From 8b7ea120670525d9ac7f1698ae7482d691e840a4 Mon Sep 17 00:00:00 2001
From: Radovan Sroka <rsroka@redhat.com>
Date: Mon, 9 Nov 2020 17:02:22 +0100
Subject: [PATCH] Added check for " (deleted)" suffix in get_program_from_fd()
 (#97)

- get rid of this suffix

Signed-off-by: Radovan Sroka <rsroka@redhat.com>

Removed strstr (#102)
---
 src/library/process.c | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/src/library/process.c b/src/library/process.c
index edd2cca..6406610 100644
--- a/src/library/process.c
+++ b/src/library/process.c
@@ -146,10 +146,24 @@ char *get_program_from_pid(pid_t pid, size_t blen, char *buf)
 
 		return buf;
 	}
+
+	size_t len = 0;
 	if ((size_t)path_len < blen)
-		buf[path_len] = 0;
+		len = path_len;
 	else
-		buf[blen-1] = '\0';
+		len = blen-1;
+
+	buf[len] = '\0';
+	// some binaries can be deleted after execution
+	// then we need to delete the suffix so they are
+	// trusted even after deletion
+
+	// strlen(" deleted") == 10
+	if (buf[len-1] == ')' && len > 10) {
+
+		if (strcmp(&buf[len - 10], " (deleted)") == 0)
+			buf[len - 10] = '\0';
+	}
 
 	return buf;
 }
-- 
2.26.2