POSIX Process Signals

Signals are the UNIX mechanism for asynchronous process notification. The POSIX standard defines a fixed set; the three that matter most in day-to-day operations are:

Signal	Default action	Meaning
SIGTERM	Terminate	Polite kill — the process may catch it and clean up before exiting
SIGKILL	Terminate	Force kill — cannot be caught, blocked, or ignored; no cleanup possible
SIGSTOP	Stop	Suspend execution — cannot be caught or ignored; resume with SIGCONT

The rest of the core set

• SIGHUP — terminal hangup or controlling process death; daemons often reload config on SIGHUP.
• SIGINT — interrupt from keyboard (Ctrl+C).
• SIGQUIT — quit from keyboard (Ctrl+), produces a core dump.
• SIGCHLD — child process terminated; the parent must wait() to reap zombies.

Sending signals

kill -TERM $PID    # polite termination
kill -9 $PID       # SIGKILL — last resort
kill -STOP $PID    # suspend
kill -CONT $PID    # resume

Security relevance

• SIGKILL leaves no cleanup: temp files, shared memory segments, and half-written logs remain. During incident response, that can be a feature (preserves evidence) or a bug (leaves the system dirty).
• Signal handling is a common vulnerability class: race conditions in signal handlers have caused CVEs in everything from bash (Shellshock era) to sshd.
• Process hiding: Attackers sometimes SIGSTOP their own tools to make them invisible to naive ps checks, then SIGCONT them when needed.

Related

• ps — inspecting processes before you signal them
• shell-stabilization — reverse shells often need signal-handling tricks to survive terminal closure

Sources

• signal(7) — Linux manual page
• POSIX <signal.h> — The Open Group Base Specifications Issue 7