Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Linux: Fix task parent pid in several plugins #1412

Merged

Conversation

gcmoreira
Copy link
Contributor

Linux plugins are using the wrong value for the parent process identifier (PPID).
Using task.parent can result in inaccurate results, especially in cases involving ptraced processes (refer to PR #1288 for more details).

This PR introduces a new method in the task object extension that mimics the Linux kernel's getppid syscall, ensuring correct and consistent retrieval of the parent PID.

It also adds a method to get the correct one in a unified way from the task object extension
@gcmoreira gcmoreira requested review from atcuno and ikelos December 17, 2024 01:29
Copy link
Member

@ikelos ikelos left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for fixing all the consumer plugins and bumping their versions. I think there's still some version work to be done, and I'm a little concerned about the return pid if there's an error (rather than just throwing an exception). Really don't like papering over problems and particularly when the caller of the function can't differentiate the error condition from an actual valid response.

@ikelos ikelos merged commit 7d2f8b2 into volatilityfoundation:develop Dec 17, 2024
13 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants