#ptrace

A Linux kernel ptrace flaw enables local attackers to exploit a race condition and duplicate privileged file descriptors, exposing sensitive data such as SSH private keys and shadow password files across major distributions.

Source: Orca Security

How to ptrace a multi-threaded application?

EDIT (MADE PROGRESS):

I am trying to ptrace a vsftpd daemon. I have the following code which is attaching to the daemon. Then it successfully displays the PID of the first spawned process. However, for the children of this spawned process it returns the PIDs as 2,3,.. The program does catch the exiting of the spawned processes though, which makes me think I am close.

Any ideas?

void *…

Getting a zombie process after a ptrace signal sent

I am testing ptrace and signals.

The problem is that when I am forwarding a signal with sigaction and then senting the interrupt signal to the process via kill(pid, SIGKILL) and after the ptrace(PTRACE_SYSCALL, pid, NULL, tracee_signal) the process is printed as zombie at the output of ps aux.

Only when I quit the “master” process, then the zombie process has its return status collected by…