Beyond Ctrl-C: The dark corners of Unix signal handling

[chrsig]

My favorite signal surprise was running nginx and/or httpd in the foreground and wondering why on earth it quit whenver i resized the window.

Turns out, they use SIGWINCH (which is sent on WINdow CHange) for graceful shutdown.

It's a silly, silly problem.

[eadmund]

> Turns out, they use SIGWINCH (which is sent on WINdow CHange) for graceful shutdown.

That’s … that’s even worse than people who send errors with an HTTP 200 response code.

[thayne]

Why? That's what SIGTERM is for.

[ykonstant]

I don't know whether to laugh or cry.

[layer8]

> Another common extension is to use what is sometimes called a double Ctrl-C pattern. The first time the user hits Ctrl-C, you attempt to shut down the database cleanly, but the second time you encounter it, you give up and exit immediately.

This is a terrible behavior, because users tend to hit Ctrl-C multiple times without intending anything different than on a single hit (not to mention bouncing key mechanics and short key repeat delays). Unclean exits should be reserved for SIGQUIT (Ctrl-\) and SIGKILL (by definition).

[tripdout]

If you don't know about it, sure, but I find it's kind of convenient to get a safe shutdown and then be able to easily say "I don't care, just stop this program" without needing a separate kill -9 command or something.

[bonzini]

In the Meson build system's test harness, a single Ctrl-C terminates the longest running test with a SIGTERM; while three Ctrl-C in a second interrupt the whole run as if you sent the harness a SIGTERM. This was done because it's not uncommon that there are hundreds of tests left to run and you have seen what you want, and it's useful to have an intuitive shortcut for that case.

However, in both cases it's a clean shutdown, all running are terminated and the test report is printed.

[jcelerier]

> Unclean exits should be reserved for SIGQUIT (Ctrl-\) and SIGKILL (by definition).

I don't know how it works on your keyboard but on french layout, Ctrl-\ is a two-hands, three-fingers, very unpleasant on the wrist, keyboard shortcut. Not a chance I'd use that for such a common operation.

[marcosdumay]

It's worse, because there are languages that encode interruption into the error handling functionality, so it's common that people mismanage their errors and programs require several Ctrl-C presses to actually reach the interruption handler.

What means that you have to memorize a list of "oh, this program needs Ctrl-C 3 times; oh, this program must only receive Ctrl-C once!"... I don't know of any "oh, this program needs Ctrl-C exactly 2 times", but it's an annoying possibility.

[bcrl]

That shouldn't matter. Your database should be consistent in the face of an unclean exit. ACID has been around for a long time.

[Levitating]

They can print a message that states that it is attempting to quit cleanly but can be forced to quit by pressing Ctrl+C another time(s). Unison does this.

[sunshowers]

While I agree in spirit, I also want to meet users where they are.

[cperciva]

The article doesn't mention the most useful of all signals: SIGINFO, aka "please print to stderr your current status". Very useful for tools like dd and tar.

Probably because Linux doesn't implement it. Worst mistake Linus ever made.

Also, it talks about self-pipe but doesn't mention that self-socket is much better since you can't select on a pipe.

[epcoa]

> self-socket is much better since you can't select on a pipe.

This needs further explanation. Why can’t you select on a pipe? You certainly can use select/poll on pipes in general and I’m not sure of any reason in particular they won’t work for the self pipe notification.

Its even right in the original: https://cr.yp.to/docs/selfpipe.html

[sunshowers]

Thanks for the feedback! As the talk and the post both mentioned, I was focusing on signals that work on all Unix platforms. Within the constraints of a 30 minute talk there must be material left on the cutting room floor. (If I started talking about the specifics of various Unix lineages I could fill up a whole day...)

For most users in the real world, self-pipes are sufficient. This includes mio (Tokio's underlying library)'s portable Unix implementation of wakers (how parts of the system tell other parts to wake up).

[avidiax]

SIGSTOP and SIGCONT are very useful as well.

SIGSTOP is the equivalent of Ctrl-Z in a shell, but you can address it to any process. If you have a server being bogged down, you can stop the offending process temporarily.

SIGCONT undoes SIGSTOP.

The cpulimit tool does this in an automated way so that a process can be limited to use x% of CPU. Nice/renice doesn't keep your CPU from hitting 100% even with an idle priority process, which may be undesirable if it drains battery quickly or makes the cooling fan loud.

[fragmede]

dd prints out status when sent SIGUSR1, but yeah that would be cool if other utilities did that as well off SIGINFO.

[efxhoy]

I recently wrote a little data transfer service in python that runs in ECS. When developing it locally it was easy to handle SIGINT: try write a batch, except KeyboardInterrupt, if caught mark the transfer as incomplete and finally commit the change and shut down.

But there’s no exception in python to catch for a SIGTERM, which is what ECS and other service mangers send when it’s time to shut down. So I had to add a signal handler. Would have been neat if SIGTERM could be caught like SIGINT with a “native” exception.

[mananaysiempre]

  from signal import SIGTERM, raise_signal, signal
  import sys # for excepthook
  class Terminate(BaseException):
      pass
  def _excepthook(type, value, traceback):
      if not issubclass(type, Terminate):
          return _prevhook(type, value, traceback)
      # If a Terminate went unhandled, make sure we are killed
      # by SIGTERM as far as wait(2) and friends are concerned.
      signal(SIGTERM, _prevterm)
      raise_signal(SIGTERM)
  _prevhook, sys.excepthook = sys.excepthook, _excepthook
  def terminate(signo=SIGTERM, frame=None):
      signal(SIGTERM, _prevterm)
      raise Terminate
  _prevterm = signal(SIGTERM, terminate)

[Spivak]

I mean you can just have the signal handler throw StopRequested in your Python boilerplate and never think about it again.

One common pattern is raising KeyboardInterrupt from your handler so it's all handled the same.