Kernel sends SIGKILL to process which is subscribed on ES_EVENT_TYPE_AUTH_OPEN

The kernel sends SIGKILL to application if it handles ES_EVENT_TYPE_AUTH_OPEN and lldb is attached to this process.

App:

int main(int /*argc*/, char** /*argv*/)
{
    es_client_t *pEpClient = nullptr;

    es_new_client_result_t result = es_new_client(&pEpClient, ^(es_client_t *pClient, const es_message_t *pMessage)
    {
        switch (pMessage->event_type)
        {
            case ES_EVENT_TYPE_AUTH_OPEN:
            {
                uint32_t authorizedFlags = pMessage->event.open.fflag;

                if ((authorizedFlags & FREAD) || (authorizedFlags & FWRITE))
                {
                    std::filesystem::path filePath = std::string(pMessage->event.open.file->path.data, pMessage->event.open.file->path.length);

                    std::string fileName = filePath.filename();

                    if (fileName == "test.txt")
                    {
                        std::cout << "blocked fileName: " << filePath.filename() << std::endl;

                        authorizedFlags &= ~FWRITE;
                        authorizedFlags &= ~FREAD;
                    }
                }

                if (es_respond_flags_result(pClient, pMessage, authorizedFlags, false) != ES_RESPOND_RESULT_SUCCESS)
                {
                    std::cout << "es_respond_flags_result() failed with error " << std::endl;
                }
            }
                break;
            default:
                break;
        }

    });

    if (result != ES_NEW_CLIENT_RESULT_SUCCESS)
    {
        std::cout << "es_new_client() failed." << std::endl;
        return 1;
    }

    es_event_type_t eventsList[] =
    {
        ES_EVENT_TYPE_AUTH_OPEN
    };

    if (es_subscribe(pEpClient, eventsList, 1) == ES_RETURN_ERROR)
    {
        std::cout << "es_subscribe() failed." << std::endl;
    }

    // wait
    int i = 0;
    std::cin >> i;

    if (es_delete_client(pEpClient) == ES_RETURN_ERROR)
    {
        std::cout << "es_delete_client() failed." << std::endl;
    }

    return 0;
}

(lldb) process attach --pid 61127 .... (lldb) c

Process 61127 resuming
Process 61127 exited with status = 9 (0x00000009) Terminated due to signal 9

System log:

Allowing set_exception_ports from [debugserver] on [ep_sample] for entitled process/debugger
Client did not respond in appropriate amount of time (client pid: 61127), sent SIGKILL