[arch-general] Zombie Processes

[Daniel Micay]

On 26/08/14 07:54 PM, Mark Lee wrote:
> To all,
> 
> I was wondering regarding the killing of a zombie process. As far as I
> know, a zombied process is inherited by root when it's parent is
> killed. The kernel periodically calls wait() which reaps the zombie
> process and frees its memory. I was wondering if a possible attack
> could be mounted by the zombie process when it is inherited by root.
> 
> Regards,
> Mark

Orphaned processes are inherited by init (pid 1). A modern init like
systemd uses an event loop and handles the signals (SIGCHLD) in a
non-blocking fashion. Linux also provides the ability to turn other
processes into sub-reapers, and has a concept of process namespaces
where the first process in the namespace is treated as init for those
processes. I don't think this is a viable attack surface.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <http://mailman.archlinux.org/pipermail/arch-general/attachments/20140826/a1256798/attachment.asc>