From cb13d43a7acb79ab38475b7fd7e149e24f205196 Mon Sep 17 00:00:00 2001 From: Carter Li Date: Thu, 21 Aug 2025 00:12:41 +0800 Subject: [PATCH] TerminalShell (Linux): always ignore pid1 (v2) --- src/detection/terminalshell/terminalshell_linux.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src/detection/terminalshell/terminalshell_linux.c b/src/detection/terminalshell/terminalshell_linux.c index fe3ee1d61..74e8cf39a 100644 --- a/src/detection/terminalshell/terminalshell_linux.c +++ b/src/detection/terminalshell/terminalshell_linux.c @@ -31,7 +31,7 @@ static pid_t getShellInfo(FFShellResult* result, pid_t pid) userShellName = instance.state.platform.userShell.chars + index + 1; } - while (ffProcessGetBasicInfoLinux(pid, &result->processName, &ppid, &tty) == NULL) + while (pid > 1 && ffProcessGetBasicInfoLinux(pid, &result->processName, &ppid, &tty) == NULL) { if (!ffStrbufEqualS(&result->processName, userShellName)) { @@ -75,14 +75,14 @@ static pid_t getShellInfo(FFShellResult* result, pid_t pid) ffProcessGetInfoLinux(pid, &result->processName, &result->exe, &result->exeName, &result->exePath); break; } - return ppid; + return pid > 1 ? ppid : 0; } static pid_t getTerminalInfo(FFTerminalResult* result, pid_t pid) { pid_t ppid = 0; - while (ffProcessGetBasicInfoLinux(pid, &result->processName, &ppid, NULL) == NULL) + while (pid > 1 && ffProcessGetBasicInfoLinux(pid, &result->processName, &ppid, NULL) == NULL) { //Known shells if ( @@ -145,7 +145,7 @@ static pid_t getTerminalInfo(FFTerminalResult* result, pid_t pid) ffProcessGetInfoLinux(pid, &result->processName, &result->exe, &result->exeName, &result->exePath); break; } - return ppid; + return pid > 1 ? ppid : 0; } static bool getTerminalInfoByPidEnv(FFTerminalResult* result, const char* pidEnv)