mirrors/opensnitch
1
0
Fork 0
mirror of https://github.com/evilsocket/opensnitch.git synced 2025-03-04 08:34:40 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

replace /proc/self from bin paths

Browse source 
Sometimes we receive /proc/self/exe as the path of the process (electron
apps).
Since a couple of systemd versions ago, some processes spawned by
systemd are reported as /proc/self/fd/<number>.

In these cases reading the symbolic link /proc/<pid>/exe points to the
file on disk.
This commit is contained in:
Gustavo Iñiguez Goia 2023-12-03 01:13:55 +01:00
parent d3ba9d65ce
commit fb2c9893d0
Failed to generate hash of commit
2 changed files with 3 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
daemon/procmon/details.go
View file

@ -239,7 +239,7 @@ func (p *Process) ReadCmdline() {
// - AppImages cmdline reports the execuable launched as /proc/self/exe, // - AppImages cmdline reports the execuable launched as /proc/self/exe,
// instead of the actual path to the binary. // instead of the actual path to the binary.
func (p *Process) CleanArgs() { func (p *Process) CleanArgs() {
if len(p.Args) > 0 && p.Args[0] == ProcSelfExe { if len(p.Args) > 0 && p.Args[0] == ProcSelf {
p.Args[0] = p.Path p.Args[0] = p.Path
} }
} }
@ -343,7 +343,7 @@ func (p *Process) CleanPath() {
// This is not useful to the user, and besides it's a generic path that can represent // This is not useful to the user, and besides it's a generic path that can represent
// to any process. // to any process.
// Therefore we cannot use /proc/self/exe directly, because it resolves to our own process. // Therefore we cannot use /proc/self/exe directly, because it resolves to our own process.
if p.Path == ProcSelfExe { if strings.HasPrefix(p.Path, ProcSelf) {
if link, err := os.Readlink(p.pathExe); err == nil { if link, err := os.Readlink(p.pathExe); err == nil {
p.Path = link p.Path = link
return return

2
daemon/procmon/process.go
View file

@ -22,7 +22,7 @@ const (
MethodEbpf = "ebpf" MethodEbpf = "ebpf"
KernelConnection = "Kernel connection" KernelConnection = "Kernel connection"
ProcSelfExe = "/proc/self/exe" ProcSelf = "/proc/self/"
HashMD5 = "process.hash.md5" HashMD5 = "process.hash.md5"
HashSHA1 = "process.hash.sha1" HashSHA1 = "process.hash.sha1"