Merge pull request #1405 from gcmoreira/fix_dentry_prior_kernels_3.19

Linux - Fix dentry type support for kernels pre 3.19

test/test_volatility.py

@@ -632,6 +632,26 @@ def test_linux_vmayarascan_yara_string(image, volatility, python):
     assert rc == 0
 
 
+def test_linux_page_cache_files(image, volatility, python):
+    rc, out, _err = runvol_plugin(
+        "linux.pagecache.Files",
+        image,
+        volatility,
+        python,
+        pluginargs=["--find", "/etc/passwd"],
+    )
+    out = out.lower()
+
+    assert out.count(b"\n") > 4
+
+    # inode_num inode_addr ... file_path
+    assert re.search(
+        rb"146829\s0x88001ab5c270.*?/etc/passwd",
+        out,
+    )
+    assert rc == 0
+
+
 # MAC
 
 

volatility3/framework/symbols/linux/extensions/__init__.py

@@ -1107,9 +1107,16 @@ class dentry(objects.StructType):
             walk_member = "d_sib"
             list_head_member = self.d_children
         elif self.has_member("d_child") and self.has_member("d_subdirs"):
-            # 2.5.0 <= kernels < 6.8
+            # 3.19.0 <= kernels < 6.8
             walk_member = "d_child"
             list_head_member = self.d_subdirs
+        elif self.has_member("d_u") and self.has_member("d_subdirs"):
+            # kernels < 3.19
+
+            # Actually, 'd_u.d_child' but to_list() doesn't support something like that.
+            # Since, it's an union, everything is at the same offset than 'd_u'.
+            walk_member = "d_u"
+            list_head_member = self.d_subdirs
         else:
             raise exceptions.VolatilityException("Unsupported dentry type")