On 26/08/14 07:54 PM, Mark Lee wrote:
To all,
I was wondering regarding the killing of a zombie process. As far as I know, a zombied process is inherited by root when it's parent is killed. The kernel periodically calls wait() which reaps the zombie process and frees its memory. I was wondering if a possible attack could be mounted by the zombie process when it is inherited by root.
Regards, Mark
Orphaned processes are inherited by init (pid 1). A modern init like systemd uses an event loop and handles the signals (SIGCHLD) in a non-blocking fashion. Linux also provides the ability to turn other processes into sub-reapers, and has a concept of process namespaces where the first process in the namespace is treated as init for those processes. I don't think this is a viable attack surface.