Unkillable processes

[Steven Bellovin]

> > I have seen several times in the past years, processes which cannot
> > be killed on UNIX. I have been told that one of two things can be
> > happening. One, the process is waiting on a non-existant wait channel, or
> > two, the process is running with a negative priority level.
> 
> A process sleep()ing with a lower (more attractive) priority than the constant
> PZERO ignores signals, and cannot be awakened other than with a wakeup() call.
> Since kill()ing a process involves sending it a signal, a process is unkillable
> if it is sleeping below PZERO.  There are several places in most Unix kernels
> where a process will sleep like this.
> 
> The solution:
> 
> 	(1) Trick the process into waking up somehow.
> 	(2) Use adb on /dev/kmem to change the priority to (PZERO + 1)
> 
> Once the process is running or has a higher (less attractive) priority than
> PZERO, it will obey a number nine.  Bear in mind that if a process is sleeping
> below PZERO there is probably a reason for it, and kludging it awake may
> make your kernel nauseous.

Another common cause of unkillable processes is a device close routine.  When
a process dies, exit() (in the kernel) tries to close all open file descriptors.
If the close routine is waiting for something that will never take place --
and tty drivers are notorious for this -- then the process can't exit.  All
signals, including signal 9, are ignored by this point, but that doesn't really
matter much, since even if you did kill the process it would just recurse through
exit() and call the close routine again...