fix(sinsp): invalid threads shoudln't be in a pid namespace

Signed-off-by: Andrea Terzolo <[email protected]>
falcosecurity · Jun 20, 2024 · 4172892 · 4172892
1 parent 3c1264c
commit 4172892
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/userspace/libsinsp/threadinfo.h b/userspace/libsinsp/threadinfo.h
@@ -198,7 +198,8 @@ class SINSP_PUBLIC sinsp_threadinfo : public libsinsp::state::table_entry
 	*/
 	inline bool is_in_pid_namespace() const
 	{
-		return (m_flags & PPM_CL_CHILD_IN_PIDNS || m_tid != m_vtid);
+		// m_tid should be always valid because we read it from the scap event header
+		return (m_flags & PPM_CL_CHILD_IN_PIDNS || (m_tid != m_vtid && m_vtid >= 0));
 	}
 
 	/*!