Skip to content



sigsuspend - temporarily replaces the signal mask of the executing thread with the given set of signals.


The sigsuspend() system call suspends the caller until a signal is received. It is equivalent to

sigprocmask(SIG_SETMASK, &mask, NULL);

The mask given as argument is used as the signal mask of the process during the period of suspension; upon return from the call it is restored to the previous value. While sigsuspend() is being executed, any signal may be accepted, except SIGKILL and SIGSTOP.

The sigsuspend() function shall not return if it is interrupted by a signal handler and the signal handler does not return.


  • mask:const sigset_t*[K] - pointer to a signal set specifying the new signal mask for the process.

Available Tags

  • K - Originated from kernel-space.




kprobe + kretprobe


To monitor when the program defines a new signal mask and waits until a signal is received.

Example Use Case

When monitoring a program that handles signals and the need to know when a new signal mask is set and in which order the signals are handled.


If a signal is sent with a higher priority than SIGKILL and SIGSTOP, it might be missed by the call to sigsuspend().

  • sigprocmask()
  • sigsuspend()
  • sigpending()

This document was automatically generated by OpenAI and needs review. It might not be accurate and might contain errors. The authors of Tracee recommend that the user reads the "events.go" source file to understand the events and their arguments better.