sophie HUP/TERM issue

Sascha Lucas <[email protected]> Mon, 26 Apr 2004 14:16:05 +0200 (CEST)
Newsgroups gmane.comp.security.virus.vtools
Message-ID <[email protected]>
Hi list,

first of all my versions:
  - OS     = SuSE 8.2 (glibc-2.3.2)
  - sophie = 3.04RC1
  - sophos = 3.81

I just want to know if I'm doing something wrong or what piece should be
fixed (sophos, sophie, OS, user :-) ).

a typical process-picture is this:

$ ps -Af f | grep sophie | grep -v grep
root   17080	 1 0 13:55 ? S 0:00 /usr/local/sbin/sophie -D
sophie 17081 17080 1 13:55 ? S 0:00  \_ /usr/local/sbin/sophie -D
sophie 17084 17080 0 13:55 ? S 0:00  \_ /usr/local/sbin/sophie -D

where the PID 14160 ist the parent and the others running as user "sophie"
are the childs.

Problem #1: TERM with libc6 and libc6.glibc.2.2 (testet with 3.77b 
and 3.81)

The parent terminates put childs stay and get new parent (PID 1)

$ ps -Af f | grep sophie | grep -v grep
sophie 17081     1 1 13:55 ? S 0:00  \_ /usr/local/sbin/sophie -D
sophie 17084     1 0 13:55 ? S 0:00  \_ /usr/local/sbin/sophie -D

Problem #2: same as #1 but with KILL

Problem #3: HUP with libc6.glibc.2.2

A new child 17122 running as root appaers

$ kill -HUP 17080
$ ps -Af f | grep sophie | grep -v grep
root   17080	 1 1 13:55 ? R 0:01 /usr/local/sbin/sophie -D
sophie 17081 17080 0 13:55 ? S 0:00  \_ /usr/local/sbin/sophie -D
sophie 17084 17080 0 13:55 ? S 0:00  \_ /usr/local/sbin/sophie -D
root   17122 17080 0 13:56 ? S 0:00  \_ /usr/local/sbin/sophie -D

Thanks Sascha.