Geek asks and answers

Linux kernel module signal to user space process killed

I am wondering if there is a hook that can be used in the Linux kernel module that starts when the application / user space process is destroyed?

+5
source share
1 answer

You can first register a notification chain in your kernel module.

Inside get_signal_to_deliver( kernel / signal.c ), any process that has just (the relative term IMHO) has been killed has the PF_SIGNALED flag set . Here you can check the name of the current process using its tcomm field, for example:

char tcomm[sizeof(current->comm)];
get_task_comm(tcomm, current);

, , , , .

+2

More articles:


All Articles