I have an application that leverages endpoint security which runs a launchd service. It protects itself from user termination by intercepting signals addresses to the daemon and only allowing a whitelisted group of processes (including launchd) send signals. Launchd is set to keep the process alive. When I shut down the machine, I get a long hang similar to when an endpoint application is deadlocked on when processing an event who causes an auth event to be created for the target process. There is nothing interesting to speak of in the unified logs. I suspect I might be shutting down the endpoint framework in the wrong order or something when I intercept the signals delivered by the system shutdown. I have tried various combinations of allowing and denying the kill-my-daemon signal from launchd (I never do see the sigterm, but I do see the sigkill) with varying levels of pauses and hangs, but I only get a quick shutdown on a few occasions. I do mute notifications for my daemon so as to not deadlock myself. I’m thinking there is a better way to appproach this problem, but the method escapes me. How to best have my process protect itself from users terminating it while still having the os shut down quickly without getting locked waiting on notifications to expire for a killed process... I very much appreciate the community’s insights. These are some interesting problems caused by doing this work in user space!!!
