feat(userspace): add gid field parsing support for exec* family

Signed-off-by: Leonardo Di Giovanna <[email protected]>
ekoops · Dec 16, 2024 · 19e64eb · 19e64eb
1 parent ddda902
commit 19e64eb
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/userspace/libsinsp/parsers.cpp b/userspace/libsinsp/parsers.cpp
@@ -2205,6 +2205,11 @@ void sinsp_parser::parse_execve_exit(sinsp_evt *evt) {
 		evt->get_tinfo()->m_pgid = -1;
 	}
 
+	// Get gid
+	if(evt->get_num_params() > 29) {
+		evt->get_tinfo()->set_group(evt->get_param(29)->as<uint32_t>());
+	}
+
 	//
 	// execve starts with a clean fd list, so we get rid of the fd list that clone
 	// copied from the parent