__sysctl

Prototype

int __sysctl(int *name, u_int namelen, void *old, size_t *oldlenp, void *new, size_t newlen);

Returns: int

Arguments

Version history

Examples

int mib[2] = { CTL_KERN, KERN_OSRELEASE };
char buf[64];
size_t len = sizeof(buf);
sysctl(mib, 2, buf, &len, NULL, 0);

Notes

Backs the libc sysctl(3), sysctlbyname(3) and sysctlnametomib(3) wrappers. The userland sysctl(8) command, hw.* / kern.* queries, and most of the system-info gathering done by tools like ps, top, vm_stat and ioreg ultimately funnel through this one syscall. Some MIBs (notably kern.proc) honour per-entitlement filtering on hardened binaries.

Detection

Endpoint Security does not surface __sysctl directly, but its NOTIFY_PROC_CHECK event covers proc-listing sysctls. DTrace's syscall::__sysctl:entry probe decodes the OID array and is the standard way to audit who is reading kern.proc.

Related APIs