requested type in a task's IPC space.Mach trap
- #-15_kernelrpc_mach_vm_map_trapTrap-level entry point that backs mach_vm_map — maps a memory object (file, shared region, or anonymous) into a task's address space.Mach trap
- #-14_kernelrpc_mach_vm_protect_trapTrap-level entry point that backs mach_vm_protect — changes the current or maximum protection flags of a VM range.Mach trap
- #-13task_dyld_process_info_notify_get_trapFetch the per-task notification port set used by dyld to broadcast image load/unload events.Mach trap
- #-12_kernelrpc_mach_vm_deallocate_trapTrap-level entry point that backs mach_vm_deallocate — releases a virtual address range in a target task.Mach trap
- #-11_kernelrpc_mach_vm_purgable_control_trapTrap-level entry point that backs mach_vm_purgable_control — manages the purgeable (volatile) state of a VM region.Mach trap
- #-10_kernelrpc_mach_vm_allocate_trapTrap-level entry point that backs mach_vm_allocate — reserves a region of virtual address space in a target task.Mach trap
- #0thread_get_cthread_selfReturns the per-thread C-thread (pthread) self pointer — the legacy way userland tracked TLS base on early macOS.MachDep (Intel)
- #0hv_task_trapHypervisor.framework task-scoped trap — entry point user-mode hypervisors (VMware Fusion, UTM, Parallels) use to manage VM state on Intel macOS.MachDep (Intel)
- #1thread_set_cthread_selfSets the per-thread C-thread self pointer; foundation of pthread thread-local storage on Intel macOS.MachDep (Intel)
- #1hv_thread_trapHypervisor.framework thread-scoped trap — used to enter and exit guest execution on Intel VT-x.MachDep (Intel)
- #3thread_fast_set_cthread_selfFast path for setting the C-thread self pointer — writes the GS-base segment register directly without a full Mach round-trip.MachDep (Intel)
- #4thread_set_user_ldtInstalls a per-thread Local Descriptor Table on x86, allowing user-mode segment manipulation (Wine, classic emulators).MachDep (Intel)
- #5PCcreateLegacy NeXT-era trap for creating a PC-emulation context. Obsolete; never reachable on shipped macOS.MachDep (Intel)
- #5thread_fast_set_cthread_self6464-bit Intel variant of thread_fast_set_cthread_self — the path libpthread uses to install TSD on every new thread under x86_64.MachDep (Intel)
- #6PCldtLegacy NeXT-era trap for PC-emulation LDT setup. Obsolete.MachDep (Intel)
- #7PCresumeLegacy NeXT-era trap to resume a PC-emulation context. Obsolete.MachDep (Intel)
- #7i386_set_ldt64Process-wide variant of LDT installation for x86_64; used by emulation and compatibility layers that need custom segment descriptors.MachDep (Intel)
- #8PCcopyBIOSDataLegacy NeXT-era trap to copy BIOS data into a PC-emulation context. Obsolete.MachDep (Intel)
- #8i386_get_ldt64Reads back the process-wide LDT entries previously installed with i386_set_ldt64.MachDep (Intel)
- #9PCsizeBIOSExtDataLegacy NeXT-era trap to query the BIOS extended-data size for PC emulation. Obsolete.MachDep (Intel)
- #10PCcopyBIOSExtDataLegacy NeXT-era trap to copy BIOS extended data for PC emulation. Obsolete.MachDep (Intel)
- #11PCmapBIOSRomLegacy NeXT-era trap to map the BIOS ROM into a PC-emulation address space. Obsolete.MachDep (Intel)