CertC-POS44

Do not use signals to terminate threads

Required inputs: IR

Do not send an uncaught signal to kill a thread because the signal kills the entire process, not just the individual thread. This rule is a specific instance of SIG02-C. Avoid using signals to implement normal functionality.

In POSIX systems, using the signal() function in a multithreaded program falls under exception CON37C-C-EX0 of rule  CON37-C. Do not call signal() in a multithreaded program.

Noncompliant Code Example

This code uses the  pthread_kill() function to send a  SIGTERM signal to the created thread. The thread receives the signal, and the entire process is terminated.

void func(void *foo) {
  /* Execution of thread */
}

int main(void) {
  int result;
  pthread_t thread;

  if ((result = pthread_create(&thread, NULL, func, 0)) != 0) {
    /* Handle Error */
  }
  if ((result = pthread_kill(thread, SIGTERM)) != 0) {
    /* Handle Error */
  }

  /* This point is not reached because the process terminates in pthread_kill() */

  return 0;
}

Compliant Solution

This compliant code uses instead the  pthread_cancel() function to terminate the thread. The thread continues to run until it reaches a cancellation point. See  The Open Group Base Specifications Issue 6, IEEE Std 1003.1, 2004 Edition [ Open Group 2004] for lists of functions that are required and allowed to be cancellation points. If the cancellation type is set to asynchronous, the thread is terminated immediately. However, POSIX requires only the  pthread_cancel(),  pthread_setcancelstate(), and  pthread_setcanceltype() functions to be async-cancel safe. An application that calls other POSIX functions with asynchronous cancellation enabled is nonconforming. Consequently, we recommend disallowing asynchronous cancellation, as explained by  POS47-C. Do not use threads that can be canceled asynchronously.

void func(void *foo) {
  /* Execution of thread */
}

int main(void) {
  int result;
  pthread_t thread;

  if ((result = pthread_create(&thread, NULL, func, 0)) != 0) {
    /* Handle Error */
  }
  if ((result = pthread_cancel(thread)) != 0) {
    /* Handle Error */
  }

  /* Continue executing */

  return 0;
}

Risk Assessment

Sending the signal to a process causes it to be abnormally terminated.

Rule	Severity	Likelihood	Remediation Cost	Priority	Level
POS44-C	Low	Probable	Low	P6	L2

Bibliography

[ OpenBSD]	signal() Man Page
[ MKS]	pthread_cancel() Man Page
[ Open Group 2004]	Threads Overview

Excerpt from SEI CERT C Coding Standard: Rules for Developing Safe, Reliable, and Secure Systems (2016 Edition) and SEI CERT C Coding Standard [https://cmu-sei.github.io/secure-coding-standards/sei-cert-c-coding-standard/rules/posix-pos/pos44-c], Copyright (C) 1995-2026 Carnegie Mellon University. See section 9.4. "3rd-Party Licenses" in the documentation for full details.

Possible Messages

Key	Text	Severity	Disabled
forbidden_libfunc_call	Do not call pthread_kill().	None	False

Options

• This rule shares the following common options: exclude_in_macros, exclude_messages_in_system_headers, excludes, extend_exclude_to_macro_invocations, includes, justification_checker, languages, post_processing, provider, report_at, severity

• The following places define options that affect this rule: Stylechecks, Analysis-GlobalOptions

blacklist

blacklist

Type: dict[bauhaus.analysis.config.FileGlobPattern, list[bauhaus.analysis.config.GlobPattern]]

Default:

{
   'sig*.h': ['pthread_kill']
}

Dictionary of header globbing to (list of) function name globbing(s) of forbidden functions.