launchd Mastery: The Real init System of macOS

Every process on macOS starts here. From the first kext loaded at boot to the last login item registered when a user opens a session, launchd is the supervisor — a single daemon that replaced init, cron, and xinetd in one stroke and has remained the anchor of the platform for two decades. This book walks launchd from the domain model down to the byte-level plist format. It covers how jobs are bootstrapped into system, user, gui, session, and pid domains; how triggers decide when a job runs; how XPC services use Mach ports registered with launchd to build modern macOS application architectures; and how SMAppService replaced direct plist installation in macOS 13 and later. From there it moves into debugging — reading the unified log, interpreting launchctl print output, diagnosing crash loops — and into security: the ownership checks that prevent plist injection, the code-signature validation that protects Mach services, and the persistence mechanisms malware exploits. Real commands throughout: launchctl bootstrap, bootout, kickstart, print, enable, disable, blame, dumpstate, plus plutil, log show, and log stream with working predicates. Written for macOS developers, systems administrators, security engineers, and anyone who has ever typed launchctl load and wondered what it actually did.