you are viewing a single comment's thread
view the rest of the comments
[–] 11 points 4 months ago

It's not. They both expose a POSIX API and userspace, but the underlying architecture is very different. macOS is in part based on the Mach microkernel, and creating a process has a bunch of work related to that.

Even ignoring that difference, macOS has built-in signature checking that suspends a newly-started process the first time its executable is seen.

  • source
  • parent