Rietveld Code Review Tool
Help | Bug tracker | Discussion group | Source code | Sign in
(1991)

Unified Diff: plaso/preprocessors/linux.py

Issue 322490043: [plaso] Added Linux system product preprocessor plugin #1337 (Closed)
Patch Set: Created 6 years, 7 months ago
Use n/p to move between diff chunks; N/P to move between comments. Please Sign in to add in-line comments.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « no previous file | plaso/preprocessors/windows.py » ('j') | plaso/preprocessors/windows.py » ('J')
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: plaso/preprocessors/linux.py
diff --git a/plaso/preprocessors/linux.py b/plaso/preprocessors/linux.py
index d26a880213931ab09946583d709ecd9583ab51a7..952fac1d7cd8b13f5866c5f59fded413cae3a2db 100644
--- a/plaso/preprocessors/linux.py
+++ b/plaso/preprocessors/linux.py
@@ -55,6 +55,44 @@ class LinuxHostnamePlugin(interface.FileArtifactPreprocessorPlugin):
return result
+class LinuxSystemProductPlugin(interface.FileArtifactPreprocessorPlugin):
+ """The Linux system product plugin."""
+
+ ARTIFACT_DEFINITION_NAME = 'LinuxRelease'
+
+ def _ParseFileData(self, knowledge_base, file_object):
+ """Parses file content (data) for system product preprocessing attribute.
+
+ Args:
+ knowledge_base (KnowledgeBase): to fill with preprocessing information.
+ file_object (dfvfs.FileIO): file-like object that contains the artifact
+ value data.
+
+ Returns:
+ bool: True if all the preprocessing attributes were found and
+ the preprocessor plugin is done.
+
+ Raises:
+ errors.PreProcessFail: if the preprocessing fails.
+ """
+ result = False
+ text_file_object = dfvfs_text_file.TextFile(file_object)
+ system_product = text_file_object.readline()
aaronp 2017/08/10 17:31:25 This seems like it will work well with the example
Joachim Metz 2017/08/11 06:09:19 Thx for flagging. Now I think of it /etc/lsb-relea
+
+ try:
+ system_product = system_product.decode('utf-8')
+ except UnicodeDecodeError:
+ # TODO: add and store preprocessing errors.
+ system_product = system_product.decode('utf-8', errors='replace')
+
+ system_product = system_product.strip()
+ if system_product:
+ knowledge_base.SetValue('operating_system_product', system_product)
+ result = True
+
+ return result
+
+
class LinuxTimeZonePlugin(interface.FileEntryArtifactPreprocessorPlugin):
"""Linux time zone plugin."""
@@ -157,4 +195,5 @@ class LinuxUserAccountsPlugin(interface.FileArtifactPreprocessorPlugin):
manager.PreprocessPluginsManager.RegisterPlugins([
- LinuxHostnamePlugin, LinuxTimeZonePlugin, LinuxUserAccountsPlugin])
+ LinuxHostnamePlugin, LinuxSystemProductPlugin, LinuxTimeZonePlugin,
+ LinuxUserAccountsPlugin])
« no previous file with comments | « no previous file | plaso/preprocessors/windows.py » ('j') | plaso/preprocessors/windows.py » ('J')

Powered by Google App Engine
RSS Feeds Recent Issues | This issue
This is Rietveld f62528b