BSD syscall#135
svc · unix #135
socketpair
Creates an unnamed, connected pair of sockets in the AF_UNIX domain for in-process IPC.
Prototype
int socketpair(int domain, int type, int protocol, int *rsv);Returns: int
Arguments
| Name | Type | Dir | Description |
|---|---|---|---|
| domain | int | - | |
| type | int | - | |
| protocol | int | - | |
| rsv | int | - |
Version history
| XNU tag | macOS | # |
|---|---|---|
| xnu-1456.1.26 | macOS 10.6 Snow Leopard | 135 |
| xnu-1486.2.11 | — | 135 |
| xnu-1504.15.3 | — | 135 |
| xnu-1504.3.12 | — | 135 |
| xnu-1504.7.4 | — | 135 |
| xnu-1504.9.17 | — | 135 |
| xnu-1504.9.26 | — | 135 |
| xnu-1504.9.37 | — | 135 |
Notes
Only AF_UNIX is accepted on macOS; the kernel returns EOPNOTSUPP for AF_INET. The two descriptors share a buffer in xnu's unp_pcb and behave like a bidirectional pipe with optional SCM_RIGHTS file-descriptor passing. XPC, launchd, and many Apple frameworks use socketpair under the hood to hand a child process a pre-connected control channel, often inherited across posix_spawn.
Detection
No Endpoint Security event covers socketpair. Detect indirectly by enumerating Unix-domain pairs via proc_pidinfo + PROC_PIDFDSOCKETINFO and correlating peer addresses with sysctl net.local.stream.pcblist.
Related APIs
socketpipesendmsgrecvmsgfileport_makeport