File.open(@@pid_file, 'r') {|f| pid = f.read.chomp } if system("ps -p #{pid} | grep #{pid}")If we can write to the pid file, we could inject commands. The problem is I doubt the pid file is in a location we can write to. The log file is created under the current working directory, if launched from /tmp or /var/tmp we could possibly exploit this.