From c34b252db05a1190ced573e568cfdf2c55e9639a Mon Sep 17 00:00:00 2001
From: Christoph Wurm <cw@elastic.co>
Date: Wed, 26 Dec 2018 20:32:51 +0000
Subject: [PATCH 1/8] Add uid and gid for darwin.

---
 providers/darwin/process_darwin_amd64.go | 7 +++++++
 types/process.go                         | 6 ++++++
 2 files changed, 13 insertions(+)

diff --git a/providers/darwin/process_darwin_amd64.go b/providers/darwin/process_darwin_amd64.go
index 24e3c32f..7701e64e 100644
--- a/providers/darwin/process_darwin_amd64.go
+++ b/providers/darwin/process_darwin_amd64.go
@@ -28,6 +28,7 @@ import (
 	"bytes"
 	"encoding/binary"
 	"os"
+	"strconv"
 	"time"
 	"unsafe"
 
@@ -84,6 +85,12 @@ func (p *process) Info() (types.ProcessInfo, error) {
 		Args: p.args,
 		StartTime: time.Unix(int64(task.Pbsd.Pbi_start_tvsec),
 			int64(task.Pbsd.Pbi_start_tvusec)*int64(time.Microsecond)),
+		UID:   strconv.Itoa(int(task.Pbsd.Pbi_uid)),
+		RUID:  strconv.Itoa(int(task.Pbsd.Pbi_ruid)),
+		SVUID: strconv.Itoa(int(task.Pbsd.Pbi_svuid)),
+		GID:   strconv.Itoa(int(task.Pbsd.Pbi_gid)),
+		RGID:  strconv.Itoa(int(task.Pbsd.Pbi_rgid)),
+		SVGID: strconv.Itoa(int(task.Pbsd.Pbi_svgid)),
 	}, nil
 }
 
diff --git a/types/process.go b/types/process.go
index fce67bad..dda3e9dd 100644
--- a/types/process.go
+++ b/types/process.go
@@ -33,6 +33,12 @@ type ProcessInfo struct {
 	Exe       string    `json:"exe"`
 	Args      []string  `json:"args"`
 	StartTime time.Time `json:"start_time"`
+	UID       string    `json:"uid"`
+	RUID      string    `json:"ruid"`
+	SVUID     string    `json:"svuid"`
+	GID       string    `json:"gid"`
+	RGID      string    `json:"rgid"`
+	SVGID     string    `json:"svgid"`
 }
 
 type Environment interface {

From 191df629e0b5f9a3923256c6d8f00b6a1f2ff5c5 Mon Sep 17 00:00:00 2001
From: Christoph Wurm <cw@elastic.co>
Date: Wed, 26 Dec 2018 23:48:04 +0000
Subject: [PATCH 2/8] Implement for Linux

---
 providers/darwin/process_darwin_amd64.go | 22 ++++++++++++++-----
 providers/linux/process_linux.go         | 28 ++++++++++++++++++++++++
 system_test.go                           | 11 ++++++++++
 types/process.go                         | 18 ++++++++++-----
 4 files changed, 67 insertions(+), 12 deletions(-)

diff --git a/providers/darwin/process_darwin_amd64.go b/providers/darwin/process_darwin_amd64.go
index 7701e64e..66dec86a 100644
--- a/providers/darwin/process_darwin_amd64.go
+++ b/providers/darwin/process_darwin_amd64.go
@@ -85,12 +85,22 @@ func (p *process) Info() (types.ProcessInfo, error) {
 		Args: p.args,
 		StartTime: time.Unix(int64(task.Pbsd.Pbi_start_tvsec),
 			int64(task.Pbsd.Pbi_start_tvusec)*int64(time.Microsecond)),
-		UID:   strconv.Itoa(int(task.Pbsd.Pbi_uid)),
-		RUID:  strconv.Itoa(int(task.Pbsd.Pbi_ruid)),
-		SVUID: strconv.Itoa(int(task.Pbsd.Pbi_svuid)),
-		GID:   strconv.Itoa(int(task.Pbsd.Pbi_gid)),
-		RGID:  strconv.Itoa(int(task.Pbsd.Pbi_rgid)),
-		SVGID: strconv.Itoa(int(task.Pbsd.Pbi_svgid)),
+	}, nil
+}
+
+func (p *process) User() (types.UserInfo, error) {
+	var task procTaskAllInfo
+	if err := getProcTaskAllInfo(p.pid, &task); err != nil {
+		return types.UserInfo{}, err
+	}
+
+	return types.UserInfo{
+		UID:  strconv.Itoa(int(task.Pbsd.Pbi_ruid)),
+		EUID: strconv.Itoa(int(task.Pbsd.Pbi_uid)),
+		SUID: strconv.Itoa(int(task.Pbsd.Pbi_svuid)),
+		GID:  strconv.Itoa(int(task.Pbsd.Pbi_rgid)),
+		EGID: strconv.Itoa(int(task.Pbsd.Pbi_gid)),
+		SGID: strconv.Itoa(int(task.Pbsd.Pbi_svgid)),
 	}, nil
 }
 
diff --git a/providers/linux/process_linux.go b/providers/linux/process_linux.go
index 4c6c713b..06dc911e 100644
--- a/providers/linux/process_linux.go
+++ b/providers/linux/process_linux.go
@@ -22,6 +22,7 @@ import (
 	"io/ioutil"
 	"os"
 	"strconv"
+	"strings"
 	"time"
 
 	"github.com/prometheus/procfs"
@@ -204,6 +205,33 @@ func (p *process) Capabilities() (*types.CapabilityInfo, error) {
 	return readCapabilities(content)
 }
 
+func (p *process) User() (types.UserInfo, error) {
+	content, err := ioutil.ReadFile(p.path("status"))
+	if err != nil {
+		return types.UserInfo{}, err
+	}
+
+	var user types.UserInfo
+	err = parseKeyValue(content, ":", func(key, value []byte) error {
+		// See proc(5) for the format of /proc/[pid]/status
+		switch string(key) {
+		case "Uid":
+			ids := strings.Split(string(value), "\t")
+			user.UID = ids[0]
+			user.EUID = ids[1]
+			user.SUID = ids[2]
+		case "Gid":
+			ids := strings.Split(string(value), "\t")
+			user.GID = ids[0]
+			user.EGID = ids[1]
+			user.SGID = ids[2]
+		}
+		return nil
+	})
+
+	return user, nil
+}
+
 func ticksToDuration(ticks uint64) time.Duration {
 	seconds := float64(ticks) / float64(userHz) * float64(time.Second)
 	return time.Duration(int64(seconds))
diff --git a/system_test.go b/system_test.go
index 31fed9a7..1506f639 100644
--- a/system_test.go
+++ b/system_test.go
@@ -21,6 +21,7 @@ import (
 	"encoding/json"
 	"os"
 	"runtime"
+	"strconv"
 	"strings"
 	"testing"
 	"time"
@@ -130,6 +131,16 @@ func TestSelf(t *testing.T) {
 	}
 	assert.WithinDuration(t, info.StartTime, time.Now(), 10*time.Second)
 
+	user, err := process.User()
+	if err != nil {
+		t.Fatal(err)
+	}
+	output["process.user"] = user
+	assert.EqualValues(t, strconv.Itoa(os.Getuid()), user.UID)
+	assert.EqualValues(t, strconv.Itoa(os.Geteuid()), user.EUID)
+	assert.EqualValues(t, strconv.Itoa(os.Getgid()), user.GID)
+	assert.EqualValues(t, strconv.Itoa(os.Getegid()), user.EGID)
+
 	if v, ok := process.(types.Environment); ok {
 		expectedEnv := map[string]string{}
 		for _, keyValue := range os.Environ() {
diff --git a/types/process.go b/types/process.go
index dda3e9dd..cd1b9f13 100644
--- a/types/process.go
+++ b/types/process.go
@@ -23,6 +23,7 @@ type Process interface {
 	CPUTimer
 	Info() (ProcessInfo, error)
 	Memory() (MemoryInfo, error)
+	User() (UserInfo, error)
 }
 
 type ProcessInfo struct {
@@ -33,12 +34,17 @@ type ProcessInfo struct {
 	Exe       string    `json:"exe"`
 	Args      []string  `json:"args"`
 	StartTime time.Time `json:"start_time"`
-	UID       string    `json:"uid"`
-	RUID      string    `json:"ruid"`
-	SVUID     string    `json:"svuid"`
-	GID       string    `json:"gid"`
-	RGID      string    `json:"rgid"`
-	SVGID     string    `json:"svgid"`
+}
+
+// UserInfo contains information about the UID and GID
+// values of a process.
+type UserInfo struct {
+	UID  string `json:"uid"`  /* real user ID */
+	EUID string `json:"euid"` /* effective user ID */
+	SUID string `json:"suid"` /* saved user ID */
+	GID  string `json:"gid"`  /* real group ID */
+	EGID string `json:"egid"` /* effective group ID */
+	SGID string `json:"sgid"` /* saved group ID */
 }
 
 type Environment interface {

From 4ebc3f490af2698b44c0be476193201a62ec82bf Mon Sep 17 00:00:00 2001
From: Christoph Wurm <cw@elastic.co>
Date: Thu, 27 Dec 2018 18:45:55 +0000
Subject: [PATCH 3/8] Implement for Windows

---
 providers/windows/process_windows.go | 39 ++++++++++++++++++++++++++--
 system_test.go                       | 17 +++++++++---
 types/process.go                     |  4 +--
 3 files changed, 52 insertions(+), 8 deletions(-)

diff --git a/providers/windows/process_windows.go b/providers/windows/process_windows.go
index 4597d9a5..e9cbb108 100644
--- a/providers/windows/process_windows.go
+++ b/providers/windows/process_windows.go
@@ -26,10 +26,10 @@ import (
 	"unsafe"
 
 	"github.com/pkg/errors"
-
-	windows "github.com/elastic/go-windows"
+	syswin "golang.org/x/sys/windows"
 
 	"github.com/elastic/go-sysinfo/types"
+	windows "github.com/elastic/go-windows"
 )
 
 var (
@@ -241,6 +241,41 @@ func (p *process) Info() (types.ProcessInfo, error) {
 	return p.info, nil
 }
 
+func (p *process) User() (types.UserInfo, error) {
+	handle, err := p.open()
+	if err != nil {
+		return types.UserInfo{}, err
+	}
+	defer syscall.CloseHandle(handle)
+
+	// Filling types.UserInfo
+	var token syswin.Token
+	syswin.OpenProcessToken(syswin.Handle(handle), syscall.TOKEN_QUERY, &token)
+	tokenUser, err := token.GetTokenUser()
+	if err != nil {
+		return types.UserInfo{}, errors.Wrapf(err, "GetTokenUser failed for PID %v", p.pid)
+	}
+
+	sid, err := tokenUser.User.Sid.String()
+	if err != nil {
+		return types.UserInfo{}, errors.Wrapf(err, "failed to look up user SID for PID %v", p.pid)
+	}
+
+	tokenGroup, err := token.GetTokenPrimaryGroup()
+	if err != nil {
+		return types.UserInfo{}, errors.Wrapf(err, "GetTokenPrimaryGroup failed for PID %v", p.pid)
+	}
+	gsid, err := tokenGroup.PrimaryGroup.String()
+	if err != nil {
+		return types.UserInfo{}, errors.Wrapf(err, "failed to look up primary group SID for PID %v", p.pid)
+	}
+
+	return types.UserInfo{
+		UID: sid,
+		GID: gsid,
+	}, nil
+}
+
 func (p *process) Memory() (types.MemoryInfo, error) {
 	handle, err := p.open()
 	if err != nil {
diff --git a/system_test.go b/system_test.go
index 1506f639..7b135b22 100644
--- a/system_test.go
+++ b/system_test.go
@@ -20,6 +20,7 @@ package sysinfo
 import (
 	"encoding/json"
 	"os"
+	osUser "os/user"
 	"runtime"
 	"strconv"
 	"strings"
@@ -136,10 +137,18 @@ func TestSelf(t *testing.T) {
 		t.Fatal(err)
 	}
 	output["process.user"] = user
-	assert.EqualValues(t, strconv.Itoa(os.Getuid()), user.UID)
-	assert.EqualValues(t, strconv.Itoa(os.Geteuid()), user.EUID)
-	assert.EqualValues(t, strconv.Itoa(os.Getgid()), user.GID)
-	assert.EqualValues(t, strconv.Itoa(os.Getegid()), user.EGID)
+
+	currentUser, err := osUser.Current()
+	if err != nil {
+		t.Fatal(err)
+	}
+	assert.EqualValues(t, currentUser.Uid, user.UID)
+	assert.EqualValues(t, currentUser.Gid, user.GID)
+
+	if runtime.GOOS != "windows" {
+		assert.EqualValues(t, strconv.Itoa(os.Geteuid()), user.EUID)
+		assert.EqualValues(t, strconv.Itoa(os.Getegid()), user.EGID)
+	}
 
 	if v, ok := process.(types.Environment); ok {
 		expectedEnv := map[string]string{}
diff --git a/types/process.go b/types/process.go
index cd1b9f13..063e4205 100644
--- a/types/process.go
+++ b/types/process.go
@@ -39,10 +39,10 @@ type ProcessInfo struct {
 // UserInfo contains information about the UID and GID
 // values of a process.
 type UserInfo struct {
-	UID  string `json:"uid"`  /* real user ID */
+	UID  string `json:"uid"`  /* real user ID (user SID on Windows) */
 	EUID string `json:"euid"` /* effective user ID */
 	SUID string `json:"suid"` /* saved user ID */
-	GID  string `json:"gid"`  /* real group ID */
+	GID  string `json:"gid"`  /* real group ID (primary group SID on Windows) */
 	EGID string `json:"egid"` /* effective group ID */
 	SGID string `json:"sgid"` /* saved group ID */
 }

From 7cef7dbdad55ec572e907dcbc875610c3596fb05 Mon Sep 17 00:00:00 2001
From: Christoph Wurm <cw@elastic.co>
Date: Wed, 2 Jan 2019 11:59:59 +0000
Subject: [PATCH 4/8] Lowercase fields and add commentary.

---
 providers/darwin/process_darwin_amd64.go | 12 ++++-----
 providers/linux/process_linux.go         | 12 ++++-----
 providers/windows/process_windows.go     |  4 +--
 system_test.go                           |  8 +++---
 types/process.go                         | 31 +++++++++++++++++++-----
 5 files changed, 43 insertions(+), 24 deletions(-)

diff --git a/providers/darwin/process_darwin_amd64.go b/providers/darwin/process_darwin_amd64.go
index 66dec86a..806e729a 100644
--- a/providers/darwin/process_darwin_amd64.go
+++ b/providers/darwin/process_darwin_amd64.go
@@ -95,12 +95,12 @@ func (p *process) User() (types.UserInfo, error) {
 	}
 
 	return types.UserInfo{
-		UID:  strconv.Itoa(int(task.Pbsd.Pbi_ruid)),
-		EUID: strconv.Itoa(int(task.Pbsd.Pbi_uid)),
-		SUID: strconv.Itoa(int(task.Pbsd.Pbi_svuid)),
-		GID:  strconv.Itoa(int(task.Pbsd.Pbi_rgid)),
-		EGID: strconv.Itoa(int(task.Pbsd.Pbi_gid)),
-		SGID: strconv.Itoa(int(task.Pbsd.Pbi_svgid)),
+		Uid:  strconv.Itoa(int(task.Pbsd.Pbi_ruid)),
+		Euid: strconv.Itoa(int(task.Pbsd.Pbi_uid)),
+		Suid: strconv.Itoa(int(task.Pbsd.Pbi_svuid)),
+		Gid:  strconv.Itoa(int(task.Pbsd.Pbi_rgid)),
+		Egid: strconv.Itoa(int(task.Pbsd.Pbi_gid)),
+		Sgid: strconv.Itoa(int(task.Pbsd.Pbi_svgid)),
 	}, nil
 }
 
diff --git a/providers/linux/process_linux.go b/providers/linux/process_linux.go
index 06dc911e..f16c5950 100644
--- a/providers/linux/process_linux.go
+++ b/providers/linux/process_linux.go
@@ -217,14 +217,14 @@ func (p *process) User() (types.UserInfo, error) {
 		switch string(key) {
 		case "Uid":
 			ids := strings.Split(string(value), "\t")
-			user.UID = ids[0]
-			user.EUID = ids[1]
-			user.SUID = ids[2]
+			user.Uid = ids[0]
+			user.Euid = ids[1]
+			user.Suid = ids[2]
 		case "Gid":
 			ids := strings.Split(string(value), "\t")
-			user.GID = ids[0]
-			user.EGID = ids[1]
-			user.SGID = ids[2]
+			user.Gid = ids[0]
+			user.Egid = ids[1]
+			user.Sgid = ids[2]
 		}
 		return nil
 	})
diff --git a/providers/windows/process_windows.go b/providers/windows/process_windows.go
index e9cbb108..645244db 100644
--- a/providers/windows/process_windows.go
+++ b/providers/windows/process_windows.go
@@ -271,8 +271,8 @@ func (p *process) User() (types.UserInfo, error) {
 	}
 
 	return types.UserInfo{
-		UID: sid,
-		GID: gsid,
+		Uid: sid,
+		Gid: gsid,
 	}, nil
 }
 
diff --git a/system_test.go b/system_test.go
index 7b135b22..074d8c69 100644
--- a/system_test.go
+++ b/system_test.go
@@ -142,12 +142,12 @@ func TestSelf(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	assert.EqualValues(t, currentUser.Uid, user.UID)
-	assert.EqualValues(t, currentUser.Gid, user.GID)
+	assert.EqualValues(t, currentUser.Uid, user.Uid)
+	assert.EqualValues(t, currentUser.Gid, user.Gid)
 
 	if runtime.GOOS != "windows" {
-		assert.EqualValues(t, strconv.Itoa(os.Geteuid()), user.EUID)
-		assert.EqualValues(t, strconv.Itoa(os.Getegid()), user.EGID)
+		assert.EqualValues(t, strconv.Itoa(os.Geteuid()), user.Euid)
+		assert.EqualValues(t, strconv.Itoa(os.Getegid()), user.Egid)
 	}
 
 	if v, ok := process.(types.Environment); ok {
diff --git a/types/process.go b/types/process.go
index 063e4205..3b06c1df 100644
--- a/types/process.go
+++ b/types/process.go
@@ -39,12 +39,31 @@ type ProcessInfo struct {
 // UserInfo contains information about the UID and GID
 // values of a process.
 type UserInfo struct {
-	UID  string `json:"uid"`  /* real user ID (user SID on Windows) */
-	EUID string `json:"euid"` /* effective user ID */
-	SUID string `json:"suid"` /* saved user ID */
-	GID  string `json:"gid"`  /* real group ID (primary group SID on Windows) */
-	EGID string `json:"egid"` /* effective group ID */
-	SGID string `json:"sgid"` /* saved group ID */
+	// Uid is the user ID.
+	// On Linux and Darwin (macOS) this is the real user ID.
+	// On Windows, this is a security identifier (SID).
+	Uid string `json:"uid"`
+
+	// On Linux and Darwin (macOS) this is the effective user ID.
+	// On Windows, this is empty.
+	Euid string `json:"euid"`
+
+	// On Linux and Darwin (macOS) this is the saved user ID.
+	// On Windows, this is empty.
+	Suid string `json:"suid"`
+
+	// Gid is the primary group ID.
+	// On Linux and Darwin (macOS) this is the real group ID.
+	// On Windows, this is a security identifier (SID).
+	Gid string `json:"gid"`
+
+	// On Linux and Darwin (macOS) this is the effective group ID.
+	// On Windows, this is empty.
+	Egid string `json:"egid"`
+
+	// On Linux and Darwin (macOS) this is the saved group ID.
+	// On Windows, this is empty.
+	Sgid string `json:"sgid"`
 }
 
 type Environment interface {

From 6a87627c330064b3156d58ec61c95dd5b550da06 Mon Sep 17 00:00:00 2001
From: Christoph Wurm <cw@elastic.co>
Date: Wed, 2 Jan 2019 12:09:52 +0000
Subject: [PATCH 5/8] Close handle.

---
 providers/windows/process_windows.go | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/providers/windows/process_windows.go b/providers/windows/process_windows.go
index 645244db..d987d158 100644
--- a/providers/windows/process_windows.go
+++ b/providers/windows/process_windows.go
@@ -248,10 +248,10 @@ func (p *process) User() (types.UserInfo, error) {
 	}
 	defer syscall.CloseHandle(handle)
 
-	// Filling types.UserInfo
-	var token syswin.Token
-	syswin.OpenProcessToken(syswin.Handle(handle), syscall.TOKEN_QUERY, &token)
-	tokenUser, err := token.GetTokenUser()
+	var accessToken syswin.Token
+	syswin.OpenProcessToken(syswin.Handle(handle), syscall.TOKEN_QUERY, &accessToken)
+	defer accessToken.Close()
+	tokenUser, err := accessToken.GetTokenUser()
 	if err != nil {
 		return types.UserInfo{}, errors.Wrapf(err, "GetTokenUser failed for PID %v", p.pid)
 	}
@@ -261,7 +261,7 @@ func (p *process) User() (types.UserInfo, error) {
 		return types.UserInfo{}, errors.Wrapf(err, "failed to look up user SID for PID %v", p.pid)
 	}
 
-	tokenGroup, err := token.GetTokenPrimaryGroup()
+	tokenGroup, err := accessToken.GetTokenPrimaryGroup()
 	if err != nil {
 		return types.UserInfo{}, errors.Wrapf(err, "GetTokenPrimaryGroup failed for PID %v", p.pid)
 	}

From 1c14de4388529e5a0b068a1face80108191ce7d8 Mon Sep 17 00:00:00 2001
From: Christoph Wurm <cw@elastic.co>
Date: Wed, 2 Jan 2019 13:05:22 +0000
Subject: [PATCH 6/8] Small changes.

---
 providers/windows/process_windows.go | 19 ++++++++++++-------
 types/process.go                     |  6 ++++--
 2 files changed, 16 insertions(+), 9 deletions(-)

diff --git a/providers/windows/process_windows.go b/providers/windows/process_windows.go
index d987d158..062fa836 100644
--- a/providers/windows/process_windows.go
+++ b/providers/windows/process_windows.go
@@ -28,8 +28,9 @@ import (
 	"github.com/pkg/errors"
 	syswin "golang.org/x/sys/windows"
 
-	"github.com/elastic/go-sysinfo/types"
 	windows "github.com/elastic/go-windows"
+
+	"github.com/elastic/go-sysinfo/types"
 )
 
 var (
@@ -244,30 +245,34 @@ func (p *process) Info() (types.ProcessInfo, error) {
 func (p *process) User() (types.UserInfo, error) {
 	handle, err := p.open()
 	if err != nil {
-		return types.UserInfo{}, err
+		return types.UserInfo{}, errors.Wrap(err, "OpenProcess failed")
 	}
 	defer syscall.CloseHandle(handle)
 
 	var accessToken syswin.Token
-	syswin.OpenProcessToken(syswin.Handle(handle), syscall.TOKEN_QUERY, &accessToken)
+	err = syswin.OpenProcessToken(syswin.Handle(handle), syscall.TOKEN_QUERY, &accessToken)
+	if err != nil {
+		return types.UserInfo{}, errors.Wrap(err, "OpenProcessToken failed")
+	}
 	defer accessToken.Close()
+
 	tokenUser, err := accessToken.GetTokenUser()
 	if err != nil {
-		return types.UserInfo{}, errors.Wrapf(err, "GetTokenUser failed for PID %v", p.pid)
+		return types.UserInfo{}, errors.Wrap(err, "GetTokenUser failed")
 	}
 
 	sid, err := tokenUser.User.Sid.String()
 	if err != nil {
-		return types.UserInfo{}, errors.Wrapf(err, "failed to look up user SID for PID %v", p.pid)
+		return types.UserInfo{}, errors.Wrap(err, "failed to look up user SID")
 	}
 
 	tokenGroup, err := accessToken.GetTokenPrimaryGroup()
 	if err != nil {
-		return types.UserInfo{}, errors.Wrapf(err, "GetTokenPrimaryGroup failed for PID %v", p.pid)
+		return types.UserInfo{}, errors.Wrap(err, "GetTokenPrimaryGroup failed")
 	}
 	gsid, err := tokenGroup.PrimaryGroup.String()
 	if err != nil {
-		return types.UserInfo{}, errors.Wrapf(err, "failed to look up primary group SID for PID %v", p.pid)
+		return types.UserInfo{}, errors.Wrap(err, "failed to look up primary group SID")
 	}
 
 	return types.UserInfo{
diff --git a/types/process.go b/types/process.go
index 3b06c1df..343f93f8 100644
--- a/types/process.go
+++ b/types/process.go
@@ -41,7 +41,8 @@ type ProcessInfo struct {
 type UserInfo struct {
 	// Uid is the user ID.
 	// On Linux and Darwin (macOS) this is the real user ID.
-	// On Windows, this is a security identifier (SID).
+	// On Windows, this is the security identifier (SID) of the
+	// user account of the process access token.
 	Uid string `json:"uid"`
 
 	// On Linux and Darwin (macOS) this is the effective user ID.
@@ -54,7 +55,8 @@ type UserInfo struct {
 
 	// Gid is the primary group ID.
 	// On Linux and Darwin (macOS) this is the real group ID.
-	// On Windows, this is a security identifier (SID).
+	// On Windows, this is the security identifier (SID) of the
+	// primary group of the process access token.
 	Gid string `json:"gid"`
 
 	// On Linux and Darwin (macOS) this is the effective group ID.

From ec04f9646478fe34cc304a7ca3f9b202f483cde5 Mon Sep 17 00:00:00 2001
From: Christoph Wurm <cw@elastic.co>
Date: Thu, 3 Jan 2019 13:35:26 +0000
Subject: [PATCH 7/8] Capitalize fields.

---
 providers/darwin/process_darwin_amd64.go | 12 ++++++------
 providers/linux/process_linux.go         | 12 ++++++------
 providers/windows/process_windows.go     |  4 ++--
 system_test.go                           |  8 ++++----
 types/process.go                         | 16 ++++++++--------
 5 files changed, 26 insertions(+), 26 deletions(-)

diff --git a/providers/darwin/process_darwin_amd64.go b/providers/darwin/process_darwin_amd64.go
index 806e729a..66dec86a 100644
--- a/providers/darwin/process_darwin_amd64.go
+++ b/providers/darwin/process_darwin_amd64.go
@@ -95,12 +95,12 @@ func (p *process) User() (types.UserInfo, error) {
 	}
 
 	return types.UserInfo{
-		Uid:  strconv.Itoa(int(task.Pbsd.Pbi_ruid)),
-		Euid: strconv.Itoa(int(task.Pbsd.Pbi_uid)),
-		Suid: strconv.Itoa(int(task.Pbsd.Pbi_svuid)),
-		Gid:  strconv.Itoa(int(task.Pbsd.Pbi_rgid)),
-		Egid: strconv.Itoa(int(task.Pbsd.Pbi_gid)),
-		Sgid: strconv.Itoa(int(task.Pbsd.Pbi_svgid)),
+		UID:  strconv.Itoa(int(task.Pbsd.Pbi_ruid)),
+		EUID: strconv.Itoa(int(task.Pbsd.Pbi_uid)),
+		SUID: strconv.Itoa(int(task.Pbsd.Pbi_svuid)),
+		GID:  strconv.Itoa(int(task.Pbsd.Pbi_rgid)),
+		EGID: strconv.Itoa(int(task.Pbsd.Pbi_gid)),
+		SGID: strconv.Itoa(int(task.Pbsd.Pbi_svgid)),
 	}, nil
 }
 
diff --git a/providers/linux/process_linux.go b/providers/linux/process_linux.go
index f16c5950..06dc911e 100644
--- a/providers/linux/process_linux.go
+++ b/providers/linux/process_linux.go
@@ -217,14 +217,14 @@ func (p *process) User() (types.UserInfo, error) {
 		switch string(key) {
 		case "Uid":
 			ids := strings.Split(string(value), "\t")
-			user.Uid = ids[0]
-			user.Euid = ids[1]
-			user.Suid = ids[2]
+			user.UID = ids[0]
+			user.EUID = ids[1]
+			user.SUID = ids[2]
 		case "Gid":
 			ids := strings.Split(string(value), "\t")
-			user.Gid = ids[0]
-			user.Egid = ids[1]
-			user.Sgid = ids[2]
+			user.GID = ids[0]
+			user.EGID = ids[1]
+			user.SGID = ids[2]
 		}
 		return nil
 	})
diff --git a/providers/windows/process_windows.go b/providers/windows/process_windows.go
index 062fa836..d4765a94 100644
--- a/providers/windows/process_windows.go
+++ b/providers/windows/process_windows.go
@@ -276,8 +276,8 @@ func (p *process) User() (types.UserInfo, error) {
 	}
 
 	return types.UserInfo{
-		Uid: sid,
-		Gid: gsid,
+		UID: sid,
+		GID: gsid,
 	}, nil
 }
 
diff --git a/system_test.go b/system_test.go
index 074d8c69..7b135b22 100644
--- a/system_test.go
+++ b/system_test.go
@@ -142,12 +142,12 @@ func TestSelf(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	assert.EqualValues(t, currentUser.Uid, user.Uid)
-	assert.EqualValues(t, currentUser.Gid, user.Gid)
+	assert.EqualValues(t, currentUser.Uid, user.UID)
+	assert.EqualValues(t, currentUser.Gid, user.GID)
 
 	if runtime.GOOS != "windows" {
-		assert.EqualValues(t, strconv.Itoa(os.Geteuid()), user.Euid)
-		assert.EqualValues(t, strconv.Itoa(os.Getegid()), user.Egid)
+		assert.EqualValues(t, strconv.Itoa(os.Geteuid()), user.EUID)
+		assert.EqualValues(t, strconv.Itoa(os.Getegid()), user.EGID)
 	}
 
 	if v, ok := process.(types.Environment); ok {
diff --git a/types/process.go b/types/process.go
index 343f93f8..a12b344a 100644
--- a/types/process.go
+++ b/types/process.go
@@ -39,33 +39,33 @@ type ProcessInfo struct {
 // UserInfo contains information about the UID and GID
 // values of a process.
 type UserInfo struct {
-	// Uid is the user ID.
+	// UID is the user ID.
 	// On Linux and Darwin (macOS) this is the real user ID.
 	// On Windows, this is the security identifier (SID) of the
 	// user account of the process access token.
-	Uid string `json:"uid"`
+	UID string `json:"uid"`
 
 	// On Linux and Darwin (macOS) this is the effective user ID.
 	// On Windows, this is empty.
-	Euid string `json:"euid"`
+	EUID string `json:"euid"`
 
 	// On Linux and Darwin (macOS) this is the saved user ID.
 	// On Windows, this is empty.
-	Suid string `json:"suid"`
+	SUID string `json:"suid"`
 
-	// Gid is the primary group ID.
+	// GID is the primary group ID.
 	// On Linux and Darwin (macOS) this is the real group ID.
 	// On Windows, this is the security identifier (SID) of the
 	// primary group of the process access token.
-	Gid string `json:"gid"`
+	GID string `json:"gid"`
 
 	// On Linux and Darwin (macOS) this is the effective group ID.
 	// On Windows, this is empty.
-	Egid string `json:"egid"`
+	EGID string `json:"egid"`
 
 	// On Linux and Darwin (macOS) this is the saved group ID.
 	// On Windows, this is empty.
-	Sgid string `json:"sgid"`
+	SGID string `json:"sgid"`
 }
 
 type Environment interface {

From 5f5016b2946caefa6930e18a541e8be1b879d420 Mon Sep 17 00:00:00 2001
From: Christoph Wurm <cw@elastic.co>
Date: Thu, 3 Jan 2019 13:37:33 +0000
Subject: [PATCH 8/8] Add length check.

---
 providers/linux/process_linux.go | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/providers/linux/process_linux.go b/providers/linux/process_linux.go
index 06dc911e..efe04f5e 100644
--- a/providers/linux/process_linux.go
+++ b/providers/linux/process_linux.go
@@ -217,14 +217,18 @@ func (p *process) User() (types.UserInfo, error) {
 		switch string(key) {
 		case "Uid":
 			ids := strings.Split(string(value), "\t")
-			user.UID = ids[0]
-			user.EUID = ids[1]
-			user.SUID = ids[2]
+			if len(ids) >= 3 {
+				user.UID = ids[0]
+				user.EUID = ids[1]
+				user.SUID = ids[2]
+			}
 		case "Gid":
 			ids := strings.Split(string(value), "\t")
-			user.GID = ids[0]
-			user.EGID = ids[1]
-			user.SGID = ids[2]
+			if len(ids) >= 3 {
+				user.GID = ids[0]
+				user.EGID = ids[1]
+				user.SGID = ids[2]
+			}
 		}
 		return nil
 	})