From 06af39835a485f89cfbaa5726307d4264a89418f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=9D=8E=E9=80=9A=E6=B4=B2?= <zhangsongcui3371@sina.com>
Date: Fri, 19 Jan 2024 10:46:19 +0800
Subject: [PATCH] Terminal: don't use `login` as terminal process; set ppid

---
 CHANGELOG.md                                      | 5 ++++-
 src/detection/terminalshell/terminalshell_linux.c | 2 ++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index caa7f0f58..eafb2f57f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,8 +1,11 @@
 # 2.6.1
 
+Features:
+* Improve xonsh shell detection (Shell)
+
 Bugfixes:
 * Fix segfault in CPU module when running in aarch64 machine without `lscpu` installed (CPU, Linux)
-* Improve xonsh shell detection (Shell, Linux)
+* Don't use `login` as terminal process (Terminal, Linux)
 * Silence warnings when building in 32bit machines.
 
 # 2.6.0
diff --git a/src/detection/terminalshell/terminalshell_linux.c b/src/detection/terminalshell/terminalshell_linux.c
index 439cf6535..e3440cd05 100644
--- a/src/detection/terminalshell/terminalshell_linux.c
+++ b/src/detection/terminalshell/terminalshell_linux.c
@@ -225,6 +225,7 @@ static pid_t getTerminalInfo(FFTerminalResult* result, pid_t pid)
             ffStrEquals(name, "elvish")     ||
             ffStrEquals(name, "oil.ovm")    ||
             ffStrEquals(name, "xonsh")      || // works in Linux but not in macOS because kernel returns `Python` in this case
+            ffStrEquals(name, "login")      ||
             ffStrEndsWith(name, ".sh")
         )
         {
@@ -242,6 +243,7 @@ static pid_t getTerminalInfo(FFTerminalResult* result, pid_t pid)
         #endif
 
         result->pid = (uint32_t) pid;
+        result->ppid = (uint32_t) ppid;
         ffStrbufSetS(&result->processName, name);
         getProcessInformation(pid, &result->processName, &result->exe, &result->exeName);
         break;