diff --git a/src/detection/terminalshell/terminalshell.c b/src/detection/terminalshell/terminalshell.c index f4e56a124..ed2912118 100644 --- a/src/detection/terminalshell/terminalshell.c +++ b/src/detection/terminalshell/terminalshell.c @@ -356,6 +356,20 @@ FF_MAYBE_UNUSED static bool getTerminalVersionXterm(FFstrbuf* exe, FFstrbuf* ver return version->length > 0; } +FF_MAYBE_UNUSED static bool getTerminalVersionBlackbox(FFstrbuf* exe, FFstrbuf* version) +{ + if(ffProcessAppendStdOut(version, (char* const[]){ + exe->chars, + "--version", + NULL + })) return false; + + //BlackBox version 0.14.0 (flatpak) + ffStrbufSubstrBeforeLastC(version, ' '); + ffStrbufSubstrAfterLastC(version, ' '); + return version->length > 0; +} + FF_MAYBE_UNUSED static bool getTerminalVersionUrxvt(FF_MAYBE_UNUSED FFstrbuf* exe, FFstrbuf* version) { if(ffProcessAppendStdErr(version, (char* const[]){ @@ -482,6 +496,9 @@ bool fftsGetTerminalVersion(FFstrbuf* processName, FF_MAYBE_UNUSED FFstrbuf* exe if(ffStrbufIgnCaseEqualS(processName, "xterm")) return getTerminalVersionXterm(exe, version); + if(ffStrbufIgnCaseEqualS(processName, "blackbox")) + return getTerminalVersionBlackbox(exe, version); + if(ffStrbufIgnCaseEqualS(processName, "st")) return getTerminalVersionSt(exe, version); diff --git a/src/detection/terminalshell/terminalshell_linux.c b/src/detection/terminalshell/terminalshell_linux.c index 1224e14ea..a8e453ca5 100644 --- a/src/detection/terminalshell/terminalshell_linux.c +++ b/src/detection/terminalshell/terminalshell_linux.c @@ -285,6 +285,7 @@ static pid_t getTerminalInfo(FFTerminalResult* result, pid_t pid) ffStrEquals(name, "xonsh") || // works in Linux but not in macOS because kernel returns `Python` in this case ffStrEquals(name, "login") || ffStrEquals(name, "sshd") || + ffStrEquals(name, "flatpak-session-helper") || // #707 ffStrEndsWith(name, ".sh") ) {