Generation of Linux botnets and how to avoid them

Article Title: Generation and prevention of Linux botnets. Linux is a technology channel of the IT lab in China. Includes basic categories such as desktop applications, Linux system management, kernel research, embedded systems, and open source.

In the fork ()/execve () process, assume that the parent process still exists at the end of the Child process, and the parent process fork () has not installed the SIGCHLD signal processing function to call waitpid () when the sub-process ends and the signal is not explicitly ignored, the sub-process becomes a zombie and cannot end normally. In this case, even the root identity kill-9 cannot kill the zombie process. The remedy is to kill the parent process of the zombie process (the parent process of the zombie process must exist). The zombie process becomes an "orphan process" and passes the process init to process 1, init is always responsible for cleaning up zombie processes.

A zombie process means that the parent process has exited, and the dead process becomes a zombie process without being accepted by the process.

How to generate botnets:

When a process calls the exit command to end its own life, it is not actually destroyed, but it leaves a data structure called Zombie (the system calls exit, it is used to exit a process, but it is only limited to converting a normal process into a zombie process and cannot completely destroy it ). In the Linux Process status, zombie Processes

It has abandoned almost all the memory space, no executable code, and cannot be scheduled. It only keeps a location in the process list, record the rollback of the process

In addition, zombie processes no longer occupy any memory space. It requires its parent process to collect dead parts for it. If the parent process does not have the SIGCHLD message installed

The number processing function calls wait or waitpid () to wait for the sub-process to end, and does not explicitly ignore the signal, it will remain zombie. If the parent process is finished, the init process automatically

It will take over the sub-process and collect the corpse for it. It can still be cleared. However, if the parent process is a loop and does not end, the child process will remain zombie, which is why many zombie processes sometimes exist in the system.

Linux has a limit on the number of running processes. If too many zombie processes occupy the available process numbers, new processes cannot be generated. This is the biggest threat to the system from zombie processes.

Zombie process instance:

/* ----- Zombie1.c -----*/

# Include "sys/types. h"

# Include "sys/wait. h"

# Include "stdio. h"

# Include "unistd. h"

Int main (int argc, char * argv [])

{

While (1)

{

Pid_t chi = fork ();

If (chi = 0)

{

Execl ("/bin/bash", "bash", "-c", "ls", NULL );

}

Sleep (2 );

}

Will continuously generate zombie process ls;

/* ----- Zombie2.c -----*/

# Include

# Include

Main ()

{

If (! Fork ())

{

Printf ("child pid = % d \ n", getpid ());

Exit (0 );

}

/* Wait ();*/

/* Waitpid (-1, NULL, 0 );*/

Sleep (60 );

Printf ("parent pid = % d \ n", getpid ());

Exit (0 );

}

A zombie process will be generated continuously within 60 s, knowing that the parent process exit (0 );

If wait/waitpid is called to collect corpses for sub-processes, no zombie processes will be generated.

PS: run the example. first compile gcc zombie1.c-o zombie and then run zombie;

Then, you can use ps-ef to check whether a zombie process has been generated.

How to view botnets:

Using the command ps, we can see that the process marked as Z is a zombie process.

How to clear zombie processes:

1. Rewrite the parent process and send it to the dead after the child process dies. The specific method is to take over the SIGCHLD signal. After a child process dies, it sends a SIGCHLD signal to the parent process. After receiving the signal, the parent process executes the waitpid () function to collect the child process. This is based on the principle that even if the parent process does not call wait, the kernel will send SIGCHLD messages to it, even though the default processing is ignored. If you want to respond to this message, you can set a processing function.

2. Kill the parent process. After the death of the parent process, the zombie process becomes an "orphan process". After it passes through to the init process on process 1, init will always be responsible for cleaning up the zombie process. All the zombie processes it generates will also disappear.

[1] [2] Next page