33

Between the recent "Why does 'kill -9 0' end my console session" and "How to get a kernel panic" questions, I got a bur under my saddle and tried kill -9 1 on a mostly up-to-date Arch linux laptop. I did it as user ID "root".

I fully expected some kind of crash or panic or shutdown, but nothing happened. I did kill -9 1 again, to no effect.

Arch linux machines run systemd these days, so: how does systemd survive a kill -9? I expect there's special case code in the Linux 3.7 kernel, but maybe some other reason exists that I haven't thought of.

What about other things that run with PID 1? Slackware still uses init I believe, but I'm scared to try it on my production Slackware server. DD-WRT on my wireless router runs /sbin/init of some sort.

Gilles 'SO- stop being evil'
  • 829,060

1 Answers1

40

From man 2 kill:

The only signals that can be sent to process ID 1, the init process, are those for which init has explicitly installed signal handlers. This is done to assure the system is not brought down accidentally.

That is, it is possible for init to do whatever it likes upon receiving SIGKILL (including exiting), but systemd's init does not install any signal handler for it, so nothing happens.

Chris Down
  • 125,559
  • 25
  • 270
  • 266
  • 5
    Thanks for noting that. Is this Linux specific? I seem to remember crashing a SunOS workstation back in the early 90s by killing init by mistake. Or not. I was a lot more reckless in my youth. –  Mar 03 '13 at 17:04
  • 1
    @BruceEdiger, I too seem to remember being able to kill -9 init and induce a kernel panic. Sounds like it changed at some point. – psusi Mar 04 '13 at 02:31
  • 3
    @BruceEdiger - I tried it for an AIX server and an HP-UX one. Both returned an error message: kill: 1: 0403-068 The signal is invalid for this process OR kill: 1: The specified process does not exist. The man page specifically mentioned that this will return an error. I am told by a number of people that this could be done previously - but no one has succeeded in the past 10+ years. –  Mar 04 '13 at 06:58
  • 3
    @BruceEdiger It seems from some searching that this is a recent (at least, in terms of Unix lifespan) development. Unfortunately I wasn't alive in the early 90's, so when it happened is out of my scope of knowledge. It would be interesting to find out, though, as it seems that almost all modern Unices have changed to default to this behaviour. – Chris Down Mar 04 '13 at 08:49