BSD syscall#1
svc · unix #1
exit
Terminates the calling process and returns an 8-bit status to the parent via wait().
Prototype
void exit(int rval);Returns: void
Arguments
| Name | Type | Dir | Description |
|---|---|---|---|
| rval | int | - |
Version history
| XNU tag | macOS | # |
|---|---|---|
| xnu-1456.1.26 | macOS 10.6 Snow Leopard | 1 |
| xnu-1486.2.11 | — | 1 |
| xnu-1504.15.3 | — | 1 |
| xnu-1504.3.12 | — | 1 |
| xnu-1504.7.4 | — | 1 |
| xnu-1504.9.17 | — | 1 |
| xnu-1504.9.26 | — | 1 |
| xnu-1504.9.37 | — | 1 |
Notes
On XNU, _exit() / exit() funnel through the exit1() kernel routine, which tears down threads, releases the Mach task, closes file descriptors, and sends SIGCHLD to the parent. Userland exit() from libc additionally runs atexit() handlers and flushes stdio buffers; the raw syscall does not. Zombies remain in the proc table until the parent reaps them with wait4/waitid.
Detection
Endpoint Security emits ES_EVENT_TYPE_NOTIFY_EXIT with the wait4-style status. DTrace probe proc:::exit fires with the exit code in args[0].
Related APIs
forkwait4waitidexecvekill