You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository has been archived by the owner on Oct 23, 2023. It is now read-only.
Note that arguments here are separated by spaces, not null bytes. This means that splitting arguments fails inside def cmdline(self), and therefore matching by cmdlines ends up failing.
For context, I'm trying to modify the nice value of the Discord renderer process, specifically, with a rule such as:
Certain processes, such as Discord, modify their /proc/pid/cmdline file (?) to contain spaces instead of null bytes:
12:42 /proc/528292 $ cat cmdline | xxd 00000000: 2f6f 7074 2f64 6973 636f 7264 2f44 6973 /opt/discord/Dis 00000010: 636f 7264 202d 2d74 7970 653d 7265 6e64 cord --type=rend 00000020: 6572 6572 202d 2d63 7261 7368 7061 642d erer --crashpad- 00000030: 6861 6e64 6c65 722d 7069 643d 3532 3832 handler-pid=5282 00000040: 3139 202d 2d65 6e61 626c 652d 6372 6173 19 --enable-cras 00000050: 682d 7265 706f 7274 6572 3d62 3632 3039 h-reporter=b6209 00000060: 6135 342d 6565 6432 2d34 3134 382d 6138 a54-eed2-4148-a8 ... 000002c0: 6572 7300 ers.
Note that arguments here are separated by spaces, not null bytes. This means that splitting arguments fails inside
def cmdline(self)
, and therefore matching bycmdlines
ends up failing.For context, I'm trying to modify the nice value of the Discord renderer process, specifically, with a rule such as:
Splitting by both spaces and null bytes fixes the issue in this case:
However do note that this will not handle the cases where there are spaces inside the arguments.
The text was updated successfully, but these errors were encountered: