" fu ddlZddlmZmZmZddlmZmZmZddl m Z m Z m Z ddl mZddlmZddlmZddlmZdd lmZejeZeGd d ZeGd d ZGddejZdS)N) dataclassastuplefields)IterableListTuple) interfaces renderers exceptions) requirements)plugins)utility) extensions)pslistcFeZdZUdZeed<eed<eed<eed<eed<dS)TaskDataz%Stores basic information about a taskcommpidtgidppideuidN)__name__ __module__ __qualname____doc__str__annotations__intb/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/linux/capabilities.pyrrsC// III HHH III III IIIIIr rceZdZUdZejjed<ejjed<ejjed<ejjed<ejjed<defdZ d S) CapabilitiesDataz)Stores each set of capabilties for a taskcap_inheritable cap_permitted cap_effectivecap_bset cap_ambientreturncTtfdtDS)zReturns a shallow copy of the capability sets in a tuple. Otherwise, when dataclasses.astuple() performs a deep-copy recursion on ObjectInterface will take a substantial amount of time. c3BK|]}t|jVdSN)getattrname).0fieldselfs r! z+CapabilitiesData.astuple...s/II5WT5:..IIIIIIr )tupler)r1s`r!rzCapabilitiesData.astuple(s. IIIIF4LLIIIIIIr N) rrrrr objectsObjectInterfacerrrrr r!r#r#s33'7777%5555%5555 0000#3333JJJJJJJr r#ceZdZdZdZdZedeej j fdZ dej j defdZed ejjdefd Zed ejjdeeeffd Zed eejjdeeeeffdZd eejjdeeeeffdZdZdS) CapabilitieszLists process capabilitiesrr)rrr)ctjddgdtjdtjdtjdd t d gS) Nkernelz Linux kernel)Intel32Intel64AArch64)r. description architecturesrr8)r.pluginversionpidszFilter on specific process IDs.T)r.r@ element_typeoptional)r ModuleRequirementPluginRequirementrPsListListRequirementr)clss r!get_requirementszCapabilities.get_requirements8su  **???     *fmY     (=       r contextvmlinux_module_namec|j|} |d}n#tj$rYdSwxYwtj}||krtddSdS)zChecks that the framework supports at least as much capabilities as the kernel being analysed. Otherwise, it shows a warning for the developers. cap_last_cap) symbol_nameNzXDevelopers: The supported Linux capabilities of this plugin are outdated for this kernel) modulesobject_from_symbolr SymbolErrorrkernel_cap_structget_last_cap_valuevollogwarning)r1rMrNvmlinuxkernel_cap_last_cap vol2_last_caps r!_check_capabilities_supportz(Capabilities._check_capabilities_supportKs/"56 ")"<"<"<"X"X  %   44 #4GGII  . . NNj      / .s &99capct|tjr|S|}|sdS||krdSd|S)aReturns a textual representation of the capability set. The format is a comma-separated list of capabilitites. In order to summarize the output and if all the capabilities are enabled, instead of the individual capabilities, the special name "all" will be shown. Args: cap: Kernel capability object. Usually a 'kernel_cap_struct' struct Returns: str: A string with a comma separated list of decoded capabilities allz, ) isinstancer NotAvailableValueget_capabilitiesget_kernel_cap_fulljoinenumerate_capabilities)r] cap_values r! _decode_capzCapabilities._decode_capcsv c96 7 7 J((**  2 //11 1 15yy3355666r taskc ttj|jt |jt |jt |jjt |jj }|j }t|j |j |j|jt!j}|dr |j|_||fS)zReturns a tuple with the task basic information along with its capabilities Args: task: A task object from where to get the fields. Returns: A tuple with the task basic information and its capabilities )rrrrr)r$r%r&r'r(r()rrarray_to_stringrrrrparentcredr real_credr#r$r%r&r'r rb has_memberr()rKri task_data task_credcapabilities_datas r!get_task_capabilitiesz"Capabilities.get_task_capabilities|s(33DH TYT[_%%TY^$$    N ,%5#1#1'!355        . . B,5,A  )+++r tasksc#BK|D]}||VdS)a"Yields a tuple for each task containing the task's basic information along with its capabilities Args: tasks: An iterable with the tasks to process. Yields: A tuple for each task containing the task's basic information and its capabilities N)rs)rKrtris r!get_tasks_capabilitiesz#Capabilities.get_tasks_capabilitiess> 2 2D++D11 1 1 1 1 2 2r c#K|D]J\}}t|}tfd|D}d||zfVKdS)Nc3BK|]}|VdSr,)rh)r/r]r1s r!r2z*Capabilities._generator..sB&&*-  %%&&&&&&r r)rvrr3)r1rt task_fieldscapabilities_fieldscapabilities_texts` r! _generatorzCapabilities._generators150K0KE0R0R 5 5 ,K,!+..K %&&&&1D1L1L1N1N&&&!! [#444 4 4 4 4 5 5r c ||j|jd|jd}tj|}tj|j|jd|}dtfdtfdtfdtfdtfd tfd tfd tfd tfd tfg }tj || |S)Nr<rD) filter_funcNameTidPidPPidEUIDr$r%r& cap_boundingr() r\rMconfiggetrrIcreate_pid_filter list_tasksrrr TreeGridr|)r1rD pid_filterrtcolumnss r!runzCapabilities.runs ((t{87LMMM{v&&]44T::  (( L$+h/Z)   SM CL CL SM SM  $ c " c " S ! C   !'4??5+A+ABBBr N)rrrr_required_framework_version_version classmethodrr configurationRequirementInterfacerLrMContextInterfacerr\ staticmethodr4r5rhrrr#rsrrvrr|rrr r!r7r71s$$"+H j&>&S!T   [ $#4!07+;7777\70 ,%5 , x)) * , , ,[ ,D 2+;< 2 %"223 4 2 2 2[ 2 5j0@A 5 %U # $ 5 5 5 5CCCCCr r7)logging dataclassesrrrtypingrrrvolatility3.frameworkr r r #volatility3.framework.configurationr volatility3.framework.interfacesr volatility3.framework.objectsr#volatility3.framework.symbols.linuxrvolatility3.plugins.linuxr getLoggerrrWrr#PluginInterfacer7rr r!rs 2222222222((((((((((CCCCCCCCCC<<<<<<444444111111::::::,,,,,,  8 $ $   JJJJJJJ J$_C_C_C_C_C7*_C_C_C_C_Cr