dissect.target 3.19.dev45__tar.gz → 3.19.dev47__tar.gz

{dissect_target-3.19.dev45/dissect.target.egg-info → dissect_target-3.19.dev47}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.19.dev45
+Version: 3.19.dev47
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.19.dev45 → dissect_target-3.19.dev47}/dissect/target/filesystem.py

@@ -228,10 +228,9 @@ class Filesystem:
         topdown: bool = True,
         onerror: Optional[Callable] = None,
         followlinks: bool = False,
-    ) -> Iterator[str]:
-        """Walk a directory pointed to by ``path``, returning the string representation of both files and directories.
-
-        It walks across all the files inside ``path`` recursively.
+    ) -> Iterator[tuple[str, list[str], list[str]]]:
+        """Recursively walk a directory pointed to by ``path``, returning the string representation of both files
+        and directories.
 
         Args:
             path: The path to walk on the filesystem.
@@ -250,10 +249,9 @@ class Filesystem:
         topdown: bool = True,
         onerror: Optional[Callable] = None,
         followlinks: bool = False,
-    ) -> Iterator[FilesystemEntry]:
-        """Walk a directory pointed to by ``path``, returning FilesystemEntry's of both files and directories.
-
-        It walks across all the files inside ``path`` recursively.
+    ) -> Iterator[tuple[list[FilesystemEntry], list[FilesystemEntry], list[FilesystemEntry]]]:
+        """Recursively walk a directory pointed to by ``path``, returning :class:`FilesystemEntry` of files
+        and directories.
 
         Args:
             path: The path to walk on the filesystem.
@@ -266,6 +264,19 @@ class Filesystem:
         """
         return self.get(path).walk_ext(topdown, onerror, followlinks)
 
+    def recurse(self, path: str) -> Iterator[FilesystemEntry]:
+        """Recursively walk a directory and yield contents as :class:`FilesystemEntry`.
+
+        Does not follow symbolic links.
+
+        Args:
+            path: The path to recursively walk on the target filesystem.
+
+        Returns:
+            An iterator of :class:`FilesystemEntry`.
+        """
+        return self.get(path).recurse()
+
     def glob(self, pattern: str) -> Iterator[str]:
         """Iterate over the directory part of ``pattern``, returning entries matching ``pattern`` as strings.
 
@@ -578,10 +589,9 @@ class FilesystemEntry:
         topdown: bool = True,
         onerror: Optional[Callable] = None,
         followlinks: bool = False,
-    ) -> Iterator[str]:
-        """Walk a directory and list its contents as strings.
-
-        It walks across all the files inside the entry recursively.
+    ) -> Iterator[tuple[str, list[str], list[str]]]:
+        """Recursively walk a directory and yield its contents as strings split in a tuple
+        of lists of files, directories and symlinks.
 
         These contents include::
           - files
@@ -603,15 +613,9 @@ class FilesystemEntry:
         topdown: bool = True,
         onerror: Optional[Callable] = None,
         followlinks: bool = False,
-    ) -> Iterator[FilesystemEntry]:
-        """Walk a directory and show its contents as :class:`FilesystemEntry`.
-
-        It walks across all the files inside the entry recursively.
-
-        These contents include::
-          - files
-          - directories
-          - symboliclinks
+    ) -> Iterator[tuple[list[FilesystemEntry], list[FilesystemEntry], list[FilesystemEntry]]]:
+        """Recursively walk a directory and yield its contents as :class:`FilesystemEntry` split in a tuple of
+        lists of files, directories and symlinks.
 
         Args:
             topdown: ``True`` puts this entry at the top of the list, ``False`` puts this entry at the bottom.
@@ -619,10 +623,20 @@ class FilesystemEntry:
             followlinks: ``True`` if we want to follow any symbolic link
 
         Returns:
-            An iterator of :class:`FilesystemEntry`.
+            An iterator of tuples :class:`FilesystemEntry`.
         """
         yield from fsutil.walk_ext(self, topdown, onerror, followlinks)
 
+    def recurse(self) -> Iterator[FilesystemEntry]:
+        """Recursively walk a directory and yield its contents as :class:`FilesystemEntry`.
+
+        Does not follow symbolic links.
+
+        Returns:
+            An iterator of :class:`FilesystemEntry`.
+        """
+        yield from fsutil.recurse(self)
+
     def glob(self, pattern: str) -> Iterator[str]:
         """Iterate over this directory part of ``patern``, returning entries matching ``pattern`` as strings.
 

{dissect_target-3.19.dev45 → dissect_target-3.19.dev47}/dissect/target/helpers/fsutil.py

@@ -96,6 +96,7 @@ __all__ = [
     "TargetPath",
     "walk_ext",
     "walk",
+    "recurse",
 ]
 
 
@@ -291,6 +292,20 @@ def walk_ext(path_entry, topdown=True, onerror=None, followlinks=False):
         yield [path_entry], dirs, files
 
 
+def recurse(path_entry: filesystem.FilesystemEntry) -> Iterator[filesystem.FilesystemEntry]:
+    """Recursively walk the given :class:`FilesystemEntry`, yields :class:`FilesystemEntry` instances."""
+    yield path_entry
+
+    if not path_entry.is_dir():
+        return
+
+    for child_entry in path_entry.scandir():
+        if child_entry.is_dir() and not child_entry.is_symlink():
+            yield from recurse(child_entry)
+        else:
+            yield child_entry
+
+
 def glob_split(pattern: str, alt_separator: str = "") -> tuple[str, str]:
     """Split a pattern on path part boundaries on the first path part with a glob pattern.
 

{dissect_target-3.19.dev45 → dissect_target-3.19.dev47}/dissect/target/helpers/record_modifier.py

@@ -4,7 +4,7 @@ from typing import Callable, Iterable, Iterator
 from flow.record import GroupedRecord, Record, RecordDescriptor, fieldtypes
 
 from dissect.target import Target
-from dissect.target.exceptions import FilesystemError
+from dissect.target.exceptions import FileNotFoundError, FilesystemError
 from dissect.target.helpers.fsutil import TargetPath
 from dissect.target.helpers.hashutil import common
 from dissect.target.helpers.utils import StrEnum
@@ -44,7 +44,20 @@ def _resolve_path_records(field_name: str, resolved_path: TargetPath) -> Record:
 
 
 def _hash_path_records(field_name: str, resolved_path: TargetPath) -> Record:
-    """Hash files from path fields inside the record."""
+    """Hash files from path fields inside the record.
+
+    Args:
+        field_name: Name of the field.
+        resolved_path: Path to the file we should hash.
+
+    Raises:
+        FileNotFoundError: Raised if the provided ``resolved_path`` does not exist or is not a file on the target.
+
+    Returns: Modified record with digests of path field types.
+    """
+
+    if not resolved_path.exists() or not resolved_path.is_file():
+        raise FileNotFoundError(f"Path not found or is not a file: '{resolved_path}'")
 
     with resolved_path.open() as fh:
         path_hash = common(fh)
@@ -81,8 +94,14 @@ def modify_record(target: Target, record: Record, modifier_function: ModifierFun
     for field_name, resolved_path in _resolve_path_types(target, record):
         try:
             _record = modifier_function(field_name, resolved_path)
-        except FilesystemError:
-            pass
+        except FilesystemError as e:
+            target.log.warning(
+                "Unable to modify record '%s' with function '%s': %s",
+                record._desc.name,
+                modifier_function.__name__,
+                e,
+            )
+            target.log.debug("", exc_info=e)
         else:
             additional_records.append(_record)
 

dissect_target-3.19.dev47/dissect/target/plugins/filesystem/unix/capability.py

@@ -0,0 +1,184 @@
+from enum import IntEnum
+from io import BytesIO
+from typing import Iterator
+
+from dissect.target.exceptions import UnsupportedPluginError
+from dissect.target.helpers.record import TargetRecordDescriptor
+from dissect.target.plugin import Plugin, export
+
+CapabilityRecord = TargetRecordDescriptor(
+    "filesystem/unix/capability",
+    [
+        ("datetime", "ts_mtime"),
+        ("path", "path"),
+        ("string[]", "permitted"),
+        ("string[]", "inheritable"),
+        ("boolean", "effective"),
+        ("uint32", "root_id"),
+    ],
+)
+
+
+VFS_CAP_REVISION_MASK = 0xFF000000
+VFS_CAP_REVISION_SHIFT = 24
+VFS_CAP_FLAGS_MASK = (~VFS_CAP_REVISION_MASK) & 0xFFFFFFFF
+VFS_CAP_FLAGS_EFFECTIVE = 0x000001
+
+VFS_CAP_REVISION_1 = 0x01000000
+VFS_CAP_U32_1 = 1
+
+VFS_CAP_REVISION_2 = 0x02000000
+VFS_CAP_U32_2 = 2
+
+VFS_CAP_REVISION_3 = 0x03000000
+VFS_CAP_U32_3 = 2
+
+
+class Capabilities(IntEnum):
+    CAP_CHOWN = 0
+    CAP_DAC_OVERRIDE = 1
+    CAP_DAC_READ_SEARCH = 2
+    CAP_FOWNER = 3
+    CAP_FSETID = 4
+    CAP_KILL = 5
+    CAP_SETGID = 6
+    CAP_SETUID = 7
+    CAP_SETPCAP = 8
+    CAP_LINUX_IMMUTABLE = 9
+    CAP_NET_BIND_SERVICE = 10
+    CAP_NET_BROADCAST = 11
+    CAP_NET_ADMIN = 12
+    CAP_NET_RAW = 13
+    CAP_IPC_LOCK = 14
+    CAP_IPC_OWNER = 15
+    CAP_SYS_MODULE = 16
+    CAP_SYS_RAWIO = 17
+    CAP_SYS_CHROOT = 18
+    CAP_SYS_PTRACE = 19
+    CAP_SYS_PACCT = 20
+    CAP_SYS_ADMIN = 21
+    CAP_SYS_BOOT = 22
+    CAP_SYS_NICE = 23
+    CAP_SYS_RESOURCE = 24
+    CAP_SYS_TIME = 25
+    CAP_SYS_TTY_CONFIG = 26
+    CAP_MKNOD = 27
+    CAP_LEASE = 28
+    CAP_AUDIT_WRITE = 29
+    CAP_AUDIT_CONTROL = 30
+    CAP_SETFCAP = 31
+    CAP_MAC_OVERRIDE = 32
+    CAP_MAC_ADMIN = 33
+    CAP_SYSLOG = 34
+    CAP_WAKE_ALARM = 35
+    CAP_BLOCK_SUSPEND = 36
+    CAP_AUDIT_READ = 37
+    CAP_PERFMON = 38
+    CAP_BPF = 39
+    CAP_CHECKPOINT_RESTORE = 40
+
+
+class CapabilityPlugin(Plugin):
+    """Plugin to yield files with capabilites set."""
+
+    def check_compatible(self) -> None:
+        if not self.target.has_function("walkfs"):
+            raise UnsupportedPluginError("Need walkfs plugin")
+
+        if not any(fs.__type__ in ("extfs", "xfs") for fs in self.target.filesystems):
+            raise UnsupportedPluginError("Capability plugin only works on EXT and XFS filesystems")
+
+    @export(record=CapabilityRecord)
+    def capability_binaries(self) -> Iterator[CapabilityRecord]:
+        """Find all files that have capabilities set on files.
+
+        Resources:
+            - https://github.com/torvalds/linux/blob/master/include/uapi/linux/capability.h
+        """
+
+        for entry in self.target.fs.recurse("/"):
+            if not entry.is_file() or entry.is_symlink():
+                continue
+
+            try:
+                attrs = [attr for attr in entry.lattr() if attr.name == "security.capability"]
+            except Exception as e:
+                self.target.log.warning("Failed to get attrs for entry %s", entry)
+                self.target.log.debug("", exc_info=e)
+                continue
+
+            for attr in attrs:
+                try:
+                    permitted, inheritable, effective, root_id = parse_attr(attr.value)
+                except ValueError as e:
+                    self.target.log.warning("Could not parse attributes for entry %s: %s", entry, str(e.value))
+                    self.target.log.debug("", exc_info=e)
+
+                yield CapabilityRecord(
+                    ts_mtime=entry.lstat().st_mtime,
+                    path=self.target.fs.path(entry.path),
+                    permitted=permitted,
+                    inheritable=inheritable,
+                    effective=effective,
+                    root_id=root_id,
+                    _target=self.target,
+                )
+
+
+def parse_attr(attr: bytes) -> tuple[list[str], list[str], bool, int]:
+    """Efficiently parse a Linux xattr capability struct.
+
+    Returns:
+        A tuple of permitted capability names, inheritable capability names, effective flag and ``root_id``.
+    """
+    buf = BytesIO(attr)
+
+    # The struct is small enough we can just use int.from_bytes
+    magic_etc = int.from_bytes(buf.read(4), "little")
+    effective = magic_etc & VFS_CAP_FLAGS_EFFECTIVE != 0
+    cap_revision = magic_etc & VFS_CAP_REVISION_MASK
+
+    permitted_caps = []
+    inheritable_caps = []
+    root_id = None
+
+    if cap_revision == VFS_CAP_REVISION_1:
+        num_caps = VFS_CAP_U32_1
+        data_len = (1 + 2 * VFS_CAP_U32_1) * 4
+
+    elif cap_revision == VFS_CAP_REVISION_2:
+        num_caps = VFS_CAP_U32_2
+        data_len = (1 + 2 * VFS_CAP_U32_2) * 4
+
+    elif cap_revision == VFS_CAP_REVISION_3:
+        num_caps = VFS_CAP_U32_3
+        data_len = (2 + 2 * VFS_CAP_U32_2) * 4
+
+    else:
+        raise ValueError("Unexpected capability revision '%s'" % cap_revision)
+
+    if data_len != (actual_len := len(attr)):
+        raise ValueError("Unexpected capability length (%s vs %s)", data_len, actual_len)
+
+    for _ in range(num_caps):
+        permitted_caps.append(int.from_bytes(buf.read(4), "little"))
+        inheritable_caps.append(int.from_bytes(buf.read(4), "little"))
+
+    if cap_revision == VFS_CAP_REVISION_3:
+        root_id = int.from_bytes(buf.read(4), "little")
+
+    permitted = []
+    inheritable = []
+
+    for capability in Capabilities:
+        for caps, results in [(permitted_caps, permitted), (inheritable_caps, inheritable)]:
+            # CAP_TO_INDEX
+            cap_index = capability.value >> 5
+            if cap_index >= len(caps):
+                # We loop over all capabilities, but might only have a version 1 caps list
+                continue
+
+            if caps[cap_index] & (1 << (capability.value & 31)) != 0:
+                results.append(capability.name)
+
+    return permitted, inheritable, effective, root_id

dissect_target-3.19.dev47/dissect/target/plugins/filesystem/walkfs.py

@@ -0,0 +1,81 @@
+from typing import Iterator
+
+from dissect.util.ts import from_unix
+
+from dissect.target.exceptions import FileNotFoundError, UnsupportedPluginError
+from dissect.target.filesystem import FilesystemEntry, LayerFilesystemEntry
+from dissect.target.helpers.record import TargetRecordDescriptor
+from dissect.target.plugin import Plugin, arg, export
+from dissect.target.target import Target
+
+FilesystemRecord = TargetRecordDescriptor(
+    "filesystem/entry",
+    [
+        ("datetime", "atime"),
+        ("datetime", "mtime"),
+        ("datetime", "ctime"),
+        ("datetime", "btime"),
+        ("varint", "ino"),
+        ("path", "path"),
+        ("filesize", "size"),
+        ("uint32", "mode"),
+        ("uint32", "uid"),
+        ("uint32", "gid"),
+        ("string[]", "fstypes"),
+    ],
+)
+
+
+class WalkFSPlugin(Plugin):
+    def check_compatible(self) -> None:
+        if not len(self.target.filesystems):
+            raise UnsupportedPluginError("No filesystems to walk")
+
+    @export(record=FilesystemRecord)
+    @arg("--walkfs-path", default="/", help="path to recursively walk")
+    def walkfs(self, walkfs_path: str = "/") -> Iterator[FilesystemRecord]:
+        """Walk a target's filesystem and return all filesystem entries."""
+        for entry in self.target.fs.recurse(walkfs_path):
+            try:
+                yield generate_record(self.target, entry)
+
+            except FileNotFoundError as e:
+                self.target.log.warning("File not found: %s", entry)
+                self.target.log.debug("", exc_info=e)
+            except Exception as e:
+                self.target.log.warning("Exception generating record for: %s", entry)
+                self.target.log.debug("", exc_info=e)
+                continue
+
+
+def generate_record(target: Target, entry: FilesystemEntry) -> FilesystemRecord:
+    """Generate a :class:`FilesystemRecord` from the given :class:`FilesystemEntry`.
+
+    Args:
+        target: :class:`Target` instance
+        entry: :class:`FilesystemEntry` instance
+
+    Returns:
+        Generated :class:`FilesystemRecord` for the given :class:`FilesystemEntry`.
+    """
+    stat = entry.lstat()
+
+    if isinstance(entry, LayerFilesystemEntry):
+        fs_types = [sub_entry.fs.__type__ for sub_entry in entry.entries]
+    else:
+        fs_types = [entry.fs.__type__]
+
+    return FilesystemRecord(
+        atime=from_unix(stat.st_atime),
+        mtime=from_unix(stat.st_mtime),
+        ctime=from_unix(stat.st_ctime),
+        btime=from_unix(stat.st_birthtime) if stat.st_birthtime else None,
+        ino=stat.st_ino,
+        path=entry.path,
+        size=stat.st_size,
+        mode=stat.st_mode,
+        uid=stat.st_uid,
+        gid=stat.st_gid,
+        fstypes=fs_types,
+        _target=target,
+    )

{dissect_target-3.19.dev45 → dissect_target-3.19.dev47/dissect.target.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.19.dev45
+Version: 3.19.dev47
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.19.dev45 → dissect_target-3.19.dev47}/tests/helpers/test_modifier.py

@@ -50,6 +50,8 @@ def test_hash_path_records_with_paths(
 
     with (
         patch.object(TargetPath, "open", mock_open(read_data=b"")),
+        patch("dissect.target.helpers.fsutil.TargetPath.exists", return_value=True),
+        patch("dissect.target.helpers.fsutil.TargetPath.is_file", return_value=True),
         patch("dissect.target.helpers.record_modifier.common", return_value=HASHES),
     ):
         hashed_record = hash_function(target_win, record)

{dissect_target-3.19.dev45 → dissect_target-3.19.dev47}/tests/plugins/filesystem/test_walkfs.py

@@ -1,8 +1,9 @@
-from dissect.target.filesystem import VirtualFile
+from dissect.target.filesystem import VirtualFile, VirtualFilesystem
 from dissect.target.plugins.filesystem.walkfs import WalkFSPlugin
+from dissect.target.target import Target
 
 
-def test_walkfs_plugin(target_unix, fs_unix):
+def test_walkfs_plugin(target_unix: Target, fs_unix: VirtualFilesystem) -> None:
     fs_unix.map_file_entry("/path/to/some/file", VirtualFile(fs_unix, "file", None))
     fs_unix.map_file_entry("/path/to/some/other/file.ext", VirtualFile(fs_unix, "file.ext", None))
     fs_unix.map_file_entry("/root_file", VirtualFile(fs_unix, "root_file", None))

{dissect_target-3.19.dev45 → dissect_target-3.19.dev47}/tests/plugins/filesystem/unix/test_capability.py

@@ -1,10 +1,11 @@
 from unittest.mock import Mock
 
-from dissect.target.filesystem import VirtualFile
+from dissect.target.filesystem import VirtualFile, VirtualFilesystem
 from dissect.target.plugins.filesystem.unix.capability import CapabilityPlugin
+from dissect.target.target import Target
 
 
-def test_capability_plugin(target_unix, fs_unix):
+def test_capability_plugin(target_unix: Target, fs_unix: VirtualFilesystem) -> None:
     # Some fictional capability values
     xattr1 = Mock()
     xattr1.name = "security.capability"
@@ -33,12 +34,12 @@ def test_capability_plugin(target_unix, fs_unix):
     vfile3.lattr.return_value = [xattr3]
     fs_unix.map_file_entry("/path/to/xattr3/file", vfile3)
 
-    target_unix.add_plugin(CapabilityPlugin)
+    target_unix.add_plugin(CapabilityPlugin, check_compatible=False)
 
     results = list(target_unix.capability_binaries())
     assert len(results) == 3
 
-    assert results[0].record.path == "/path/to/xattr1/file"
+    assert results[0].path == "/path/to/xattr1/file"
     assert results[0].permitted == [
         "CAP_NET_RAW",
         "CAP_SYS_PACCT",
@@ -61,9 +62,9 @@ def test_capability_plugin(target_unix, fs_unix):
         "CAP_MKNOD",
     ]
     assert results[0].effective
-    assert results[0].rootid is None
+    assert results[0].root_id is None
 
-    assert results[1].record.path == "/path/to/xattr2/file"
+    assert results[1].path == "/path/to/xattr2/file"
     assert results[1].permitted == [
         "CAP_NET_RAW",
         "CAP_SYS_PACCT",
@@ -96,10 +97,10 @@ def test_capability_plugin(target_unix, fs_unix):
         "CAP_CHECKPOINT_RESTORE",
     ]
     assert results[1].effective
-    assert results[1].rootid is None
+    assert results[1].root_id is None
 
-    assert results[2].record.path == "/path/to/xattr3/file"
+    assert results[2].path == "/path/to/xattr3/file"
     assert results[2].permitted == ["CAP_NET_RAW"]
     assert results[2].inheritable == []
     assert not results[2].effective
-    assert results[2].rootid == 1337
+    assert results[2].root_id == 1337