On 26/08/14 07:54 PM, Mark Lee wrote: > To all, > > I was wondering regarding the killing of a zombie process. As far as I > know, a zombied process is inherited by root when it's parent is > killed. The kernel periodically calls wait() which reaps the zombie > process and frees its memory. I was wondering if a possible attack > could be mounted by the zombie process when it is inherited by root. > > Regards, > Mark Orphaned processes are inherited by init (pid 1). A modern init like systemd uses an event loop and handles the signals (SIGCHLD) in a non-blocking fashion. Linux also provides the ability to turn other processes into sub-reapers, and has a concept of process namespaces where the first process in the namespace is treated as init for those processes. I don't think this is a viable attack surface.
Attachment:
signature.asc
Description: OpenPGP digital signature
