An unidentified process on macOS periodically creates an empty temporary file in my Downloads folder but doesn't remove it later
I managed to figure out that immediate culprit is mktemp, but I want to understand which process calls it
I figure that I can use $ lldb > process attach -name mktemp -watifor to attach to mktemp when it's being launched, but can't figure out how to know who called it in first place
Is there any solution whether with or without lldb to know it?
That's actually a little trickier than you might think.
You can find the parent process of a given process on macOS easily by running ps -j <PID> though Terminal. The parent pid is the third column in the output. Or Activity Monitor has a hierarchical display that shows these relationships graphically.
lldb prints the pid of the process it is attaching to when it attaches, or you can find it in the output of the lldb command target list. So that's easy to find...
However, for technical reasons, when the debugger attaches to a process that process gets "reparented" by the kernel to the debugger. So if you ask a process running under lldb who its parent process is, the answer will always be "debugserver" - which is lldb's debugger stub. And there isn't an easy way to see what the original parent was.
I got this to work, though this is a bit of a hack. You want to suspend the process you are debugging so it doesn't exit on you, then detach from it so it gets reparented back to the real parent. So:
(lldb) expr (void) task_suspend((void *)mach_task_self())
Since that suspended the task before returning, the command won't actually complete. So
Use ^C in the lldb console to interrupt the expression evaluation. The target process is already suspended so this will just cancel the task_suspend return code.
Now detach:
(lldb) detach
When you do that the mktemp process will be reparented by the system back to its original parent,
ps -j in Terminal and find the process you are looking for, and it will be the original parent.If you need to get the process running again, attach to it with lldb again and call task_resume with the same arguments as you called task_suspend above.