{"action":"created","issue":{"url":"https://api.github.com/repos/facebook/osquery/issues/1356","labels_url":"https://api.github.com/repos/facebook/osquery/issues/1356/labels{/name}","comments_url":"https://api.github.com/repos/facebook/osquery/issues/1356/comments","events_url":"https://api.github.com/repos/facebook/osquery/issues/1356/events","html_url":"https://github.com/facebook/osquery/issues/1356","id":95801975,"number":1356,"title":"Process environment parsing on Linux","user":{"login":"mcarpenter","id":167893,"avatar_url":"https://avatars.githubusercontent.com/u/167893?v=3","gravatar_id":"","url":"https://api.github.com/users/mcarpenter","html_url":"https://github.com/mcarpenter","followers_url":"https://api.github.com/users/mcarpenter/followers","following_url":"https://api.github.com/users/mcarpenter/following{/other_user}","gists_url":"https://api.github.com/users/mcarpenter/gists{/gist_id}","starred_url":"https://api.github.com/users/mcarpenter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mcarpenter/subscriptions","organizations_url":"https://api.github.com/users/mcarpenter/orgs","repos_url":"https://api.github.com/users/mcarpenter/repos","events_url":"https://api.github.com/users/mcarpenter/events{/privacy}","received_events_url":"https://api.github.com/users/mcarpenter/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/facebook/osquery/labels/bug","name":"bug","color":"fc2929"},{"url":"https://api.github.com/repos/facebook/osquery/labels/linux","name":"linux","color":"d4c5f9"},{"url":"https://api.github.com/repos/facebook/osquery/labels/virtual%20tables","name":"virtual tables","color":"bfd4f2"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-07-18T08:07:45Z","updated_at":"2015-07-18T23:56:05Z","closed_at":null,"body":"Hi,\r\n\r\nLooking at the process environment on Linux:\r\n\r\nosquery/tables/system/linux/processes.cpp:\r\n\r\n    59 void genProcessEnvironment(const std::string& pid, QueryData& results) {\r\n    60   auto attr = getProcAttr(\"environ\", pid);\r\n    61 \r\n    62   std::string content;\r\n    63   readFile(attr, content);\r\n    64   for (const auto& buf : osquery::split(content, \"\\n\")) {\r\n    65     size_t idx = buf.find_first_of(\"=\");\r\n\r\nBut `environ(5)` is zero-byte (not newline) delimited (line 64). (If `environ` really was newline delimited (was it ever?) naughty processes could deceive osquery...). Consequently, as it stands, osquery's output gets truncated at the end of the first variable.\r\n\r\n    vagrant@vagrant-ubuntu-trusty-64:/vagrant$ uname -a \r\n    Linux vagrant-ubuntu-trusty-64 3.13.0-53-generic #89-Ubuntu SMP Wed May 20 10:34:39 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux\r\n    vagrant@vagrant-ubuntu-trusty-64:/vagrant$ git log -1 --oneline\r\n    6bfe03f Merge pull request #1354 from theopolis/more_install\r\n    vagrant@vagrant-ubuntu-trusty-64:/vagrant$ osqueryi --line \"select key from process_envs where pid = $$\"\r\n      key = LANG\r\n    vagrant@vagrant-ubuntu-trusty-64:/vagrant$ strings /proc/$$/environ | wc -l\r\n    14\r\n    vagrant@vagrant-ubuntu-trusty-64:/vagrant$ strings /proc/$$/environ\r\n    LANG=en_US.UTF-8\r\n    USER=vagrant\r\n    LOGNAME=vagrant\r\n    HOME=/home/vagrant\r\n    PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games\r\n    MAIL=/var/mail/vagrant\r\n    SHELL=/bin/bash\r\n    SSH_CLIENT=10.0.2.2 60872 22\r\n    SSH_CONNECTION=10.0.2.2 60872 10.0.2.15 22\r\n    SSH_TTY=/dev/pts/0\r\n    TERM=xterm\r\n    DISPLAY=localhost:10.0\r\n    XDG_SESSION_ID=2\r\n    XDG_RUNTIME_DIR=/run/user/1000\r\n    vagrant@vagrant-ubuntu-trusty-64:/vagrant$ \r\n\r\n(FreeBSD and Darwin do not use the same mechanism so are not affected).\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/facebook/osquery/issues/comments/122605948","html_url":"https://github.com/facebook/osquery/issues/1356#issuecomment-122605948","issue_url":"https://api.github.com/repos/facebook/osquery/issues/1356","id":122605948,"user":{"login":"theopolis","id":981645,"avatar_url":"https://avatars.githubusercontent.com/u/981645?v=3","gravatar_id":"","url":"https://api.github.com/users/theopolis","html_url":"https://github.com/theopolis","followers_url":"https://api.github.com/users/theopolis/followers","following_url":"https://api.github.com/users/theopolis/following{/other_user}","gists_url":"https://api.github.com/users/theopolis/gists{/gist_id}","starred_url":"https://api.github.com/users/theopolis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/theopolis/subscriptions","organizations_url":"https://api.github.com/users/theopolis/orgs","repos_url":"https://api.github.com/users/theopolis/repos","events_url":"https://api.github.com/users/theopolis/events{/privacy}","received_events_url":"https://api.github.com/users/theopolis/received_events","type":"User","site_admin":false},"created_at":"2015-07-18T23:56:05Z","updated_at":"2015-07-18T23:56:05Z","body":"Great find! @mcarpenter, do you mind submitting a pull request to switch this back to `\\0` delimiting?"}}