Its probably better to embed clearer strings in the binary that conform to some spec. Then searching over binaries would find them.

Trying to respond to a signal is a nightmare of routing and lifecycle bugs. Never mind the fact that most dependencies won't be registered. Currently file/process signature matching is ok for major runtimes, and tends to fail on specific version detection. This would effectively formalise that.

I could see it being a successful standardisation for major runtimes and many libraries that wouldn't currently be detected - but take up would never be universal. A kind of CVE search stamp.

if it's in the elf then the kernel could handle the interrupting. that way every app wouldn't need to implement the handler. just a named BOM symbol and when the kernel sees the `kill -s BOM <PID>` it reads that BOM symbol without calling any app code.