Mach trap#-41
svc · mach trap -41
init_process
Legacy XNU syscall used during launchd bring-up to mark a process as PID 1-style init.
Prototype
kern_return_t init_process(/* 0 args */);Returns: kern_return_t
Version history
| XNU tag | macOS | # |
|---|---|---|
| xnu-123.5 | macOS 10.0 Cheetah | -40 |
| xnu-201 | macOS 10.1 Puma | -40 |
| xnu-344 | macOS 10.2 Jaguar | -40 |
| xnu-517 | macOS 10.3 Panther | -40 |
| xnu-792 | macOS 10.4 Tiger | -41 |
| xnu-1228 | macOS 10.5 Leopard | -41 |
| xnu-1228.0.2 | — | -41 |
| xnu-1228.12.14 | — | -41 |
| xnu-1228.15.4 | — | -41 |
| xnu-1228.3.13 | — | -41 |
| xnu-1228.5.18 | — | -41 |
| xnu-1228.5.20 | — | -41 |
| xnu-1228.7.58 | — | -41 |
| xnu-1228.9.59 | — | -41 |
| xnu-124.1 | — | -40 |
| xnu-124.13 | — | -40 |
| xnu-124.7 | — | -40 |
| xnu-201.14 | — | -40 |
| xnu-201.19 | — | -40 |
| xnu-201.19.3 | — | -40 |
| xnu-201.42.3 | — | -40 |
| xnu-201.5 | — | -40 |
| xnu-344.12.2 | — | -40 |
| xnu-344.2 | — | -40 |
| xnu-344.21.73 | — | -40 |
| xnu-344.21.74 | — | -40 |
| xnu-344.23 | — | -40 |
| xnu-344.26 | — | -40 |
| xnu-344.32 | — | -40 |
| xnu-344.34 | — | -40 |
| xnu-344.49 | — | -40 |
| xnu-517.11.1 | — | -40 |
| xnu-517.12.7 | — | -40 |
| xnu-517.3.15 | — | -40 |
| xnu-517.3.7 | — | -40 |
| xnu-517.7.21 | — | -40 |
| xnu-517.7.7 | — | -40 |
| xnu-517.9.4 | — | -40 |
| xnu-517.9.5 | — | -40 |
| xnu-792.1.5 | — | -41 |
| xnu-792.10.96 | — | -41 |
| xnu-792.12.6 | — | -41 |
| xnu-792.13.8 | — | -41 |
| xnu-792.17.14 | — | -41 |
| xnu-792.18.15 | — | -41 |
| xnu-792.2.4 | — | -41 |
| xnu-792.21.3 | — | -41 |
| xnu-792.22.5 | — | -41 |
| xnu-792.24.17 | — | -41 |
| xnu-792.25.20 | — | -41 |
| xnu-792.6.22 | — | -41 |
| xnu-792.6.56 | — | -41 |
| xnu-792.6.61 | — | -41 |
| xnu-792.6.70 | — | -41 |
| xnu-792.6.76 | — | -41 |
Notes
Vestigial entry in the BSD syscall table (#244). On contemporary macOS it is essentially unused by third-party code; launchd is the only legitimate caller and the kernel path is largely a no-op kept for ABI stability. Treat any non-launchd invocation as highly suspicious.
Detection
DTrace syscall::init_process:entry fires on any caller; pair with execname to confirm it is launchd. No dedicated Endpoint Security event.
Related APIs
forkexecveposix_spawnsetsidsetlogin