dissect.target 3.25.dev7__tar.gz → 3.25.dev9__tar.gz

{dissect_target-3.25.dev7 → dissect_target-3.25.dev9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.25.dev7
+Version: 3.25.dev9
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License-Expression: AGPL-3.0-or-later
@@ -35,6 +35,7 @@ Requires-Dist: flow.record~=3.21.0
 Requires-Dist: structlog
 Provides-Extra: full
 Requires-Dist: asn1crypto; extra == "full"
+Requires-Dist: dissect.apfs<2,>=1.0.2.dev; extra == "full"
 Requires-Dist: dissect.archive<2,>=1; extra == "full"
 Requires-Dist: dissect.btrfs<2,>=1; extra == "full"
 Requires-Dist: dissect.cim<4,>=3; extra == "full"
@@ -61,6 +62,7 @@ Requires-Dist: tomli; python_version < "3.11" and extra == "full"
 Requires-Dist: backports.zstd; python_version < "3.14" and extra == "full"
 Provides-Extra: dev
 Requires-Dist: dissect.target[full,yara]; extra == "dev"
+Requires-Dist: dissect.apfs[dev]<2.0.dev,>=1.0.2.dev; extra == "dev"
 Requires-Dist: dissect.archive[dev]<2.0.dev,>=1.0.dev; extra == "dev"
 Requires-Dist: dissect.btrfs[dev]<2.0.dev,>=1.0.dev; extra == "dev"
 Requires-Dist: dissect.cim[dev]<4.0.dev,>=3.0.dev; extra == "dev"

{dissect_target-3.25.dev7 → dissect_target-3.25.dev9}/dissect/target/filesystem.py

@@ -1839,6 +1839,7 @@ register("xfs", "XfsFilesystem")
 register("fat", "FatFilesystem")
 register("ffs", "FfsFilesystem")
 register("vmfs", "VmfsFilesystem")
+register("apfs", "ApfsFilesystem")
 register("btrfs", "BtrfsFilesystem")
 register("exfat", "ExfatFilesystem")
 register("squashfs", "SquashFSFilesystem")

dissect_target-3.25.dev9/dissect/target/filesystems/apfs.py

@@ -0,0 +1,233 @@
+from __future__ import annotations
+
+import math
+from typing import TYPE_CHECKING, BinaryIO
+
+import dissect.apfs as apfs
+
+from dissect.target.exceptions import (
+    FileNotFoundError,
+    FilesystemError,
+    IsADirectoryError,
+    NotADirectoryError,
+    NotASymlinkError,
+)
+from dissect.target.filesystem import DirEntry, Filesystem, FilesystemEntry, VirtualFilesystem
+from dissect.target.helpers import fsutil, keychain
+from dissect.target.helpers.logging import get_logger
+
+if TYPE_CHECKING:
+    from collections.abc import Iterator
+    from uuid import UUID
+
+    from dissect.apfs.objects.fs import DirectoryEntry, INode
+
+log = get_logger(__name__)
+
+
+class ApfsFilesystem(Filesystem):
+    __type__ = "apfs-container"
+
+    def __init__(self, fh: BinaryIO | list[BinaryIO], *args, **kwargs):
+        super().__init__(fh, *args, **kwargs)
+        self.container = apfs.APFS(fh)
+        self.vfs = VirtualFilesystem()
+        self._volumes = []
+
+        for vol in self.container.volumes:
+            try:
+                vol = ApfsVolumeFilesystem(self, uuid=vol.uuid)
+            except FilesystemError as e:  # noqa: PERF203
+                log.error("Failed to open APFS volume %r (%s): %s", vol.name, vol.uuid, str(e))  # noqa: TRY400
+                log.debug("", exc_info=e)
+            else:
+                self._volumes.append(vol)
+                self.vfs.map_file_entry(vol.volume.name, vol.get("/"))
+
+    def __repr__(self) -> str:
+        return f"<Filesystem type={self.__type__} volumes={len(self._volumes)}>"
+
+    @staticmethod
+    def _detect(fh: BinaryIO) -> bool:
+        block = fh.read(4096)
+        return block[32:36] == b"NXSB"
+
+    def iter_subfs(self) -> Iterator[ApfsVolumeFilesystem]:
+        yield from self._volumes
+
+    def get(self, path: str) -> FilesystemEntry:
+        return self.vfs.get(path)
+
+
+class ApfsVolumeFilesystem(Filesystem):
+    __type__ = "apfs"
+
+    def __init__(self, container: ApfsFilesystem, name: str | None = None, uuid: UUID | None = None):
+        if name is not None and uuid is not None:
+            raise ValueError("Only one of name or uuid is allowed")
+
+        self.container = container
+
+        if name:
+            self.apfs = next((vol for vol in self.container.container.volumes if vol.name == name), None)
+        elif uuid:
+            self.apfs = next((vol for vol in self.container.container.volumes if vol.uuid == uuid), None)
+        else:
+            raise ValueError("Either name or uuid must be provided")
+
+        if not self.apfs:
+            raise ValueError("No APFS volume found with the specified identifier")
+
+        if self.apfs.is_encrypted:
+            kek_uuids = [str(kek.uuid) for kek in self.apfs.keybag.keks()]
+            for key in keychain.get_keys_for_provider(self.__type__) + keychain.get_keys_without_provider():
+                # Allow unlocking with keys that have no identifier or match the volume UUID or KEK UUIDs
+                if key.identifier and (
+                    key.identifier.lower() != str(self.apfs.uuid).lower() or key.identifier not in kek_uuids
+                ):
+                    continue
+
+                try:
+                    # But only pass the key identifier if it's a KEK UUID
+                    self.apfs.unlock(key.value, key.identifier if key.identifier in kek_uuids else None)
+                    break
+                except apfs.Error:
+                    continue
+            else:
+                raise FilesystemError("No valid decryption key found")
+
+        super().__init__(
+            container.volume,
+            alt_separator=container.alt_separator,
+            case_sensitive=not self.apfs.is_case_insensitive,
+        )
+
+    def __repr__(self) -> str:
+        return f"<Filesystem type={self.__type__} name={self.apfs.name} uuid={self.apfs.uuid}>"
+
+    def get(self, path: str) -> FilesystemEntry:
+        return ApfsFilesystemEntry(self, path, self._get_node(path))
+
+    def _get_node(self, path: str, node: INode | None = None) -> INode:
+        try:
+            return self.apfs.get(path, node)
+        except apfs.FileNotFoundError as e:
+            raise FileNotFoundError(path) from e
+        except apfs.NotADirectoryError as e:
+            raise NotADirectoryError(path) from e
+        except apfs.NotASymlinkError as e:
+            raise NotASymlinkError(path) from e
+        except apfs.Error as e:
+            raise FileNotFoundError(path) from e
+
+
+class ApfsDirEntry(DirEntry):
+    fs: ApfsVolumeFilesystem
+    entry: DirectoryEntry
+
+    def get(self) -> ApfsFilesystemEntry:
+        return ApfsFilesystemEntry(self.fs, self.path, self.entry.inode)
+
+    def is_dir(self, *, follow_symlinks: bool = True) -> bool:
+        if follow_symlinks and self.is_symlink():
+            return super().is_dir(follow_symlinks=follow_symlinks)
+
+        return self.entry.is_dir()
+
+    def is_file(self, *, follow_symlinks: bool = True) -> bool:
+        if follow_symlinks and self.is_symlink():
+            return super().is_file(follow_symlinks=follow_symlinks)
+
+        return self.entry.is_file()
+
+    def is_symlink(self) -> bool:
+        return self.entry.is_symlink()
+
+    def stat(self, *, follow_symlinks: bool = True) -> fsutil.stat_result:
+        return self.get().stat(follow_symlinks=follow_symlinks)
+
+
+class ApfsFilesystemEntry(FilesystemEntry):
+    fs: ApfsVolumeFilesystem
+    entry: INode
+
+    def get(self, path: str) -> FilesystemEntry:
+        entry_path = fsutil.join(self.path, path, alt_separator=self.fs.alt_separator)
+        entry = self.fs._get_node(path, self.entry)
+        return ApfsFilesystemEntry(self.fs, entry_path, entry)
+
+    def open(self) -> BinaryIO:
+        if self.is_dir():
+            raise IsADirectoryError(self.path)
+        return self._resolve().entry.open()
+
+    def scandir(self) -> Iterator[FilesystemEntry]:
+        if not self.is_dir():
+            raise NotADirectoryError(self.path)
+
+        for entry in self._resolve().entry.iterdir():
+            if entry.name in (".", ".."):
+                continue
+
+            yield ApfsDirEntry(self.fs, self.path, entry.name, entry)
+
+    def is_dir(self, follow_symlinks: bool = True) -> bool:
+        try:
+            return self._resolve(follow_symlinks=follow_symlinks).entry.is_dir()
+        except FilesystemError:
+            return False
+
+    def is_file(self, follow_symlinks: bool = True) -> bool:
+        try:
+            return self._resolve(follow_symlinks=follow_symlinks).entry.is_file()
+        except FilesystemError:
+            return False
+
+    def is_symlink(self) -> bool:
+        return self.entry.is_symlink()
+
+    def readlink(self) -> str:
+        if not self.is_symlink():
+            raise NotASymlinkError(self.path)
+
+        return self.entry.readlink()
+
+    def stat(self, follow_symlinks: bool = True) -> fsutil.stat_result:
+        return self._resolve(follow_symlinks=follow_symlinks).lstat()
+
+    def lstat(self) -> fsutil.stat_result:
+        entry = self.entry
+
+        # mode, ino, dev, nlink, uid, gid, size, atime, mtime, ctime
+        st_info = fsutil.stat_result(
+            [
+                entry.mode,
+                entry.oid,
+                0,
+                entry.inode.nlink,
+                entry.uid,
+                entry.gid,
+                entry.size,
+                # timestamp() returns a float which will fill both the integer and float fields
+                entry.atime.timestamp(),
+                entry.mtime.timestamp(),
+                entry.ctime.timestamp(),
+            ]
+        )
+
+        # Set the nanosecond resolution separately
+        st_info.st_atime_ns = entry.inode.access_time
+        st_info.st_mtime_ns = entry.inode.mod_time
+        st_info.st_ctime_ns = entry.inode.change_time
+
+        st_info.st_birthtime = entry.btime.timestamp()
+        st_info.st_birthtime_ns = entry.inode.create_time
+
+        # Add block information of the filesystem
+        st_info.st_blksize = self.fs.container.container.block_size
+
+        st_info.st_blocks = 0
+        if not self.is_dir():
+            st_info.st_blocks = (st_info.st_blksize // 512) * math.ceil(st_info.st_size / st_info.st_blksize)
+
+        return st_info

{dissect_target-3.25.dev7 → dissect_target-3.25.dev9}/dissect/target/loaders/utm.py

@@ -27,7 +27,7 @@ class UtmLoader(Loader):
     def map(self, target: Target) -> None:
         data_dir = self.absolute_path.joinpath("Data")
         for drive in self.config.get("Drive", []):
-            if drive.get("ImageType") != "Disk":
+            if (type := drive.get("ImageType")) and type != "Disk":
                 continue
 
             path = data_dir.joinpath(drive["ImageName"])

{dissect_target-3.25.dev7 → dissect_target-3.25.dev9}/dissect/target/plugins/os/unix/bsd/darwin/macos/_os.py

@@ -28,6 +28,10 @@ class MacOSPlugin(DarwinPlugin):
     GLOBAL = "/Library/Preferences/.GlobalPreferences.plist"
     SYSTEM = "/Library/Preferences/SystemConfiguration/preferences.plist"
 
+    def __init__(self, target: Target):
+        super().__init__(target)
+        self._add_mounts()
+
     @classmethod
     def detect(cls, target: Target) -> Filesystem | None:
         for fs in target.filesystems:
@@ -41,6 +45,23 @@ class MacOSPlugin(DarwinPlugin):
         target.fs.mount("/", sysvol)
         return cls(target)
 
+    def _add_mounts(self) -> None:
+        data_fs = None
+        for fs in self.target.filesystems:
+            if fs.__type__ == "apfs" and fs.apfs.role.name == "DATA":
+                data_fs = fs
+                break
+
+        if data_fs and (path := self.target.fs.path("/usr/share/firmlinks")).exists():
+            firmlinks = [line.strip().split("\t") for line in path.open("rt") if line.strip()]
+            layer = self.target.fs.append_layer()
+
+            for dst, src in firmlinks:
+                if data_fs.exists(src):
+                    layer.map_file_entry(dst, data_fs.get(src))
+
+        # TODO: synthetic.conf
+
     @export(property=True)
     def hostname(self) -> str | None:
         try:

{dissect_target-3.25.dev7 → dissect_target-3.25.dev9}/dissect.target.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.25.dev7
+Version: 3.25.dev9
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License-Expression: AGPL-3.0-or-later
@@ -35,6 +35,7 @@ Requires-Dist: flow.record~=3.21.0
 Requires-Dist: structlog
 Provides-Extra: full
 Requires-Dist: asn1crypto; extra == "full"
+Requires-Dist: dissect.apfs<2,>=1.0.2.dev; extra == "full"
 Requires-Dist: dissect.archive<2,>=1; extra == "full"
 Requires-Dist: dissect.btrfs<2,>=1; extra == "full"
 Requires-Dist: dissect.cim<4,>=3; extra == "full"
@@ -61,6 +62,7 @@ Requires-Dist: tomli; python_version < "3.11" and extra == "full"
 Requires-Dist: backports.zstd; python_version < "3.14" and extra == "full"
 Provides-Extra: dev
 Requires-Dist: dissect.target[full,yara]; extra == "dev"
+Requires-Dist: dissect.apfs[dev]<2.0.dev,>=1.0.2.dev; extra == "dev"
 Requires-Dist: dissect.archive[dev]<2.0.dev,>=1.0.dev; extra == "dev"
 Requires-Dist: dissect.btrfs[dev]<2.0.dev,>=1.0.dev; extra == "dev"
 Requires-Dist: dissect.cim[dev]<4.0.dev,>=3.0.dev; extra == "dev"

{dissect_target-3.25.dev7 → dissect_target-3.25.dev9}/dissect.target.egg-info/SOURCES.txt

@@ -36,6 +36,7 @@ dissect/target/containers/vhdx.py
 dissect/target/containers/vmdk.py
 dissect/target/filesystems/__init__.py
 dissect/target/filesystems/ad1.py
+dissect/target/filesystems/apfs.py
 dissect/target/filesystems/btrfs.py
 dissect/target/filesystems/cb.py
 dissect/target/filesystems/config.py
@@ -476,6 +477,7 @@ tests/containers/__init__.py
 tests/containers/test_fortifw.py
 tests/containers/test_split.py
 tests/filesystems/__init__.py
+tests/filesystems/test_apfs.py
 tests/filesystems/test_btrfs.py
 tests/filesystems/test_cb.py
 tests/filesystems/test_config.py
@@ -670,7 +672,6 @@ tests/plugins/os/unix/bsd/freebsd/__init__.py
 tests/plugins/os/unix/bsd/freebsd/test__os.py
 tests/plugins/os/unix/bsd/openbsd/__init__.py
 tests/plugins/os/unix/bsd/openbsd/test__os.py
-tests/plugins/os/unix/bsd/osx/__init__.py
 tests/plugins/os/unix/esxi/__init__.py
 tests/plugins/os/unix/esxi/test__os.py
 tests/plugins/os/unix/linux/__init__.py

{dissect_target-3.25.dev7 → dissect_target-3.25.dev9}/dissect.target.egg-info/requires.txt

@@ -17,6 +17,7 @@ carbon-black-cloud-sdk~=1.4.3
 
 [dev]
 dissect.target[full,yara]
+dissect.apfs[dev]<2.0.dev,>=1.0.2.dev
 dissect.archive[dev]<2.0.dev,>=1.0.dev
 dissect.btrfs[dev]<2.0.dev,>=1.0.dev
 dissect.cim[dev]<4.0.dev,>=3.0.dev
@@ -46,6 +47,7 @@ dissect.xfs[dev]<4.0.dev,>=3.0.dev
 
 [full]
 asn1crypto
+dissect.apfs<2,>=1.0.2.dev
 dissect.archive<2,>=1
 dissect.btrfs<2,>=1
 dissect.cim<4,>=3

{dissect_target-3.25.dev7 → dissect_target-3.25.dev9}/pyproject.toml

@@ -48,6 +48,7 @@ repository = "https://github.com/fox-it/dissect.target"
 [project.optional-dependencies]
 full = [
     "asn1crypto",
+    "dissect.apfs>=1.0.2.dev,<2",  # TODO: update on release!
     "dissect.archive>=1,<2",
     "dissect.btrfs>=1,<2",
     "dissect.cim>=3,<4",
@@ -75,6 +76,7 @@ full = [
 ]
 dev = [
     "dissect.target[full,yara]",
+    "dissect.apfs[dev]>=1.0.2.dev,<2.0.dev",  # TODO: update on release!
     "dissect.archive[dev]>=1.0.dev,<2.0.dev",
     "dissect.btrfs[dev]>=1.0.dev,<2.0.dev",
     "dissect.cim[dev]>=3.0.dev,<4.0.dev",

dissect_target-3.25.dev9/tests/filesystems/test_apfs.py

@@ -0,0 +1,60 @@
+from __future__ import annotations
+
+import gzip
+from typing import TYPE_CHECKING
+
+from dissect.target.filesystems.apfs import ApfsFilesystem
+from dissect.target.helpers import keychain
+from tests._utils import absolute_path
+
+if TYPE_CHECKING:
+    import pytest
+
+
+def test_apfs_encrypted(caplog: pytest.LogCaptureFixture) -> None:
+    """Test that encrypted APFS filesystems are correctly detected."""
+    with gzip.open(absolute_path("_data/filesystems/apfs/encrypted.bin.gz"), "rb") as fh:
+        assert ApfsFilesystem.detect(fh)
+
+        fs = ApfsFilesystem(fh)
+        assert caplog.messages == [
+            "Failed to open APFS volume 'Encrypted' (0a51df00-e6ff-6949-9607-efa24d864392): No valid decryption key found"  # noqa: E501
+        ]
+
+        # Test with wildcard key
+        keychain.register_wildcard_value("password")
+        fs = ApfsFilesystem(fh)
+        assert len(list(fs.iter_subfs())) == 1
+        assert len(next(fs.iter_subfs()).get("/").listdir()) == 11
+
+        # Test with UUID
+        keychain.KEYCHAIN.clear()
+        keychain.register_key(
+            keychain.KeyType.PASSPHRASE,
+            "password",
+            "0a51df00-e6ff-6949-9607-efa24d864392",
+            provider="apfs",
+        )
+        fs = ApfsFilesystem(fh)
+        assert len(list(fs.iter_subfs())) == 1
+        assert len(next(fs.iter_subfs()).get("/").listdir()) == 11
+
+
+def test_apfs_direntry() -> None:
+    """Test APFS directory entries and symlink behavior."""
+    with gzip.open(absolute_path("_data/filesystems/apfs/encrypted.bin.gz"), "rb") as fh:
+        assert ApfsFilesystem.detect(fh)
+
+        keychain.register_wildcard_value("password")
+        fs = ApfsFilesystem(fh)
+        volume = next(fs.iter_subfs())
+        root = volume.get("/")
+
+        dirents = {entry.name: entry for entry in root.scandir()}
+        assert len(dirents) == 11
+
+        assert dirents["dir"].is_dir(follow_symlinks=False)
+        assert dirents["dir"].is_dir(follow_symlinks=True)
+        assert dirents["symlink-dir"].is_symlink()
+        assert not dirents["symlink-dir"].is_dir(follow_symlinks=False)
+        assert dirents["symlink-dir"].is_dir(follow_symlinks=True)

{dissect_target-3.25.dev7 → dissect_target-3.25.dev9}/tests/helpers/test_cache.py

@@ -20,12 +20,12 @@ def test_cache_namespace(target_bare: Target) -> None:
 
     target_bare._config.CACHE_DIR = "/tmp"
     assert (
-        cache1.cache_path(target_bare, ("a", 1234)).name
-        == "dissect.target.plugins.os.windows.amcache.AmcachePlugin.__call__.KCdhJywgMTIzNCk=.zstd"
+        cache1.cache_path(target_bare, ("a", 1234)).stem
+        == "dissect.target.plugins.os.windows.amcache.AmcachePlugin.__call__.KCdhJywgMTIzNCk="
     )
     assert (
-        cache2.cache_path(target_bare, ("b", 5678)).name
-        == "dissect.target.plugins.os.windows.ual.UalPlugin.__call__.KCdiJywgNTY3OCk=.zstd"
+        cache2.cache_path(target_bare, ("b", 5678)).stem
+        == "dissect.target.plugins.os.windows.ual.UalPlugin.__call__.KCdiJywgNTY3OCk="
     )
 
 
@@ -43,18 +43,16 @@ def test_cache_filename(target_win: Target) -> None:
 
     target_win._config.CACHE_DIR = "/tmp"
     assert (
-        cache1.cache_path(target_win, ()).name
-        == "dissect.target.plugins.os.windows.amcache.AmcachePlugin.applications.KCk=.zstd"
+        cache1.cache_path(target_win, ()).stem
+        == "dissect.target.plugins.os.windows.amcache.AmcachePlugin.applications.KCk="
     )
     assert (
-        cache2.cache_path(target_win, ()).name
-        == "dissect.target.plugins.os.windows.ual.UalPlugin.client_access.KCk=.zstd"
+        cache2.cache_path(target_win, ()).stem == "dissect.target.plugins.os.windows.ual.UalPlugin.client_access.KCk="
     )
     assert (
-        cache3.cache_path(target_win, ()).name
-        == "dissect.target.plugins.os.windows.amcache.AmcachePlugin.applications.KCk=.zstd"
+        cache3.cache_path(target_win, ()).stem
+        == "dissect.target.plugins.os.windows.amcache.AmcachePlugin.applications.KCk="
     )
     assert (
-        cache4.cache_path(target_win, ()).name
-        == "dissect.target.plugins.os.windows.ual.UalPlugin.client_access.KCk=.zstd"
+        cache4.cache_path(target_win, ()).stem == "dissect.target.plugins.os.windows.ual.UalPlugin.client_access.KCk="
     )

dissect_target-3.25.dev9/tests/plugins/os/unix/bsd/darwin/macos/test__os.py

@@ -0,0 +1,82 @@
+from __future__ import annotations
+
+from io import BytesIO
+from typing import TYPE_CHECKING
+from unittest.mock import Mock
+
+from flow.record.fieldtypes import posix_path
+
+from dissect.target.filesystem import VirtualFilesystem
+from dissect.target.plugin import OperatingSystem
+from dissect.target.plugins.os.unix.bsd.darwin.macos._os import MacOSPlugin
+from tests._utils import absolute_path
+
+if TYPE_CHECKING:
+    from dissect.target.target import Target
+
+
+def test_macos_os(target_macos_users: Target, fs_macos: VirtualFilesystem) -> None:
+    """Test if we detect a macOS target correctly."""
+
+    target_macos_users.add_plugin(MacOSPlugin)
+
+    interface = absolute_path("_data/plugins/os/unix/bsd/darwin/macos/_os/en0.plist")
+    fs_macos.map_file("/private/var/db/dhcpclient/leases/en0.plist", interface)
+
+    users = list(target_macos_users.users())
+    ips = target_macos_users.ips
+    ips.sort()
+
+    dissect_user = users[0]
+    test_user = users[1]
+
+    assert target_macos_users.os == OperatingSystem.MACOS
+    assert target_macos_users.hostname == "dummys Mac"
+    assert target_macos_users.version == "macOS 11.7.5 (20G1225)"
+
+    assert len(users) == 2
+    assert len(ips) == 2
+
+    assert dissect_user._desc.name == "macos/user"
+    assert dissect_user.name == "_dissect"
+    assert dissect_user.passwd == "*"
+    assert dissect_user.home == posix_path("/Users/dissect")
+    assert dissect_user.shell == "/usr/bin/false"
+    assert dissect_user.source == "/var/db/dslocal/nodes/Default/users/_dissect.plist"
+
+    assert test_user.home is None
+
+    assert ips == ["10.42.43.63", "10.42.43.64"]
+
+
+def test_apfs_mounts(target_bare: Target) -> None:
+    """Test that macOS firmlinks are correctly mounted."""
+    mock_system_volume = VirtualFilesystem()
+    mock_system_volume.__type__ = "apfs"
+    mock_system_volume.apfs = Mock()
+    mock_system_volume.apfs.role = Mock()
+    mock_system_volume.apfs.role.name = "SYSTEM"
+
+    mock_system_volume.makedirs("/Library")
+    mock_system_volume.makedirs("/Applications")
+    mock_system_volume.map_file_fh("/usr/share/firmlinks", BytesIO(b"/Applications\tApplications\n/Library\tLibrary\n"))
+
+    mock_data_volume = VirtualFilesystem()
+    mock_data_volume.__type__ = "apfs"
+    mock_data_volume.apfs = Mock()
+    mock_data_volume.apfs.role = Mock()
+    mock_data_volume.apfs.role.name = "DATA"
+    mock_data_volume.makedirs("/Library/something")
+    mock_data_volume.makedirs("/Applications/Some.app")
+
+    target_bare.filesystems.add(mock_system_volume)
+    target_bare.filesystems.add(mock_data_volume)
+
+    assert MacOSPlugin.detect(target_bare) is mock_system_volume
+    target_bare._os_plugin = MacOSPlugin
+    target_bare.apply()
+
+    assert target_bare.fs.exists("/Applications")
+    assert target_bare.fs.exists("/Library")
+    assert target_bare.fs.exists("/Applications/Some.app")
+    assert target_bare.fs.exists("/Library/something")

dissect_target-3.25.dev7/tests/plugins/os/unix/bsd/darwin/macos/test__os.py

@@ -1,47 +0,0 @@
-from __future__ import annotations
-
-from typing import TYPE_CHECKING
-
-from flow.record.fieldtypes import posix_path
-
-from dissect.target.plugin import OperatingSystem
-from dissect.target.plugins.os.unix.bsd.darwin.macos._os import MacOSPlugin
-from tests._utils import absolute_path
-
-if TYPE_CHECKING:
-    from dissect.target.filesystem import VirtualFilesystem
-    from dissect.target.target import Target
-
-
-def test_unix_bsd_darwin_macos_os(target_macos_users: Target, fs_macos: VirtualFilesystem) -> None:
-    """Test if we detect a macOS target correctly."""
-
-    target_macos_users.add_plugin(MacOSPlugin)
-
-    interface = absolute_path("_data/plugins/os/unix/bsd/darwin/macos/_os/en0.plist")
-    fs_macos.map_file("/private/var/db/dhcpclient/leases/en0.plist", interface)
-
-    users = list(target_macos_users.users())
-    ips = target_macos_users.ips
-    ips.sort()
-
-    dissect_user = users[0]
-    test_user = users[1]
-
-    assert target_macos_users.os == OperatingSystem.MACOS
-    assert target_macos_users.hostname == "dummys Mac"
-    assert target_macos_users.version == "macOS 11.7.5 (20G1225)"
-
-    assert len(users) == 2
-    assert len(ips) == 2
-
-    assert dissect_user._desc.name == "macos/user"
-    assert dissect_user.name == "_dissect"
-    assert dissect_user.passwd == "*"
-    assert dissect_user.home == posix_path("/Users/dissect")
-    assert dissect_user.shell == "/usr/bin/false"
-    assert dissect_user.source == "/var/db/dslocal/nodes/Default/users/_dissect.plist"
-
-    assert test_user.home is None
-
-    assert ips == ["10.42.43.63", "10.42.43.64"]