What are Linux signals and what are they used for?
A signal is a software interrupt the kernel delivers to a process to tell it an event happened — like Ctrl+C, a kill, or a segfault.
Signals are the standard, lightweight way to nudge a running process asynchronously. The process doesn't have to be checking anything — the kernel interrupts it, runs the matching action, then (usually) lets it continue. They're how the outside world "talks to" a process that has no other interface.
Where signals come from:
- keyboard shortcuts in the terminal (Ctrl+C → SIGINT, Ctrl+Z → SIGTSTP)
- the
kill/killall/pkillcommands - the kernel itself (a segfault sends SIGSEGV, a timer sends SIGALRM)
- other processes (with permission)
Each signal has a default action if the process does nothing special:
- Term — terminate
- Core — terminate and write a core dump (for debugging)
- Stop — suspend (pause)
- Cont — resume a stopped process
- Ignore — do nothing
What a process may do with a signal: install a handler (run custom code — e.g. SIGHUP often means "re-read my config"), let the default happen, or ignore it. The two exceptions are SIGKILL (9) and SIGSTOP (19): these can't be caught, handled, or ignored, which guarantees the kernel always has a way to forcibly stop or pause any process.
Tip: Signals are a one-way notification, not a message channel — the only "content" is which signal it is.
Go deeper:
signal(7) man page (man7.org) — the signal table with default actions and the uncatchable SIGKILL/SIGSTOP rule.- Signal (IPC) (Wikipedia) — how handlers are installed and what async-signal-safe means.