Skip to content

Instantly share code, notes, and snippets.

@hazcod
Created June 13, 2026 11:16
Show Gist options
  • Select an option

  • Save hazcod/340cd82f3ed8bec9a666eb367a8ec4b1 to your computer and use it in GitHub Desktop.

Select an option

Save hazcod/340cd82f3ed8bec9a666eb367a8ec4b1 to your computer and use it in GitHub Desktop.
List of processes using or not using MTE.
Currently running processes with MIE/checked-allocation entitlement on your host included:
/usr/libexec/UserEventAgent
/usr/libexec/coreduetd
/usr/libexec/locationd
/usr/libexec/mobileassetd
/usr/libexec/secd
/usr/libexec/captiveagent
/usr/libexec/findmydeviced
/usr/libexec/spotlightknowledged.updater
/usr/sbin/coreaudiod
/System/Library/CoreServices/TimeMachine/backupd
/System/Library/CoreServices/Spotlight.app/.../Spotlight
/System/Library/Frameworks/Accounts.framework/.../accountsd
/System/Library/Frameworks/Contacts.framework/.../contactsd
/System/Library/Frameworks/CoreSpotlight.framework/spotlightknowledged
/System/Library/Frameworks/.../corespotlightd
/System/Library/Frameworks/Security.framework/.../TrustedPeersHelper.xpc
/System/Library/Frameworks/VideoToolbox.framework/.../VTDecoderXPCService
/System/Library/Frameworks/WebKit.framework/.../WebContent.EnhancedSecurity.xpc
/System/Library/PrivateFrameworks/AppStoreDaemon.framework/.../appstoreagent
/System/Library/PrivateFrameworks/AppStoreDaemon.framework/.../StorePrivilegedTaskService.xpc
/System/Library/PrivateFrameworks/CloudServices.framework/.../com.apple.sbd
/System/Library/PrivateFrameworks/CoreDuetContext.framework/.../contextstored
/System/Library/PrivateFrameworks/ManagedAppDistribution.framework/.../managedappdistributiond
/System/Library/PrivateFrameworks/MobileAssetDaemon.framework/.../DownloadService.Builtin.xpc
/System/Library/PrivateFrameworks/VoiceShortcuts.framework/.../siriactionsd
/System/Library/PrivateFrameworks/WorkflowKit.framework/.../BackgroundShortcutRunner.xpc
Notable running system processes without that entitlement:
/sbin/launchd
/usr/libexec/amfid
/usr/libexec/configd
/usr/libexec/sandboxd
/usr/libexec/tccd
/usr/libexec/trustd
/usr/libexec/watchdogd
/usr/libexec/xprotectd
/usr/sbin/securityd
/usr/sbin/bluetoothd
/System/Library/PrivateFrameworks/SkyLight.framework/.../WindowServer
/System/Library/CoreServices/Finder.app/.../Finder
/System/Library/CoreServices/Dock.app/.../Dock
/System/Library/CoreServices/loginwindow.app/.../loginwindow
/System/Library/Frameworks/CoreServices.framework/.../mds
/System/Library/Frameworks/CoreServices.framework/.../mdworker_shared
/System/Library/Frameworks/QuickLookThumbnailing.framework/.../com.apple.quicklook.ThumbnailsAgent
/System/Library/Frameworks/QuickLookUI.framework/.../QuickLookUIService.xpc
/System/Library/Frameworks/Metal.framework/.../MTLCompilerService.xpc
/System/Library/Frameworks/WebKit.framework/.../WebKit.GPU.xpc
/System/Library/Frameworks/WebKit.framework/.../WebKit.Networking.xpc
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment