Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Linux - Harden mountinfo API and several related fixes #1545

Merged
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
linux: vfsmount: improve kernel implementation detection
  • Loading branch information
gcmoreira committed Jan 29, 2025
commit 74a834b6de089a0ba8cca62d9e86314996faa9fb
4 changes: 1 addition & 3 deletions volatility3/framework/symbols/linux/extensions/__init__.py
Original file line number Diff line number Diff line change
Expand Up @@ -1575,13 +1575,11 @@ def _is_kernel_prior_to_struct_mount(self) -> bool:
# the 'mnt_parent' member was relocated from the 'vfsmount' struct to the newly
# introduced 'mount' struct.

Alternatively, vmlinux.has_type('mount') can be used here but it is faster.

Returns:
'True' if the kernel lacks the 'mount' struct, typically indicating kernel < 3.3.
"""

return self.has_member("mnt_parent")
return not self._context.symbol_space.has_type("mount")

def is_equal(self, vfsmount_ptr) -> bool:
"""Helper to make sure it is comparing two pointers to 'vfsmount'.
Expand Down
Loading