fix: double quotes on spaces in Buffer::to_argv

kunai-common/src/buffer/user.rs

@@ -3,16 +3,22 @@ use core::str;
 use super::Buffer;
 
 impl<const N: usize> Buffer<N> {
-    pub fn to_command_line(&self) -> String {
-        self.to_argv().join(" ")
-    }
-
+    #[inline]
     pub fn to_argv(&self) -> Vec<String> {
         self.as_slice()
             .split(|&b| b == b'\0')
             // this must not panic as we are sure to have utf8 from kernel
             .map(|s| str::from_utf8(s).unwrap().to_string())
             .filter(|s| !s.is_empty())
+            .map(|s| {
+                if s.chars().any(|c| c.is_whitespace()) {
+                    // we wrap strings containg space between double quotes
+                    // but we also need to replace double quotes by escaped double quotes
+                    format!(r#""{}""#, s.replace(r#"""#, r#"\""#))
+                } else {
+                    s
+                }
+            })
             .collect()
     }
 }

kunai/src/bin/main.rs

@@ -802,13 +802,14 @@ impl<'s> EventConsumer<'s> {
         event: &bpf_events::ExecveEvent,
     ) -> UserEvent<ExecveData> {
         let ancestors = self.get_ancestors_string(&info);
+        let cli = self.get_command_line(info.process_key());
 
         let opt_mnt_ns = Self::task_mnt_ns(&event.info);
 
         let mut data = ExecveData {
             ancestors,
             parent_exe: self.get_parent_image(&info),
-            command_line: event.data.argv.to_command_line(),
+            command_line: cli,
             exe: self.get_hashes_with_ns(opt_mnt_ns, &cache::Path::from(&event.data.executable)),
             interpreter: None,
         };
@@ -831,7 +832,7 @@ impl<'s> EventConsumer<'s> {
         let data = CloneData {
             ancestors: self.get_ancestors_string(&info),
             exe: event.data.executable.to_path_buf().into(),
-            command_line: event.data.argv.to_command_line(),
+            command_line: self.get_command_line(info.process_key()),
             flags: event.data.flags,
         };
         UserEvent::new(data, info)
@@ -937,13 +938,11 @@ impl<'s> EventConsumer<'s> {
         let opt_mnt_ns = Self::task_mnt_ns(&event.info);
         let mmapped_hashes = self.get_hashes_with_ns(opt_mnt_ns, &cache::Path::from(&filename));
 
-        let ck = info.process_key();
-
-        let exe = self.get_exe(ck);
+        let (exe, command_line) = self.get_exe_and_command_line(&info);
 
         let data = kunai::events::MmapExecData {
             ancestors: self.get_ancestors_string(&info),
-            command_line: self.get_command_line(ck),
+            command_line,
             exe: exe.into(),
             mapped: mmapped_hashes,
         };
@@ -958,9 +957,7 @@ impl<'s> EventConsumer<'s> {
         event: &bpf_events::DnsQueryEvent,
     ) -> Vec<UserEvent<DnsQueryData>> {
         let mut out = vec![];
-        let ck = info.process_key();
-        let exe = self.get_exe(ck);
-        let command_line = self.get_command_line(ck);
+        let (exe, command_line) = self.get_exe_and_command_line(&info);
 
         let src: SockAddr = event.data.src.into();
         let dst: SockAddr = event.data.dst.into();