Hacking - The Art of Exploitation, 2nd Edition

324 0x600

reader@hacking:~/booksrc $ kill -l

1. SIGHUP 2) SIGINT 3) SIGQUIT 4) SIGILL


2. SIGTRAP 6) SIGABRT 7) SIGBUS 8) SIGFPE


3. SIGKILL 10) SIGUSR1 11) SIGSEGV 12) SIGUSR2


4. SIGPIPE 14) SIGALRM 15) SIGTERM 16) SIGSTKFLT


5. SIGCHLD 18) SIGCONT 19) SIGSTOP 20) SIGTSTP


6. SIGTTIN 22) SIGTTOU 23) SIGURG 24) SIGXCPU


7. SIGXFSZ 26) SIGVTALRM 27) SIGPROF 28) SIGWINCH


8. SIGIO 30) SIGPWR 31) SIGSYS 34) SIGRTMIN


9. SIGRTMIN+1 36) SIGRTMIN+2 37) SIGRTMIN+3 38) SIGRTMIN+4


10. SIGRTMIN+5 40) SIGRTMIN+6 41) SIGRTMIN+7 42) SIGRTMIN+8


11. SIGRTMIN+9 44) SIGRTMIN+10 45) SIGRTMIN+11 46) SIGRTMIN+12


12. SIGRTMIN+13 48) SIGRTMIN+14 49) SIGRTMIN+15 50) SIGRTMAX-14


13. SIGRTMAX-13 52) SIGRTMAX-12 53) SIGRTMAX-11 54) SIGRTMAX-10


14. SIGRTMAX-9 56) SIGRTMAX-8 57) SIGRTMAX-7 58) SIGRTMAX-6


15. SIGRTMAX-5 60) SIGRTMAX-4 61) SIGRTMAX-3 62) SIGRTMAX-2


16. SIGRTMAX-1 64) SIGRTMAX
    reader@hacking:~/booksrc $ ps a | grep signal_example
    24491 pts/3 R+ 0:17 ./signal_example
    24512 pts/1 S+ 0:00 grep signal_example
    reader@hacking:~/booksrc $ kill -10 24491
    reader@hacking:~/booksrc $ kill -12 24491
    reader@hacking:~/booksrc $ kill -9 24491
    reader@hacking:~/booksrc $

Finally, the SIGKILL signal is sent using kill -9. This signal’s handler

cannot be changed, so kill -9 can always be used to kill processes. In the

other terminal, the running signal_example shows the signals as they are

caught and the process is killed.

reader@hacking:~/booksrc $ ./signal_example

Caught signal 10 SIGUSR1

Caught signal 12 SIGUSR2

Killed

reader@hacking:~/booksrc $

Signals themselves are pretty simple; however, interprocess communica-

tion can quickly become a complex web of dependencies. Fortunately, in the

new tinyweb daemon, signals are only used for clean termination, so the

implementation is simple.

0x622 Tinyweb Daemon

This newer version of the tinyweb program is a system daemon that runs in

the background without a controlling terminal. It writes its output to a log

file with timestamps, and it listens for the terminate (SIGTERM) signal so it

can shut down cleanly when it’s killed.

These additions are fairly minor, but they provide a much more realistic

exploit target. The new portions of the code are shown in bold in the listing

below.