How to identify a process in C within a Mac Network Kernel Extension (Socket Filter)?
<p>I've developed a Network Kernel Extension (Socket Filter) for Mac OS X that works as a Firewall to block network access for certain Applications.</p>

<p>Here is the simple attach function for the Socket Filter (every time when an application opens a TCP socket):</p>

<pre><code>&lt;!-- language: C --&gt;
static errno_t
filter_attach_fn(void **cookie, socket_t so)
{
    errno_t                 result = 0;
    char                    name[PATH_MAX];

    *cookie = NULL;

    proc_selfname(name, PATH_MAX);
    printf("Filter attaching to process: %s\n", name);

    if (strcmp(name, "Google Chrome") != 0) result = ENOPOLICY; // don't attach to this socket.

    return result;
}
</code></pre>

<p>Right now I'm using proc_selfname. Let's say I want to block all connections from Google Chrome. So I just gonna check if the name var is equal to "Google Chrome" and if so, the filter shall attach. </p>

<p>Later I want to use a socket control to dynamically add application names to a kind of "blocked list".</p>

<p>Is there any better way to identify these applications (expect the process name)? If I check for "Safari" this approach doesn't work, because the name of the process that opens the sockets is named "com.apple.Webkit" and not "Safari". And I'm sure there are more exceptions for other applications.</p>

<p>Is there a way to know that com.apple.Webkit's "root process" is Safari?</p>