Signaling from within: how eBPF interacts with signals

This publication examines the behavior and side effects of sending SIGKILL from within eBPF programs as a security control, showing that signals are processed after system calls and can allow operations (like file creation or writes) to partially complete before termination. Through experiments on open/write flows across filesystems (Btrfs, ext4, tmpfs, XFS), it demonstrates that some filesystems voluntarily abort when a fatal signal is pending, while Btrfs often completes I/O, enabling a race to write despite early SIGKILL. The authors conclude that using SIGKILL from eBPF is context- and filesystem-dependent and cannot be relied upon to block certain operations consistently.