Handling "one session with only one process"

.gitignore

@@ -0,0 +1,3 @@
+# Ignore build directory
+build/
+*.egg-info/

repeatfs/provenance/io_record.py

@@ -28,7 +28,7 @@ def get(cls, descriptor, management, pid=None):
         """ Get IO for a descriptor and pid """
         with management.lock:
             if descriptor not in cls._lookup:
-                return
+                return {} if pid is None else None
 
             if not pid:
                 return cls._lookup[descriptor]

repeatfs/provenance/process_record.py

@@ -34,7 +34,7 @@ def update(cls, pid, management, ignore_pipes=None):
             if pid in cls._lookup:
                 # Update entry
                 process_record = cls._lookup[pid]
-                process_record._update(ignore_pipes)
+                process_record._update(ignore_pipes=ignore_pipes)
             else:
                 # Create and register new entry
                 process_record = ProcessRecord(pid, management, ignore_pipes)
@@ -184,6 +184,11 @@ def _update(self, force=False, ignore_pipes=None):
         # Record executable
         try:
             self.exe = os.readlink("/proc/{0}/exe".format(self.pid)) if self.pid > 1 else ""
+            # re-direction to the real path
+            if self.exe is not None and self.exe!="":
+                path=FileEntry.get_paths(self.exe, self.management.core.root, self.management.core.mount)
+                if path is not None and path['abs_real'] is not None:
+                    self.exe=path['abs_real']
             try:
                 self.md5 = self.management._calculate_hash(self.exe)
             except (PermissionError, FileNotFoundError):

repeatfs/provenance/replication.py

@@ -368,6 +368,16 @@ def get_session_chains(self, filter_expanded):
 
                     # Update remaining
                     expand_remain.discard(parent_id)
+
+            unexpandable = {
+                pid for pid in expand_remain
+                if not any(
+                    tuple(str(p[k]) for k in ["phost", "parent_start", "parent_pid"]) == pid
+                    for p in self.provenance["process"].values()
+                )
+            }
+            session_children.update(unexpandable)
+            expand_remain -= unexpandable
 
         # Build chains for all session children
         for process_id in session_children: