Title: Supported launch code requirement with direct posix_spawn and exclusive child reaping on macOS
I'm designing a security-sensitive process-lifecycle controller on Apple silicon macOS.
The controller directly launches a signed foreground executable and must satisfy two requirements:
- Before any child executable code runs, macOS must enforce a launcher-supplied requirement binding the child to approved code, preferably using
LaunchCodeRequirementandCodeDirectoryHash. - The original parent must retain exclusive ownership of the child's terminal status through
waitpid(), with signalling and reaping serialised by one designated execution context.
I understand that Foundation Process.launchRequirement supports launch-time executable constraints, whereas the established lifecycle currently uses direct posix_spawn().
Could Apple DTS clarify:
1. Is there a supported public API for supplying an equivalent launcher-owned code requirement through direct posix_spawn() or its attributes?
2. If Foundation Process is the supported route, can its caller exclusively consume the direct child's terminal status with waitpid() without competing automatic reaping or status consumption by Foundation? Or must callers use Foundation's own termination reporting?
3. If those requirements cannot be combined through one supported interface, is there a recommended public API or launch topology providing both pre-execution code-requirement enforcement and an attributable terminal-status oracle?
I'm seeking supported contractual behaviour, not private implementation details.
This question concerns executable identity and child lifecycle ownership only. It does not assume that process termination establishes containment of descendants, delegated work or pending external operations.
Thank you.