sigpending¶

Intro¶

sigpending - Check the signals that are pending for the process.

Description¶

The sigpending() system call queries the pending signals for the calling process (check which signals have been raised while blocked). It fills in the signal set pointed to by set, which is of type sigset_t, with the set of signals currently pending for the process.

Are there any edge-cases, drawbacks or advantages of using it?

The most useful edge-case is that it allows a process to find out signals that have been sent to it, but blocked by the process with sigprocmask().

Arguments¶

set:sigset_t*[U] - Pointer to a signal set which will be set to the set of pending signals for the process.

Available Tags¶

K - Originated from kernel-space.
U - Originated from user space (for example, pointer to user space memory used to get it)
TOCTOU - Vulnerable to TOCTOU (time of check, time of use)
OPT - Optional argument - might not always be available (passed with null value)

Hooks¶

do_sigpending¶

Type¶

Kprobes

Purpose¶

Triggers every time the system call is made, allowing to analyze what was the source of the call.

Example Use Case¶

For example, this system call can be used to create a signal handler to check whether or not a particular signal is blocked.

Issues¶

No known issues.

signal, sigprocmask, sigaction

This document was automatically generated by OpenAI and needs review. It might not be accurate and might contain errors. The authors of Tracee recommend that the user reads the "events.go" source file to understand the events and their arguments better.