Skip to content

Commit

Permalink
Add CONTAINER_MOUNTED evidence state (#892)
Browse files Browse the repository at this point in the history
* Add CONTAINER_MOUNTED evidence state

* Add imports

* remove old comment
  • Loading branch information
aarontp authored Aug 25, 2021
1 parent c5ee8a1 commit 834301e
Show file tree
Hide file tree
Showing 10 changed files with 24 additions and 14 deletions.
14 changes: 6 additions & 8 deletions turbinia/evidence.py
Original file line number Diff line number Diff line change
Expand Up @@ -97,6 +97,7 @@ class EvidenceState(IntEnum):
MOUNTED = 1
ATTACHED = 2
DECOMPRESSED = 3
CONTAINER_MOUNTED = 4


class Evidence:
Expand Down Expand Up @@ -850,7 +851,7 @@ class DockerContainer(Evidence):
_docker_root_directory(str): Full path to the docker root directory.
"""

POSSIBLE_STATES = [EvidenceState.MOUNTED]
POSSIBLE_STATES = [EvidenceState.CONTAINER_MOUNTED]

def __init__(self, container_id=None, *args, **kwargs):
"""Initialization for Docker Container."""
Expand All @@ -862,21 +863,18 @@ def __init__(self, container_id=None, *args, **kwargs):
self.context_dependent = True

def _preprocess(self, _, required_states):
# Checking for either ATTACHED or MOUNTED since artefact extraction only
# requires ATTACHED, but a docker container can't be attached.
if (EvidenceState.ATTACHED in required_states or
EvidenceState.MOUNTED in required_states):
if EvidenceState.CONTAINER_MOUNTED in required_states:
self._docker_root_directory = GetDockerPath(
self.parent_evidence.mount_path)
# Mounting the container's filesystem
self._container_fs_path = docker.PreprocessMountDockerFS(
self._docker_root_directory, self.container_id)
self.mount_path = self._container_fs_path
self.local_path = self.mount_path
self.state[EvidenceState.MOUNTED] = True
self.state[EvidenceState.CONTAINER_MOUNTED] = True

def _postprocess(self):
if self.state[EvidenceState.MOUNTED]:
if self.state[EvidenceState.CONTAINER_MOUNTED]:
# Unmount the container's filesystem
mount_local.PostprocessUnmountPath(self._container_fs_path)
self.state[EvidenceState.MOUNTED] = False
self.state[EvidenceState.CONTAINER_MOUNTED] = False
2 changes: 1 addition & 1 deletion turbinia/workers/analysis/jenkins.py
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@
class JenkinsAnalysisTask(TurbiniaTask):
"""Task to analyze a Jenkins install."""

REQUIRED_STATES = [state.ATTACHED, state.MOUNTED]
REQUIRED_STATES = [state.ATTACHED, state.CONTAINER_MOUNTED]

def run(self, evidence, result):
"""Run the Jenkins worker.
Expand Down
2 changes: 1 addition & 1 deletion turbinia/workers/analysis/jupyter.py
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@
class JupyterAnalysisTask(TurbiniaTask):
"""Task to analyze a Jupyter Notebook config."""

REQUIRED_STATES = [state.ATTACHED, state.MOUNTED]
REQUIRED_STATES = [state.ATTACHED, state.CONTAINER_MOUNTED]

def run(self, evidence, result):
"""Run the Jupyter worker.
Expand Down
4 changes: 3 additions & 1 deletion turbinia/workers/analysis/linux_acct.py
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,9 @@
class LinuxAccountAnalysisTask(TurbiniaTask):
"""Task to analyze a Linux password file."""

REQUIRED_STATES = [state.ATTACHED, state.DECOMPRESSED]
REQUIRED_STATES = [
state.ATTACHED, state.CONTAINER_MOUNTED, state.DECOMPRESSED
]

def run(self, evidence, result):
"""Run the Linux Account worker.
Expand Down
4 changes: 3 additions & 1 deletion turbinia/workers/analysis/windows_acct.py
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,9 @@
class WindowsAccountAnalysisTask(TurbiniaTask):
"""Task to analyze Windows accounts."""

REQUIRED_STATES = [state.ATTACHED, state.DECOMPRESSED]
REQUIRED_STATES = [
state.ATTACHED, state.CONTAINER_MOUNTED, state.DECOMPRESSED
]

def run(self, evidence, result):
"""Run the Windows Account worker.
Expand Down
2 changes: 2 additions & 0 deletions turbinia/workers/analysis/wordpress.py
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,8 @@
class WordpressAccessLogAnalysisTask(TurbiniaTask):
"""Task to analyze Wordpress access logs."""

REQUIRED_STATES = [state.ATTACHED, state.CONTAINER_MOUNTED]

timestamp_regex = re.compile(r'\[(?P<timestamp>.+)\]')

install_step_regex = re.compile(
Expand Down
2 changes: 1 addition & 1 deletion turbinia/workers/hadoop.py
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@
class HadoopAnalysisTask(TurbiniaTask):
"""Task to analyse Hadoop AppRoot files."""

REQUIRED_STATES = [state.ATTACHED, state.MOUNTED]
REQUIRED_STATES = [state.ATTACHED, state.CONTAINER_MOUNTED]

def _AnalyzeHadoopAppRoot(self, collected_artifacts, output_dir):
"""Runs a naive AppRoot files parsing method.
Expand Down
2 changes: 1 addition & 1 deletion turbinia/workers/redis.py
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@
class RedisAnalysisTask(TurbiniaTask):
"""Task to analyze a Redis configuration file."""

REQUIRED_STATES = [state.ATTACHED, state.MOUNTED]
REQUIRED_STATES = [state.ATTACHED, state.CONTAINER_MOUNTED]

def run(self, evidence, result):
"""Run the Redis configuration analysis worker.
Expand Down
3 changes: 3 additions & 0 deletions turbinia/workers/sshd.py
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@
import re

from turbinia.evidence import ReportText
from turbinia.evidence import EvidenceState as state
from turbinia.lib import text_formatter as fmt
from turbinia.workers import TurbiniaTask
from turbinia.workers import Priority
Expand All @@ -28,6 +29,8 @@
class SSHDAnalysisTask(TurbiniaTask):
"""Task to analyze a sshd_config file."""

REQUIRED_STATES = [state.ATTACHED, state.CONTAINER_MOUNTED]

def run(self, evidence, result):
"""Run the sshd_config analysis worker.
Expand Down
3 changes: 3 additions & 0 deletions turbinia/workers/tomcat.py
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@
import re

from turbinia.evidence import ReportText
from turbinia.evidence import EvidenceState as state
from turbinia.lib import text_formatter as fmt
from turbinia.workers import TurbiniaTask
from turbinia.workers import Priority
Expand All @@ -28,6 +29,8 @@
class TomcatAnalysisTask(TurbiniaTask):
"""Task to analyze a Tomcat file."""

REQUIRED_STATES = [state.ATTACHED, state.CONTAINER_MOUNTED]

def run(self, evidence, result):
"""Run the Tomcat analysis worker.
Expand Down

0 comments on commit 834301e

Please sign in to comment.