Skip to content

cmdline 如果被进程重写,现有逻辑将无法忽略空格。 #32

@YouZhengChuan

Description

@YouZhengChuan

nux/proc.go

Line 67 in debb382

if cmdlineBytes[j] != 0 {

有一些进程,例如nginx会重写cmdline:

[root@vm-vm114 falcon-agent]# ps aux|grep nginx
root     14811  0.0  0.0 108964  1884 ?        Ss   19:18   0:00 nginx: master process /usr/sbin/nginx -c /etc/nginx/nginx.conf
nginx    14812  0.0  0.1 109388  2736 ?        S    19:18   0:00 nginx: worker process
nginx    14813  0.0  0.1 109388  2656 ?        S    19:18   0:00 nginx: worker process
root     15182  0.0  0.0 103336   864 pts/2    S+   19:57   0:00 grep nginx
[root@vm-vm114 falcon-agent]#
[root@vm-vm114 falcon-agent]# xxd /proc/14811/cmdline
0000000: 6e67 696e 783a 206d 6173 7465 7220 7072  nginx: master pr
0000010: 6f63 6573 7320 2f75 7372 2f73 6269 6e2f  ocess /usr/sbin/
0000020: 6e67 696e 7820 2d63 202f 6574 632f 6e67  nginx -c /etc/ng
0000030: 696e 782f 6e67 696e 782e 636f 6e66       inx/nginx.conf

可以看到,原本看起来应该是0x00的地方,却用0x20(空格字符),falcon-agent在使用这个库获取到的进程含有空格,会导致cmdline无法匹配上。

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions