Reading one of Stephen's excellent replies,
When the operating system shuts down, processes are shut down using
SIGKILL, but those signals don’t come from the kernel (or not directly — calling
kill()with a pid of 0 or a negative pid will result in the kernel sending the signal to a number of processes). They come from a service manager terminating its services and from various last-ditch-kill-everything application-mode programs that are part of the system management mechanism: e.g. the
killprocsOpenRC script, and the
When the OS shuts down,
How does a service manager know that it should terminates its services? Is the service manager notified by receiving SIGKILL or SIGTERM or some other signal from the kernel or some process?
Similarly how do various last-ditch-kill-everything application-mode programs that are part of the system management mechanism know that they should send out SIGTERM and SIGKILL?