> This reminds me, it is still not clear what should we actually do when the > killed tracee calls tracehook_report_exit(), but this is another story.
Indeed it is. Currently old ptrace will stop for exit tracing after processing the SIGKILL. Then you can send it another SIGKILL to wake it up to die quicker, or it should always resume if you kill the tracer. (I think that is considered necessary for "one SIGKILL to everybody" always being sufficient on shutdown.) So for now we should match that. IMHO the truly desireable behavior is to distinguish real SIGKILL (userland kill, oom_kill) from "normal" group-exit. When it's a real SIGKILL that has special urgent priority: no tracing can save you, you die ASAP. For other group-exit deaths, exit tracing et al should work normally. But this seems like a clean refinement we can do after merge. Thanks, Roland
