> Well, the compiler has no way of knowing if a function will later be a signal handler after linking, or even dynamic loading.

That's why GP suggested annotating them. Typically this would be done via a function attribute.

> There is no portable way to annotate all functions ever written or ever will be written as being async signal safe.

This is not a requirement for such an annotation to exist and to be used by projects that care about security or even just correctness.

> Which functions are async signal safe varies with the operating system and runtime (eg. an unsafe function in linux-gnu might be safe in linux-musl or linux-bionic).

And libc implementations already annotate many of their functions to tell the compiler how they work. Compilers are also more than happy to assume behavior of standard function matches the C/C++ standards in non-freestanding environmnets.

> Other than those insurmountable problems, yeah, good idea.

All fairly trivial problems that have already been solved many times for similar issues.

I'd like a more general attribute though to declare that a particular funcion is in some abstract domain and then annotations that certain functions may or may not be called in certain domains. This could come useful in cases where you want some functions to only be called from special threads.