BSD syscall#546
svc · unix #546
tracker_action
Apple-private syscall driving the NetworkExtension tracker / domain-resolution telemetry pipeline.
Prototype
int tracker_action(int action, char *buffer, size_t buffer_size);Returns: int
Arguments
| Name | Type | Dir | Description |
|---|---|---|---|
| action | int | - | |
| buffer | char | - | |
| buffer_size | size_t | - |
Version history
| XNU tag | macOS | # |
|---|---|---|
| xnu-8019.41.5 | macOS 12.0 Monterey | 546 |
| xnu-8792.41.9 | macOS 13.0 Ventura | 546 |
| xnu-10002.1.13 | macOS 14.0 Sonoma | 546 |
| xnu-11215.1.10 | macOS 15.0 Sequoia | 546 |
| xnu-11417.101.15 | macOS 15.4 Sequoia | 546 |
| xnu-12377.1.9 | macOS 26.0 Tahoe | 546 |
| xnu-10002.41.9 | — | 546 |
| xnu-10002.61.3 | — | 546 |
| xnu-10002.81.5 | — | 546 |
| xnu-10063.101.15 | — | 546 |
| xnu-10063.121.3 | — | 546 |
| xnu-10063.141.1 | — | 546 |
| xnu-11215.41.3 | — | 546 |
| xnu-11215.61.5 | — | 546 |
| xnu-11215.81.4 | — | 546 |
| xnu-11417.121.6 | — | 546 |
| xnu-11417.140.69 | — | 546 |
| xnu-12377.101.15 | — | 546 |
| xnu-12377.41.6 | — | 546 |
| xnu-12377.61.12 | — | 546 |
| xnu-12377.81.4 | — | 546 |
| xnu-8019.61.5 | — | 546 |
| xnu-8019.80.24 | — | 546 |
| xnu-8020.101.4 | — | 546 |
| xnu-8020.121.3 | — | 546 |
| xnu-8020.140.41 | — | 546 |
| xnu-8792.61.2 | — | 546 |
| xnu-8792.81.2 | — | 546 |
| xnu-8796.101.5 | — | 546 |
| xnu-8796.121.2 | — | 546 |
| xnu-8796.141.3 | — | 546 |
Notes
Newer-vintage syscall (introduced around macOS 13) used by NEHelperManager and trustd to feed the kernel's per-flow tracker-domain classification used by Safari's Intelligent Tracking Prevention and the Privacy Report. The action argument selects an operation on the kernel-resident tracker domain map. Restricted to processes with the com.apple.private.necp.* entitlements.
Detection
DTrace fbt::tracker_action:entry; the operation code is in arg0. Largely an Apple-internal signal — any third-party caller is an entitlement-abuse candidate.
Related APIs
necp_client_actionnecp_session_actionnecp_match_policynecp_open