What is the ___mac_get_pid symbol in a node profile?

Question

I am profiling some multi-process nodejs code run on OSX.

I'm seeing:

[C++]:
   ticks  total  nonlib   name
  23398   63.6%   63.8%  ___mac_get_pid

What is ___mac_get_pid? It's name is certainly suggestive that it's some code that "gets a PID on a Mac", but the time seems excessive.

Googling has provided nothing useful.

Answer 1

__mac_get_pid is the syscall behind mac_get_pid library function. It is described in man page mac_get: http://man.cx/mac_get(3)

mac_get_pid .. get the label of a file, socket, socket peer or process The mac_get_pid() and mac_get_proc() system calls return the process label associated with an arbitrary process ID, or the current process.

Label storage for use with these calls must first be allocated and prepared using the mac_prepare(3) functions. When an application is done using a label, the memory may be returned using mac_free(3).

The "MAC" here is not Mac OS X / macOS, but POSIX.1e's Mandatory Access Control ("was introduced in FreeBSD 5.0 as part of the TrustedBSD Project"). The mac_get_pid is implemented in macOS/Dawrin/XNU as "Extended non-POSIX.1e interfaces".

Possibly there is some methods in used nodejs libraries which try to do detailed work with process lists (like ps/top), but they were unable to limit rate of their requests. Getting several stacktraces with mac_get_pid either with profiler (not v8 profiler which stacktraces only js, but some external profiler attached to nodejs process) or with debugger (gdb/lldb) by manual stopping and checking backtrace until you find who calls mac_get_pid (continue and stop again when you are not in mac_get_pid) is the needed step to find out who did call it.