What is the iOS process model, and what can an app process not do?

6.1.1 · L3 · Interview

Predict first

Can an iOS app start a child process with fork?

// A: yes, like on a Mac
// B: no, the sandbox forbids it
  • A
  • B

Mental model. Each app is a tenant in a building with a doorman. The tenant can do anything inside the flat, but every request for shared services goes through the front desk.

Each app runs as its own process with a private virtual address space, started by the system (via launchd and the runtime that supervises apps) when the user opens it or an event wakes it. Frameworks load into that process; system services (notifications, the keychain, network transfers, Photos, Contacts) live in other processes that the app reaches through XPC or system frameworks. Each app extension is a separate process too, so a share sheet or a widget never shares memory with its host app.

Two kernel mechanisms constrain the process before it runs a line of code. Code signing means every executable page must be signed and checked when loaded, so an app cannot download and run new native code or create writable-executable memory without a special entitlement. The sandbox gives each process a profile that limits which files, services and system calls it may use. The practical consequences: no fork or launching other processes, no reading another app’s data, and access to system capabilities only through the frameworks that broker them, with the user’s consent where needed.

The sandbox profile does not allow creating new processes. Concurrency inside an app uses threads and system services.

Common traps

  • Assuming an extension can read the app’s memory or globals. It is another process; share data through an app group or a service.
  • Expecting to spawn helper processes. The sandbox forbids it, so use threads, XPC services (on macOS) or system-provided background mechanisms.

They might follow up with

  • Why can’t an app generate and run machine code? The kernel only runs signed pages. A just-in-time compiler needs a specific entitlement that few apps get.
  • What enforces all this? The kernel’s mandatory access control and the code-signing checks, not your app’s own code.

Related questions

  • 6.1.2 What is the app container, and why must you never persist an absolute path?
  • 6.1.3 What are entitlements, and what happens when they do not match the provisioning profile?
  • 6.8.3 Why is an app extension a separate process, and what does that mean for how you build it?

What is the app container, and why must you never persist an absolute… →