What causes various signals to be sent?

Question

I sometimes get a little confused by all of the signals that an application can receive. As I understand it, an application has a default handler for each of these signals, but it can provide its own handler by calling sigaction().

So here is my question: what causes each of the signals to be sent? I realize that you can manually send signals to running applications via the -s parameter to kill, but what are the natural circumstances under which these signals are sent? For example, when does SIGINT get sent?

Also, are there any restrictions on which signals can be handled? Can even SIGSEGV signals be processed and control returned to the application?

Answer 1

In addition to processes calling kill(2), some signals are sent by the kernel (or sometimes by the process itself) in various circumstances:

• Terminal drivers send signals corresponding to various events:
  • Key press notifications: SIGINT (please go back to the main loop) on Ctrl+C, SIGQUIT (please quit immediately) on Ctrl+\, SIGTSTP (please suspend) on Ctrl+Z. The keys can be changed with the stty command.
  • SIGTTIN and SIGTTOU are sent when a background process tries to read or write to its controlling terminal.
  • SIGWINCH is sent to signal that the size of the terminal window has changed.
  • SIGHUP is sent to signal that the terminal has disappeared (historically because your modem had hung up, nowadays usually because you've closed the terminal emulator window).
• Some processor traps can generate a signal. The details are architecture and system dependent; here are typical examples:
  • SIGBUS for an unaligned access memory;
  • SIGSEGV for an access to an unmapped page;
  • SIGILL for an illegal instruction (bad opcode);
  • SIGFPE for a floating-point instruction with bad arguments (e.g. sqrt(-1)).
• A number of signals notify the target process that some system event has occured:
  • SIGALRM notifies that a timer set by the process has expired. Timers can be set with alarm, setitimer and others.
  • SIGCHLD notifies a process that one of its children has died.
  • SIGPIPE is generated when a process tries to write to a pipe when the reading end has been closed (the idea is that if you run foo | bar and bar exits, foo gets killed by a SIGPIPE).
  • SIGPOLL (also called SIGIO) notifies the process that a pollable event has occured. POSIX specifies pollable events registered through the I_SETSIG ioctl. Many systems allow pollable events on any file descriptor, set via the O_ASYNC fcntl flag. A related signal is SIGURG, which notifies of urgent data on a device (registered via the I_SETSIG ioctl) or socket.
  • On some systems, SIGPWR is sent to all processes when the UPS signals that a power failure is imminent.

These lists are not exhaustive. Standard signals are defined in signal.h.

Most signals can be caught and handled (or ignored) by the application. The only two portable signals that cannot be caught are SIGKILL (just die) and STOP (stop execution).

SIGSEGV (segmentation fault) and its cousin SIGBUS (bus error) can be caught, but it's a bad idea unless you really know what you're doing. A common application for catching them is printing a stack trace or other debug information. A more advanced application is to implement some kind of in-process memory management, or to trap bad instructions in virtual machine engines.

Finally, let me mention something that isn't a signal. When you press Ctrl+D at the beginning of a line in a program that's reading input from the terminal, this tells the program that the end of the input file is reached. This isn't a signal: it's transmitted via the input/output API. Like Ctrl+C and friends, the key can be configured with stty.

Answer 2

To answer your second question first: SIGSTOP and SIGKILL cannot be caught by the application, but every other signal can, even SIGSEGV. This property is useful for debugging -- for instance, with the right library support, you could listen for SIGSEGV and generate a stack backtrace to show just where that segfault happened.

The official word (for Linux, anyway) on what each signal does is available by typing man 7 signal from a Linux command line. http://linux.die.net/man/7/signal has the same information, but the tables are harder to read.

However, without some experience with signals, it's hard to know from the short descriptions what they do in practice, so here's my interpretation:

Triggered from the keyboard

• SIGINT happens when you hit CTRL+C.
• SIGQUIT is triggered by CTRL+\, and dumps core.
• SIGTSTP suspends your program when you hit CTRL+Z. Unlike SIGSTOP, it is catchable, which gives programs like vi a chance to reset the terminal to a safe state before suspending themselves.

Terminal interactions

• SIGHUP ("hangup") is what happens when you close your xterm (or otherwise disconnect the terminal) while your program is running.
• SIGTTIN and SIGTTOU pause your program if it tries to read from or write to the terminal while it's running in the background. For SIGTTOU to happen, I think the program needs to be writing to /dev/tty, not just default stdout.

Triggered by a CPU exception

These mean your program tried to do something wrong.

• SIGILL means an illegal or unknown processor instruction. This might happen if you tried to access processor I/O ports directly, for example.
• SIGFPE means there was a hardware math error; most likely the program tried to divide by zero.
• SIGSEGV means your program tried to access an unmapped region of memory.
• SIGBUS means the program accessed memory incorrectly in some other way; I won't go into details for this summary.

Process interaction

• SIGPIPE happens if you try to write to a pipe after the pipe's reader closed their end. See man 7 pipe.
• SIGCHLD happens when a child process you created either quits or is suspended (by SIGSTOP or similar).

Useful for self-signaling

• SIGABRT is usually caused by the program calling the abort() function, and causes a core dump by default. Sort of a "panic button".
• SIGALRM is caused by the alarm() system call, which will cause the kernel to deliver a SIGALRM to the program after a specified number of seconds. See man 2 alarm and man 2 sleep.
• SIGUSR1 and SIGUSR2 are used however the program likes. They could be useful for signaling between processes.

Sent by the administrator

These signals are usually sent from the command prompt, via the kill command, or fg or bg in the case of SIGCONT.

• SIGKILL and SIGSTOP are the unblockable signals. The first always terminates the process immediately; the second suspends the process.
• SIGCONT resumes a suspended process.
• SIGTERM is a catchable version of SIGKILL.