" fuddlZddlmZmZmZddlmZmZmZddl m Z m Z m Z ddl mZddlmZddlmZddlmZdd lmZej.eZeGd d ZeGd d ZGddej8Zy)N) dataclassastuplefields)IterableListTuple) interfaces renderers exceptions) requirements)plugins)utility) extensions)pslistcDeZdZUdZeed<eed<eed<eed<eed<y)TaskDataz%Stores basic information about a taskcommpidtgidppideuidN)__name__ __module__ __qualname____doc__str__annotations__intb/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/linux/capabilities.pyrrs/ I H I I Ir rceZdZUdZej j ed<ej j ed<ej j ed<ej j ed<ej j ed<defdZ y ) CapabilitiesDataz)Stores each set of capabilties for a taskcap_inheritable cap_permitted cap_effectivecap_bset cap_ambientreturnc>tfdtDS)zReturns a shallow copy of the capability sets in a tuple. Otherwise, when dataclasses.astuple() performs a deep-copy recursion on ObjectInterface will take a substantial amount of time. c3JK|]}t|jywN)getattrname).0fieldselfs r! z+CapabilitiesData.astuple...sI5WT5::.Is #)tupler)r1s`r!rzCapabilitiesData.astuple(s IF4LIIIr N) rrrrr objectsObjectInterfacerrrrr r!r#r#sm3''777%%555%%555  000##333JJr r#ceZdZdZdZdZedeejjfdZ dejjdefdZed ej"j$defd Zed ej"j$deeeffd Zed eej"j$deeeeffdZd eej"j$deeeeffdZdZy) CapabilitieszLists process capabilitiesrr)rrr)ctjddgdtjdtjdtj dd t d gS) Nkernelz Linux kernel)Intel32Intel64AArch64)r. description architecturesrr8)r.pluginversionpidszFilter on specific process IDs.T)r.r@ element_typeoptional)r ModuleRequirementPluginRequirementrPsListListRequirementr)clss r!get_requirementszCapabilities.get_requirements8s\  * **?   * *fmmY   ( (=     r contextvmlinux_module_namec|j|} |jd}tj j }||kDrtjdyy#tj$rYywxYw)zChecks that the framework supports at least as much capabilities as the kernel being analysed. Otherwise, it shows a warning for the developers. cap_last_cap) symbol_nameNzXDevelopers: The supported Linux capabilities of this plugin are outdated for this kernel) modulesobject_from_symbolr SymbolErrorrkernel_cap_structget_last_cap_valuevollogwarning)r1rMrNvmlinuxkernel_cap_last_cap vol2_last_caps r!_check_capabilities_supportz(Capabilities._check_capabilities_supportKsx//"56 ")"<"<"<"X  #44GGI  . NNj  / %%  sAA32A3capct|tjr|S|j}|sy||j k(rydj |j S)aReturns a textual representation of the capability set. The format is a comma-separated list of capabilitites. In order to summarize the output and if all the capabilities are enabled, instead of the individual capabilities, the special name "all" will be shown. Args: cap: Kernel capability object. Usually a 'kernel_cap_struct' struct Returns: str: A string with a comma separated list of decoded capabilities allz, ) isinstancer NotAvailableValueget_capabilitiesget_kernel_cap_fulljoinenumerate_capabilities)r] cap_values r! _decode_capzCapabilities._decode_capcsY c966 7J((*  //1 1yy33566r taskc ttj|jt |j t |j t |jj t |jj}|j}t|j|j|j|jt!j"}|j%dr|j&|_||fS)zReturns a tuple with the task basic information along with its capabilities Args: task: A task object from where to get the fields. Returns: A tuple with the task basic information and its capabilities )rrrrr)r$r%r&r'r(r()rrarray_to_stringrrrrparentcredr real_credr#r$r%r&r'r rb has_memberr()rKri task_data task_credcapabilities_datas r!get_task_capabilitiesz"Capabilities.get_task_capabilities|s((3DHH TYYT[[__%TYY^^$  NN ,%55#11#11''!335      .,5,A,A  )+++r tasksc#@K|D]}|j|yw)a"Yields a tuple for each task containing the task's basic information along with its capabilities Args: tasks: An iterable with the tasks to process. Yields: A tuple for each task containing the task's basic information and its capabilities N)rs)rKrtris r!get_tasks_capabilitiesz#Capabilities.get_tasks_capabilitiess( 2D++D1 1 2sc#Kj|D];\}}t|}tfd|jD}d||zf=yw)Nc3@K|]}j|ywr,)rh)r/r]r1s r!r2z*Capabilities._generator..s!&*-  %&sr)rvrr3)r1rt task_fieldscapabilities_fieldscapabilities_texts` r! _generatorzCapabilities._generatorsg150K0KE0R 5 ,K,!+.K %&1D1L1L1N&! [#444 4 5sAAc |j|j|jd|jjd}tj j |}tj j|j|jd|}dtfdtfdtfdtfdtfd tfd tfd tfd tfd tfg }tj||j|S)Nr<rD) filter_funcNameTidPidPPidEUIDr$r%r& cap_boundingr() r\rMconfiggetrrIcreate_pid_filter list_tasksrrr TreeGridr|)r1rD pid_filterrtcolumnss r!runzCapabilities.runs ((t{{87LM{{v&]]44T:  (( LL$++h/Z)  SM CL CL SM SM  $ c " c " S ! C   !!'4??5+ABBr N)rrrr_required_framework_version_version classmethodrr configurationRequirementInterfacerLrMContextInterfacerr\ staticmethodr4r5rhrrr#rsrrvrr|rrr r!r7r71sF$"+H j&>&>&S&S!T  $##44!07++;;7770 ,%%55 , x)) * , ,D 2++;;< 2 %"223 4 2 2 5j00@@A 5 %U # $ 5Cr r7)logging dataclassesrrrtypingrrrvolatility3.frameworkr r r #volatility3.framework.configurationr volatility3.framework.interfacesr volatility3.framework.objectsr#volatility3.framework.symbols.linuxrvolatility3.plugins.linuxr getLoggerrrWrr#PluginInterfacer7rr r!rs 22((CC<41:,   8 $   JJ J$_C7**_Cr