Skip to content

Commit

Permalink
pop-ups: filter by absolute path+cmdline on some cases
Browse files Browse the repository at this point in the history
If the pop-ups' target is to filter by cmdline, but the typed/launched
command is not absolute or it starts with /proc, also filter by the
absolute path to the binary.
  • Loading branch information
gustavo-iniguez-goya committed Feb 8, 2024
1 parent dd3aba1 commit 1d2c070
Showing 1 changed file with 4 additions and 3 deletions.
7 changes: 4 additions & 3 deletions ui/opensnitch/dialogs/prompt.py
Original file line number Diff line number Diff line change
Expand Up @@ -673,12 +673,13 @@ def _send_rule(self):
is_list_rule = self._is_list_rule()

# If the user has selected to filter by cmdline, but the launched
# command path is not absolute, we can't trust it. In this case,
# also filter by the absolute path to the binary.
# command path is not absolute or the first component contains
# "/proc/" (/proc/self/fd.., /proc/1234/fd...), we can't trust it.
# In these cases, also filter by the absolute path to the binary.
if self._rule.operator.operand == Config.OPERAND_PROCESS_COMMAND:
proc_args = " ".join(self._con.process_args)
proc_args = proc_args.split(" ")
if os.path.isabs(proc_args[0]) == False:
if os.path.isabs(proc_args[0]) == False or proc_args[0].startswith("/proc"):
is_list_rule = True
data.append({"type": Config.RULE_TYPE_SIMPLE, "operand": Config.OPERAND_PROCESS_PATH, "data": str(self._con.process_path)})

Expand Down

0 comments on commit 1d2c070

Please sign in to comment.