use a dict of dataclasses for taint_flags

volatility3/framework/constants/linux/__init__.py

@@ -6,6 +6,7 @@
 Linux-specific values that aren't found in debug symbols
 """
 from enum import IntEnum, Flag
+from dataclasses import dataclass
 
 KERNEL_NAME = "__kernel__"
 
@@ -349,78 +350,47 @@ MODULE_MAXIMUM_CORE_TEXT_SIZE = 20000000
 MODULE_MINIMUM_SIZE = 4096
 
 
+@dataclass
+class TaintFlag:
+    shift: int
+    desc: str
+    when_present: bool
+    module: bool
+
+
 TAINT_FLAGS = {
-    "P": {
-        "shift": 1 << 0,
-        "desc": "PROPRIETARY_MODULE",
-        "when_present": True,
-        "module": True,
-    },
-    "G": {
-        "shift": 1 << 0,
-        "desc": "PROPRIETARY_MODULE",
-        "when_present": False,
-        "module": True,
-    },
-    "F": {
-        "shift": 1 << 1,
-        "desc": "FORCED_MODULE",
-        "when_present": True,
-        "module": False,
-    },
-    # CPU_OUT_OF_SPEC was TAINT_UNSAFE_SMP on < 3.15-rc1 : https://lore.kernel.org/linux-kernel//20140303080432.GA25489@localhost/t/#:~:text=liked%20your%20proposal%3A-,%3E%20Right,-%2C%20I%20was%20about
-    "S": {
-        "shift": 1 << 2,
-        "desc": "CPU_OUT_OF_SPEC",
-        "when_present": True,
-        "module": False,
-    },
-    "R": {
-        "shift": 1 << 3,
-        "desc": "FORCED_RMMOD",
-        "when_present": True,
-        "module": False,
-    },
-    "M": {
-        "shift": 1 << 4,
-        "desc": "MACHINE_CHECK",
-        "when_present": True,
-        "module": False,
-    },
-    "B": {"shift": 1 << 5, "desc": "BAD_PAGE", "when_present": True, "module": False},
-    "U": {"shift": 1 << 6, "desc": "USER", "when_present": True, "module": False},
-    "D": {"shift": 1 << 7, "desc": "DIE", "when_present": True, "module": False},
-    "A": {
-        "shift": 1 << 8,
-        "desc": "OVERRIDDEN_ACPI_TABLE",
-        "when_present": True,
-        "module": False,
-    },
-    "W": {"shift": 1 << 9, "desc": "WARN", "when_present": True, "module": False},
-    "C": {"shift": 1 << 10, "desc": "CRAP", "when_present": True, "module": True},
-    "I": {
-        "shift": 1 << 11,
-        "desc": "FIRMWARE_WORKAROUND",
-        "when_present": True,
-        "module": False,
-    },
-    "O": {"shift": 1 << 12, "desc": "OOT_MODULE", "when_present": True, "module": True},
-    "E": {
-        "shift": 1 << 13,
-        "desc": "UNSIGNED_MODULE",
-        "when_present": True,
-        "module": True,
-    },
-    "L": {
-        "shift": 1 << 14,
-        "desc": "SOFTLOCKUP",
-        "when_present": True,
-        "module": False,
-    },
-    "K": {"shift": 1 << 15, "desc": "LIVEPATCH", "when_present": True, "module": True},
-    "X": {"shift": 1 << 16, "desc": "AUX", "when_present": True, "module": True},
-    "T": {"shift": 1 << 17, "desc": "RANDSTRUCT", "when_present": True, "module": True},
-    "N": {"shift": 1 << 18, "desc": "TEST", "when_present": True, "module": True},
+    "P": TaintFlag(
+        shift=1 << 0, desc="PROPRIETARY_MODULE", when_present=True, module=True
+    ),
+    "G": TaintFlag(
+        shift=1 << 0, desc="PROPRIETARY_MODULE", when_present=False, module=True
+    ),
+    "F": TaintFlag(shift=1 << 1, desc="FORCED_MODULE", when_present=True, module=False),
+    "S": TaintFlag(
+        shift=1 << 2, desc="CPU_OUT_OF_SPEC", when_present=True, module=False
+    ),
+    "R": TaintFlag(shift=1 << 3, desc="FORCED_RMMOD", when_present=True, module=False),
+    "M": TaintFlag(shift=1 << 4, desc="MACHINE_CHECK", when_present=True, module=False),
+    "B": TaintFlag(shift=1 << 5, desc="BAD_PAGE", when_present=True, module=False),
+    "U": TaintFlag(shift=1 << 6, desc="USER", when_present=True, module=False),
+    "D": TaintFlag(shift=1 << 7, desc="DIE", when_present=True, module=False),
+    "A": TaintFlag(
+        shift=1 << 8, desc="OVERRIDDEN_ACPI_TABLE", when_present=True, module=False
+    ),
+    "W": TaintFlag(shift=1 << 9, desc="WARN", when_present=True, module=False),
+    "C": TaintFlag(shift=1 << 10, desc="CRAP", when_present=True, module=True),
+    "I": TaintFlag(
+        shift=1 << 11, desc="FIRMWARE_WORKAROUND", when_present=True, module=False
+    ),
+    "O": TaintFlag(shift=1 << 12, desc="OOT_MODULE", when_present=True, module=True),
+    "E": TaintFlag(
+        shift=1 << 13, desc="UNSIGNED_MODULE", when_present=True, module=True
+    ),
+    "L": TaintFlag(shift=1 << 14, desc="SOFTLOCKUP", when_present=True, module=False),
+    "K": TaintFlag(shift=1 << 15, desc="LIVEPATCH", when_present=True, module=True),
+    "X": TaintFlag(shift=1 << 16, desc="AUX", when_present=True, module=True),
+    "T": TaintFlag(shift=1 << 17, desc="RANDSTRUCT", when_present=True, module=True),
+    "N": TaintFlag(shift=1 << 18, desc="TEST", when_present=True, module=True),
 }
 """Flags used to taint kernel and modules, for debugging purposes.
 

volatility3/framework/symbols/linux/extensions/__init__.py

@@ -287,8 +287,8 @@ class module(generic.GenericIntelProcess):
             The raw taints string.
         """
         taints_string = ""
-        for char, infos in linux_constants.TAINT_FLAGS.items():
-            if infos["module"] and self.taints_value & infos["shift"]:
+        for char, taint_flag in linux_constants.TAINT_FLAGS.items():
+            if taint_flag.module and self.taints_value & taint_flag.shift:
                 taints_string += char
 
         return taints_string
@@ -342,11 +342,11 @@ class module(generic.GenericIntelProcess):
         """
         comprehensive_taints = []
         for c in self.get_taints_as_plain_string():
-            infos = linux_constants.TAINT_FLAGS.get(c)
-            if not infos:
+            taint_flag = linux_constants.TAINT_FLAGS.get(c)
+            if not taint_flag:
                 comprehensive_taints.append(f"<UNKNOWN_TAINT_CHAR_{c}>")
-            elif infos["when_present"]:
-                comprehensive_taints.append(infos["desc"])
+            elif taint_flag.when_present:
+                comprehensive_taints.append(taint_flag.desc)
 
         return comprehensive_taints