systemd TimeoutStopSec: Main PID vs Full Cgroup Termination Scope

Unresolved Timeout Enforcement Boundary

systemd enforces service stop deadlines through TimeoutStopSec, sending SIGTERM then SIGKILL after the interval expires. The KillMode setting (control-group, process, mixed, none) controls which processes receive these signals, yet the exact termination scope remains ambiguous when a service forks children.

Constraints and Uncertainty

• KillMode=process signals only the main PID; children in the same cgroup may survive after systemd marks the unit stopped.
• KillMode=control-group signals all cgroup members, but the timeout is measured from the initial SIGTERM, while kernel process termination is asynchronous.
• Custom SIGTERM handlers in the main process can delay shutdown past TimeoutStopSec, triggering SIGKILL before children receive any signal.

Documentation does not clarify whether TimeoutStopSec should guarantee all cgroup processes exit, or only bound the main PID lifetime.

Questions

1. Does TimeoutStopSec define a deadline for the main PID alone, or for complete cgroup teardown?
2. When KillMode=process and the main PID exits early, should systemd continue tracking child processes against the original timeout?
3. Is there a supported pattern to enforce a hard deadline on all descendant processes without resorting to KillMode=control-group side effects?