From 761c649817fcddcff77097cf500cd1131dfa66e8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=9D=8E=E9=80=9A=E6=B4=B2?= <zhangsongcui3371@sina.com>
Date: Wed, 1 Nov 2023 08:55:00 +0800
Subject: [PATCH] TerminalShell: better support for environment running with
 `su`

---
 src/detection/terminalshell/terminalshell.c      | 16 ++++++++++++++++
 .../terminalshell/terminalshell_linux.c          |  4 ++++
 2 files changed, 20 insertions(+)

diff --git a/src/detection/terminalshell/terminalshell.c b/src/detection/terminalshell/terminalshell.c
index 60bff0490..c0444047d 100644
--- a/src/detection/terminalshell/terminalshell.c
+++ b/src/detection/terminalshell/terminalshell.c
@@ -455,6 +455,22 @@ bool fftsGetTerminalVersion(FFstrbuf* processName, FF_MAYBE_UNUSED FFstrbuf* exe
         }
     }
 
+    termProgramVersion = getenv("LC_TERMINAL_VERSION");
+    if(termProgramVersion)
+    {
+        const char* termProgram = getenv("LC_TERMINAL");
+        if(termProgram)
+        {
+            if(ffStrbufStartsWithIgnCaseS(processName, termProgram) || // processName ends with `.exe` on Windows
+                (ffStrEquals(termProgram, "vscode") && ffStrbufStartsWithIgnCaseS(processName, "code")) ||
+                (ffStrStartsWith(termProgram, "iTerm") && ffStrbufStartsWithIgnCaseS(processName, "iTermServer-"))
+            ) {
+                ffStrbufSetS(version, termProgramVersion);
+                return true;
+            }
+        }
+    }
+
     #ifdef _WIN32
 
     return getFileVersion(exe->chars, version);
diff --git a/src/detection/terminalshell/terminalshell_linux.c b/src/detection/terminalshell/terminalshell_linux.c
index 4d44746ac..460f99fc4 100644
--- a/src/detection/terminalshell/terminalshell_linux.c
+++ b/src/detection/terminalshell/terminalshell_linux.c
@@ -139,6 +139,7 @@ static void getTerminalShell(FFTerminalShellResult* result, pid_t pid)
         strcasecmp(name, "sshd")                 == 0 ||
         strcasecmp(name, "gdb")                  == 0 ||
         strcasecmp(name, "lldb")                 == 0 ||
+        strcasecmp(name, "login")                == 0 ||
         strcasecmp(name, "guake-wrapped")        == 0 ||
         strcasestr(name, "debug")             != NULL ||
         strcasestr(name, "command-not-found") != NULL ||
@@ -251,6 +252,9 @@ static void getTerminalFromEnv(FFTerminalShellResult* result)
     if(!ffStrSet(term))
         term = getenv("TERM_PROGRAM");
 
+    if(!ffStrSet(term))
+        term = getenv("LC_TERMINAL");
+
     //Normal Terminal
     if(!ffStrSet(term))
         term = getenv("TERM");