[ { "action": { "result": { "result": { "auth": 0 }, "result_type": 0 } }, "action_type": 1, "event": { "fork": { "child": { "audit_token": { "asid": 100021, "auid": 502, "egid": 0, "euid": 0, "pid": 65597, "pidversion": 961255, "rgid": 0, "ruid": 0 }, "cdhash": "4FBA9CA99A86160DAD7F4E4EA5193A86A175622C", "codesigning_flags": 570556931, "executable": { "path": "/Users/johndoe/p/playground/posix_spawn_bugreport/posix_spawn", "path_truncated": false, "stat": { "st_atimespec": "2026-01-19T11:51:43.077102595Z", "st_birthtimespec": "2026-01-19T09:56:24.087331226Z", "st_blksize": 4096, "st_blocks": 72, "st_ctimespec": "2026-01-19T09:56:24.087458893Z", "st_dev": 16777231, "st_flags": 0, "st_gen": 0, "st_gid": 20, "st_ino": 73228371, "st_mode": 33261, "st_mtimespec": "2026-01-19T09:56:24.087458893Z", "st_nlink": 1, "st_rdev": 0, "st_size": 34408, "st_uid": 502 } }, "group_id": 65587, "is_es_client": false, "is_platform_binary": false, "original_ppid": 65588, "parent_audit_token": { "asid": 100021, "auid": 502, "egid": 0, "euid": 0, "pid": 65588, "pidversion": 961237, "rgid": 0, "ruid": 0 }, "ppid": 65588, "responsible_audit_token": { "asid": 100021, "auid": 502, "egid": 20, "euid": 502, "pid": 2551, "pidversion": 4671, "rgid": 20, "ruid": 502 }, "session_id": 58457, "signing_id": "posix_spawn", "start_time": "2026-01-19T11:51:43.078062Z", "team_id": null, "tty": { "path": "/dev/ttys027", "path_truncated": false, "stat": { "st_atimespec": "2026-01-19T11:51:42.789563000Z", "st_birthtimespec": "1970-01-01T00:00:00.000000000Z", "st_blksize": 65536, "st_blocks": 0, "st_ctimespec": "2026-01-19T11:51:43.078049000Z", "st_dev": -1270801196, "st_flags": 0, "st_gen": 0, "st_gid": 4, "st_ino": 985, "st_mode": 8592, "st_mtimespec": "2026-01-19T11:51:43.078049000Z", "st_nlink": 1, "st_rdev": 268435483, "st_size": 0, "st_uid": 502 } } } } }, "event_type": 11, "global_seq_num": 59, "mach_time": 4123922685304, "process": { "audit_token": { "asid": 100021, "auid": 502, "egid": 0, "euid": 0, "pid": 65588, "pidversion": 961237, "rgid": 0, "ruid": 0 }, "cdhash": "4FBA9CA99A86160DAD7F4E4EA5193A86A175622C", "codesigning_flags": 570556931, "executable": { "path": "/Users/johndoe/p/playground/posix_spawn_bugreport/posix_spawn", "path_truncated": false, "stat": { "st_atimespec": "2026-01-19T11:51:43.077102595Z", "st_birthtimespec": "2026-01-19T09:56:24.087331226Z", "st_blksize": 4096, "st_blocks": 72, "st_ctimespec": "2026-01-19T09:56:24.087458893Z", "st_dev": 16777231, "st_flags": 0, "st_gen": 0, "st_gid": 20, "st_ino": 73228371, "st_mode": 33261, "st_mtimespec": "2026-01-19T09:56:24.087458893Z", "st_nlink": 1, "st_rdev": 0, "st_size": 34408, "st_uid": 502 } }, "group_id": 65587, "is_es_client": false, "is_platform_binary": false, "original_ppid": 65587, "parent_audit_token": { "asid": 100021, "auid": 502, "egid": 0, "euid": 0, "pid": 65587, "pidversion": 961235, "rgid": 0, "ruid": 502 }, "ppid": 65587, "responsible_audit_token": { "asid": 100021, "auid": 502, "egid": 20, "euid": 502, "pid": 2551, "pidversion": 4671, "rgid": 20, "ruid": 502 }, "session_id": 58457, "signing_id": "posix_spawn", "start_time": "2026-01-19T11:51:42.815925Z", "team_id": null, "tty": { "path": "/dev/ttys027", "path_truncated": false, "stat": { "st_atimespec": "2026-01-19T11:51:42.789563000Z", "st_birthtimespec": "1970-01-01T00:00:00.000000000Z", "st_blksize": 65536, "st_blocks": 0, "st_ctimespec": "2026-01-19T11:51:43.078049000Z", "st_dev": -1270801196, "st_flags": 0, "st_gen": 0, "st_gid": 4, "st_ino": 985, "st_mode": 8592, "st_mtimespec": "2026-01-19T11:51:43.078049000Z", "st_nlink": 1, "st_rdev": 268435483, "st_size": 0, "st_uid": 502 } } }, "schema_version": 1, "seq_num": 10, "thread": { "thread_id": 6142361 }, "time": "2026-01-19T11:51:43.078086547Z", "version": 8 }, { "action": { "result": { "result": { "auth": 0 }, "result_type": 0 } }, "action_type": 1, "event": { "setuid": { "uid": 501 } }, "event_type": 103, "global_seq_num": 60, "mach_time": 4123922685536, "process": { "audit_token": { "asid": 100021, "auid": 502, "egid": 0, "euid": 0, "pid": 65588, "pidversion": 961237, "rgid": 0, "ruid": 0 }, "cdhash": "4FBA9CA99A86160DAD7F4E4EA5193A86A175622C", "codesigning_flags": 570556931, "executable": { "path": "/Users/johndoe/p/playground/posix_spawn_bugreport/posix_spawn", "path_truncated": false, "stat": { "st_atimespec": "2026-01-19T11:51:43.077102595Z", "st_birthtimespec": "2026-01-19T09:56:24.087331226Z", "st_blksize": 4096, "st_blocks": 72, "st_ctimespec": "2026-01-19T09:56:24.087458893Z", "st_dev": 16777231, "st_flags": 0, "st_gen": 0, "st_gid": 20, "st_ino": 73228371, "st_mode": 33261, "st_mtimespec": "2026-01-19T09:56:24.087458893Z", "st_nlink": 1, "st_rdev": 0, "st_size": 34408, "st_uid": 502 } }, "group_id": 65587, "is_es_client": false, "is_platform_binary": false, "original_ppid": 65587, "parent_audit_token": { "asid": 100021, "auid": 502, "egid": 0, "euid": 0, "pid": 65587, "pidversion": 961235, "rgid": 0, "ruid": 502 }, "ppid": 65587, "responsible_audit_token": { "asid": 100021, "auid": 502, "egid": 20, "euid": 502, "pid": 2551, "pidversion": 4671, "rgid": 20, "ruid": 502 }, "session_id": 58457, "signing_id": "posix_spawn", "start_time": "2026-01-19T11:51:42.815925Z", "team_id": null, "tty": { "path": "/dev/ttys027", "path_truncated": false, "stat": { "st_atimespec": "2026-01-19T11:51:42.789563000Z", "st_birthtimespec": "1970-01-01T00:00:00.000000000Z", "st_blksize": 65536, "st_blocks": 0, "st_ctimespec": "2026-01-19T11:51:43.078049000Z", "st_dev": -1270801196, "st_flags": 0, "st_gen": 0, "st_gid": 4, "st_ino": 985, "st_mode": 8592, "st_mtimespec": "2026-01-19T11:51:43.078049000Z", "st_nlink": 1, "st_rdev": 268435483, "st_size": 0, "st_uid": 502 } } }, "schema_version": 1, "seq_num": 4, "thread": { "thread_id": 6142361 }, "time": "2026-01-19T11:51:43.078096214Z", "version": 8 }, { "action": { "result": { "result": { "auth": 0 }, "result_type": 0 } }, "action_type": 1, "event": { "exec": { "args": [ "sleep", "1" ], "cwd": { "path": "/private/tmp/test_dir", "path_truncated": false, "stat": { "st_atimespec": "2026-01-19T10:26:25.243610168Z", "st_birthtimespec": "2026-01-19T10:26:25.243610168Z", "st_blksize": 4096, "st_blocks": 0, "st_ctimespec": "2026-01-19T10:26:25.243692209Z", "st_dev": 16777231, "st_flags": 0, "st_gen": 0, "st_gid": 0, "st_ino": 73232599, "st_mode": 16877, "st_mtimespec": "2026-01-19T10:26:25.243610168Z", "st_nlink": 2, "st_rdev": 0, "st_size": 64, "st_uid": 502 } }, "dyld_exec_path": "/bin/sleep", "env": [ "TERM=xterm-256color", "SSH_AUTH_SOCK=/private/tmp/com.apple.launchd.00QGpZslR8/Listeners", "__CF_USER_TEXT_ENCODING=0x0:0:0", "LSCOLORS=ExFxBxDxCxegedabagacad", "PATH=/Users/johndoe/google-cloud-sdk/bin:/usr/local/bin:/System/Cryptexes/App/usr/bin:/usr/bin:/bin:/usr/sbin:/sbin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/local/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/appleinternal/bin:/Library/Apple/usr/bin:/opt/homebrew/bin:/Applications/iTerm.app/Contents/Resources/utilities:/opt/homebrew/bin:/opt/homebrew/opt/conan@1/bin:/opt/homebrew/opt/ruby/bin:/opt/homebrew/Cellar/binutils/2.44/bin", "LANG=he_IL.UTF-8", "COLORFGBG=15;0", "HOME=/Users/johndoe", "LC_TERMINAL_VERSION=3.6.5", "LC_TERMINAL=iTerm2", "DISPLAY=:0", "LC_TIME=en_US.UTF-8", "COLORTERM=truecolor", "MAIL=/var/mail/root", "LOGNAME=root", "USER=root", "SHELL=/usr/bin/false", "SUDO_COMMAND=/Users/johndoe/p/playground/posix_spawn_bugreport/posix_spawn", "SUDO_USER=johndoe", "SUDO_UID=502", "SUDO_GID=20" ], "fds": [ { "fd": 0, "fdtype": 1 }, { "fd": 1, "fdtype": 1 }, { "fd": 2, "fdtype": 1 } ], "image_cpusubtype": -2147483646, "image_cputype": 16777228, "last_fd": 2, "script": null, "target": { "audit_token": { "asid": 100021, "auid": 502, "egid": 0, "euid": 501, "pid": 65597, "pidversion": 961256, "rgid": 0, "ruid": 501 }, "cdhash": "740CFFD2D37B2487049CD360E1C68A81BC054050", "codesigning_flags": 637606673, "executable": { "path": "/bin/sleep", "path_truncated": false, "stat": { "st_atimespec": "2025-05-04T05:39:22.000000000Z", "st_birthtimespec": "2025-05-04T05:39:22.000000000Z", "st_blksize": 4096, "st_blocks": 24, "st_ctimespec": "2025-05-04T05:39:22.000000000Z", "st_dev": 16777231, "st_flags": 524320, "st_gen": 0, "st_gid": 0, "st_ino": 1152921500312522419, "st_mode": 33261, "st_mtimespec": "2025-05-04T05:39:22.000000000Z", "st_nlink": 1, "st_rdev": 0, "st_size": 101168, "st_uid": 0 } }, "group_id": 65587, "is_es_client": false, "is_platform_binary": true, "original_ppid": 65588, "parent_audit_token": { "asid": 100021, "auid": 502, "egid": 0, "euid": 0, "pid": 65588, "pidversion": 961237, "rgid": 0, "ruid": 0 }, "ppid": 65588, "responsible_audit_token": { "asid": 100021, "auid": 502, "egid": 20, "euid": 502, "pid": 2551, "pidversion": 4671, "rgid": 20, "ruid": 502 }, "session_id": 58457, "signing_id": "com.apple.sleep", "start_time": "2026-01-19T11:51:43.078062Z", "team_id": null, "tty": { "path": "/dev/ttys027", "path_truncated": false, "stat": { "st_atimespec": "2026-01-19T11:51:42.789563000Z", "st_birthtimespec": "1970-01-01T00:00:00.000000000Z", "st_blksize": 65536, "st_blocks": 0, "st_ctimespec": "2026-01-19T11:51:43.078253000Z", "st_dev": -1270801196, "st_flags": 0, "st_gen": 0, "st_gid": 4, "st_ino": 985, "st_mode": 8592, "st_mtimespec": "2026-01-19T11:51:43.078253000Z", "st_nlink": 1, "st_rdev": 268435483, "st_size": 0, "st_uid": 502 } } } } }, "event_type": 9, "global_seq_num": 61, "mach_time": 4123922687348, "process": { "audit_token": { "asid": 100021, "auid": 502, "egid": 0, "euid": 0, "pid": 65597, "pidversion": 961255, "rgid": 0, "ruid": 0 }, "cdhash": "4FBA9CA99A86160DAD7F4E4EA5193A86A175622C", "codesigning_flags": 570556931, "executable": { "path": "/Users/johndoe/p/playground/posix_spawn_bugreport/posix_spawn", "path_truncated": false, "stat": { "st_atimespec": "2026-01-19T11:51:43.077102595Z", "st_birthtimespec": "2026-01-19T09:56:24.087331226Z", "st_blksize": 4096, "st_blocks": 72, "st_ctimespec": "2026-01-19T09:56:24.087458893Z", "st_dev": 16777231, "st_flags": 0, "st_gen": 0, "st_gid": 20, "st_ino": 73228371, "st_mode": 33261, "st_mtimespec": "2026-01-19T09:56:24.087458893Z", "st_nlink": 1, "st_rdev": 0, "st_size": 34408, "st_uid": 502 } }, "group_id": 65587, "is_es_client": false, "is_platform_binary": false, "original_ppid": 65588, "parent_audit_token": { "asid": 100021, "auid": 502, "egid": 0, "euid": 0, "pid": 65588, "pidversion": 961237, "rgid": 0, "ruid": 0 }, "ppid": 65588, "responsible_audit_token": { "asid": 100021, "auid": 502, "egid": 20, "euid": 502, "pid": 2551, "pidversion": 4671, "rgid": 20, "ruid": 502 }, "session_id": 58457, "signing_id": "posix_spawn", "start_time": "2026-01-19T11:51:43.078062Z", "team_id": null, "tty": { "path": "/dev/ttys027", "path_truncated": false, "stat": { "st_atimespec": "2026-01-19T11:51:42.789563000Z", "st_birthtimespec": "1970-01-01T00:00:00.000000000Z", "st_blksize": 65536, "st_blocks": 0, "st_ctimespec": "2026-01-19T11:51:43.078049000Z", "st_dev": -1270801196, "st_flags": 0, "st_gen": 0, "st_gid": 4, "st_ino": 985, "st_mode": 8592, "st_mtimespec": "2026-01-19T11:51:43.078049000Z", "st_nlink": 1, "st_rdev": 268435483, "st_size": 0, "st_uid": 502 } } }, "schema_version": 1, "seq_num": 11, "thread": { "thread_id": 6142361 }, "time": "2026-01-19T11:51:43.078171713Z", "version": 8 }, { "action": { "result": { "result": { "auth": 0 }, "result_type": 0 } }, "action_type": 1, "event": { "exit": { "stat": 0 } }, "event_type": 15, "global_seq_num": 66, "mach_time": 4123946890964, "process": { "audit_token": { "asid": 100021, "auid": 502, "egid": 0, "euid": 501, "pid": 65597, "pidversion": 961256, "rgid": 0, "ruid": 501 }, "cdhash": "740CFFD2D37B2487049CD360E1C68A81BC054050", "codesigning_flags": 637606673, "executable": { "path": "/bin/sleep", "path_truncated": false, "stat": { "st_atimespec": "2025-05-04T05:39:22.000000000Z", "st_birthtimespec": "2025-05-04T05:39:22.000000000Z", "st_blksize": 4096, "st_blocks": 24, "st_ctimespec": "2025-05-04T05:39:22.000000000Z", "st_dev": 16777231, "st_flags": 524320, "st_gen": 0, "st_gid": 0, "st_ino": 1152921500312522419, "st_mode": 33261, "st_mtimespec": "2025-05-04T05:39:22.000000000Z", "st_nlink": 1, "st_rdev": 0, "st_size": 101168, "st_uid": 0 } }, "group_id": 65587, "is_es_client": false, "is_platform_binary": true, "original_ppid": 65588, "parent_audit_token": { "asid": 100021, "auid": 502, "egid": 0, "euid": 0, "pid": 65588, "pidversion": 961237, "rgid": 0, "ruid": 0 }, "ppid": 65588, "responsible_audit_token": { "asid": 100021, "auid": 502, "egid": 20, "euid": 502, "pid": 2551, "pidversion": 4671, "rgid": 20, "ruid": 502 }, "session_id": 58457, "signing_id": "com.apple.sleep", "start_time": "2026-01-19T11:51:43.078062Z", "team_id": null, "tty": { "path": "/dev/ttys027", "path_truncated": false, "stat": { "st_atimespec": "2026-01-19T11:51:42.789563000Z", "st_birthtimespec": "1970-01-01T00:00:00.000000000Z", "st_blksize": 65536, "st_blocks": 0, "st_ctimespec": "2026-01-19T11:51:43.078253000Z", "st_dev": -1270801196, "st_flags": 0, "st_gen": 0, "st_gid": 4, "st_ino": 985, "st_mode": 8592, "st_mtimespec": "2026-01-19T11:51:43.078253000Z", "st_nlink": 1, "st_rdev": 268435483, "st_size": 0, "st_uid": 502 } } }, "schema_version": 1, "seq_num": 9, "thread": { "thread_id": 6142384 }, "time": "2026-01-19T11:51:44.086648776Z", "version": 8 } ]