fix(sinsp): invalid threads shoudln't be in a pid namespace

Signed-off-by: Andrea Terzolo <[email protected]>
falcosecurity · Jun 20, 2024 · 1bd5782 · 1bd5782
1 parent 3c1264c
commit 1bd5782
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/userspace/libsinsp/threadinfo.h b/userspace/libsinsp/threadinfo.h
@@ -198,7 +198,7 @@ class SINSP_PUBLIC sinsp_threadinfo : public libsinsp::state::table_entry
 	*/
 	inline bool is_in_pid_namespace() const
 	{
-		return (m_flags & PPM_CL_CHILD_IN_PIDNS || m_tid != m_vtid);
+		return (m_flags & PPM_CL_CHILD_IN_PIDNS || (m_tid != m_vtid && m_vtid >= 0));
 	}
 
 	/*!