Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Inherit container id from parent if cgroup info can't be read #192

Merged
merged 1 commit into from
Jan 11, 2024

Conversation

hillu
Copy link
Collaborator

@hillu hillu commented Jan 11, 2024

Short-lived programs such as /bin/true are usually cleaned up before Laurel can read data from their /proc/. In this case, we assume that the process has inherited the container ID from its parent.

Close: #191

Short-lived programs such as /bin/true are usually cleaned up before
Laurel can read data from their /proc/<pid>. In this case, we assume
that the process has inherited the container ID from its parent.

Close: threathunters-io#191
@hillu hillu merged commit 9f8c3d4 into threathunters-io:master Jan 11, 2024
5 checks passed
@hillu hillu deleted the inherit-container branch January 11, 2024 23:31
hillu added a commit that referenced this pull request Jan 12, 2024
If we can't look up the script through /proc/<pid>/root because the
script has exited by the time we see the event, try /proc/<ppid>/root.

See also: #191 / #192
hillu added a commit that referenced this pull request Jan 12, 2024
If we can't look up the script through /proc/<pid>/root because the
script has exited by the time we see the event, try /proc/<ppid>/root.

See also: #191 / #192
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Missing CONTAINER_INFO in a child process
1 participant