| 143 | } |
| 144 | |
| 145 | bool shell_like_process(const Engine& eng, const Process& p) { |
| 146 | if (p.mm == 0) return false; |
| 147 | if (p.comm == "bash" || p.comm == "zsh" || p.comm == "fish" || |
| 148 | p.comm == "sh" || p.comm == "dash" || p.comm == "ksh" || |
| 149 | p.comm == "mksh") return true; |
| 150 | std::string meta; |
| 151 | try { |
| 152 | auto cmd = gen_cmdline(eng.phys(), eng.isf(), eng.kernel(), p); |
| 153 | meta.append(reinterpret_cast<const char*>(cmd.data()), cmd.size()); |
| 154 | } catch (...) {} |
| 155 | try { |
| 156 | auto env = gen_environ(eng.phys(), eng.isf(), eng.kernel(), p); |
| 157 | meta.append(reinterpret_cast<const char*>(env.data()), env.size()); |
| 158 | } catch (...) {} |
| 159 | return meta.find("SHELL=") != std::string::npos || |
| 160 | meta.find("HISTFILE=") != std::string::npos || |
| 161 | meta.find("ZDOTDIR=") != std::string::npos || |
| 162 | contains_icase(meta, "bash") || |
| 163 | contains_icase(meta, "zsh") || |
| 164 | contains_icase(meta, "fish"); |
| 165 | } |
| 166 | |
| 167 | bool generic_heap_scan_allowed(const Engine& eng, const Process& p) { |
| 168 | if (p.comm == "bash" || p.comm == "zsh" || p.comm == "fish" || |
no test coverage detected