linux: testcases: add 10 final test cases to achieve full plugin coverage

test/test_volatility.py

@@ -640,7 +640,130 @@ def test_linux_page_cache_files(image, volatility, python):
         rb"146829\s0x88001ab5c270.*?/etc/passwd",
         out,
     )
+
+
+def test_linux_page_cache_inodepages(image, volatility, python):
+
+    inode_address = hex(0x88001AB5C270)
+    inode_dump_filename = f"inode_{inode_address}.dmp"
+    try:
+        rc, out, _err = runvol_plugin(
+            "linux.pagecache.InodePages",
+            image,
+            volatility,
+            python,
+            pluginargs=["--inode", inode_address, "--dump"],
+        )
+
+        assert rc == 0
+        assert out.count(b"\n") > 4
+
+        # PageVAddr PagePAddr MappingAddr .. DumpSafe
+        assert re.search(
+            rb"0xea000054c5f8\s0x18389000\s0x88001ab5c3b0.*?True",
+            out,
+        )
+        assert os.path.exists(inode_dump_filename)
+        inode_contents = open(inode_dump_filename, "rb").read()
+        assert inode_contents.count(b"\n") > 30
+        assert inode_contents.count(b"root:x:0:0:root:/root:/bin/bash") > 0
+    finally:
+        with contextlib.suppress(FileNotFoundError):
+            os.remove(inode_dump_filename)
+
+
+def test_linux_check_afinfo(image, volatility, python):
+    rc, out, _err = runvol_plugin(
+        "linux.check_afinfo.Check_afinfo", image, volatility, python
+    )
+
+    # linux-sample-1.bin has no suspicious results.
+    # This validates that plugin requirements are met and exceptions are not raised.
     assert rc == 0
+    assert out.count(b"\n") >= 4
+
+
+def test_linux_check_modules(image, volatility, python):
+    rc, out, _err = runvol_plugin(
+        "linux.check_modules.Check_modules", image, volatility, python
+    )
+
+    # linux-sample-1.bin has no suspicious results.
+    # This validates that plugin requirements are met and exceptions are not raised.
+    assert rc == 0
+    assert out.count(b"\n") >= 4
+
+
+def test_linux_ebpf_progs(image, volatility, python):
+    rc, out, err = runvol_plugin(
+        "linux.ebpf.EBPF",
+        image,
+        volatility,
+        python,
+        globalargs=["-vvv"],
+    )
+
+    if rc != 0 and err.count(b"Unsupported kernel") > 0:
+        # The linux-sample-1.bin kernel implementation isn't supported.
+        # However, we can still check that the plugin requirements are met.
+        return None
+
+    assert rc == 0
+    assert out.count(b"\n") > 4
+
+
+def test_linux_iomem(image, volatility, python):
+    rc, out, _err = runvol_plugin("linux.iomem.IOMem", image, volatility, python)
+
+    assert rc == 0
+    assert out.count(b"\n") > 100
+
+
+def test_linux_keyboard_notifiers(image, volatility, python):
+    rc, out, _err = runvol_plugin(
+        "linux.keyboard_notifiers.Keyboard_notifiers", image, volatility, python
+    )
+
+    # linux-sample-1.bin has no suspicious results for this plugin.
+    # This validates that plugin requirements are met and exceptions are not raised.
+    assert rc == 0
+    assert out.count(b"\n") >= 4
+
+
+def test_linux_kmesg(image, volatility, python):
+    rc, out, _err = runvol_plugin("linux.kmsg.Kmsg", image, volatility, python)
+
+    assert rc == 0
+    assert out.count(b"\n") > 100
+
+
+def test_linux_netfilter(image, volatility, python):
+    rc, out, _err = runvol_plugin(
+        "linux.netfilter.Netfilter", image, volatility, python
+    )
+
+    # linux-sample-1.bin has no suspicious results for this plugin.
+    # This validates that plugin requirements are met and exceptions are not raised.
+    assert rc == 0
+    assert out.count(b"\n") >= 4
+
+
+def test_linux_psscan(image, volatility, python):
+    rc, out, _err = runvol_plugin("linux.psscan.PsScan", image, volatility, python)
+
+    assert rc == 0
+    assert out.count(b"\n") > 100
+
+
+def test_linux_hidden_modules(image, volatility, python):
+    rc, out, _err = runvol_plugin(
+        "linux.hidden_modules.Hidden_modules", image, volatility, python
+    )
+
+    # linux-sample-1.bin has no hidden modules.
+    # This validates that plugin requirements are met and exceptions are not raised.
+    assert rc == 0
+    assert out.count(b"\n") >= 4
 
 
 # MAC