BSD syscall#523
svc · unix #523
necp_session_action
Performs an administrative action (add/update/delete/list/apply) on an open NECP session.
Prototype
int necp_session_action(int necp_fd, uint32_t action, uint8_t *in_buffer, size_t in_buffer_length, uint8_t *out_buffer, size_t out_buffer_length);Returns: int
Arguments
| Name | Type | Dir | Description |
|---|---|---|---|
| necp_fd | int | - | |
| action | uint32_t | - | |
| in_buffer | uint8_t | - | |
| in_buffer_length | size_t | - | |
| out_buffer | uint8_t | - | |
| out_buffer_length | size_t | - |
Version history
| XNU tag | macOS | # |
|---|---|---|
| xnu-4570.1.46 | macOS 10.13 High Sierra | 523 |
| xnu-4903.221.2 | macOS 10.14 Mojave | 523 |
| xnu-6153.11.26 | macOS 10.15 Catalina | 523 |
| xnu-7195.50.7.100.1 | macOS 11.0 Big Sur | 523 |
| xnu-8019.41.5 | macOS 12.0 Monterey | 523 |
| xnu-8792.41.9 | macOS 13.0 Ventura | 523 |
| xnu-10002.1.13 | macOS 14.0 Sonoma | 523 |
| xnu-11215.1.10 | macOS 15.0 Sequoia | 523 |
| xnu-11417.101.15 | macOS 15.4 Sequoia | 523 |
| xnu-12377.1.9 | macOS 26.0 Tahoe | 523 |
| xnu-10002.41.9 | — | 523 |
| xnu-10002.61.3 | — | 523 |
| xnu-10002.81.5 | — | 523 |
| xnu-10063.101.15 | — | 523 |
| xnu-10063.121.3 | — | 523 |
| xnu-10063.141.1 | — | 523 |
| xnu-11215.41.3 | — | 523 |
| xnu-11215.61.5 | — | 523 |
| xnu-11215.81.4 | — | 523 |
| xnu-11417.121.6 | — | 523 |
| xnu-11417.140.69 | — | 523 |
| xnu-12377.101.15 | — | 523 |
| xnu-12377.41.6 | — | 523 |
| xnu-12377.61.12 | — | 523 |
| xnu-12377.81.4 | — | 523 |
| xnu-4570.20.62 | — | 523 |
| xnu-4570.31.3 | — | 523 |
| xnu-4570.41.2 | — | 523 |
| xnu-4570.51.1 | — | 523 |
| xnu-4570.61.1 | — | 523 |
| xnu-4570.71.2 | — | 523 |
| xnu-4903.231.4 | — | 523 |
| xnu-4903.241.1 | — | 523 |
| xnu-4903.270.47 | — | 523 |
| xnu-6153.101.6 | — | 523 |
| xnu-6153.121.1 | — | 523 |
| xnu-6153.141.1 | — | 523 |
| xnu-6153.41.3 | — | 523 |
| xnu-6153.61.1 | — | 523 |
| xnu-6153.81.5 | — | 523 |
| xnu-7195.101.1 | — | 523 |
| xnu-7195.121.3 | — | 523 |
| xnu-7195.141.2 | — | 523 |
| xnu-7195.60.75 | — | 523 |
| xnu-7195.81.3 | — | 523 |
| xnu-8019.61.5 | — | 523 |
| xnu-8019.80.24 | — | 523 |
| xnu-8020.101.4 | — | 523 |
| xnu-8020.121.3 | — | 523 |
| xnu-8020.140.41 | — | 523 |
| xnu-8792.61.2 | — | 523 |
| xnu-8792.81.2 | — | 523 |
| xnu-8796.101.5 | — | 523 |
| xnu-8796.121.2 | — | 523 |
| xnu-8796.141.3 | — | 523 |
Notes
The action codes include NECP_SESSION_ACTION_POLICY_ADD, _UPDATE, _DELETE, _APPLY_ALL, _LIST_ALL, and _DUMP_ALL. Policies are described as a packed TLV blob containing match conditions (effective UUID, signing identifier, account identifier, domain pattern, IP range) and a result (interface, agent, drop, allow, redirect). _APPLY_ALL commits the staged ruleset atomically — useful when reloading after a Configuration Profile changes.
Detection
No ES event. Anomalous use by non-Apple processes is itself a high-severity signal. Auditing tools typically dump the active table with `sudo nettop -m necp` and `sysctl net.necp`.
Related APIs
necp_session_opennecp_opennecp_match_policynecp_client_action