Trace the Source of a SIGKILL by Adding a Kernel Logging Patch
When a Linux process is terminated by SIGKILL, the sender cannot be identified directly, but by adding a small patch to kernel/signal.c that logs the killer's PID and command name, you can trace the source of the kill, compile and flash the kernel to verify the change.
