Struct es_event_get_task_t

#[repr(C)]
pub struct es_event_get_task_t {
    pub target: ShouldNotBeNull<es_process_t>,
    pub type_: es_get_task_type_t,
    /* private fields */
}

Available on macOS only.

Get a process’s task control port.

This event is fired when a process obtains a send right to a task control port (e.g. task_for_pid(), task_identity_token_get_task_port(), processor_set_tasks() and other means).

Task control ports were formerly known as simply “task ports”.

There are many legitimate reasons why a process might need to obtain a send right to a task control port of another process, not limited to intending to debug or suspend the target process. For instance, frameworks and their daemons may need to obtain a task control port to fulfill requests made by the target process. Obtaining a task control port is in itself not indicative of malicious activity. Denying system processes acquiring task control ports may result in breaking system functionality in potentially fatal ways.

Cache key for this event type: (process executable file, target executable file).

Fields

target: ShouldNotBeNull<es_process_t>

The process for which the task control port will be retrieved

type_: es_get_task_type_t

Type indicating how the process is obtaining the task port for the target process.

Field available only if message version >= 5.

Implementations

impl es_event_get_task_t

Accessors for ShouldNotBeNull fields

pub unsafe fn target(&self) -> &es_process_t

Gives a references to the field while checking for null.

Safety

See ShouldNotBeNull safety requirements.