Is there an analogue to cgroups in Darwin for preventing processes from escaping from the control / monitoring of its parent process by means of fork()? If yes, what is it?

For some background, consider a process, P, a direct descendant, Q, and the descendants of Q, R: cgroups allows P to control and monitor Q and R. If P launches Q, but Q spawns a process (r in R), without something akin to cgroups, P is unable to monitor r.

A real world example of this would be systemd (P) spawning openssh's sshd (Q) as a daemon, which then spawns other instances of sshd (R) to handle each opened session. Without cgroups, systemd would not be able to interact with the per-session sshd's.

(In the NT environment, cgroups are analogous to Job objects.)

  • Clarified the question. – user314104 Feb 5 '14 at 16:44

Exactly what aren't they supposed to "escape" from? You might want to take a look at chroot and jails (Darwin is a BSD derivative, so this last BSDism might be available). Be careful, really putting a process in a cage it can't escape from is not trivial.

  • 1
    If a program double-forks the only way to reliably track the processes is with cgroups because the forked processes will be in the same one. – kyrias Sep 24 '14 at 18:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.