I have 2 EndpointSecurity apps. App1 is doing the heavy lifting and processes multiple events(ES_EVENT_TYPE_AUTH_EXEC, ES_EVENT_TYPE_AUTH_OPEN, ES_EVENT_TYPE_AUTH_RENAME, ES_EVENT_TYPE_AUTH_UNLINK, ES_EVENT_TYPE_NOTIFY_CLOSE, ES_EVENT_TYPE_NOTIFY_CREATE ). App2 is responsible for checking whether Full Disk Access is granted or not: int main(int argc, char * argv[]) { ttes_client_t *client; auto res = es_new_client(&client, ^(es_client_t *clt, const es_message_t *msg) { }); tt_exit(res == ES_NEW_CLIENT_RESULT_ERR_NOT_PERMITTED ? 0 : 1); } (please note that none of the apps is a System Extension). Sometimes when App1 is runing and App2 executes, the system hangs. After few days of investigation, it seems that starting a new es client (even without registering any messages) causes the system to block all operations until all the currently pending auth requests from other clients are answered. This makes it very hard to reason about the application. It also requires to basically offload everything to
0
0
466