I'm looking forward to build my first linux device driver and it's goal is to detect when a combination of keys is pressed, such as CTRL + ALT and then receive a number, such as 103, that should correspond to the PID of some process. It should then kill this process.

The questions I have: How can I detect such combination of keys? How can I kill a process in kernel space?

Thanks everyone!

  • 1
    That's not a "device driver" - you're trying to make a kernel module to be sure, but it's purpose is not that of driving a device. Nov 27, 2016 at 4:33
  • 2
    It seems like this would be better done in userspace.
    – Celada
    Nov 27, 2016 at 5:51
  • @Celada To be able to bypass whatever libraries the applications might use, the key event interception must be done at a lower level. If not done in the kernel, that would be in the X11 server but then the key combination won't work in console mode. So you'll need multiple handlers.
    – jlliagre
    Nov 27, 2016 at 12:51
  • @DepressedDaniel A keyboard is a device and handling it is already done by a device driver, the tty one.
    – jlliagre
    Nov 27, 2016 at 12:53
  • @jlliagre I was thinking of a daemon that watches /dev/input/somekeyboard and then sends the appropriate signal. If the daemon runs as root it's no more or less immune to "bypass" than a kernel module, but a lot simpler to do.
    – Celada
    Nov 27, 2016 at 12:54

1 Answer 1


Instead of starting from scratch , I would suggest you to slightly modify the specs and implement it as a custom extension to the sysreq feature provided by the tty driver.

There is already a similar but more severe functionality, AltPrintScreeni, which kills all processes but the init one.

As documented is the first link I posted, you can register your own extensions by providing a sysrq_key_op structure to the register_sysrq_key function.

Have also a look to the send_sig_all function which it uses to get an example on how to kill userland processes from the kernel.

Here is an example explaining how to build such an extension.

The main part that is missing is to intercept the user input while the PID number is entered.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .