From f22b8ede0297d5d028b1a0c1d2635307e13cf37b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=9D=8E=E9=80=9A=E6=B4=B2?= <zhangsongcui3371@sina.com>
Date: Fri, 23 Aug 2024 15:52:14 +0800
Subject: [PATCH] TerminalShell: ignore the parent process if
 `$FFTS_IGNORE_PARENT` is set to `1`

Fix #1205
---
 src/detection/terminalshell/terminalshell_linux.c   | 8 ++++++++
 src/detection/terminalshell/terminalshell_windows.c | 4 ++++
 2 files changed, 12 insertions(+)

diff --git a/src/detection/terminalshell/terminalshell_linux.c b/src/detection/terminalshell/terminalshell_linux.c
index 30e131904..18be4f3b8 100644
--- a/src/detection/terminalshell/terminalshell_linux.c
+++ b/src/detection/terminalshell/terminalshell_linux.c
@@ -384,6 +384,14 @@ const FFShellResult* ffDetectShell()
     result.tty = -1;
 
     pid_t ppid = getppid();
+
+    const char* ignoreParent = getenv("FFTS_IGNORE_PARENT");
+    if (ignoreParent && ffStrEquals(ignoreParent, "1"))
+    {
+        FF_STRBUF_AUTO_DESTROY _ = ffStrbufCreate();
+        ffProcessGetBasicInfoLinux(ppid, &_, &ppid, NULL);
+    }
+
     ppid = getShellInfo(&result, ppid);
     getUserShellFromEnv(&result);
     setShellInfoDetails(&result);
diff --git a/src/detection/terminalshell/terminalshell_windows.c b/src/detection/terminalshell/terminalshell_windows.c
index f1e27d63e..f2ff3b1cd 100644
--- a/src/detection/terminalshell/terminalshell_windows.c
+++ b/src/detection/terminalshell/terminalshell_windows.c
@@ -345,6 +345,10 @@ const FFShellResult* ffDetectShell(void)
     if(!ffProcessGetInfoWindows(0, &ppid, NULL, NULL, NULL, NULL, NULL))
         return &result;
 
+    const char* ignoreParent = getenv("FFTS_IGNORE_PARENT");
+    if (ignoreParent && ffStrEquals(ignoreParent, "1"))
+        ffProcessGetInfoWindows(ppid, &ppid, NULL, NULL, NULL, NULL, NULL);
+
     ppid = getShellInfo(&result, ppid);
 
     if (result.processName.length > 0)