Linux kernel module signal on userspace process killed

Question

I'm wondering if there is a hook that could be used in a Linux Kernel Module that is fired when a user space application/process is killed ?

Answer 1

You could first register for a notifier chain within your kernel module.

Inside get_signal_to_deliver(kernel/signal.c), any process which has just (this being a relative term IMHO) been killed has its PF_SIGNALED flag being set. Here you could check for the name of the current process using its tcomm field like so:

char tcomm[sizeof(current->comm)];
get_task_comm(tcomm, current);

If it is indeed the process under question, you could just fire the notification chain which will awaken your module which has been waiting on that chain.