BSD syscall#7
svc · unix #7
wait4
Waits for a child process to change state, returning status and rusage.
Prototype
int wait4(int pid, user_addr_t status, int options, user_addr_t rusage);Returns: int
Arguments
| Name | Type | Dir | Description |
|---|---|---|---|
| pid | int | - | |
| status | user_addr_t | - | |
| options | int | - | |
| rusage | user_addr_t | - |
Version history
| XNU tag | macOS | # |
|---|---|---|
| xnu-1456.1.26 | macOS 10.6 Snow Leopard | 7 |
| xnu-1486.2.11 | — | 7 |
| xnu-1504.15.3 | — | 7 |
| xnu-1504.3.12 | — | 7 |
| xnu-1504.7.4 | — | 7 |
| xnu-1504.9.17 | — | 7 |
| xnu-1504.9.26 | — | 7 |
| xnu-1504.9.37 | — | 7 |
Notes
BSD-flavoured reaper that backs waitpid() in libc. Options include WNOHANG for polling and WUNTRACED/WCONTINUED to observe job-control stops. The rusage out-parameter is populated from the child's accumulated counters before its proc struct is freed.
Detection
DTrace syscall::wait4:return shows the reaped PID in arg0 and decoded status via WIFEXITED/WTERMSIG macros. Endpoint Security correlates the prior ES_EVENT_TYPE_NOTIFY_EXIT.
Related APIs
waitidforkposix_spawnexitkillgetrusage