Is there any way to figure out that child process was killed with SIGKILL by the kernel when the parent process isn't root

You need to wait(2) on the child and use the macro WIFSIGNALED to check if it was terminated by a signal.

int status = 0;// wait for child to exitpid_t child_pid = wait(&status);if (WIFEXITED(status)){    printf("exited with %d\n", WEXITSTATUS(status));}else if (WIFSIGNALED(status)){    printf("Signaled with %d\n", WTERMSIG(status));}

If you have multiple child processes, you can use a loop to wait for them all.

WTERMSIG(status) would return the signal number. To figure out the signal, you could check:

if (WTERMSIG(status) == SIGKILL) {    ...} else if (WTERMSIG(status) == SIGTERM) {    ...}

There's no way to figure out exactly who sent a kill (whether by the OOM killer or something else e.g., one could do kill -9 PID from the shell).It's reasonable to assume that signals are not sent indiscriminately on a system and that it's usually the kernel itself (OOM killer) that sends SIGKILL.

The status provided by waitXXX( )(see man page) makes it possible to determine that the child has been killed by a signal:First check by calling WIFSIGNALED(wstatus) if that happened, then you can call WTERMSIG(wstatus) to determine the signal number. However you can't determine if the process was killed by the kernel or by another process calling kill().