dissect.target 3.14.dev20__tar.gz → 3.14.dev23__tar.gz

{dissect.target-3.14.dev20/dissect.target.egg-info → dissect.target-3.14.dev23}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.14.dev20
+Version: 3.14.dev23
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect.target-3.14.dev20 → dissect.target-3.14.dev23}/dissect/target/filesystem.py

@@ -147,7 +147,7 @@ class Filesystem:
         except NotImplementedError:
             raise
         except Exception as e:
-            log.warning("Failed to detect ID on %s filesystem", cls.__fstype__)
+            log.warning("Failed to detect ID on %s filesystem", cls.__type__)
             log.debug("", exc_info=e)
         finally:
             fh.seek(offset)

{dissect.target-3.14.dev20 → dissect.target-3.14.dev23}/dissect/target/filesystems/btrfs.py

@@ -17,7 +17,7 @@ from dissect.target.helpers import fsutil
 
 
 class BtrfsFilesystem(Filesystem):
-    __fstype__ = "btrfs"
+    __type__ = "btrfs"
     __multi_volume__ = True
 
     def __init__(self, fh: Union[BinaryIO, list[BinaryIO]], *args, **kwargs):
@@ -55,7 +55,7 @@ class BtrfsFilesystem(Filesystem):
 
 
 class BtrfsSubvolumeFilesystem(Filesystem):
-    __fstype__ = "btrfs"
+    __type__ = "btrfs"
 
     def __init__(self, fs: BtrfsFilesystem, subvol: Optional[str] = None, subvolid: Optional[int] = None):
         super().__init__(fs.volume, alt_separator=fs.alt_separator, case_sensitive=fs.case_sensitive)

{dissect.target-3.14.dev20 → dissect.target-3.14.dev23}/dissect/target/helpers/cache.py

@@ -144,7 +144,7 @@ class Cache:
 
         if read_file_cache:
             target.log.debug("Reading from cache file: %s", cache_file)
-            if os.access(cache_file, os.R_OK, effective_ids=True):
+            if os.access(cache_file, os.R_OK, effective_ids=bool(os.supports_effective_ids)):
                 if os.stat(cache_file).st_size != 0:
                     try:
                         return self.open_reader(cache_file, output)
@@ -173,7 +173,7 @@ class Cache:
                         err,
                     )
 
-            if os.access(temp_dir, os.W_OK | os.R_OK | os.X_OK, effective_ids=True):
+            if os.access(temp_dir, os.W_OK | os.R_OK | os.X_OK, effective_ids=bool(os.supports_effective_ids)):
                 if os.path.exists(temp_path):
                     try:
                         os.remove(temp_path)

{dissect.target-3.14.dev20 → dissect.target-3.14.dev23}/dissect/target/helpers/fsutil.py

@@ -725,12 +725,15 @@ class TargetPath(Path, PureDissectPath):
 
     def open(self, mode='rb', buffering=0, encoding=None,
              errors=None, newline=None):
-        # CPython >= 3.10
-        if "b" not in mode and hasattr(io, "text_encoding"):
-            # Vermin linting needs to be skipped for this line as this is
-            # guarded by an explicit check for availability.
-            # novermin
-            encoding = io.text_encoding(encoding)
+
+        if "b" not in mode:
+            encoding = encoding or "UTF-8"
+            # CPython >= 3.10
+            if hasattr(io, "text_encoding"):
+                # Vermin linting needs to be skipped for this line as this is
+                # guarded by an explicit check for availability.
+                # novermin
+                encoding = io.text_encoding(encoding)
         return self._accessor.open(self, mode, buffering, encoding, errors,
                                    newline)
 

{dissect.target-3.14.dev20 → dissect.target-3.14.dev23}/dissect/target/helpers/hashutil.py

@@ -72,10 +72,6 @@ def hash_uri_records(target: Target, record: Record) -> Record:
 
 def hash_path_records(target: Target, record: Record) -> Record:
     """Hash files from path fields inside the record."""
-    if target.os == "windows":
-        path_type = fieldtypes.windows_path
-    else:
-        path_type = fieldtypes.posix_path
 
     hash_records = []
 
@@ -93,7 +89,7 @@ def hash_path_records(target: Target, record: Record) -> Record:
         except (FileNotFoundError, IsADirectoryError):
             pass
         else:
-            resolved_path = path_type(resolved_path)
+            resolved_path = target.fs.path(resolved_path)
             record_kwargs = dict()
             record_def = list()
 

{dissect.target-3.14.dev20 → dissect.target-3.14.dev23}/dissect/target/loaders/log.py

@@ -26,12 +26,12 @@ class LogLoader(Loader):
 
     def map(self, target: Target) -> None:
         self.target = target
-        vfs = VirtualFilesystem(case_sensitive=False)
+        vfs = VirtualFilesystem(case_sensitive=False, alt_separator=target.fs.alt_separator)
         for entry in self.path.parent.glob(self.path.name):
             ext = self.options.get("hint", entry.suffix.lower()).strip(".")
             if (mapping := self.LOGS_DIRS.get(ext, None)) is None:
                 continue
-            mapping = str(Path(mapping).joinpath(entry.name))
+            mapping = str(vfs.path(mapping).joinpath(entry.name))
             vfs.map_file(mapping, str(entry))
         target.filesystems.add(vfs)
         target.fs = vfs

{dissect.target-3.14.dev20 → dissect.target-3.14.dev23}/dissect/target/loaders/smb.py

@@ -11,6 +11,7 @@ from urllib.parse import ParseResult, parse_qsl
 from dissect.regf import regf
 from dissect.util import ts
 from impacket.dcerpc.v5 import rpcrt, rrp, scmr, transport
+from impacket.dcerpc.v5.rpcrt import DCERPCException
 from impacket.smbconnection import SessionError, SMBConnection
 
 from dissect.target import Target
@@ -189,18 +190,24 @@ class SmbRegistry(RegistryPlugin):
         return False
 
     def _init_registry(self) -> None:
-        self._svcctl = _connect_rpc(self.conn, "ncacn_np:445[\\pipe\\svcctl]", scmr.MSRPC_UUID_SCMR)
-        self._check_service_status()
+        try:
+            self._svcctl = _connect_rpc(self.conn, "ncacn_np:445[\\pipe\\svcctl]", scmr.MSRPC_UUID_SCMR)
+            self._check_service_status()
 
-        self._winreg = _connect_rpc(self.conn, "ncacn_np:445[\\pipe\\winreg]", rrp.MSRPC_UUID_RRP)
+            self._winreg = _connect_rpc(self.conn, "ncacn_np:445[\\pipe\\winreg]", rrp.MSRPC_UUID_RRP)
 
-        hklm_hive = SmbRegistryHive(self._winreg, "HKEY_LOCAL_MACHINE", rrp.hOpenLocalMachine(self._winreg)["phKey"])
-        hku_hive = SmbRegistryHive(self._winreg, "HKEY_USERS", rrp.hOpenUsers(self._winreg)["phKey"])
+            hklm_hive = SmbRegistryHive(
+                self._winreg, "HKEY_LOCAL_MACHINE", rrp.hOpenLocalMachine(self._winreg)["phKey"]
+            )
+            hku_hive = SmbRegistryHive(self._winreg, "HKEY_USERS", rrp.hOpenUsers(self._winreg)["phKey"])
 
-        self._add_hive("HKLM", hklm_hive, TargetPath(self.target.fs, "HKLM"))
-        self._add_hive("HKU", hku_hive, TargetPath(self.target.fs, "HKU"))
-        self._map_hive("HKEY_LOCAL_MACHINE", hklm_hive)
-        self._map_hive("HKEY_USERS", hku_hive)
+            self._add_hive("HKLM", hklm_hive, TargetPath(self.target.fs, "HKLM"))
+            self._add_hive("HKU", hku_hive, TargetPath(self.target.fs, "HKU"))
+            self._map_hive("HKEY_LOCAL_MACHINE", hklm_hive)
+            self._map_hive("HKEY_USERS", hku_hive)
+        except SessionError:
+            self.target.log.info("Failed to open remote registry, registry will not be available")
+            return  # no registry access, probably no access rights
 
     def _init_users(self) -> None:
         pass
@@ -212,15 +219,18 @@ class SmbRegistry(RegistryPlugin):
         if hasattr(self, "_was_disabled") and self._was_disabled:
             scmr.hRChangeServiceConfigW(self._svcctl, self._svc_handle, dwStartType=0x4)
 
-        if hasattr(self, "_svcctl"):
+        if getattr(self, "_svcctl", None):
             self._svcctl.disconnect()
 
-        if hasattr(self, "_winreg"):
+        if getattr(self, "_winreg", None):
             self._winreg.disconnect()
 
     def _check_service_status(self) -> None:
-        manager_handle = scmr.hROpenSCManagerW(self._svcctl)["lpScHandle"]
-        self._svc_handle = scmr.hROpenServiceW(self._svcctl, manager_handle, "RemoteRegistry")["lpServiceHandle"]
+        try:
+            manager_handle = scmr.hROpenSCManagerW(self._svcctl)["lpScHandle"]
+            self._svc_handle = scmr.hROpenServiceW(self._svcctl, manager_handle, "RemoteRegistry")["lpServiceHandle"]
+        except DCERPCException:
+            return
 
         current_state = scmr.hRQueryServiceStatus(self._svcctl, self._svc_handle)["lpServiceStatus"]["dwCurrentState"]
         if current_state == scmr.SERVICE_STOPPED:

{dissect.target-3.14.dev20 → dissect.target-3.14.dev23}/dissect/target/plugins/apps/av/sophos.py

@@ -3,7 +3,6 @@ from typing import Iterator
 
 from dissect.sql import sqlite3
 from dissect.util.ts import wintimestamp
-from flow.record.fieldtypes import path
 
 from dissect.target import Target
 from dissect.target.exceptions import UnsupportedPluginError
@@ -105,7 +104,7 @@ class SophosPlugin(Plugin):
                     yield SophosLogRecord(
                         ts=ts,
                         description=details.get("threat_name", details),
-                        path=path.from_windows(path_to_infected_file),
+                        path=self.target.fs.path(path_to_infected_file),
                         _target=self.target,
                     )
                 except Exception as error:

{dissect.target-3.14.dev20 → dissect.target-3.14.dev23}/dissect/target/plugins/apps/av/trendmicro.py

@@ -2,7 +2,6 @@ from typing import Iterator
 
 from dissect import cstruct
 from dissect.util.ts import from_unix
-from flow.record.fieldtypes import path
 
 from dissect.target import Target
 from dissect.target.exceptions import UnsupportedPluginError
@@ -86,7 +85,7 @@ class TrendMicroPlugin(Plugin):
                 yield TrendMicroWFLogRecord(
                     ts=from_unix(int(cells[9])),
                     threat=cells[2],
-                    path=path.from_windows(cells[6] + cells[7]),
+                    path=self.target.fs.path(cells[6] + cells[7]),
                     lineno=lineno,
                 )
 
@@ -115,7 +114,7 @@ class TrendMicroPlugin(Plugin):
                             remote_ip=entry.remote_ip.strip(b"\x00").decode(self.codepage),
                             port=entry.port,
                             direction=("out" if entry.direction == b"\x01" else "in"),
-                            path=path.from_windows(entry.path.strip(b"\x00").decode(self.codepage)),
+                            path=self.target.fs.path(entry.path.strip(b"\x00").decode(self.codepage)),
                             description=entry.description.strip("\x00"),
                         )
                 except EOFError:

{dissect.target-3.14.dev20 → dissect.target-3.14.dev23}/dissect/target/plugins/apps/browser/chromium.py

@@ -6,7 +6,6 @@ from dissect.sql import sqlite3
 from dissect.sql.exceptions import Error as SQLError
 from dissect.sql.sqlite3 import SQLite3
 from dissect.util.ts import webkittimestamp
-from flow.record.fieldtypes import path
 
 from dissect.target.exceptions import FileNotFoundError, UnsupportedPluginError
 from dissect.target.helpers.descriptor_extensions import UserRecordDescriptorExtension
@@ -142,11 +141,8 @@ class ChromiumMixin:
                     chain.sort(key=lambda row: row.chain_index)
 
                 for row in db.table("downloads").rows():
-                    download_path = row.target_path
-                    if download_path and self.target.os == "windows":
-                        download_path = path.from_windows(download_path)
-                    elif download_path:
-                        download_path = path.from_posix(download_path)
+                    if download_path := row.target_path:
+                        download_path = self.target.fs.path(download_path)
 
                     url = None
                     download_chain = download_chains.get(row.id)
@@ -216,11 +212,8 @@ class ChromiumMixin:
                         if ts_update:
                             ts_update = webkittimestamp(ts_update)
 
-                        ext_path = extension_data.get("path")
-                        if ext_path and self.target.os == "windows":
-                            ext_path = path.from_windows(ext_path)
-                        elif ext_path:
-                            ext_path = path.from_posix(ext_path)
+                        if ext_path := extension_data.get("path"):
+                            ext_path = self.target.fs.path(ext_path)
 
                         manifest = extension_data.get("manifest")
                         if manifest:

{dissect.target-3.14.dev20 → dissect.target-3.14.dev23}/dissect/target/plugins/apps/browser/firefox.py

@@ -5,7 +5,6 @@ from dissect.sql import sqlite3
 from dissect.sql.exceptions import Error as SQLError
 from dissect.sql.sqlite3 import SQLite3
 from dissect.util.ts import from_unix_ms, from_unix_us
-from flow.record.fieldtypes import path
 
 from dissect.target.exceptions import FileNotFoundError, UnsupportedPluginError
 from dissect.target.helpers.descriptor_extensions import UserRecordDescriptorExtension
@@ -197,12 +196,9 @@ class FirefoxPlugin(BrowserPlugin):
                         state = content.get("state")
 
                     dest_file_info = annotation.get("downloads/destinationFileURI", {})
-                    download_path = dest_file_info.get("content")
 
-                    if download_path and self.target.os == "windows":
-                        download_path = path.from_windows(download_path)
-                    elif download_path:
-                        download_path = path.from_posix(download_path)
+                    if download_path := dest_file_info.get("content"):
+                        download_path = self.target.fs.path(download_path)
 
                     place = places.get(place_id)
                     url = place.get("url")

{dissect.target-3.14.dev20 → dissect.target-3.14.dev23}/dissect/target/plugins/child/hyperv.py

@@ -3,7 +3,6 @@ from __future__ import annotations
 from typing import TYPE_CHECKING, Iterator
 
 from dissect.hypervisor import hyperv
-from flow.record.fieldtypes import path
 
 from dissect.target.exceptions import UnsupportedPluginError
 from dissect.target.helpers.record import ChildTargetRecord
@@ -47,7 +46,7 @@ class HyperVChildTargetPlugin(ChildTargetPlugin):
                 for vm_path in virtual_machines.values():
                     yield ChildTargetRecord(
                         type=self.__type__,
-                        path=path.from_windows(vm_path),
+                        path=self.target.fs.path(vm_path),
                         _target=self.target,
                     )
 

{dissect.target-3.14.dev20 → dissect.target-3.14.dev23}/dissect/target/plugins/child/vmware_workstation.py

@@ -1,5 +1,3 @@
-from flow.record.fieldtypes import path
-
 from dissect.target.exceptions import UnsupportedPluginError
 from dissect.target.helpers.record import ChildTargetRecord
 from dissect.target.plugin import ChildTargetPlugin
@@ -42,6 +40,6 @@ class WorkstationChildTargetPlugin(ChildTargetPlugin):
 
                 yield ChildTargetRecord(
                     type=self.__type__,
-                    path=path.from_windows(value.strip('"')),
+                    path=self.target.fs.path(value.strip('"')),
                     _target=self.target,
                 )

{dissect.target-3.14.dev20 → dissect.target-3.14.dev23}/dissect/target/plugins/filesystem/acquire_handles.py

@@ -43,4 +43,6 @@ class OpenHandlesPlugin(Plugin):
         """
         with self.open_handles_file.open() as fh:
             for row in csv.DictReader(gzip.open(fh, "rt")):
+                if name := row.get("name"):
+                    row.update({"name": self.target.fs.path(name)})
                 yield AcquireOpenHandlesRecord(_target=self.target, **row)

{dissect.target-3.14.dev20 → dissect.target-3.14.dev23}/dissect/target/plugins/filesystem/acquire_hash.py

@@ -1,8 +1,6 @@
 import csv
 import gzip
 
-from flow.record.fieldtypes import posix_path, windows_path
-
 from dissect.target.exceptions import UnsupportedPluginError
 from dissect.target.helpers.record import TargetRecordDescriptor
 from dissect.target.plugin import Plugin, export
@@ -35,15 +33,11 @@ class AcquireHashPlugin(Plugin):
         An Acquire file container contains a file hashes csv when the hashes module was used. The content of this csv
         file is returned.
         """
-        if self.target.os == "windows":
-            path_type = windows_path
-        else:
-            path_type = posix_path
 
         with self.hash_file.open() as fh:
             for row in csv.DictReader(gzip.open(fh, "rt")):
                 yield AcquireHashRecord(
-                    path=path_type(row["path"]),
+                    path=self.target.fs.path((row["path"])),
                     filesize=row["file-size"],
                     digest=(row["md5"] or None, row["sha1"] or None, row["sha256"] or None),
                     _target=self.target,

{dissect.target-3.14.dev20 → dissect.target-3.14.dev23}/dissect/target/plugins/filesystem/ntfs/usnjrnl.py

@@ -1,7 +1,6 @@
 from typing import Iterator
 
 from dissect.ntfs.c_ntfs import segment_reference
-from flow.record.fieldtypes import path as rpath
 
 from dissect.target.helpers.record import TargetRecordDescriptor
 from dissect.target.plugin import Plugin, export
@@ -64,7 +63,7 @@ class UsnjrnlPlugin(Plugin):
                     yield UsnjrnlRecord(
                         ts=ts,
                         segment=f"{segment}#{record.FileReferenceNumber.SequenceNumber}",
-                        path=rpath.from_windows(path),
+                        path=self.target.fs.path(path),
                         usn=record.Usn,
                         reason=str(record.Reason).replace("USN_REASON.", ""),
                         attr=str(record.FileAttributes).replace("FILE_ATTRIBUTE.", ""),

{dissect.target-3.14.dev20 → dissect.target-3.14.dev23}/dissect/target/plugins/filesystem/resolver.py

@@ -98,7 +98,7 @@ class ResolverPlugin(Plugin):
                     return lookup_ext
 
                 for search_path in search_paths:
-                    lookup_path = "/".join([search_path, lookup_ext])
+                    lookup_path = fsutil.join(search_path, lookup_ext, alt_separator=self.target.fs.alt_separator)
                     if self.target.fs.exists(lookup_path):
                         return lookup_path
 

dissect.target-3.14.dev23/dissect/target/plugins/filesystem/unix/capability.py

@@ -0,0 +1,169 @@
+import struct
+from enum import IntEnum
+from io import BytesIO
+
+from dissect.target.exceptions import FileNotFoundError, UnsupportedPluginError
+from dissect.target.helpers.record import TargetRecordDescriptor
+from dissect.target.plugin import Plugin, export
+from dissect.target.plugins.filesystem.walkfs import generate_record
+
+CapabilityRecord = TargetRecordDescriptor(
+    "filesystem/unix/capability",
+    [
+        ("record", "record"),
+        ("string[]", "permitted"),
+        ("string[]", "inheritable"),
+        ("boolean", "effective"),
+        ("uint32", "rootid"),
+    ],
+)
+
+
+VFS_CAP_REVISION_MASK = 0xFF000000
+VFS_CAP_REVISION_SHIFT = 24
+VFS_CAP_FLAGS_MASK = (~VFS_CAP_REVISION_MASK) & 0xFFFFFFFF
+VFS_CAP_FLAGS_EFFECTIVE = 0x000001
+
+VFS_CAP_REVISION_1 = 0x01000000
+VFS_CAP_U32_1 = 1
+
+VFS_CAP_REVISION_2 = 0x02000000
+VFS_CAP_U32_2 = 2
+
+VFS_CAP_REVISION_3 = 0x03000000
+VFS_CAP_U32_3 = 2
+
+
+class Capabilities(IntEnum):
+    CAP_CHOWN = 0
+    CAP_DAC_OVERRIDE = 1
+    CAP_DAC_READ_SEARCH = 2
+    CAP_FOWNER = 3
+    CAP_FSETID = 4
+    CAP_KILL = 5
+    CAP_SETGID = 6
+    CAP_SETUID = 7
+    CAP_SETPCAP = 8
+    CAP_LINUX_IMMUTABLE = 9
+    CAP_NET_BIND_SERVICE = 10
+    CAP_NET_BROADCAST = 11
+    CAP_NET_ADMIN = 12
+    CAP_NET_RAW = 13
+    CAP_IPC_LOCK = 14
+    CAP_IPC_OWNER = 15
+    CAP_SYS_MODULE = 16
+    CAP_SYS_RAWIO = 17
+    CAP_SYS_CHROOT = 18
+    CAP_SYS_PTRACE = 19
+    CAP_SYS_PACCT = 20
+    CAP_SYS_ADMIN = 21
+    CAP_SYS_BOOT = 22
+    CAP_SYS_NICE = 23
+    CAP_SYS_RESOURCE = 24
+    CAP_SYS_TIME = 25
+    CAP_SYS_TTY_CONFIG = 26
+    CAP_MKNOD = 27
+    CAP_LEASE = 28
+    CAP_AUDIT_WRITE = 29
+    CAP_AUDIT_CONTROL = 30
+    CAP_SETFCAP = 31
+    CAP_MAC_OVERRIDE = 32
+    CAP_MAC_ADMIN = 33
+    CAP_SYSLOG = 34
+    CAP_WAKE_ALARM = 35
+    CAP_BLOCK_SUSPEND = 36
+    CAP_AUDIT_READ = 37
+    CAP_PERFMON = 38
+    CAP_BPF = 39
+    CAP_CHECKPOINT_RESTORE = 40
+
+
+class CapabilityPlugin(Plugin):
+    """Plugin to yield files with capabilites set."""
+
+    def check_compatible(self) -> None:
+        if not self.target.has_function("walkfs") or self.target.os == "windows":
+            raise UnsupportedPluginError("Unsupported plugin")
+
+    @export(record=CapabilityRecord)
+    def capability_binaries(self):
+        """Find all files that have capabilities set."""
+        for path_entries, _, files in self.target.fs.walk_ext("/"):
+            entries = [path_entries[-1]] + files
+            for entry in entries:
+                path = self.target.fs.path(entry.path)
+                try:
+                    record = generate_record(self.target, path)
+                except FileNotFoundError:
+                    continue
+                try:
+                    attrs = path.get().lattr()
+                except TypeError:
+                    # Virtual(File|Directory|Symlink) instances don't have a functional lattr()
+                    continue
+                except Exception:
+                    self.target.log.exception("Failed to get attrs for entry %s", entry)
+                    continue
+
+                for attr in attrs:
+                    if attr.name != "security.capability":
+                        continue
+
+                    buf = BytesIO(attr.value)
+
+                    # Reference: https://github.com/torvalds/linux/blob/master/include/uapi/linux/capability.h
+                    # The struct is small enough we can just use struct
+                    magic_etc = struct.unpack("<I", buf.read(4))[0]
+                    cap_revision = magic_etc & VFS_CAP_REVISION_MASK
+
+                    permitted_caps = []
+                    inheritable_caps = []
+                    rootid = None
+
+                    if cap_revision == VFS_CAP_REVISION_1:
+                        num_caps = VFS_CAP_U32_1
+                        data_len = (1 + 2 * VFS_CAP_U32_1) * 4
+                    elif cap_revision == VFS_CAP_REVISION_2:
+                        num_caps = VFS_CAP_U32_2
+                        data_len = (1 + 2 * VFS_CAP_U32_2) * 4
+                    elif cap_revision == VFS_CAP_REVISION_3:
+                        num_caps = VFS_CAP_U32_3
+                        data_len = (2 + 2 * VFS_CAP_U32_2) * 4
+                    else:
+                        self.target.log.error("Unexpected capability revision: %s", entry)
+                        continue
+
+                    if data_len != len(attr.value):
+                        self.target.log.error("Unexpected capability length: %s", entry)
+                        continue
+
+                    for _ in range(num_caps):
+                        permitted_val, inheritable_val = struct.unpack("<2I", buf.read(8))
+                        permitted_caps.append(permitted_val)
+                        inheritable_caps.append(inheritable_val)
+
+                    if cap_revision == VFS_CAP_REVISION_3:
+                        rootid = struct.unpack("<I", buf.read(4))[0]
+
+                    permitted = []
+                    inheritable = []
+
+                    for capability in Capabilities:
+                        for caps, results in [(permitted_caps, permitted), (inheritable_caps, inheritable)]:
+                            # CAP_TO_INDEX
+                            cap_index = capability.value >> 5
+                            if cap_index >= len(caps):
+                                # We loop over all capabilities, but might only have a version 1 caps list
+                                continue
+
+                            if caps[cap_index] & (1 << (capability.value & 31)) != 0:
+                                results.append(capability.name)
+
+                    yield CapabilityRecord(
+                        record=record,
+                        permitted=permitted,
+                        inheritable=inheritable,
+                        effective=magic_etc & VFS_CAP_FLAGS_EFFECTIVE != 0,
+                        rootid=rootid,
+                        _target=self.target,
+                    )

{dissect.target-3.14.dev20 → dissect.target-3.14.dev23}/dissect/target/plugins/filesystem/walkfs.py

@@ -1,8 +1,13 @@
+from typing import Iterable
+
 from dissect.util.ts import from_unix
 
 from dissect.target.exceptions import FileNotFoundError, UnsupportedPluginError
+from dissect.target.filesystem import RootFilesystemEntry
+from dissect.target.helpers.fsutil import TargetPath
 from dissect.target.helpers.record import TargetRecordDescriptor
-from dissect.target.plugin import Plugin, export, internal
+from dissect.target.plugin import Plugin, export
+from dissect.target.target import Target
 
 FilesystemRecord = TargetRecordDescriptor(
     "filesystem/entry",
@@ -17,8 +22,7 @@ FilesystemRecord = TargetRecordDescriptor(
         ("uint32", "mode"),
         ("uint32", "uid"),
         ("uint32", "gid"),
-        ("string", "fstype"),
-        ("uint32", "fsidx"),
+        ("string[]", "fstypes"),
     ],
 )
 
@@ -29,36 +33,36 @@ class WalkFSPlugin(Plugin):
             raise UnsupportedPluginError("No filesystems found")
 
     @export(record=FilesystemRecord)
-    def walkfs(self):
+    def walkfs(self) -> Iterable[FilesystemRecord]:
         """Walk a target's filesystem and return all filesystem entries."""
-        for _, record in self.walkfs_ext():
-            yield record
-
-    @internal
-    def walkfs_ext(self, root="/", pattern="*"):
-        for idx, fs in enumerate(self.target.filesystems):
-            for entry in fs.path(root).rglob(pattern):
+        for path_entries, _, files in self.target.fs.walk_ext("/"):
+            entries = [path_entries[-1]] + files
+            for entry in entries:
+                path = self.target.fs.path(entry.path)
                 try:
-                    yield entry, generate_record(self.target, entry, idx)
+                    record = generate_record(self.target, path)
                 except FileNotFoundError:
                     continue
-                except Exception:
-                    self.target.log.exception("Failed to generate record from entry %s", entry)
+                yield record
 
 
-def generate_record(target, entry, idx):
-    stat = entry.lstat()
+def generate_record(target: Target, path: TargetPath) -> FilesystemRecord:
+    stat = path.lstat()
+    entry = path.get()
+    if isinstance(entry, RootFilesystemEntry):
+        fs_types = [sub_entry.fs.__type__ for sub_entry in entry.entries]
+    else:
+        fs_types = [entry.fs.__type__]
     return FilesystemRecord(
         atime=from_unix(stat.st_atime),
         mtime=from_unix(stat.st_mtime),
         ctime=from_unix(stat.st_ctime),
         ino=stat.st_ino,
-        path=entry,
+        path=path,
         size=stat.st_size,
         mode=stat.st_mode,
         uid=stat.st_uid,
         gid=stat.st_gid,
-        fstype=entry.get().fs.__type__,
-        fsidx=idx,
+        fstypes=fs_types,
         _target=target,
     )