posix_spawn

Creates a new process running a specified program in a single atomic syscall.

Prototype

int posix_spawn(pid_t *pid, const char *path, const struct _posix_spawn_args_desc *adesc, char **argv, char **envp);

Returns: int

Arguments

Name	Type	Dir
pid	pid_t	-
path	const char	-
adesc	const struct _posix_spawn_args_desc	-
argv	char	-
envp	char	-

Version history

XNU tag	macOS	#
xnu-1456.1.26	macOS 10.6 Snow Leopard	244
xnu-1486.2.11	—	244
xnu-1504.15.3	—	244
xnu-1504.3.12	—	244
xnu-1504.7.4	—	244
xnu-1504.9.17	—	244
xnu-1504.9.26	—	244
xnu-1504.9.37	—	244

Examples

Spawn with CLOEXEC default

posix_spawnattr_t attr;
posix_spawnattr_init(&attr);
posix_spawnattr_setflags(&attr, POSIX_SPAWN_CLOEXEC_DEFAULT);
pid_t pid;
char *argv[] = {"/bin/echo", "hi", NULL};
posix_spawn(&pid, argv[0], NULL, &attr, argv, environ);
posix_spawnattr_destroy(&attr);

Notes

Apple's preferred process-creation primitive. Internally it bypasses fork() entirely, building the child task and image with a dedicated kernel path, which is why it is safe in apps that link Cocoa. File actions and attribute objects allow fd dup/close, signal masks, and macOS-specific extensions (POSIX_SPAWN_CLOEXEC_DEFAULT, POSIX_SPAWN_START_SUSPENDED, persona attributes). libdispatch, launchd, and NSTask are all layered on top.

Detection

Endpoint Security raises ES_EVENT_TYPE_NOTIFY_EXEC for spawned processes just like execve. DTrace probe syscall::posix_spawn:entry exposes the path argument and attribute pointer.

Related APIs

forkvforkexecvewait4waitidexit