linux: Add 15 new test cases for plugins dependent on pslist

test/test_volatility.py

@@ -386,6 +386,171 @@ def test_linux_library_list(image, volatility, python):
     assert rc == 0
 
 
+def test_linux_pstree(image, volatility, python):
+    rc, out, _err = runvol_plugin("linux.pstree.PsTree", image, volatility, python)
+    out = out.lower()
+
+    assert (out.find(b"init") != -1) or (out.find(b"systemd") != -1)
+    assert out.count(b"\n") > 10
+    assert rc == 0
+
+
+def test_linux_pidhashtable(image, volatility, python):
+    rc, out, _err = runvol_plugin(
+        "linux.pidhashtable.PIDHashTable", image, volatility, python
+    )
+    out = out.lower()
+
+    assert (out.find(b"init") != -1) or (out.find(b"systemd") != -1)
+    assert out.count(b"\n") > 10
+    assert rc == 0
+
+
+def test_linux_bash(image, volatility, python):
+    rc, out, _err = runvol_plugin("linux.bash.Bash", image, volatility, python)
+    out = out.lower()
+
+    assert out.count(b"\n") > 10
+    assert rc == 0
+
+
+def test_linux_boottime(image, volatility, python):
+    rc, out, _err = runvol_plugin("linux.boottime.Boottime", image, volatility, python)
+    out = out.lower()
+
+    assert out.count(b"utc") >= 1
+    assert rc == 0
+
+
+def test_linux_capabilities(image, volatility, python):
+    rc, out, err = runvol_plugin(
+        "linux.capabilities.Capabilities",
+        image,
+        volatility,
+        python,
+        globalargs=["-vvv"],
+    )
+    if rc != 0 and err.count(b"Unsupported kernel capabilities implementation") > 0:
+        # The linux-sample-1.bin kernel implementation isn't supported.
+        # However, we can still check that the plugin requirements are met.
+        return None
+
+    out = out.lower()
+
+    assert out.count(b"\n") > 10
+    assert rc == 0
+
+
+def test_linux_check_creds(image, volatility, python):
+    rc, out, _err = runvol_plugin(
+        "linux.check_creds.Check_creds", image, volatility, python
+    )
+    out = out.lower()
+
+    # linux-sample-1.bin has no processes sharing credentials.
+    # This validates that plugin requirements are met and exceptions are not raised.
+    assert rc == 0
+
+
+def test_linux_elfs(image, volatility, python):
+    rc, out, _err = runvol_plugin("linux.elfs.Elfs", image, volatility, python)
+    out = out.lower()
+
+    assert out.count(b"\n") > 10
+    assert rc == 0
+
+
+def test_linux_envars(image, volatility, python):
+    rc, out, _err = runvol_plugin("linux.envars.Envars", image, volatility, python)
+    out = out.lower()
+
+    assert out.count(b"\n") > 10
+    assert rc == 0
+
+
+def test_linux_kthreads(image, volatility, python):
+    rc, out, err = runvol_plugin(
+        "linux.kthreads.Kthreads",
+        image,
+        volatility,
+        python,
+        globalargs=["-vvv"],
+    )
+    out = out.lower()
+
+    if rc != 0 and err.count(b"Unsupported kthread implementation") > 0:
+        # The linux-sample-1.bin kernel implementation isn't supported.
+        # However, we can still check that the plugin requirements are met.
+        return None
+
+    assert out.count(b"\n") > 10
+    assert rc == 0
+
+
+def test_linux_malfind(image, volatility, python):
+    rc, out, _err = runvol_plugin("linux.malfind.Malfind", image, volatility, python)
+    out = out.lower()
+
+    # linux-sample-1.bin has no process memory ranges with potential injected code.
+    # This validates that plugin requirements are met and exceptions are not raised.
+    assert rc == 0
+
+
+def test_linux_mountinfo(image, volatility, python):
+    rc, out, _err = runvol_plugin(
+        "linux.mountinfo.MountInfo", image, volatility, python
+    )
+    out = out.lower()
+
+    assert out.count(b"\n") > 10
+    assert rc == 0
+
+
+def test_linux_psaux(image, volatility, python):
+    rc, out, _err = runvol_plugin("linux.psaux.PsAux", image, volatility, python)
+    out = out.lower()
+
+    assert out.count(b"\n") > 50
+    assert rc == 0
+
+
+def test_linux_ptrace(image, volatility, python):
+    rc, out, _err = runvol_plugin("linux.ptrace.Ptrace", image, volatility, python)
+    out = out.lower()
+
+    # linux-sample-1.bin has no processes being ptreaced.
+    # This validates that plugin requirements are met and exceptions are not raised.
+    assert rc == 0
+
+
+def test_linux_vmaregexscan(image, volatility, python):
+    rc, out, _err = runvol_plugin(
+        "linux.vmaregexscan.VmaRegExScan",
+        image,
+        volatility,
+        python,
+        pluginargs=["--pid", "1", "--pattern", "\\x7fELF"],
+    )
+    out = out.lower()
+
+    assert out.count(b"\n") > 10
+    assert rc == 0
+
+
+def test_linux_vmayarascan(image, volatility, python):
+    rc, out, _err = runvol_plugin(
+        "linux.vmayarascan.VmaYaraScan",
+        image,
+        volatility,
+        python,
+        pluginargs=["--pid", "1", "--yara-string", "ELF"],
+    )
+    out = out.lower()
+
+    assert out.count(b"\n") > 10
+    assert rc == 0
+
+
 # MAC