Skip to content

Commit

Permalink
Remote capture: fix error on shells without $PPID
Browse files Browse the repository at this point in the history
The PID of SSHD was retrieved using this shell variable that exists on bash and dash, but other shells (like fish) don't have it.
  • Loading branch information
oshaked1 committed Oct 29, 2024
1 parent a7b2f21 commit e49f9b0
Showing 1 changed file with 7 additions and 3 deletions.
10 changes: 7 additions & 3 deletions extcap/tracee-capture.py
Original file line number Diff line number Diff line change
Expand Up @@ -1091,11 +1091,15 @@ def prepare_remote_capture(args: argparse.Namespace, ssh_client: paramiko.SSHCli
error(f'error changing permissions on new entrypoint script, stderr dump:\n{err}')

# get pid of sshd responsible for the ssh tunnel (it constantly polls its sockets which may spam the capture)
out, err, returncode = send_ssh_command(ssh_data_client, "echo $PPID")
out, err, returncode = send_ssh_command(ssh_data_client, f'ps -o ppid= -p $$')
if returncode != 0:
error(f'error getting sshd pid, stderr dump:\n{err}')
# fish doesn't have $$
if err.startswith('fish:'):
out, err, returncode = send_ssh_command(ssh_data_client, f'ps -o ppid= -p $fish_pid')
if returncode != 0:
error(f'error getting sshd pid, stderr dump:\n{err}')

return int(out)
return int(out.lstrip())


def stop_existing_tracee_capture():
Expand Down

0 comments on commit e49f9b0

Please sign in to comment.