Filename regex is applied to the path and not only to the filename

As usual thanks so much for your awesome work on GRR!

When using list process flow, the option filename regex is also applied to the path and not only to the filename. Analysts aren’t aware of that and the documentation on the field is hiding that important information 😃

See ListProcessesArgs in the flows.proto file

https://github.com/google/grr/blob/5cef4e8e2f0d5df43ea4877e9c798e0bf60bfe74/grr/proto/grr_response_proto/flows.proto#L1435

The check is made against the “exe”-property of the process as seen in the processes flow implementation (_FilenameMatch).

https://github.com/google/grr/blob/0671ba57bc585c4e1baaabfafae001d19dcc397a/grr/server/grr_response_server/flows/general/processes.py#L39

Question: Would it be possible to extend the description that the regex is applied to the whole path?

Thanks in advance for your feedback.

---

While going through the code, I saw that you only use your match function once in IterateProcesses.

When using fetch binaries

https://github.com/google/grr/blob/0671ba57bc585c4e1baaabfafae001d19dcc397a/grr/server/grr_response_server/flows/general/processes.py#L62

vs the match for only listing processes

https://github.com/google/grr/blob/0671ba57bc585c4e1baaabfafae001d19dcc397a/grr/server/grr_response_server/flows/general/processes.py#L83

[Karneades]

FTR Fixed in https://github.com/google/grr/commit/768686c220a3c4173495e79a42d1a8915ab93caa. Thanks!

[max-vogler]

Thanks for raising the issue, Karneades. Much appreciated 👍

I have fixed the description in our internal version control system. The change will be pushed to GitHub in the next days.

As for your second note: It’s right that the match function should be reused. The whole logic in ListProcesses is somewhat convoluted, so that’s a bigger refactoring effort.