BSD syscall#37
svc · unix #37
kill
Sends a signal to a process or process group identified by PID.
Prototype
int kill(int pid, int signum, int posix);Returns: int
Arguments
| Name | Type | Dir | Description |
|---|---|---|---|
| pid | int | - | |
| signum | int | - | |
| posix | int | - |
Version history
| XNU tag | macOS | # |
|---|---|---|
| xnu-1456.1.26 | macOS 10.6 Snow Leopard | 37 |
| xnu-1486.2.11 | — | 37 |
| xnu-1504.15.3 | — | 37 |
| xnu-1504.3.12 | — | 37 |
| xnu-1504.7.4 | — | 37 |
| xnu-1504.9.17 | — | 37 |
| xnu-1504.9.26 | — | 37 |
| xnu-1504.9.37 | — | 37 |
Notes
Permission checks compare the sender's effective/real UID against the target's saved-set UID, with root bypassing the check. PID 0 targets the caller's process group, -1 broadcasts to every permitted process, and negative PIDs address an explicit pgid. Sending signal 0 performs only the permission and existence check, which is the standard way to probe whether a PID is alive.
Detection
Endpoint Security exposes ES_EVENT_TYPE_NOTIFY_SIGNAL with sender, target, and signal number. DTrace proc:::signal-send shows args[0]=target proc, args[2]=signal.
Related APIs
sigactionsigprocmasksigsuspend__sigwaitwaitid