dissect.target 3.11.2.dev24__tar.gz → 3.11.2.dev26__tar.gz

{dissect.target-3.11.2.dev24/dissect.target.egg-info → dissect.target-3.11.2.dev26}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.11.2.dev24
+Version: 3.11.2.dev26
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect.target-3.11.2.dev24 → dissect.target-3.11.2.dev26}/dissect/target/loaders/local.py

@@ -13,8 +13,18 @@ from dissect.target.filesystems.dir import DirectoryFilesystem
 from dissect.target.helpers.utils import parse_path_uri
 from dissect.target.loader import Loader
 
+SOLARIS_DEV_DIR = Path("/dev/dsk")
 SOLARIS_DRIVE_REGEX = re.compile(r".+d\d+$")
-LINUX_DRIVE_REGEX = re.compile(r"([sh]d[a-z]$)|(fd\d+$)|(nvme\d+n\d+$)")
+
+LINUX_DEV_DIR = Path("/dev")
+LINUX_DRIVE_REGEX = re.compile(r"(([sh]|xv)d[a-z]$)|(fd\d+$)|(nvme\d+n\d+$)")
+VOLATILE_LINUX_PATHS = [
+    Path("/proc"),
+    Path("/sys"),
+]
+
+ESXI_DEV_DIR = Path("/vmfs/devices/disks")
+
 WINDOWS_ERROR_INSUFFICIENT_BUFFER = 0x7A
 WINDOWS_DRIVE_FIXED = 3
 
@@ -59,21 +69,35 @@ class LocalLoader(Loader):
 
 
 def map_linux_drives(target: Target):
-    """Map Linux raw disks.
+    """Map Linux raw disks and /proc and /sys.
 
     Iterate through /dev and match raw device names (not partitions).
+
+    /proc and /sys are mounted if they exists, allowing access to volatile files.
     """
-    for drive in Path("/dev").iterdir():
+    for drive in LINUX_DEV_DIR.iterdir():
         if LINUX_DRIVE_REGEX.match(drive.name):
             _add_disk_as_raw_container_to_target(drive, target)
 
+    # Volatile filesystems are not present when running on a local target's raw
+    # disks, so they are explicitly mounted here.
+    #
+    # Note that when running on a local target using a directory fs (through
+    # force-directory-fs or fallback-to-directory-fs), these filesystems are
+    # already present as they are usually mounted on the local system.
+    for volatile_path in VOLATILE_LINUX_PATHS:
+        if volatile_path.exists():
+            volatile_fs = DirectoryFilesystem(volatile_path)
+            target.filesystems.add(volatile_fs)
+            target.fs.mount(str(volatile_path), volatile_fs)
+
 
 def map_solaris_drives(target):
     """Map Solaris raw disks.
 
     Iterate through /dev/dsk and match raw device names (not slices or partitions).
     """
-    for drive in Path("/dev/dsk").iterdir():
+    for drive in SOLARIS_DEV_DIR.iterdir():
         if not SOLARIS_DRIVE_REGEX.match(drive.name):
             continue
         _add_disk_as_raw_container_to_target(drive, target)
@@ -84,7 +108,7 @@ def map_esxi_drives(target):
 
     Get all devices from /vmfs/devices/disks/* (not partitions).
     """
-    for drive in Path("/vmfs/devices/disks").glob("vml.*"):
+    for drive in ESXI_DEV_DIR.glob("vml.*"):
         if ":" in drive.name:
             continue
         _add_disk_as_raw_container_to_target(drive, target)

{dissect.target-3.11.2.dev24 → dissect.target-3.11.2.dev26/dissect.target.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.11.2.dev24
+Version: 3.11.2.dev26
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect.target-3.11.2.dev24 → dissect.target-3.11.2.dev26}/dissect.target.egg-info/requires.txt

@@ -7,7 +7,7 @@ dissect.ntfs<4.0.dev,>=3.4.dev
 dissect.regf<4.0.dev,>=3.3.dev
 dissect.util<4.0.dev,>=3.0.dev
 dissect.volume<4.0.dev,>=3.0.dev
-flow.record~=3.10
+flow.record~=3.12.0
 structlog
 
 [cb]

{dissect.target-3.11.2.dev24 → dissect.target-3.11.2.dev26}/pyproject.toml

@@ -34,7 +34,7 @@ dependencies = [
     "dissect.regf>=3.3.dev,<4.0.dev",
     "dissect.util>=3.0.dev,<4.0.dev",
     "dissect.volume>=3.0.dev,<4.0.dev",
-    "flow.record~=3.10",
+    "flow.record~=3.12.0",
     "structlog",
 ]
 dynamic = ["version"]

{dissect.target-3.11.2.dev24 → dissect.target-3.11.2.dev26}/tests/test_loaders_local.py

@@ -1,14 +1,18 @@
 import platform
 from pathlib import Path
-from unittest.mock import MagicMock, call, mock_open, patch
+from unittest.mock import MagicMock, call, create_autospec, mock_open, patch
 
 import pytest
 
+from dissect.target import Target
 from dissect.target.containers.raw import RawContainer
+from dissect.target.filesystems.dir import DirectoryFilesystem
 from dissect.target.loaders.local import (
+    LINUX_DEV_DIR,
     LINUX_DRIVE_REGEX,
     _add_disk_as_raw_container_to_target,
     _get_windows_drive_volumes,
+    map_linux_drives,
 )
 from dissect.target.target import TargetLogAdapter
 
@@ -43,23 +47,66 @@ def test_local_loader_skip_emulated_drive(extents: MagicMock, log: MagicMock, *a
 @pytest.mark.skipif(
     platform.system() == "Windows", reason="Assertion fails because of Unix-specific path. Needs to be fixed."
 )
-def test_local_loader_drive_skipping(mock_target):
-    mock = mock_open()
+def test__add_disk_as_raw_container_to_target(mock_target: Target) -> None:
     # Does it attempt to open the file and pass a raw container?
-    with patch("builtins.open", mock), patch.object(mock_target.disks, "add") as mock_method:
-        drive = Path("/xdev/fake")
+    mock = mock_open()
+    drive = Path("/xdev/fake")
+
+    with (
+        patch("builtins.open", mock),
+        patch.object(mock_target.disks, "add") as mock_method,
+    ):
         _add_disk_as_raw_container_to_target(drive, mock_target)
+
         assert isinstance(mock_method.call_args[0][0], RawContainer) is True
-    mock.assert_called_with(Path("/xdev/fake"), "rb")
+        mock.assert_called_with(drive, "rb")
+
 
+@pytest.mark.skipif(
+    platform.system() == "Windows", reason="Assertion fails because of Unix-specific path. Needs to be fixed."
+)
+def test__add_disk_as_raw_container_to_target_skip_fail(mock_target: Target) -> None:
     # Does it emit a warning instead of raising an exception?
+    mock = mock_open()
     mock.side_effect = IOError
-    with patch.object(TargetLogAdapter, "warning") as mock_method, patch("builtins.open", mock):
-        drive = Path("/xdev/fake")
+    drive = Path("/xdev/fake")
+
+    with (
+        patch.object(TargetLogAdapter, "warning") as mock_method,
+        patch("builtins.open", mock),
+    ):
         _add_disk_as_raw_container_to_target(drive, mock_target)
-        assert mock_method.call_args[0][0] == "Unable to open drive: /xdev/fake, skipped"
+
+        assert mock_method.call_args[0][0] == f"Unable to open drive: {str(drive)}, skipped"
         assert isinstance(mock_method.call_args[1]["exc_info"], OSError) is True
-    mock.assert_called_with(Path("/xdev/fake"), "rb")
+        mock.assert_called_with(drive, "rb")
+
+
+def test_map_linux_drives(mock_target: Target, tmp_path: Path) -> None:
+    mock_drive = LINUX_DEV_DIR.joinpath("sda")
+    mock_dev_dir = create_autospec(Path)
+    mock_dev_dir.iterdir.return_value = iter([mock_drive])
+
+    with (
+        patch("dissect.target.loaders.local.LINUX_DEV_DIR", mock_dev_dir),
+        patch(
+            "dissect.target.loaders.local._add_disk_as_raw_container_to_target",
+            autospec=True,
+        ) as mock_add_raw_disks,
+        patch("dissect.target.loaders.local.VOLATILE_LINUX_PATHS", [tmp_path]),
+        patch.object(mock_target.filesystems, "add", autospec=True) as mock_add_fs,
+        patch.object(mock_target.fs, "mount", autospec=True) as mock_mount,
+    ):
+        map_linux_drives(mock_target)
+
+        mock_add_raw_disks.assert_called_with(mock_drive, mock_target)
+
+        mock_add_fs.assert_called()
+        dir_fs = mock_add_fs.call_args[0][0]
+        assert isinstance(dir_fs, DirectoryFilesystem)
+        assert dir_fs.base_path == tmp_path
+
+        mock_mount.assert_called_with(str(tmp_path), dir_fs)
 
 
 @pytest.mark.parametrize(
@@ -84,5 +131,5 @@ def test_local_loader_drive_skipping(mock_target):
         (Path("/dev/xhdaa"), False),  # Fake
     ],
 )
-def test_linux_drive_regex(drive_path, expected):
+def test_linux_drive_regex(drive_path: Path, expected: bool) -> None:
     assert (LINUX_DRIVE_REGEX.match(drive_path.name) is not None) == expected

{dissect.target-3.11.2.dev24 → dissect.target-3.11.2.dev26}/tests/test_plugins_apps_remoteaccess_anydesk.py

@@ -1,4 +1,4 @@
-from datetime import datetime
+from datetime import datetime, timezone
 
 from dissect.target.plugins.apps.remoteaccess.anydesk import AnydeskPlugin
 
@@ -18,7 +18,7 @@ def test_anydesk_plugin_global_log(target_win_users, fs_win):
     assert len(records) == 1
 
     record = records[0]
-    assert record.ts == datetime(2021, 11, 11, 12, 34, 56)
+    assert record.ts == datetime(2021, 11, 11, 12, 34, 56, tzinfo=timezone.utc)
     assert record.description == "LEVEL Strip the headers, trace the source!"
     assert record.logfile == target_logfile_name
     assert record.username is None
@@ -40,7 +40,7 @@ def test_anydesk_plugin_user_log(target_win_users, fs_win):
     assert len(records) == 1
 
     record = records[0]
-    assert record.ts == datetime(2021, 11, 11, 12, 34, 56)
+    assert record.ts == datetime(2021, 11, 11, 12, 34, 56, tzinfo=timezone.utc)
     assert record.description == "LEVEL Strip the headers, trace the source!"
     assert record.logfile == target_logfile_name
     assert record.username == user_details.user.name

{dissect.target-3.11.2.dev24 → dissect.target-3.11.2.dev26}/tests/test_plugins_apps_remoteaccess_teamviewer.py

@@ -1,4 +1,4 @@
-from datetime import datetime
+from datetime import datetime, timezone
 
 from dissect.target.plugins.apps.remoteaccess.teamviewer import TeamviewerPlugin
 
@@ -18,7 +18,7 @@ def test_teamviewer_plugin_global_log(target_win_users, fs_win):
     assert len(records) == 1
 
     record = records[0]
-    assert record.ts == datetime(2021, 11, 11, 12, 34, 56)
+    assert record.ts == datetime(2021, 11, 11, 12, 34, 56, tzinfo=timezone.utc)
     assert record.description == "Strip the headers, trace the source!"
     assert record.logfile == target_logfile_name
     assert record.username is None
@@ -40,7 +40,7 @@ def test_teamviewer_plugin_user_log(target_win_users, fs_win):
     assert len(records) == 1
 
     record = records[0]
-    assert record.ts == datetime(2021, 11, 11, 12, 34, 56)
+    assert record.ts == datetime(2021, 11, 11, 12, 34, 56, tzinfo=timezone.utc)
     assert record.description == "Strip the headers, trace the source!"
     assert record.logfile == target_logfile_name
     assert record.username == user_details.user.name

{dissect.target-3.11.2.dev24 → dissect.target-3.11.2.dev26}/tests/test_plugins_os_unix_log.py

@@ -92,7 +92,7 @@ def test_atop_plugin(target_unix: Target, fs_unix: VirtualFilesystem) -> None:
 
     results = list(target_unix.atop())
     assert len(results) == 2219
-    assert str(results[0].ts) == "2022-11-11 19:50:44"
+    assert results[0].ts == datetime(2022, 11, 11, 19, 50, 44, tzinfo=timezone.utc)
     assert results[0].process == "systemd"
     assert results[0].cmdline == "/sbin/init"
     assert results[0].tgid == 1

{dissect.target-3.11.2.dev24 → dissect.target-3.11.2.dev26}/tests/test_plugins_os_windows_tasks.py

@@ -1,5 +1,5 @@
 import re
-from datetime import datetime
+from datetime import datetime, timezone
 
 import pytest
 from flow.record import GroupedRecord
@@ -30,7 +30,7 @@ def assert_xml_task_properties(xml_task):
         == "D:(A;;0x111FFFFF;;;SY)(A;;0x111FFFFF;;;BA)(A;;0x111FFFFF;;;S-1-5-80-3028837079-3186095147-955107200-3701964851-1150726376)(A;;FRFX;;;AU)"  # noqa: E501
     )
     assert xml_task.source is None
-    assert str(xml_task.date) == "2014-11-05 00:00:00"
+    assert xml_task.date == datetime(2014, 11, 5, 0, 0, 0, tzinfo=timezone.utc)
     assert xml_task.last_run_date is None
     assert xml_task.author == "$(@%SystemRoot%\\system32\\mapstoasttask.dll,-600)"
     assert xml_task.version is None
@@ -76,7 +76,7 @@ def assert_at_task_properties(at_task):
     assert at_task.security_descriptor is None
     assert str(at_task.task_path) == "sysvol\\windows\\tasks\\AtTask.job"
     assert at_task.date is None
-    assert at_task.last_run_date == datetime.strptime("2023-05-21 10:44:25.794000", "%Y-%m-%d %H:%M:%S.%f")
+    assert at_task.last_run_date == datetime(2023, 5, 21, 10, 44, 25, 794000, tzinfo=timezone.utc)
     assert at_task.author == "user1"
     assert at_task.version == "1"
     assert at_task.description == "At job task for testing purposes"