From 2a125e226b93668894bb617bb1c204debf53a76e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=9D=8E=E9=80=9A=E6=B4=B2?= <carter.li@eoitek.com>
Date: Thu, 7 Mar 2024 22:38:03 +0800
Subject: [PATCH] Terminal (Linux): ignore `SessionLeader`

I don't know why it's there, but let's ignore it for now
---
 src/detection/terminalshell/terminalshell_linux.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/detection/terminalshell/terminalshell_linux.c b/src/detection/terminalshell/terminalshell_linux.c
index 8af68f598..00aabad33 100644
--- a/src/detection/terminalshell/terminalshell_linux.c
+++ b/src/detection/terminalshell/terminalshell_linux.c
@@ -231,6 +231,7 @@ static pid_t getShellInfo(FFShellResult* result, pid_t pid)
             ffStrEquals(name, "ltrace")              ||
             ffStrEquals(name, "perf")                ||
             ffStrEquals(name, "guake-wrapped")       ||
+            ffStrEquals(name, "SessionLeader")       || // #750
             ffStrContainsIgnCase(name, "debug")      ||
             ffStrContainsIgnCase(name, "not-found")  ||
             ffStrEndsWith(name, ".sh")