From d5a0b93383fda59267bdd9b42e716b70ad66595c Mon Sep 17 00:00:00 2001
From: Abyss Watcher <abyss-w4tcher@proton.me>
Date: Thu, 31 Oct 2024 12:28:40 +0100
Subject: [PATCH] add TAINT_FLAGS constant

---
 .../framework/constants/linux/__init__.py     | 85 +++++++++++++++++++
 1 file changed, 85 insertions(+)

diff --git a/volatility3/framework/constants/linux/__init__.py b/volatility3/framework/constants/linux/__init__.py
index 7c485d3c3..9f25c9225 100644
--- a/volatility3/framework/constants/linux/__init__.py
+++ b/volatility3/framework/constants/linux/__init__.py
@@ -347,3 +347,88 @@ class PT_FLAGS(Flag):
 MODULE_MAXIMUM_CORE_SIZE = 20000000
 MODULE_MAXIMUM_CORE_TEXT_SIZE = 20000000
 MODULE_MINIMUM_SIZE = 4096
+
+
+TAINT_FLAGS = {
+    "P": {
+        "shift": 1 << 0,
+        "desc": "PROPRIETARY_MODULE",
+        "when_present": True,
+        "module": True,
+    },
+    "G": {
+        "shift": 1 << 0,
+        "desc": "PROPRIETARY_MODULE",
+        "when_present": False,
+        "module": True,
+    },
+    "F": {
+        "shift": 1 << 1,
+        "desc": "FORCED_MODULE",
+        "when_present": True,
+        "module": False,
+    },
+    # CPU_OUT_OF_SPEC was TAINT_UNSAFE_SMP on < 3.15-rc1 : https://lore.kernel.org/linux-kernel//20140303080432.GA25489@localhost/t/#:~:text=liked%20your%20proposal%3A-,%3E%20Right,-%2C%20I%20was%20about
+    "S": {
+        "shift": 1 << 2,
+        "desc": "CPU_OUT_OF_SPEC",
+        "when_present": True,
+        "module": False,
+    },
+    "R": {
+        "shift": 1 << 3,
+        "desc": "FORCED_RMMOD",
+        "when_present": True,
+        "module": False,
+    },
+    "M": {
+        "shift": 1 << 4,
+        "desc": "MACHINE_CHECK",
+        "when_present": True,
+        "module": False,
+    },
+    "B": {"shift": 1 << 5, "desc": "BAD_PAGE", "when_present": True, "module": False},
+    "U": {"shift": 1 << 6, "desc": "USER", "when_present": True, "module": False},
+    "D": {"shift": 1 << 7, "desc": "DIE", "when_present": True, "module": False},
+    "A": {
+        "shift": 1 << 8,
+        "desc": "OVERRIDDEN_ACPI_TABLE",
+        "when_present": True,
+        "module": False,
+    },
+    "W": {"shift": 1 << 9, "desc": "WARN", "when_present": True, "module": False},
+    "C": {"shift": 1 << 10, "desc": "CRAP", "when_present": True, "module": True},
+    "I": {
+        "shift": 1 << 11,
+        "desc": "FIRMWARE_WORKAROUND",
+        "when_present": True,
+        "module": False,
+    },
+    "O": {"shift": 1 << 12, "desc": "OOT_MODULE", "when_present": True, "module": True},
+    "E": {
+        "shift": 1 << 13,
+        "desc": "UNSIGNED_MODULE",
+        "when_present": True,
+        "module": True,
+    },
+    "L": {
+        "shift": 1 << 14,
+        "desc": "SOFTLOCKUP",
+        "when_present": True,
+        "module": False,
+    },
+    "K": {"shift": 1 << 15, "desc": "LIVEPATCH", "when_present": True, "module": True},
+    "X": {"shift": 1 << 16, "desc": "AUX", "when_present": True, "module": True},
+    "T": {"shift": 1 << 17, "desc": "RANDSTRUCT", "when_present": True, "module": True},
+    "N": {"shift": 1 << 18, "desc": "TEST", "when_present": True, "module": True},
+}
+"""Flags used to taint kernel and modules, for debugging purposes.
+
+Map based on 6.12-rc5.
+
+Documentation :
+    - https://www.kernel.org/doc/Documentation/admin-guide/sysctl/kernel.rst#:~:text=guide/sysrq.rst.-,tainted,-%3D%3D%3D%3D%3D%3D%3D%0A%0ANon%2Dzero%20if
+    - https://www.kernel.org/doc/Documentation/admin-guide/tainted-kernels.rst#:~:text=More%20detailed%20explanation%20for%20tainting
+    - taint_flag kernel struct
+    - taint_flags kernel constant
+"""