linux: intel VMCoreInfo: Add the vmcoreinfo to the layer metadata

volatility3/framework/automagic/linux.py

@@ -2,8 +2,9 @@
 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
 #
 
-import logging
 import os
+import logging
+import collections
 from typing import Optional, Tuple, Type
 
 from volatility3.framework import constants, interfaces
@@ -107,11 +108,13 @@ class LinuxIntelStacker(interfaces.automagic.StackerLayerInterface):
                     join(config_path, LinuxSymbolFinder.banner_config_key)
                 ] = str(banner, "latin-1")
 
+                # Set an empty vmcoreinfo entry to prevent using the wrong one in the layer stack.
+                layer_metadata = dict(os="Linux", vmcoreinfo={})
                 layer = layer_class(
                     context,
                     config_path=config_path,
                     name=new_layer_name,
-                    metadata={"os": "Linux"},
+                    metadata=layer_metadata,
                 )
                 layer.config["kernel_virtual_offset"] = aslr_shift
 
@@ -376,6 +379,10 @@ class LinuxIntelVMCOREINFOStacker(interfaces.automagic.StackerLayerInterface):
                         aslr_shift,
                         dtb,
                     )
+                    # Add the vmcoreinfo dict to the layer metadata
+                    layer._direct_metadata = collections.ChainMap(
+                        {"vmcoreinfo": vmcoreinfo}, layer._direct_metadata
+                    )
 
                     return layer