diff --git a/turbinia/evidence.py b/turbinia/evidence.py index 6b1b9b928..28f18339b 100644 --- a/turbinia/evidence.py +++ b/turbinia/evidence.py @@ -97,6 +97,7 @@ class EvidenceState(IntEnum): MOUNTED = 1 ATTACHED = 2 DECOMPRESSED = 3 + CONTAINER_MOUNTED = 4 class Evidence: @@ -850,7 +851,7 @@ class DockerContainer(Evidence): _docker_root_directory(str): Full path to the docker root directory. """ - POSSIBLE_STATES = [EvidenceState.MOUNTED] + POSSIBLE_STATES = [EvidenceState.CONTAINER_MOUNTED] def __init__(self, container_id=None, *args, **kwargs): """Initialization for Docker Container.""" @@ -862,10 +863,7 @@ def __init__(self, container_id=None, *args, **kwargs): self.context_dependent = True def _preprocess(self, _, required_states): - # Checking for either ATTACHED or MOUNTED since artefact extraction only - # requires ATTACHED, but a docker container can't be attached. - if (EvidenceState.ATTACHED in required_states or - EvidenceState.MOUNTED in required_states): + if EvidenceState.CONTAINER_MOUNTED in required_states: self._docker_root_directory = GetDockerPath( self.parent_evidence.mount_path) # Mounting the container's filesystem @@ -873,10 +871,10 @@ def _preprocess(self, _, required_states): self._docker_root_directory, self.container_id) self.mount_path = self._container_fs_path self.local_path = self.mount_path - self.state[EvidenceState.MOUNTED] = True + self.state[EvidenceState.CONTAINER_MOUNTED] = True def _postprocess(self): - if self.state[EvidenceState.MOUNTED]: + if self.state[EvidenceState.CONTAINER_MOUNTED]: # Unmount the container's filesystem mount_local.PostprocessUnmountPath(self._container_fs_path) - self.state[EvidenceState.MOUNTED] = False + self.state[EvidenceState.CONTAINER_MOUNTED] = False diff --git a/turbinia/workers/analysis/jenkins.py b/turbinia/workers/analysis/jenkins.py index a1168e241..7d6e5081b 100644 --- a/turbinia/workers/analysis/jenkins.py +++ b/turbinia/workers/analysis/jenkins.py @@ -32,7 +32,7 @@ class JenkinsAnalysisTask(TurbiniaTask): """Task to analyze a Jenkins install.""" - REQUIRED_STATES = [state.ATTACHED, state.MOUNTED] + REQUIRED_STATES = [state.ATTACHED, state.CONTAINER_MOUNTED] def run(self, evidence, result): """Run the Jenkins worker. diff --git a/turbinia/workers/analysis/jupyter.py b/turbinia/workers/analysis/jupyter.py index d77be1eb1..053e100f0 100644 --- a/turbinia/workers/analysis/jupyter.py +++ b/turbinia/workers/analysis/jupyter.py @@ -30,7 +30,7 @@ class JupyterAnalysisTask(TurbiniaTask): """Task to analyze a Jupyter Notebook config.""" - REQUIRED_STATES = [state.ATTACHED, state.MOUNTED] + REQUIRED_STATES = [state.ATTACHED, state.CONTAINER_MOUNTED] def run(self, evidence, result): """Run the Jupyter worker. diff --git a/turbinia/workers/analysis/linux_acct.py b/turbinia/workers/analysis/linux_acct.py index 071618cab..c7e0c0aef 100644 --- a/turbinia/workers/analysis/linux_acct.py +++ b/turbinia/workers/analysis/linux_acct.py @@ -30,7 +30,9 @@ class LinuxAccountAnalysisTask(TurbiniaTask): """Task to analyze a Linux password file.""" - REQUIRED_STATES = [state.ATTACHED, state.DECOMPRESSED] + REQUIRED_STATES = [ + state.ATTACHED, state.CONTAINER_MOUNTED, state.DECOMPRESSED + ] def run(self, evidence, result): """Run the Linux Account worker. diff --git a/turbinia/workers/analysis/windows_acct.py b/turbinia/workers/analysis/windows_acct.py index b882b2be5..245edb4ff 100644 --- a/turbinia/workers/analysis/windows_acct.py +++ b/turbinia/workers/analysis/windows_acct.py @@ -30,7 +30,9 @@ class WindowsAccountAnalysisTask(TurbiniaTask): """Task to analyze Windows accounts.""" - REQUIRED_STATES = [state.ATTACHED, state.DECOMPRESSED] + REQUIRED_STATES = [ + state.ATTACHED, state.CONTAINER_MOUNTED, state.DECOMPRESSED + ] def run(self, evidence, result): """Run the Windows Account worker. diff --git a/turbinia/workers/analysis/wordpress.py b/turbinia/workers/analysis/wordpress.py index 306949d9b..265ac2738 100644 --- a/turbinia/workers/analysis/wordpress.py +++ b/turbinia/workers/analysis/wordpress.py @@ -30,6 +30,8 @@ class WordpressAccessLogAnalysisTask(TurbiniaTask): """Task to analyze Wordpress access logs.""" + REQUIRED_STATES = [state.ATTACHED, state.CONTAINER_MOUNTED] + timestamp_regex = re.compile(r'\[(?P.+)\]') install_step_regex = re.compile( diff --git a/turbinia/workers/hadoop.py b/turbinia/workers/hadoop.py index 29db7d7b1..ee163717c 100644 --- a/turbinia/workers/hadoop.py +++ b/turbinia/workers/hadoop.py @@ -36,7 +36,7 @@ class HadoopAnalysisTask(TurbiniaTask): """Task to analyse Hadoop AppRoot files.""" - REQUIRED_STATES = [state.ATTACHED, state.MOUNTED] + REQUIRED_STATES = [state.ATTACHED, state.CONTAINER_MOUNTED] def _AnalyzeHadoopAppRoot(self, collected_artifacts, output_dir): """Runs a naive AppRoot files parsing method. diff --git a/turbinia/workers/redis.py b/turbinia/workers/redis.py index 44110f2f3..f5292bcc7 100644 --- a/turbinia/workers/redis.py +++ b/turbinia/workers/redis.py @@ -29,7 +29,7 @@ class RedisAnalysisTask(TurbiniaTask): """Task to analyze a Redis configuration file.""" - REQUIRED_STATES = [state.ATTACHED, state.MOUNTED] + REQUIRED_STATES = [state.ATTACHED, state.CONTAINER_MOUNTED] def run(self, evidence, result): """Run the Redis configuration analysis worker. diff --git a/turbinia/workers/sshd.py b/turbinia/workers/sshd.py index 051664d08..e98f445c7 100644 --- a/turbinia/workers/sshd.py +++ b/turbinia/workers/sshd.py @@ -20,6 +20,7 @@ import re from turbinia.evidence import ReportText +from turbinia.evidence import EvidenceState as state from turbinia.lib import text_formatter as fmt from turbinia.workers import TurbiniaTask from turbinia.workers import Priority @@ -28,6 +29,8 @@ class SSHDAnalysisTask(TurbiniaTask): """Task to analyze a sshd_config file.""" + REQUIRED_STATES = [state.ATTACHED, state.CONTAINER_MOUNTED] + def run(self, evidence, result): """Run the sshd_config analysis worker. diff --git a/turbinia/workers/tomcat.py b/turbinia/workers/tomcat.py index 348c2f2db..7a4634c91 100644 --- a/turbinia/workers/tomcat.py +++ b/turbinia/workers/tomcat.py @@ -20,6 +20,7 @@ import re from turbinia.evidence import ReportText +from turbinia.evidence import EvidenceState as state from turbinia.lib import text_formatter as fmt from turbinia.workers import TurbiniaTask from turbinia.workers import Priority @@ -28,6 +29,8 @@ class TomcatAnalysisTask(TurbiniaTask): """Task to analyze a Tomcat file.""" + REQUIRED_STATES = [state.ATTACHED, state.CONTAINER_MOUNTED] + def run(self, evidence, result): """Run the Tomcat analysis worker.