Skip to content
Mach trap#-16

svc · mach trap -16

_kernelrpc_mach_port_allocate_trap

Trap-level entry point that backs mach_port_allocate — creates a new port right of the requested type in a task's IPC space.

Prototype

kern_return_t _kernelrpc_mach_port_allocate_trap(/* 3 args */);

Returns: kern_return_t

Version history

XNU tagmacOS#
xnu-2050.18.24macOS 10.8 Mountain Lion-16
xnu-2422.115.4macOS 10.9 Mavericks-16
xnu-2782.40.9macOS 10.10 Yosemite-16
xnu-3247.1.106macOS 10.11 El Capitan-16
xnu-3789.1.32macOS 10.12 Sierra-16
xnu-4570.1.46macOS 10.13 High Sierra-16
xnu-4903.221.2macOS 10.14 Mojave-16
xnu-6153.11.26macOS 10.15 Catalina-16
xnu-7195.50.7.100.1macOS 11.0 Big Sur-16
xnu-8019.41.5macOS 12.0 Monterey-16
xnu-8792.41.9macOS 13.0 Ventura-16
xnu-10002.1.13macOS 14.0 Sonoma-16
xnu-11215.1.10macOS 15.0 Sequoia-16
xnu-11417.101.15macOS 15.4 Sequoia-16
xnu-12377.1.9macOS 26.0 Tahoe-16
xnu-10002.41.9-16
xnu-10002.61.3-16
xnu-10002.81.5-16
xnu-10063.101.15-16
xnu-10063.121.3-16
xnu-10063.141.1-16
xnu-11215.41.3-16
xnu-11215.61.5-16
xnu-11215.81.4-16
xnu-11417.121.6-16
xnu-11417.140.69-16
xnu-12377.101.15-16
xnu-12377.41.6-16
xnu-12377.61.12-16
xnu-12377.81.4-16
xnu-2050.22.13-16
xnu-2050.24.15-16
xnu-2050.48.11-16
xnu-2050.7.9-16
xnu-2050.9.2-16
xnu-2422.1.72-16
xnu-2422.100.13-16
xnu-2422.110.17-16
xnu-2422.90.20-16
xnu-2782.1.97-16
xnu-2782.10.72-16
xnu-2782.20.48-16
xnu-2782.30.5-16
xnu-3247.10.11-16
xnu-3248.20.55-16
xnu-3248.30.4-16
xnu-3248.40.184-16
xnu-3248.50.21-16
xnu-3248.60.10-16
xnu-3789.21.4-16
xnu-3789.31.2-16
xnu-3789.41.3-16
xnu-3789.51.2-16
xnu-3789.60.24-16
xnu-3789.70.16-16
xnu-4570.20.62-16
xnu-4570.31.3-16
xnu-4570.41.2-16
xnu-4570.51.1-16
xnu-4570.61.1-16
xnu-4570.71.2-16
xnu-4903.231.4-16
xnu-4903.241.1-16
xnu-4903.270.47-16
xnu-6153.101.6-16
xnu-6153.121.1-16
xnu-6153.141.1-16
xnu-6153.41.3-16
xnu-6153.61.1-16
xnu-6153.81.5-16
xnu-7195.101.1-16
xnu-7195.121.3-16
xnu-7195.141.2-16
xnu-7195.60.75-16
xnu-7195.81.3-16
xnu-8019.61.5-16
xnu-8019.80.24-16
xnu-8020.101.4-16
xnu-8020.121.3-16
xnu-8020.140.41-16
xnu-8792.61.2-16
xnu-8792.81.2-16
xnu-8796.101.5-16
xnu-8796.121.2-16
xnu-8796.141.3-16

Examples

C — allocate a receive right via the libsyscall wrapper

mach_port_t recv;
kern_return_t kr = mach_port_allocate(mach_task_self(),
                                      MACH_PORT_RIGHT_RECEIVE,
                                      &recv);
// libsyscall routes this directly through _kernelrpc_mach_port_allocate_trap

Notes

The MIG userspace stub mach_port_allocate calls this trap directly when the target is mach_task_self(), bypassing the MIG message machinery for a fast path. The right_type argument selects MACH_PORT_RIGHT_RECEIVE, MACH_PORT_RIGHT_PORT_SET, or MACH_PORT_RIGHT_DEAD_NAME; receive rights are the most common, since they are the building block for every server and reply port. Every allocated right counts against the task's IPC table quota (currently 64K names by default, raisable via task_set_port_space_limits).

Detection

Mach IPC operations are not surfaced by Endpoint Security. DTrace mach_trap::_kernelrpc_mach_port_allocate_trap:entry plus periodic snapshots of lsmp output (or task_info(TASK_EXTMOD_INFO)) are the practical detection surface for port-leak hunts.

Related APIs

_kernelrpc_mach_port_deallocate_trap_kernelrpc_mach_port_construct_trap_kernelrpc_mach_port_mod_refs_trapmach_port_allocatemach_reply_port