diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..73301fc --- /dev/null +++ b/.gitignore @@ -0,0 +1,3 @@ +# Ignore build directory +build/ +*.egg-info/ \ No newline at end of file diff --git a/repeatfs/provenance/io_record.py b/repeatfs/provenance/io_record.py index 25499f3..46fbce2 100755 --- a/repeatfs/provenance/io_record.py +++ b/repeatfs/provenance/io_record.py @@ -28,7 +28,7 @@ def get(cls, descriptor, management, pid=None): """ Get IO for a descriptor and pid """ with management.lock: if descriptor not in cls._lookup: - return + return {} if pid is None else None if not pid: return cls._lookup[descriptor] diff --git a/repeatfs/provenance/process_record.py b/repeatfs/provenance/process_record.py index c6d3a75..367e063 100755 --- a/repeatfs/provenance/process_record.py +++ b/repeatfs/provenance/process_record.py @@ -34,7 +34,7 @@ def update(cls, pid, management, ignore_pipes=None): if pid in cls._lookup: # Update entry process_record = cls._lookup[pid] - process_record._update(ignore_pipes) + process_record._update(ignore_pipes=ignore_pipes) else: # Create and register new entry process_record = ProcessRecord(pid, management, ignore_pipes) @@ -184,6 +184,11 @@ def _update(self, force=False, ignore_pipes=None): # Record executable try: self.exe = os.readlink("/proc/{0}/exe".format(self.pid)) if self.pid > 1 else "" + # re-direction to the real path + if self.exe is not None and self.exe!="": + path=FileEntry.get_paths(self.exe, self.management.core.root, self.management.core.mount) + if path is not None and path['abs_real'] is not None: + self.exe=path['abs_real'] try: self.md5 = self.management._calculate_hash(self.exe) except (PermissionError, FileNotFoundError): diff --git a/repeatfs/provenance/replication.py b/repeatfs/provenance/replication.py index 3d1f367..138e7e2 100755 --- a/repeatfs/provenance/replication.py +++ b/repeatfs/provenance/replication.py @@ -368,6 +368,16 @@ def get_session_chains(self, filter_expanded): # Update remaining expand_remain.discard(parent_id) + + unexpandable = { + pid for pid in expand_remain + if not any( + tuple(str(p[k]) for k in ["phost", "parent_start", "parent_pid"]) == pid + for p in self.provenance["process"].values() + ) + } + session_children.update(unexpandable) + expand_remain -= unexpandable # Build chains for all session children for process_id in session_children: