From 33f54f8cf7be2039c3e976917f66ced49ce8365b Mon Sep 17 00:00:00 2001
From: Gustavo Moreira <gmoreira@gmail.com>
Date: Wed, 26 Apr 2023 00:33:35 +1000
Subject: [PATCH 01/13] Replace LinuxUtilities._do_get_path() with the new
 mountinfo _do_get_path() avoiding duplicate code. It also fixes issue #930

---
 .../framework/plugins/linux/mountinfo.py      |  40 +----
 .../framework/symbols/linux/__init__.py       | 149 ++++++++++--------
 2 files changed, 84 insertions(+), 105 deletions(-)

diff --git a/volatility3/framework/plugins/linux/mountinfo.py b/volatility3/framework/plugins/linux/mountinfo.py
index ebd6e55a0..1de776412 100644
--- a/volatility3/framework/plugins/linux/mountinfo.py
+++ b/volatility3/framework/plugins/linux/mountinfo.py
@@ -9,6 +9,7 @@ from typing import Tuple, List, Iterable, Union
 from volatility3.framework import renderers, interfaces
 from volatility3.framework.configuration import requirements
 from volatility3.framework.interfaces import plugins
+from volatility3.framework.symbols import linux
 from volatility3.plugins.linux import pslist
 
 vollog = logging.getLogger(__name__)
@@ -71,40 +72,9 @@ class MountInfo(plugins.PluginInterface):
             ),
         ]
 
-    @classmethod
-    def _do_get_path(cls, mnt, fs_root) -> Union[None, str]:
-        """It mimics the Linux kernel prepend_path function."""
-        vfsmnt = mnt.mnt
-        dentry = vfsmnt.get_mnt_root()
-
-        path_reversed = []
-        while dentry != fs_root.dentry or vfsmnt.vol.offset != fs_root.mnt:
-            if dentry == vfsmnt.get_mnt_root() or dentry.is_root():
-                parent = mnt.get_mnt_parent().dereference()
-                # Escaped?
-                if dentry != vfsmnt.get_mnt_root():
-                    return None
-
-                # Global root?
-                if mnt.vol.offset != parent.vol.offset:
-                    dentry = mnt.get_mnt_mountpoint()
-                    mnt = parent
-                    vfsmnt = mnt.mnt
-                    continue
-
-                return None
-
-            parent = dentry.d_parent
-            dname = dentry.d_name.name_as_str()
-            path_reversed.append(dname.strip("/"))
-            dentry = parent
-
-        path = "/" + "/".join(reversed(path_reversed))
-        return path
-
     @classmethod
     def get_mountinfo(
-        cls, mnt, task
+        cls, mnt, task, context
     ) -> Union[
         None, Tuple[int, int, str, str, str, List[str], List[str], str, str, List[str]]
     ]:
@@ -115,8 +85,8 @@ class MountInfo(plugins.PluginInterface):
         if not mnt_root:
             return None
 
-        path_root = cls._do_get_path(mnt, task.fs.root)
-        if path_root is None:
+        path_root = linux.LinuxUtilities._get_path_root(context, mnt, task.fs.root)
+        if not path_root:
             return None
 
         mnt_root_path = mnt_root.path()
@@ -207,7 +177,7 @@ class MountInfo(plugins.PluginInterface):
             if mnt_ns_ids and mnt_ns_id not in mnt_ns_ids:
                 continue
 
-            mnt_info = self.get_mountinfo(mnt, task)
+            mnt_info = MountInfo.get_mountinfo(mnt, task, self.context)
             if mnt_info is None:
                 continue
 
diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py
index ce07167e5..80f5e9990 100644
--- a/volatility3/framework/symbols/linux/__init__.py
+++ b/volatility3/framework/symbols/linux/__init__.py
@@ -1,11 +1,11 @@
 # This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0
 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
 #
-from typing import Iterator, List, Tuple, Optional
+from typing import Iterator, List, Tuple, Optional, Union
 
 from volatility3 import framework
 from volatility3.framework import constants, exceptions, interfaces, objects
-from volatility3.framework.objects import utility
+from volatility3.framework.objects import utility, Pointer
 from volatility3.framework.symbols import intermed
 from volatility3.framework.symbols.linux import extensions
 
@@ -59,83 +59,92 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface):
 
     framework.require_interface_version(*_required_framework_version)
 
-    # based on __d_path from the Linux kernel
     @classmethod
-    def _do_get_path(cls, rdentry, rmnt, dentry, vfsmnt) -> str:
-        ret_path: List[str] = []
-
-        while dentry != rdentry or vfsmnt != rmnt:
-            dname = dentry.path()
-            if dname == "":
-                break
-
-            ret_path.insert(0, dname.strip("/"))
-            if dentry == vfsmnt.get_mnt_root() or dentry == dentry.d_parent:
-                if vfsmnt.get_mnt_parent() == vfsmnt:
-                    break
-
-                dentry = vfsmnt.get_mnt_mountpoint()
-                vfsmnt = vfsmnt.get_mnt_parent()
-
-                continue
-
-            parent = dentry.d_parent
-            dentry = parent
-
-        # if we did not gather any valid dentrys in the path, then the entire file is
-        # either 1) smeared out of memory or 2) de-allocated and corresponding structures overwritten
-        # we return an empty string in this case to avoid confusion with something like a handle to the root
-        # directory (e.g., "/")
-        if not ret_path:
-            return ""
-
-        ret_val = "/".join([str(p) for p in ret_path if p != ""])
-
-        if ret_val.startswith(("socket:", "pipe:")):
-            if ret_val.find("]") == -1:
-                try:
-                    inode = dentry.d_inode
-                    ino = inode.i_ino
-                except exceptions.InvalidAddressException:
-                    ino = 0
-
-                ret_val = ret_val[:-1] + f":[{ino}]"
-            else:
-                ret_val = ret_val.replace("/", "")
-
-        elif ret_val != "inotify":
-            ret_val = "/" + ret_val
-
-        return ret_val
-
-    # method used by 'older' kernels
-    # TODO: lookup when dentry_operations->d_name was merged into the mainline kernel for exact version
-    @classmethod
-    def _get_path_file(cls, task, filp) -> str:
+    def _get_path_file(cls, context, task, filp) -> str:
         rdentry = task.fs.get_root_dentry()
         rmnt = task.fs.get_root_mnt()
-        dentry = filp.get_dentry()
         vfsmnt = filp.get_vfsmnt()
+        dentry = filp.get_dentry()
 
-        return LinuxUtilities._do_get_path(rdentry, rmnt, dentry, vfsmnt)
+        return cls.do_get_path(rdentry, rmnt, dentry, vfsmnt, context)
+
+    @classmethod
+    def _get_path_root(cls, context, mnt, fs_root) -> str:
+        rdentry = fs_root.dentry
+        rmnt = fs_root.mnt
+        vfsmnt = mnt.mnt
+        dentry = vfsmnt.mnt_root
+
+        return cls.do_get_path(rdentry, rmnt, dentry, vfsmnt, context)
+
+    @classmethod
+    def _get_vmlinux_from_volobj(cls, volobj, context):
+        symbol_table_arr = volobj.vol.type_name.split("!", 1)
+        symbol_table = symbol_table_arr[0] if len(symbol_table_arr) == 2 else None
+
+        module_names = context.modules.get_modules_by_symbol_tables(symbol_table)
+        module_names = list(module_names)
+
+        if not module_names:
+            raise ValueError(f"No module using the symbol table '{symbol_table}'")
+
+        kernel_module_name = module_names[0]
+        kernel = context.modules[kernel_module_name]
+
+        return kernel
+
+    @classmethod
+    def _get_mnt_from_vfsmnt(cls, vfsmnt, dentry, context):
+        vmlinux = cls._get_vmlinux_from_volobj(dentry, context)
+
+        # When it's called from _get_path_file(), 'vfsmnt' is a Pointer
+        # struct file->f_path->mnt is "struct vfsmount *".
+        # However, when called from _get_path_root()
+        # struct mount -> mnt is "struct vfsmount"
+        vfsmnt_ptr = vfsmnt if type(vfsmnt) == Pointer else vfsmnt.vol.offset
+
+        mnt = cls.container_of(vfsmnt_ptr, "mount", "mnt", vmlinux)
+
+        return mnt
+
+    @classmethod
+    def do_get_path(cls, rdentry, rmnt, dentry, vfsmnt, context) -> Union[None, str]:
+        """It mimics the Linux kernel prepend_path function."""
+
+        mnt = cls._get_mnt_from_vfsmnt(vfsmnt, dentry, context)
+
+        path_reversed = []
+        while dentry != rdentry or vfsmnt.vol.offset != rmnt:
+            if dentry == vfsmnt.get_mnt_root() or dentry.is_root():
+                parent = mnt.get_mnt_parent().dereference()
+                # Escaped?
+                if dentry != vfsmnt.get_mnt_root():
+                    break
+
+                # Global root?
+                if mnt.vol.offset != parent.vol.offset:
+                    dentry = mnt.get_mnt_mountpoint()
+                    mnt = parent
+                    vfsmnt = mnt.mnt
+                    continue
+
+                break
+
+            parent = dentry.d_parent
+            dname = dentry.d_name.name_as_str()
+            path_reversed.append(dname.strip("/"))
+            dentry = parent
+
+        path = "/" + "/".join(reversed(path_reversed))
+        return path
 
     @classmethod
     def _get_new_sock_pipe_path(cls, context, task, filp) -> str:
         dentry = filp.get_dentry()
 
+        kernel_module = cls._get_vmlinux_from_volobj(dentry, context)
+
         sym_addr = dentry.d_op.d_dname
-
-        symbol_table_arr = sym_addr.vol.type_name.split("!")
-        symbol_table = None
-        if len(symbol_table_arr) == 2:
-            symbol_table = symbol_table_arr[0]
-
-        for module_name in context.modules.get_modules_by_symbol_tables(symbol_table):
-            kernel_module = context.modules[module_name]
-            break
-        else:
-            raise ValueError(f"No module using the symbol table {symbol_table}")
-
         symbs = list(kernel_module.get_symbols_by_absolute_location(sym_addr))
 
         if len(symbs) == 1:
@@ -151,7 +160,7 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface):
                 pre_name = "pipe"
 
             elif sym == "simple_dname":
-                pre_name = cls._get_path_file(task, filp)
+                pre_name = cls._get_path_file(context, task, filp)
 
             else:
                 pre_name = f"<unsupported d_op symbol: {sym}>"
@@ -192,7 +201,7 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface):
         if dname_is_valid:
             ret = LinuxUtilities._get_new_sock_pipe_path(context, task, filp)
         else:
-            ret = LinuxUtilities._get_path_file(task, filp)
+            ret = LinuxUtilities._get_path_file(context, task, filp)
 
         return ret
 

From b2d33c2cb0cf8535647f77feac35c44bc124ace5 Mon Sep 17 00:00:00 2001
From: Gustavo Moreira <gmoreira@gmail.com>
Date: Wed, 26 Apr 2023 00:36:58 +1000
Subject: [PATCH 02/13] Check if 'mnt_namespace' has the 'ns' member before
 using it

---
 volatility3/framework/symbols/linux/extensions/__init__.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py
index 5ab8f1aa0..da5bf5dad 100644
--- a/volatility3/framework/symbols/linux/extensions/__init__.py
+++ b/volatility3/framework/symbols/linux/extensions/__init__.py
@@ -825,7 +825,7 @@ class mnt_namespace(objects.StructType):
     def get_inode(self):
         if self.has_member("proc_inum"):
             return self.proc_inum
-        elif self.ns.has_member("inum"):
+        elif self.has_member("ns") and self.ns.has_member("inum"):
             return self.ns.inum
         else:
             raise AttributeError("Unable to find mnt_namespace inode")

From 7063e6094481e940026b9654f4a52580aa6805cb Mon Sep 17 00:00:00 2001
From: Gustavo Moreira <gmoreira@gmail.com>
Date: Sat, 6 May 2023 14:12:09 +0200
Subject: [PATCH 03/13] mountinfo improvements: + Fixes issue with repeated
 path suffixes. + Adds support for older kernels (<3.3.8) and + Adds a
 function which simplify the way the framework internally can gets a context
 and a vmlinux. This is obtaining the context and symbol space from the same
 vol object instead of drag a context everywhere. This changes also affects
 other plugins such as elfs, malfind and proc.maps. It also adds doc strings
 to some of the existent functions.

---
 volatility3/framework/plugins/linux/elfs.py   |   2 +-
 .../framework/plugins/linux/malfind.py        |   2 +-
 .../framework/plugins/linux/mountinfo.py      |   4 +-
 volatility3/framework/plugins/linux/proc.py   |   2 +-
 .../framework/symbols/linux/__init__.py       | 161 ++++++++-----
 .../symbols/linux/extensions/__init__.py      | 216 ++++++++++++++++--
 6 files changed, 308 insertions(+), 79 deletions(-)

diff --git a/volatility3/framework/plugins/linux/elfs.py b/volatility3/framework/plugins/linux/elfs.py
index 822a69dd6..fa14dcd49 100644
--- a/volatility3/framework/plugins/linux/elfs.py
+++ b/volatility3/framework/plugins/linux/elfs.py
@@ -58,7 +58,7 @@ class Elfs(plugins.PluginInterface):
                 ):
                     continue
 
-                path = vma.get_name(self.context, task)
+                path = vma.get_name(task)
 
                 yield (
                     0,
diff --git a/volatility3/framework/plugins/linux/malfind.py b/volatility3/framework/plugins/linux/malfind.py
index 18237b80c..552fb8f53 100644
--- a/volatility3/framework/plugins/linux/malfind.py
+++ b/volatility3/framework/plugins/linux/malfind.py
@@ -47,7 +47,7 @@ class Malfind(interfaces.plugins.PluginInterface):
         proc_layer = self.context.layers[proc_layer_name]
 
         for vma in task.mm.get_mmap_iter():
-            if vma.is_suspicious() and vma.get_name(self.context, task) != "[vdso]":
+            if vma.is_suspicious() and vma.get_name(task) != "[vdso]":
                 data = proc_layer.read(vma.vm_start, 64, pad=True)
                 yield vma, data
 
diff --git a/volatility3/framework/plugins/linux/mountinfo.py b/volatility3/framework/plugins/linux/mountinfo.py
index 1de776412..dfb2e23b4 100644
--- a/volatility3/framework/plugins/linux/mountinfo.py
+++ b/volatility3/framework/plugins/linux/mountinfo.py
@@ -74,7 +74,7 @@ class MountInfo(plugins.PluginInterface):
 
     @classmethod
     def get_mountinfo(
-        cls, mnt, task, context
+        cls, mnt, task
     ) -> Union[
         None, Tuple[int, int, str, str, str, List[str], List[str], str, str, List[str]]
     ]:
@@ -85,7 +85,7 @@ class MountInfo(plugins.PluginInterface):
         if not mnt_root:
             return None
 
-        path_root = linux.LinuxUtilities._get_path_root(context, mnt, task.fs.root)
+        path_root = linux.LinuxUtilities._get_path_mnt(task, mnt)
         if not path_root:
             return None
 
diff --git a/volatility3/framework/plugins/linux/proc.py b/volatility3/framework/plugins/linux/proc.py
index 9d8af482e..fa7bc1629 100644
--- a/volatility3/framework/plugins/linux/proc.py
+++ b/volatility3/framework/plugins/linux/proc.py
@@ -59,7 +59,7 @@ class Maps(plugins.PluginInterface):
                         minor = inode_object.i_sb.minor
                         inode = inode_object.i_ino
 
-                path = vma.get_name(self.context, task)
+                path = vma.get_name(task)
 
                 yield (
                     0,
diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py
index 80f5e9990..486314dd5 100644
--- a/volatility3/framework/symbols/linux/__init__.py
+++ b/volatility3/framework/symbols/linux/__init__.py
@@ -5,7 +5,7 @@ from typing import Iterator, List, Tuple, Optional, Union
 
 from volatility3 import framework
 from volatility3.framework import constants, exceptions, interfaces, objects
-from volatility3.framework.objects import utility, Pointer
+from volatility3.framework.objects import utility
 from volatility3.framework.symbols import intermed
 from volatility3.framework.symbols.linux import extensions
 
@@ -60,75 +60,74 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface):
     framework.require_interface_version(*_required_framework_version)
 
     @classmethod
-    def _get_path_file(cls, context, task, filp) -> str:
+    def _get_path_file(cls, task, filp) -> str:
+        """Returns the file pathname relative to the task's root directory.
+
+        Args:
+            task (task_struct): A reference task
+            filp (file *): A pointer to an open file
+
+        Returns:
+            str: File pathname relative to the task's root directory.
+        """
         rdentry = task.fs.get_root_dentry()
         rmnt = task.fs.get_root_mnt()
         vfsmnt = filp.get_vfsmnt()
         dentry = filp.get_dentry()
 
-        return cls.do_get_path(rdentry, rmnt, dentry, vfsmnt, context)
+        return cls.do_get_path(rdentry, rmnt, dentry, vfsmnt)
 
     @classmethod
-    def _get_path_root(cls, context, mnt, fs_root) -> str:
-        rdentry = fs_root.dentry
-        rmnt = fs_root.mnt
-        vfsmnt = mnt.mnt
-        dentry = vfsmnt.mnt_root
+    def _get_path_mnt(cls, task, mnt) -> str:
+        """Returns the mount point pathname relative to the task's root directory.
 
-        return cls.do_get_path(rdentry, rmnt, dentry, vfsmnt, context)
+        Args:
+            task (task_struct): A reference task
+            mnt (vfsmount or mount): A mounted filesystem or a mount point.
+                - kernels < 3.3.8 type is 'vfsmount'
+                - kernels >= 3.3.8 type is 'mount'
+
+        Returns:
+            str: Pathname of the mount point relative to the task's root directory.
+        """
+        rdentry = task.fs.get_root_dentry()
+        rmnt = task.fs.get_root_mnt()
+
+        vfsmnt = mnt.get_vfsmnt_current()
+        dentry = mnt.get_dentry_current()
+
+        return cls.do_get_path(rdentry, rmnt, dentry, vfsmnt)
 
     @classmethod
-    def _get_vmlinux_from_volobj(cls, volobj, context):
-        symbol_table_arr = volobj.vol.type_name.split("!", 1)
-        symbol_table = symbol_table_arr[0] if len(symbol_table_arr) == 2 else None
+    def do_get_path(cls, rdentry, rmnt, dentry, vfsmnt) -> Union[None, str]:
+        """Returns a pathname of the mount point or file
+        It mimics the Linux kernel prepend_path function.
 
-        module_names = context.modules.get_modules_by_symbol_tables(symbol_table)
-        module_names = list(module_names)
+        Args:
+            rdentry (dentry *): A pointer to the root dentry
+            rmnt (vfsmount *): A pointer to the root vfsmount
+            dentry (dentry *): A pointer to the dentry
+            vfsmnt (vfsmount *): A pointer to the vfsmount
 
-        if not module_names:
-            raise ValueError(f"No module using the symbol table '{symbol_table}'")
-
-        kernel_module_name = module_names[0]
-        kernel = context.modules[kernel_module_name]
-
-        return kernel
-
-    @classmethod
-    def _get_mnt_from_vfsmnt(cls, vfsmnt, dentry, context):
-        vmlinux = cls._get_vmlinux_from_volobj(dentry, context)
-
-        # When it's called from _get_path_file(), 'vfsmnt' is a Pointer
-        # struct file->f_path->mnt is "struct vfsmount *".
-        # However, when called from _get_path_root()
-        # struct mount -> mnt is "struct vfsmount"
-        vfsmnt_ptr = vfsmnt if type(vfsmnt) == Pointer else vfsmnt.vol.offset
-
-        mnt = cls.container_of(vfsmnt_ptr, "mount", "mnt", vmlinux)
-
-        return mnt
-
-    @classmethod
-    def do_get_path(cls, rdentry, rmnt, dentry, vfsmnt, context) -> Union[None, str]:
-        """It mimics the Linux kernel prepend_path function."""
-
-        mnt = cls._get_mnt_from_vfsmnt(vfsmnt, dentry, context)
+        Returns:
+            str: Pathname of the mount point or file
+        """
 
         path_reversed = []
-        while dentry != rdentry or vfsmnt.vol.offset != rmnt:
+        while dentry != rdentry or not vfsmnt.is_equal(rmnt):
             if dentry == vfsmnt.get_mnt_root() or dentry.is_root():
-                parent = mnt.get_mnt_parent().dereference()
                 # Escaped?
                 if dentry != vfsmnt.get_mnt_root():
                     break
 
                 # Global root?
-                if mnt.vol.offset != parent.vol.offset:
-                    dentry = mnt.get_mnt_mountpoint()
-                    mnt = parent
-                    vfsmnt = mnt.mnt
-                    continue
+                if not vfsmnt.has_parent():
+                    break
 
-                break
+                dentry = vfsmnt.get_dentry_parent()
+                vfsmnt = vfsmnt.get_vfsmnt_parent()
+
+                continue
 
             parent = dentry.d_parent
             dname = dentry.d_name.name_as_str()
@@ -139,10 +138,19 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface):
         return path
 
     @classmethod
-    def _get_new_sock_pipe_path(cls, context, task, filp) -> str:
+    def _get_new_sock_pipe_path(cls, task, filp) -> str:
+        """Returns the sock pipe pathname relative to the task's root directory.
+
+        Args:
+            task (task_struct): A reference task
+            filp (file *): A pointer to a sock pipe open file
+
+        Returns:
+            str: Sock pipe pathname relative to the task's root directory.
+        """
         dentry = filp.get_dentry()
 
-        kernel_module = cls._get_vmlinux_from_volobj(dentry, context)
+        kernel_module = cls.get_vmlinux_from_volobj(dentry)
 
         sym_addr = dentry.d_op.d_dname
         symbs = list(kernel_module.get_symbols_by_absolute_location(sym_addr))
@@ -160,7 +168,7 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface):
                 pre_name = "pipe"
 
             elif sym == "simple_dname":
-                pre_name = cls._get_path_file(context, task, filp)
+                pre_name = cls._get_path_file(task, filp)
 
             else:
                 pre_name = f"<unsupported d_op symbol: {sym}>"
@@ -172,10 +180,20 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface):
 
         return ret
 
-    # a 'file' structure doesn't have enough information to properly restore its full path
-    # we need the root mount information from task_struct to determine this
     @classmethod
-    def path_for_file(cls, context, task, filp) -> str:
+    def path_for_file(cls, task, filp) -> str:
+        """Returns a file (or sock pipe) pathname relative to the task's root directory.
+
+        A 'file' structure doesn't have enough information to properly restore its
+        full path we need the root mount information from task_struct to determine this
+
+        Args:
+            task (task_struct): A reference task
+            filp (file *): A pointer to an open file
+
+        Returns:
+            str: A file (or sock pipe) pathname relative to the task's root directory.
+        """
         try:
             dentry = filp.get_dentry()
         except exceptions.InvalidAddressException:
@@ -199,9 +217,9 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface):
             dname_is_valid = False
 
         if dname_is_valid:
-            ret = LinuxUtilities._get_new_sock_pipe_path(context, task, filp)
+            ret = LinuxUtilities._get_new_sock_pipe_path(task, filp)
         else:
-            ret = LinuxUtilities._get_path_file(context, task, filp)
+            ret = LinuxUtilities._get_path_file(task, filp)
 
         return ret
 
@@ -234,7 +252,7 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface):
 
         for fd_num, filp in enumerate(fds):
             if filp != 0:
-                full_path = LinuxUtilities.path_for_file(context, task, filp)
+                full_path = LinuxUtilities.path_for_file(task, filp)
 
                 yield fd_num, filp, full_path
 
@@ -357,3 +375,30 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface):
         return vmlinux.object(
             object_type=type_name, offset=container_addr, absolute=True
         )
+
+    @classmethod
+    def get_vmlinux_from_volobj(cls, volobj):
+        """Get the vmlinux from a vol obj
+
+        Args:
+            volobj (vol object): A vol object
+
+        Raises:
+            ValueError: If it cannot obtain any module from the symbol table
+
+        Returns:
+            volatility3.framework.contexts.Module: A kernel object (vmlinux)
+        """
+        symbol_table_arr = volobj.vol.type_name.split("!", 1)
+        symbol_table = symbol_table_arr[0] if len(symbol_table_arr) == 2 else None
+
+        module_names = volobj._context.modules.get_modules_by_symbol_tables(symbol_table)
+        module_names = list(module_names)
+
+        if not module_names:
+            raise ValueError(f"No module using the symbol table '{symbol_table}'")
+
+        kernel_module_name = module_names[0]
+        kernel = volobj._context.modules[kernel_module_name]
+
+        return kernel
diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py
index da5bf5dad..b2225f764 100644
--- a/volatility3/framework/symbols/linux/extensions/__init__.py
+++ b/volatility3/framework/symbols/linux/extensions/__init__.py
@@ -435,9 +435,9 @@ class vm_area_struct(objects.StructType):
 
         return self.vm_pgoff << constants.linux.PAGE_SHIFT
 
-    def get_name(self, context, task):
+    def get_name(self, task):
         if self.vm_file != 0:
-            fname = linux.LinuxUtilities.path_for_file(context, task, self.vm_file)
+            fname = linux.LinuxUtilities.path_for_file(task, self.vm_file)
         elif self.vm_start <= task.mm.start_brk and self.vm_end >= task.mm.brk:
             fname = "[heap]"
         elif self.vm_start <= task.mm.start_stack <= self.vm_end:
@@ -544,6 +544,7 @@ class struct_file(objects.StructType):
             raise AttributeError("Unable to find file -> dentry")
 
     def get_vfsmnt(self) -> interfaces.objects.ObjectInterface:
+        """Returns the fs (vfsmount) where this file is mounted"""
         if self.has_member("f_vfsmnt"):
             return self.f_vfsmnt
         elif self.has_member("f_path"):
@@ -675,11 +676,70 @@ class mount(objects.StructType):
             raise AttributeError("Unable to find mount -> mount flags")
 
     def get_mnt_parent(self):
+        """Gets the fs where we are mounted on
+
+        Returns:
+            A 'mount *'
+        """
         return self.mnt_parent
 
     def get_mnt_mountpoint(self):
+        """Gets the dentry of the mountpoint
+
+        Returns:
+            A 'dentry *'
+        """
+
         return self.mnt_mountpoint
 
+    def get_parent_mount(self):
+        return self.mnt.get_parent_mount()
+
+    def has_parent(self) -> bool:
+        """Checks if this mount has a parent
+
+        Returns:
+            bool: 'True' if this mount has a parent
+        """
+        return self.mnt_parent != self.vol.offset
+
+    def get_vfsmnt_current(self):
+        """Returns the fs where we are mounted on
+
+        Returns:
+            A 'vfsmount'
+        """
+        return self.mnt
+
+    def get_vfsmnt_parent(self):
+        """Gets the parent fs (vfsmount) to where it's mounted on
+
+        Returns:
+            A 'vfsmount'
+        """
+
+        return self.get_mnt_parent().get_vfsmnt_current()
+
+    def get_dentry_current(self):
+        """Returns the root of the mounted tree
+
+        Returns:
+            A 'dentry *'
+        """
+        vfsmnt = self.get_vfsmnt_current()
+        dentry = vfsmnt.mnt_root
+
+        return dentry
+
+    def get_dentry_parent(self):
+        """Returns the parent root of the mounted tree
+
+        Returns:
+            A 'dentry *'
+        """
+
+        return self.get_mnt_parent().get_dentry_current()
+
     def get_flags_access(self) -> str:
         return "ro" if self.get_mnt_flags() & self.MNT_READONLY else "rw"
 
@@ -703,9 +763,6 @@ class mount(objects.StructType):
     def get_devname(self) -> str:
         return utility.pointer_to_string(self.mnt_devname, count=255)
 
-    def has_parent(self) -> bool:
-        return self.vol.offset != self.mnt_parent
-
     def get_dominating_id(self, root) -> int:
         """Get ID of closest dominating peer group having a representative under the given root."""
         mnt_seen = set()
@@ -783,24 +840,117 @@ class vfsmount(objects.StructType):
             and self.get_mnt_parent() != 0
         )
 
-    def _get_real_mnt(self):
-        table_name = self.vol.type_name.split(constants.BANG)[0]
-        mount_struct = f"{table_name}{constants.BANG}mount"
-        offset = self._context.symbol_space.get_type(
-            mount_struct
-        ).relative_child_offset("mnt")
+    def _is_kernel_prior_to_struct_mount(self) -> bool:
+        """Helper to distinguish between kernels prior to version 3.3.8 that
+        lacked the 'mount' structure and later versions that have it.
 
-        return self._context.object(
-            mount_struct, self.vol.layer_name, offset=self.vol.offset - offset
-        )
+        The 'mnt_parent' member was moved from struct 'vfsmount' to struct
+        'mount' when the latter was introduced.
+
+        Alternatively, vmlinux.has_type('mount') can be used here but it is faster.
+
+        Returns:
+            bool: 'True' if the kernel
+        """
+
+        return self.has_member("mnt_parent")
+
+    def is_equal(self, vfsmount_ptr) -> bool:
+        """Helper to make sure it is comparing two pointers to 'vfsmount'.
+
+        Depending on the kernel version, the calling object (self) could be
+        a 'vfsmount *' (<3.3.8) or a 'vfsmount' (>=3.3.8). This way we trust
+        in the framework "auto" dereferencing ability to assure that when we
+        reach this point 'self' will be a 'vfsmount' already and self.vol.offset
+        a 'vfsmount *' and not a 'vfsmount **'. The argument must be a 'vfsmount *'.
+        Typically, it's called from do_get_path().
+
+        Args:
+            vfsmount_ptr (vfsmount *): A pointer to a 'vfsmount'
+
+        Raises:
+            exceptions.VolatilityException: If vfsmount_ptr is not a 'vfsmount *'
+
+        Returns:
+            bool: 'True' if the given argument points to the the same 'vfsmount'
+            as 'self'.
+        """
+        if type(vfsmount_ptr) == objects.Pointer:
+            return self.vol.offset == vfsmount_ptr
+        else:
+            raise exceptions.VolatilityException("Unexpected argument type. It has to be a 'vfsmount *'")
+
+    def _get_real_mnt(self):
+        """Gets the struct 'mount' containing this 'vfsmount'.
+
+        It should be only called from kernels >= 3.3.8 when 'struct mount' was introduced.
+
+        Returns:
+            mount: the struct 'mount' containing this 'vfsmount'.
+        """
+        vmlinux = linux.LinuxUtilities.get_vmlinux_from_volobj(self)
+        return linux.LinuxUtilities.container_of(self.vol.offset, "mount", "mnt", vmlinux)
+
+    def get_vfsmnt_current(self):
+        """Returns the current fs where we are mounted on
+
+        Returns:
+            A 'vfsmount *'
+        """
+        return self.get_mnt_parent()
+
+    def get_vfsmnt_parent(self):
+        """Gets the parent fs (vfsmount) to where it's mounted on
+
+        Returns:
+            For kernels <  3.3.8: A 'vfsmount *'
+            For kernels >= 3.3.8: A 'vfsmount'
+        """
+        if self._is_kernel_prior_to_struct_mount():
+            return self.get_mnt_parent()
+        else:
+            return self._get_real_mnt().get_vfsmnt_parent()
+
+    def get_dentry_current(self):
+        """Returns the root of the mounted tree
+
+        Returns:
+            A 'dentry *'
+        """
+        if self._is_kernel_prior_to_struct_mount():
+            return self.get_mnt_mountpoint()
+        else:
+            return self._get_real_mnt().get_dentry_current()
+
+    def get_dentry_parent(self):
+        """Returns the parent root of the mounted tree
+
+        Returns:
+            A 'dentry *'
+        """
+        if self._is_kernel_prior_to_struct_mount():
+            return self.get_mnt_mountpoint()
+        else:
+            return self._get_real_mnt().get_mnt_mountpoint()
 
     def get_mnt_parent(self):
-        if self.has_member("mnt_parent"):
+        """Gets the mnt_parent member.
+
+        Returns:
+            For kernels <  3.3.8: A 'vfsmount *'
+            For kernels >= 3.3.8: A 'mount *'
+        """
+        if self._is_kernel_prior_to_struct_mount():
             return self.mnt_parent
         else:
-            return self._get_real_mnt().mnt_parent
+            return self._get_real_mnt().get_mnt_parent()
 
     def get_mnt_mountpoint(self):
+        """Gets the dentry of the mountpoint
+
+        Returns:
+            A 'dentry *'
+        """
         if self.has_member("mnt_mountpoint"):
             return self.mnt_mountpoint
         else:
@@ -809,6 +959,40 @@ class vfsmount(objects.StructType):
     def get_mnt_root(self):
         return self.mnt_root
 
+    def has_parent(self) -> bool:
+        if self._is_kernel_prior_to_struct_mount():
+            return self.mnt_parent != self.vol.offset
+        else:
+            return self._get_real_mnt().has_parent()
+
+    def get_mnt_sb(self):
+        return self.mnt_sb
+
+    def get_flags_access(self) -> str:
+        return "ro" if self.mnt_flags & mount.MNT_READONLY else "rw"
+
+    def get_flags_opts(self) -> Iterable[str]:
+        flags = [
+            mntflagtxt
+            for mntflag, mntflagtxt in mount.MNT_FLAGS.items()
+            if mntflag & self.mnt_flags != 0
+        ]
+        return flags
+
+    def get_mnt_flags(self):
+        return self.mnt_flags
+
+    def is_shared(self) -> bool:
+        return self.get_mnt_flags() & mount.MNT_SHARED
+
+    def is_unbindable(self) -> bool:
+        return self.get_mnt_flags() & mount.MNT_UNBINDABLE
+
+    def is_slave(self) -> bool:
+        return self.mnt_master and self.mnt_master.vol.offset != 0
+
+    def get_devname(self) -> str:
+        return utility.pointer_to_string(self.mnt_devname, count=255)
 
 class kobject(objects.StructType):
     def reference_count(self):

From 2d922a8cd645c318e4e10c5d286bc86589f64f8b Mon Sep 17 00:00:00 2001
From: Gustavo Moreira <gmoreira@gmail.com>
Date: Sat, 6 May 2023 14:18:33 +0200
Subject: [PATCH 04/13] Improves the way the mount points and the namespaces
 are filtered. Previously, it was filtering by mount namespaces id. Even that
 approach was working as expected, it's not viable for older kernels were
 there was not a mount namespace ID. With this changes we filtered the mount
 points individually by the mount ID which is unique system wide, no mather
 the namespace to which it belongs to.

---
 .../framework/plugins/linux/mountinfo.py      | 70 ++++++++++++-------
 1 file changed, 46 insertions(+), 24 deletions(-)

diff --git a/volatility3/framework/plugins/linux/mountinfo.py b/volatility3/framework/plugins/linux/mountinfo.py
index dfb2e23b4..e03659aec 100644
--- a/volatility3/framework/plugins/linux/mountinfo.py
+++ b/volatility3/framework/plugins/linux/mountinfo.py
@@ -12,6 +12,7 @@ from volatility3.framework.interfaces import plugins
 from volatility3.framework.symbols import linux
 from volatility3.plugins.linux import pslist
 
+
 vollog = logging.getLogger(__name__)
 
 MountInfoData = namedtuple(
@@ -140,30 +141,38 @@ class MountInfo(plugins.PluginInterface):
         )
 
     def _get_tasks_mountpoints(
-        self, tasks: Iterable[interfaces.objects.ObjectInterface], per_namespace: bool
+        self, tasks: Iterable[interfaces.objects.ObjectInterface], filtered_by_pids: bool
     ):
-        seen_namespaces = set()
+        seen_mountpoints = set()
         for task in tasks:
             if not (
-                task
-                and task.fs
-                and task.fs.root
-                and task.nsproxy
-                and task.nsproxy.mnt_ns
+                task and
+                task.fs and
+                task.fs.root and
+                task.nsproxy and
+                task.nsproxy.mnt_ns
             ):
-                # This task doesn't have all the information required
+                # This task doesn't have all the information required.
+                # It should be a kernel < 2.6.30
                 continue
 
             mnt_namespace = task.nsproxy.mnt_ns
-            mnt_ns_id = mnt_namespace.get_inode()
-
-            if per_namespace:
-                if mnt_ns_id in seen_namespaces:
-                    continue
-                else:
-                    seen_namespaces.add(mnt_ns_id)
+            try:
+                mnt_ns_id = str(mnt_namespace.get_inode())
+            except AttributeError:
+                mnt_ns_id = renderers.NotAvailableValue()
 
             for mount in mnt_namespace.get_mount_points():
+                # When PIDs are filtered, it makes sense that the user want to
+                # see each of those processes mount points. So we don't filter
+                # by mount id in this case.
+                if not filtered_by_pids:
+                    mnt_id = int(mount.mnt_id)
+                    if mnt_id in seen_mountpoints:
+                        continue
+                    else:
+                        seen_mountpoints.add(mnt_id)
+
                 yield task, mount, mnt_ns_id
 
     def _generator(
@@ -171,13 +180,26 @@ class MountInfo(plugins.PluginInterface):
         tasks: Iterable[interfaces.objects.ObjectInterface],
         mnt_ns_ids: List[int],
         mount_format: bool,
-        per_namespace: bool,
+        filtered_by_pids: bool,
     ) -> Iterable[Tuple[int, Tuple]]:
-        for task, mnt, mnt_ns_id in self._get_tasks_mountpoints(tasks, per_namespace):
-            if mnt_ns_ids and mnt_ns_id not in mnt_ns_ids:
+        warning_shown = False
+        for task, mnt, mnt_ns_id in self._get_tasks_mountpoints(tasks, filtered_by_pids):
+            if (
+                not warning_shown and
+                mnt_ns_ids and
+                isinstance(mnt_ns_id, renderers.NotAvailableValue)
+            ):
+                vollog.warning("Cannot filter by namespace id, it is not available in this kernel.")
+                warning_shown = True
+
+            if (
+                not isinstance(mnt_ns_id, renderers.NotAvailableValue) and
+                mnt_ns_ids and
+                mnt_ns_id not in mnt_ns_ids
+            ):
                 continue
 
-            mnt_info = MountInfo.get_mountinfo(mnt, task, self.context)
+            mnt_info = self.get_mountinfo(mnt, task)
             if mnt_info is None:
                 continue
 
@@ -212,7 +234,7 @@ class MountInfo(plugins.PluginInterface):
                 ]
 
             fields_values = [mnt_ns_id]
-            if not per_namespace:
+            if filtered_by_pids:
                 fields_values.append(task.pid)
             fields_values.extend(extra_fields_values)
 
@@ -228,14 +250,14 @@ class MountInfo(plugins.PluginInterface):
             self.context, self.config["kernel"], filter_func=pid_filter
         )
 
-        columns = [("MNT_NS_ID", int)]
+        columns = [("MNT_NS_ID", str)]
         # The PID column does not make sense when a PID filter is not specified. In that case, the default behavior is
         # to displays the mountpoints per namespace.
         if pids:
             columns.append(("PID", int))
-            per_namespace = False
+            filtered_by_pids = True
         else:
-            per_namespace = True
+            filtered_by_pids = False
 
         if self.config.get("mount-format"):
             extra_columns = [
@@ -262,5 +284,5 @@ class MountInfo(plugins.PluginInterface):
         columns.extend(extra_columns)
 
         return renderers.TreeGrid(
-            columns, self._generator(tasks, mount_ns_ids, mount_format, per_namespace)
+            columns, self._generator(tasks, mount_ns_ids, mount_format, filtered_by_pids)
         )

From a09f77897b24b4b0da06a8b45a353ee730cadd08 Mon Sep 17 00:00:00 2001
From: Gustavo Moreira <gmoreira@gmail.com>
Date: Sat, 6 May 2023 14:21:58 +0200
Subject: [PATCH 05/13] sockstat improvements: + Fixes issues with netlink
 sockets for older kernels, supporting now kernels < 3.7.10 + Fixes issue with
 network namespace id for older kernels.

---
 .../framework/plugins/linux/sockstat.py       | 26 +++++++++++++++----
 .../symbols/linux/extensions/__init__.py      | 24 ++++++++++++++++-
 2 files changed, 44 insertions(+), 6 deletions(-)

diff --git a/volatility3/framework/plugins/linux/sockstat.py b/volatility3/framework/plugins/linux/sockstat.py
index f03a2ad8e..e37b8a1bb 100644
--- a/volatility3/framework/plugins/linux/sockstat.py
+++ b/volatility3/framework/plugins/linux/sockstat.py
@@ -28,7 +28,11 @@ class SockHandlers(interfaces.configuration.VersionableInterface):
         self._vmlinux = vmlinux
         self._task = task
 
-        netns_id = task.nsproxy.net_ns.get_inode()
+        try:
+            netns_id = task.nsproxy.net_ns.get_inode()
+        except AttributeError:
+            netns_id = NotAvailableValue()
+
         self._netdevices = self._build_network_devices_map(netns_id)
 
         self._sock_family_handlers = {
@@ -61,7 +65,7 @@ class SockHandlers(interfaces.configuration.VersionableInterface):
                 self._vmlinux.symbol_table_name + constants.BANG + "net_device"
             )
             for net_dev in net.dev_base_head.to_list(net_device_symname, "dev_list"):
-                if net.get_inode() != netns_id:
+                if isinstance(netns_id, NotAvailableValue) or net.get_inode() != netns_id:
                     continue
                 dev_name = utility.array_to_string(net_dev.name)
                 netdevices_map[net_dev.ifindex] = dev_name
@@ -227,14 +231,22 @@ class SockHandlers(interfaces.configuration.VersionableInterface):
         if netlink_sock.groups:
             groups_bitmap = netlink_sock.groups.dereference()
             src_addr = f"groups:0x{groups_bitmap:08x}"
-        src_port = netlink_sock.portid
+
+        try:
+            # Kernel >= 3.7.10
+            src_port = netlink_sock.get_portid()
+        except AttributeError:
+            src_port = NotAvailableValue()
 
         dst_addr = f"group:0x{netlink_sock.dst_group:08x}"
         module = netlink_sock.module
         if module and module.name:
             module_name_str = utility.array_to_string(module.name)
             dst_addr = f"{dst_addr},lkm:{module_name_str}"
-        dst_port = netlink_sock.dst_portid
+        try:
+            dst_port = netlink_sock.get_dst_portid()
+        except AttributeError:
+            dst_port = NotAvailableValue()
 
         state = netlink_sock.get_state()
 
@@ -518,7 +530,11 @@ class Sockstat(plugins.PluginInterface):
             protocol = child_sock.get_protocol()
 
             net = task.nsproxy.net_ns
-            netns_id = net.get_inode()
+            try:
+                netns_id = net.get_inode()
+            except AttributeError:
+                netns_id = NotAvailableValue()
+
             yield task, netns_id, fd_num, family, sock_type, protocol, sock_fields
 
     def _format_fields(self, sock_stat, protocol):
diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py
index b2225f764..d97916b74 100644
--- a/volatility3/framework/symbols/linux/extensions/__init__.py
+++ b/volatility3/framework/symbols/linux/extensions/__init__.py
@@ -1028,10 +1028,13 @@ class mnt_namespace(objects.StructType):
 class net(objects.StructType):
     def get_inode(self):
         if self.has_member("proc_inum"):
+            # 3.8.13 <= kernel < 3.19.8
             return self.proc_inum
-        elif self.ns.has_member("inum"):
+        elif self.has_member("ns") and self.ns.has_member("inum"):
+            # kernel >= 3.19.8
             return self.ns.inum
         else:
+            # kernel < 3.8.13
             raise AttributeError("Unable to find net_namespace inode")
 
 
@@ -1239,6 +1242,25 @@ class netlink_sock(objects.StructType):
         # Return the generic socket state
         return self.sk.sk_socket.get_state()
 
+    def get_portid(self):
+        if self.has_member("pid"):
+            # kernel < 3.7.10
+            return self.pid
+        if self.has_member("portid"):
+            # kernel >= 3.7.10
+            return self.portid
+        else:
+            raise AttributeError("Unable to find a source port id")
+
+    def get_dst_portid(self):
+        if self.has_member("dst_pid"):
+            # kernel < 3.7.10
+            return self.dst_pid
+        if self.has_member("dst_portid"):
+            # kernel >= 3.7.10
+            return self.dst_portid
+        else:
+            raise AttributeError("Unable to find a destination port id")
 
 class vsock_sock(objects.StructType):
     def get_protocol(self):

From ced6ff346cd8694ed02f835da8bec62f60ff9b56 Mon Sep 17 00:00:00 2001
From: Gustavo Moreira <gmoreira@gmail.com>
Date: Mon, 8 May 2023 11:54:48 +0200
Subject: [PATCH 06/13] Apply 'Black' suggestions

---
 .../framework/plugins/linux/mountinfo.py      | 37 +++++++++++--------
 .../framework/plugins/linux/sockstat.py       |  5 ++-
 .../framework/symbols/linux/__init__.py       |  4 +-
 .../symbols/linux/extensions/__init__.py      | 10 ++++-
 4 files changed, 37 insertions(+), 19 deletions(-)

diff --git a/volatility3/framework/plugins/linux/mountinfo.py b/volatility3/framework/plugins/linux/mountinfo.py
index e03659aec..0606884ff 100644
--- a/volatility3/framework/plugins/linux/mountinfo.py
+++ b/volatility3/framework/plugins/linux/mountinfo.py
@@ -141,16 +141,18 @@ class MountInfo(plugins.PluginInterface):
         )
 
     def _get_tasks_mountpoints(
-        self, tasks: Iterable[interfaces.objects.ObjectInterface], filtered_by_pids: bool
+        self,
+        tasks: Iterable[interfaces.objects.ObjectInterface],
+        filtered_by_pids: bool,
     ):
         seen_mountpoints = set()
         for task in tasks:
             if not (
-                task and
-                task.fs and
-                task.fs.root and
-                task.nsproxy and
-                task.nsproxy.mnt_ns
+                task
+                and task.fs
+                and task.fs.root
+                and task.nsproxy
+                and task.nsproxy.mnt_ns
             ):
                 # This task doesn't have all the information required.
                 # It should be a kernel < 2.6.30
@@ -183,19 +185,23 @@ class MountInfo(plugins.PluginInterface):
         filtered_by_pids: bool,
     ) -> Iterable[Tuple[int, Tuple]]:
         warning_shown = False
-        for task, mnt, mnt_ns_id in self._get_tasks_mountpoints(tasks, filtered_by_pids):
+        for task, mnt, mnt_ns_id in self._get_tasks_mountpoints(
+            tasks, filtered_by_pids
+        ):
             if (
-                not warning_shown and
-                mnt_ns_ids and
-                isinstance(mnt_ns_id, renderers.NotAvailableValue)
+                not warning_shown
+                and mnt_ns_ids
+                and isinstance(mnt_ns_id, renderers.NotAvailableValue)
             ):
-                vollog.warning("Cannot filter by namespace id, it is not available in this kernel.")
+                vollog.warning(
+                    "Cannot filter by namespace id, it is not available in this kernel."
+                )
                 warning_shown = True
 
             if (
-                not isinstance(mnt_ns_id, renderers.NotAvailableValue) and
-                mnt_ns_ids and
-                mnt_ns_id not in mnt_ns_ids
+                not isinstance(mnt_ns_id, renderers.NotAvailableValue)
+                and mnt_ns_ids
+                and mnt_ns_id not in mnt_ns_ids
             ):
                 continue
 
@@ -284,5 +290,6 @@ class MountInfo(plugins.PluginInterface):
         columns.extend(extra_columns)
 
         return renderers.TreeGrid(
-            columns, self._generator(tasks, mount_ns_ids, mount_format, filtered_by_pids)
+            columns,
+            self._generator(tasks, mount_ns_ids, mount_format, filtered_by_pids),
         )
diff --git a/volatility3/framework/plugins/linux/sockstat.py b/volatility3/framework/plugins/linux/sockstat.py
index e37b8a1bb..72a1e453e 100644
--- a/volatility3/framework/plugins/linux/sockstat.py
+++ b/volatility3/framework/plugins/linux/sockstat.py
@@ -65,7 +65,10 @@ class SockHandlers(interfaces.configuration.VersionableInterface):
                 self._vmlinux.symbol_table_name + constants.BANG + "net_device"
             )
             for net_dev in net.dev_base_head.to_list(net_device_symname, "dev_list"):
-                if isinstance(netns_id, NotAvailableValue) or net.get_inode() != netns_id:
+                if (
+                    isinstance(netns_id, NotAvailableValue)
+                    or net.get_inode() != netns_id
+                ):
                     continue
                 dev_name = utility.array_to_string(net_dev.name)
                 netdevices_map[net_dev.ifindex] = dev_name
diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py
index 486314dd5..858845125 100644
--- a/volatility3/framework/symbols/linux/__init__.py
+++ b/volatility3/framework/symbols/linux/__init__.py
@@ -392,7 +392,9 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface):
         symbol_table_arr = volobj.vol.type_name.split("!", 1)
         symbol_table = symbol_table_arr[0] if len(symbol_table_arr) == 2 else None
 
-        module_names = volobj._context.modules.get_modules_by_symbol_tables(symbol_table)
+        module_names = volobj._context.modules.get_modules_by_symbol_tables(
+            symbol_table
+        )
         module_names = list(module_names)
 
         if not module_names:
diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py
index d97916b74..3dbf560c6 100644
--- a/volatility3/framework/symbols/linux/extensions/__init__.py
+++ b/volatility3/framework/symbols/linux/extensions/__init__.py
@@ -878,7 +878,9 @@ class vfsmount(objects.StructType):
         if type(vfsmount_ptr) == objects.Pointer:
             return self.vol.offset == vfsmount_ptr
         else:
-            raise exceptions.VolatilityException("Unexpected argument type. It has to be a 'vfsmount *'")
+            raise exceptions.VolatilityException(
+                "Unexpected argument type. It has to be a 'vfsmount *'"
+            )
 
     def _get_real_mnt(self):
         """Gets the struct 'mount' containing this 'vfsmount'.
@@ -889,7 +891,9 @@ class vfsmount(objects.StructType):
             mount: the struct 'mount' containing this 'vfsmount'.
         """
         vmlinux = linux.LinuxUtilities.get_vmlinux_from_volobj(self)
-        return linux.LinuxUtilities.container_of(self.vol.offset, "mount", "mnt", vmlinux)
+        return linux.LinuxUtilities.container_of(
+            self.vol.offset, "mount", "mnt", vmlinux
+        )
 
     def get_vfsmnt_current(self):
         """Returns the current fs where we are mounted on
@@ -994,6 +998,7 @@ class vfsmount(objects.StructType):
     def get_devname(self) -> str:
         return utility.pointer_to_string(self.mnt_devname, count=255)
 
+
 class kobject(objects.StructType):
     def reference_count(self):
         refcnt = self.kref.refcount
@@ -1262,6 +1267,7 @@ class netlink_sock(objects.StructType):
         else:
             raise AttributeError("Unable to find a destination port id")
 
+
 class vsock_sock(objects.StructType):
     def get_protocol(self):
         # The protocol should always be 0 for vsocks

From 200099f8b3f92e2ad228e0a481a835f1fbc9d8b6 Mon Sep 17 00:00:00 2001
From: Gustavo Moreira <gmoreira@gmail.com>
Date: Mon, 8 May 2023 14:58:51 +0200
Subject: [PATCH 07/13] Improve support for socket filters in kernels < 4.1.52

---
 .../framework/plugins/linux/sockstat.py       | 23 +++++++++++++++----
 .../framework/symbols/linux/__init__.py       |  1 +
 .../symbols/linux/extensions/__init__.py      | 17 ++++++++++++++
 3 files changed, 36 insertions(+), 5 deletions(-)

diff --git a/volatility3/framework/plugins/linux/sockstat.py b/volatility3/framework/plugins/linux/sockstat.py
index 72a1e453e..f06b3ad8e 100644
--- a/volatility3/framework/plugins/linux/sockstat.py
+++ b/volatility3/framework/plugins/linux/sockstat.py
@@ -150,19 +150,32 @@ class SockHandlers(interfaces.configuration.VersionableInterface):
             return
 
         bpfprog = sock_filter.prog
-        if bpfprog.type == 0:
-            # BPF_PROG_TYPE_UNSPEC = 0
+
+        BPF_PROG_TYPE_UNSPEC = 0  # cBPF filter
+        try:
+            bpfprog_type = bpfprog.get_type()
+            if bpfprog_type == BPF_PROG_TYPE_UNSPEC:
+                return  # cBPF filter
+        except AttributeError:
+            # kernel < 3.18.140, it's a cBPF filter
+            return
+
+        BPF_PROG_TYPE_SOCKET_FILTER = 1  # eBPF filter
+        if bpfprog_type != BPF_PROG_TYPE_SOCKET_FILTER:
+            socket_filter["bpf_filter_type"] = f"UNK({bpfprog_type})"
+            vollog.warning(f"Unexpected BPF type {bpfprog_type} for a socket")
             return
 
         socket_filter["bpf_filter_type"] = "eBPF"
         if not bpfprog.has_member("aux") or not bpfprog.aux:
-            return
+            return  # kernel < 3.18.140
         bpfprog_aux = bpfprog.aux
+
         if bpfprog_aux.has_member("id"):
-            # `id` member was added to `bpf_prog_aux` in kernels 4.13
+            # `id` member was added to `bpf_prog_aux` in kernels 4.13.16
             socket_filter["bpf_filter_id"] = str(bpfprog_aux.id)
         if bpfprog_aux.has_member("name"):
-            # `name` was added to `bpf_prog_aux` in kernels 4.15
+            # `name` was added to `bpf_prog_aux` in kernels 4.15.18
             bpfprog_name = utility.array_to_string(bpfprog_aux.name)
             if bpfprog_name:
                 socket_filter["bpf_filter_name"] = bpfprog_name
diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py
index 858845125..3780a86f0 100644
--- a/volatility3/framework/symbols/linux/__init__.py
+++ b/volatility3/framework/symbols/linux/__init__.py
@@ -30,6 +30,7 @@ class LinuxKernelIntermedSymbols(intermed.IntermediateSymbolTable):
         self.set_type_class("kobject", extensions.kobject)
         # Might not exist in the current symbols
         self.optional_set_type_class("module", extensions.module)
+        self.optional_set_type_class("bpf_prog", extensions.bpf_prog)
 
         # Mount
         self.set_type_class("vfsmount", extensions.vfsmount)
diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py
index 3dbf560c6..87bd76554 100644
--- a/volatility3/framework/symbols/linux/extensions/__init__.py
+++ b/volatility3/framework/symbols/linux/extensions/__init__.py
@@ -1313,3 +1313,20 @@ class xdp_sock(objects.StructType):
     def get_state(self):
         # xdp_sock.state is an enum
         return self.state.lookup()
+
+
+class bpf_prog(objects.StructType):
+    def get_type(self):
+        # The program type was in `bpf_prog_aux::prog_type` from 3.18.140 to
+        # 4.1.52 before it was moved to `bpf_prog::type`
+        if self.has_member("type"):
+            # kernel >= 4.1.52
+            return self.type
+
+        if self.has_member("aux") and self.aux:
+            if self.aux.has_member("prog_type"):
+                # 3.18.140 <= kernel < 4.1.52
+                return self.aux.prog_type
+
+        # kernel < 3.18.140
+        raise AttributeError("Unable to find the BPF type")

From 7d65c20cc0b971c862889065d8a90d98e24819c9 Mon Sep 17 00:00:00 2001
From: Gustavo Moreira <gmoreira@gmail.com>
Date: Mon, 8 May 2023 14:59:58 +0200
Subject: [PATCH 08/13] Fix f-string

---
 volatility3/framework/plugins/linux/iomem.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/volatility3/framework/plugins/linux/iomem.py b/volatility3/framework/plugins/linux/iomem.py
index 2056851aa..785405ef3 100644
--- a/volatility3/framework/plugins/linux/iomem.py
+++ b/volatility3/framework/plugins/linux/iomem.py
@@ -66,7 +66,7 @@ class IOMem(interfaces.plugins.PluginInterface):
             name = utility.pointer_to_string(resource.name, 128)
         except exceptions.InvalidAddressException:
             vollog.warning(
-                "Unable to follow pointer to name for resource object at {resource_offset:#x}, "
+                f"Unable to follow pointer to name for resource object at {resource_offset:#x}, "
                 "replaced with UnreadableValue"
             )
             name = renderers.UnreadableValue()

From de28b5ab7077c04ac776018264c22484d1766c37 Mon Sep 17 00:00:00 2001
From: Gustavo Moreira <gmoreira@gmail.com>
Date: Mon, 8 May 2023 19:59:53 +0200
Subject: [PATCH 09/13] Rollback explicit context

---
 volatility3/framework/plugins/linux/elfs.py   |  2 +-
 .../framework/plugins/linux/malfind.py        |  2 +-
 volatility3/framework/plugins/linux/proc.py   |  2 +-
 .../framework/symbols/linux/__init__.py       | 27 +++++++++++--------
 .../symbols/linux/extensions/__init__.py      |  6 ++---
 5 files changed, 22 insertions(+), 17 deletions(-)

diff --git a/volatility3/framework/plugins/linux/elfs.py b/volatility3/framework/plugins/linux/elfs.py
index fa14dcd49..822a69dd6 100644
--- a/volatility3/framework/plugins/linux/elfs.py
+++ b/volatility3/framework/plugins/linux/elfs.py
@@ -58,7 +58,7 @@ class Elfs(plugins.PluginInterface):
                 ):
                     continue
 
-                path = vma.get_name(task)
+                path = vma.get_name(self.context, task)
 
                 yield (
                     0,
diff --git a/volatility3/framework/plugins/linux/malfind.py b/volatility3/framework/plugins/linux/malfind.py
index 552fb8f53..18237b80c 100644
--- a/volatility3/framework/plugins/linux/malfind.py
+++ b/volatility3/framework/plugins/linux/malfind.py
@@ -47,7 +47,7 @@ class Malfind(interfaces.plugins.PluginInterface):
         proc_layer = self.context.layers[proc_layer_name]
 
         for vma in task.mm.get_mmap_iter():
-            if vma.is_suspicious() and vma.get_name(task) != "[vdso]":
+            if vma.is_suspicious() and vma.get_name(self.context, task) != "[vdso]":
                 data = proc_layer.read(vma.vm_start, 64, pad=True)
                 yield vma, data
 
diff --git a/volatility3/framework/plugins/linux/proc.py b/volatility3/framework/plugins/linux/proc.py
index fa7bc1629..9d8af482e 100644
--- a/volatility3/framework/plugins/linux/proc.py
+++ b/volatility3/framework/plugins/linux/proc.py
@@ -59,7 +59,7 @@ class Maps(plugins.PluginInterface):
                         minor = inode_object.i_sb.minor
                         inode = inode_object.i_ino
 
-                path = vma.get_name(task)
+                path = vma.get_name(self.context, task)
 
                 yield (
                     0,
diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py
index 3780a86f0..3f51d3c0c 100644
--- a/volatility3/framework/symbols/linux/__init__.py
+++ b/volatility3/framework/symbols/linux/__init__.py
@@ -139,10 +139,11 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface):
         return path
 
     @classmethod
-    def _get_new_sock_pipe_path(cls, task, filp) -> str:
+    def _get_new_sock_pipe_path(cls, context, task, filp) -> str:
         """Returns the sock pipe pathname relative to the task's root directory.
 
         Args:
+            context: The context to retrieve required elements (layers, symbol tables) from
             task (task_struct): A reference task
             filp (file *): A pointer to a sock pipe open file
 
@@ -151,7 +152,7 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface):
         """
         dentry = filp.get_dentry()
 
-        kernel_module = cls.get_vmlinux_from_volobj(dentry)
+        kernel_module = cls.get_vmlinux_from_volobj(context, dentry)
 
         sym_addr = dentry.d_op.d_dname
         symbs = list(kernel_module.get_symbols_by_absolute_location(sym_addr))
@@ -182,13 +183,14 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface):
         return ret
 
     @classmethod
-    def path_for_file(cls, task, filp) -> str:
+    def path_for_file(cls, context, task, filp) -> str:
         """Returns a file (or sock pipe) pathname relative to the task's root directory.
 
         A 'file' structure doesn't have enough information to properly restore its
         full path we need the root mount information from task_struct to determine this
 
         Args:
+            context: The context to retrieve required elements (layers, symbol tables) from
             task (task_struct): A reference task
             filp (file *): A pointer to an open file
 
@@ -218,7 +220,7 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface):
             dname_is_valid = False
 
         if dname_is_valid:
-            ret = LinuxUtilities._get_new_sock_pipe_path(task, filp)
+            ret = LinuxUtilities._get_new_sock_pipe_path(context, task, filp)
         else:
             ret = LinuxUtilities._get_path_file(task, filp)
 
@@ -253,7 +255,7 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface):
 
         for fd_num, filp in enumerate(fds):
             if filp != 0:
-                full_path = LinuxUtilities.path_for_file(task, filp)
+                full_path = LinuxUtilities.path_for_file(context, task, filp)
 
                 yield fd_num, filp, full_path
 
@@ -378,30 +380,33 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface):
         )
 
     @classmethod
-    def get_vmlinux_from_volobj(cls, volobj):
+    def get_vmlinux_from_volobj(
+        cls,
+        context: interfaces.context.ContextInterface,
+        volobj: interfaces.objects.ObjectInterface,
+    ) -> interfaces.context.ModuleInterface:
         """Get the vmlinux from a vol obj
 
         Args:
+            context: The context to retrieve required elements (layers, symbol tables) from
             volobj (vol object): A vol object
 
         Raises:
             ValueError: If it cannot obtain any module from the symbol table
 
         Returns:
-            volatility3.framework.contexts.Module: A kernel object (vmlinux)
+            A kernel object (vmlinux)
         """
         symbol_table_arr = volobj.vol.type_name.split("!", 1)
         symbol_table = symbol_table_arr[0] if len(symbol_table_arr) == 2 else None
 
-        module_names = volobj._context.modules.get_modules_by_symbol_tables(
-            symbol_table
-        )
+        module_names = context.modules.get_modules_by_symbol_tables(symbol_table)
         module_names = list(module_names)
 
         if not module_names:
             raise ValueError(f"No module using the symbol table '{symbol_table}'")
 
         kernel_module_name = module_names[0]
-        kernel = volobj._context.modules[kernel_module_name]
+        kernel = context.modules[kernel_module_name]
 
         return kernel
diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py
index 87bd76554..1caab3ce5 100644
--- a/volatility3/framework/symbols/linux/extensions/__init__.py
+++ b/volatility3/framework/symbols/linux/extensions/__init__.py
@@ -435,9 +435,9 @@ class vm_area_struct(objects.StructType):
 
         return self.vm_pgoff << constants.linux.PAGE_SHIFT
 
-    def get_name(self, task):
+    def get_name(self, context, task):
         if self.vm_file != 0:
-            fname = linux.LinuxUtilities.path_for_file(task, self.vm_file)
+            fname = linux.LinuxUtilities.path_for_file(context, task, self.vm_file)
         elif self.vm_start <= task.mm.start_brk and self.vm_end >= task.mm.brk:
             fname = "[heap]"
         elif self.vm_start <= task.mm.start_stack <= self.vm_end:
@@ -890,7 +890,7 @@ class vfsmount(objects.StructType):
         Returns:
             mount: the struct 'mount' containing this 'vfsmount'.
         """
-        vmlinux = linux.LinuxUtilities.get_vmlinux_from_volobj(self)
+        vmlinux = linux.LinuxUtilities.get_vmlinux_from_volobj(self._context, self)
         return linux.LinuxUtilities.container_of(
             self.vol.offset, "mount", "mnt", vmlinux
         )

From d367b973a5cc305aad8f3a5f0b92e4b525122d11 Mon Sep 17 00:00:00 2001
From: Gustavo Moreira <gmoreira@gmail.com>
Date: Tue, 9 May 2023 09:05:37 +0200
Subject: [PATCH 10/13] Renamed get_vmlinux_from_volobj() to
 get_module_from_volobj_type()

---
 volatility3/framework/symbols/linux/__init__.py            | 4 ++--
 volatility3/framework/symbols/linux/extensions/__init__.py | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py
index 3f51d3c0c..dbdf1b777 100644
--- a/volatility3/framework/symbols/linux/__init__.py
+++ b/volatility3/framework/symbols/linux/__init__.py
@@ -152,7 +152,7 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface):
         """
         dentry = filp.get_dentry()
 
-        kernel_module = cls.get_vmlinux_from_volobj(context, dentry)
+        kernel_module = cls.get_module_from_volobj_type(context, dentry)
 
         sym_addr = dentry.d_op.d_dname
         symbs = list(kernel_module.get_symbols_by_absolute_location(sym_addr))
@@ -380,7 +380,7 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface):
         )
 
     @classmethod
-    def get_vmlinux_from_volobj(
+    def get_module_from_volobj_type(
         cls,
         context: interfaces.context.ContextInterface,
         volobj: interfaces.objects.ObjectInterface,
diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py
index 1caab3ce5..060da4d7d 100644
--- a/volatility3/framework/symbols/linux/extensions/__init__.py
+++ b/volatility3/framework/symbols/linux/extensions/__init__.py
@@ -890,7 +890,7 @@ class vfsmount(objects.StructType):
         Returns:
             mount: the struct 'mount' containing this 'vfsmount'.
         """
-        vmlinux = linux.LinuxUtilities.get_vmlinux_from_volobj(self._context, self)
+        vmlinux = linux.LinuxUtilities.get_module_from_volobj_type(self._context, self)
         return linux.LinuxUtilities.container_of(
             self.vol.offset, "mount", "mnt", vmlinux
         )

From 6c5db21ae76519ffff538eba822dccfb2c63f4c2 Mon Sep 17 00:00:00 2001
From: Gustavo Moreira <gmoreira@gmail.com>
Date: Tue, 9 May 2023 09:22:02 +0200
Subject: [PATCH 11/13] Undo mnt_ns_id cast to str

---
 volatility3/framework/plugins/linux/mountinfo.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/volatility3/framework/plugins/linux/mountinfo.py b/volatility3/framework/plugins/linux/mountinfo.py
index 0606884ff..87ba4f9c1 100644
--- a/volatility3/framework/plugins/linux/mountinfo.py
+++ b/volatility3/framework/plugins/linux/mountinfo.py
@@ -160,7 +160,7 @@ class MountInfo(plugins.PluginInterface):
 
             mnt_namespace = task.nsproxy.mnt_ns
             try:
-                mnt_ns_id = str(mnt_namespace.get_inode())
+                mnt_ns_id = mnt_namespace.get_inode()
             except AttributeError:
                 mnt_ns_id = renderers.NotAvailableValue()
 
@@ -256,7 +256,7 @@ class MountInfo(plugins.PluginInterface):
             self.context, self.config["kernel"], filter_func=pid_filter
         )
 
-        columns = [("MNT_NS_ID", str)]
+        columns = [("MNT_NS_ID", int)]
         # The PID column does not make sense when a PID filter is not specified. In that case, the default behavior is
         # to displays the mountpoints per namespace.
         if pids:

From 89ed65cc56bdce8b11c3480f5dcc93d0e1021961 Mon Sep 17 00:00:00 2001
From: Gustavo Moreira <gmoreira@gmail.com>
Date: Tue, 9 May 2023 09:59:21 +0200
Subject: [PATCH 12/13] Improve filter warning implementation

---
 .../framework/plugins/linux/mountinfo.py       | 18 ++++++++----------
 1 file changed, 8 insertions(+), 10 deletions(-)

diff --git a/volatility3/framework/plugins/linux/mountinfo.py b/volatility3/framework/plugins/linux/mountinfo.py
index 87ba4f9c1..e4081dc83 100644
--- a/volatility3/framework/plugins/linux/mountinfo.py
+++ b/volatility3/framework/plugins/linux/mountinfo.py
@@ -184,19 +184,12 @@ class MountInfo(plugins.PluginInterface):
         mount_format: bool,
         filtered_by_pids: bool,
     ) -> Iterable[Tuple[int, Tuple]]:
-        warning_shown = False
+        show_filter_warning = False
         for task, mnt, mnt_ns_id in self._get_tasks_mountpoints(
             tasks, filtered_by_pids
         ):
-            if (
-                not warning_shown
-                and mnt_ns_ids
-                and isinstance(mnt_ns_id, renderers.NotAvailableValue)
-            ):
-                vollog.warning(
-                    "Cannot filter by namespace id, it is not available in this kernel."
-                )
-                warning_shown = True
+            if mnt_ns_ids and isinstance(mnt_ns_id, renderers.NotAvailableValue):
+                show_filter_warning = True
 
             if (
                 not isinstance(mnt_ns_id, renderers.NotAvailableValue)
@@ -246,6 +239,11 @@ class MountInfo(plugins.PluginInterface):
 
             yield (0, fields_values)
 
+        if show_filter_warning:
+            vollog.warning(
+                "Could not filter by mount namespace id. This field is not available in this kernel."
+            )
+
     def run(self):
         pids = self.config.get("pids")
         mount_ns_ids = self.config.get("mntns")

From 7516346b649d7678c2996d1f4e02c48637fb050f Mon Sep 17 00:00:00 2001
From: Gustavo Moreira <gmoreira@gmail.com>
Date: Wed, 10 May 2023 10:55:19 +0200
Subject: [PATCH 13/13] Adjust framework versioning

---
 volatility3/framework/plugins/linux/mountinfo.py | 5 ++++-
 volatility3/framework/symbols/linux/__init__.py  | 4 ++--
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/volatility3/framework/plugins/linux/mountinfo.py b/volatility3/framework/plugins/linux/mountinfo.py
index e4081dc83..da743bb60 100644
--- a/volatility3/framework/plugins/linux/mountinfo.py
+++ b/volatility3/framework/plugins/linux/mountinfo.py
@@ -50,6 +50,9 @@ class MountInfo(plugins.PluginInterface):
             requirements.PluginRequirement(
                 name="pslist", plugin=pslist.PsList, version=(2, 0, 0)
             ),
+            requirements.VersionRequirement(
+                name="linuxutils", component=linux.LinuxUtilities, version=(2, 1, 0)
+            ),
             requirements.ListRequirement(
                 name="pids",
                 description="Filter on specific process IDs.",
@@ -86,7 +89,7 @@ class MountInfo(plugins.PluginInterface):
         if not mnt_root:
             return None
 
-        path_root = linux.LinuxUtilities._get_path_mnt(task, mnt)
+        path_root = linux.LinuxUtilities.get_path_mnt(task, mnt)
         if not path_root:
             return None
 
diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py
index dbdf1b777..9ae8479b6 100644
--- a/volatility3/framework/symbols/linux/__init__.py
+++ b/volatility3/framework/symbols/linux/__init__.py
@@ -55,7 +55,7 @@ class LinuxKernelIntermedSymbols(intermed.IntermediateSymbolTable):
 class LinuxUtilities(interfaces.configuration.VersionableInterface):
     """Class with multiple useful linux functions."""
 
-    _version = (2, 0, 0)
+    _version = (2, 1, 0)
     _required_framework_version = (2, 0, 0)
 
     framework.require_interface_version(*_required_framework_version)
@@ -79,7 +79,7 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface):
         return cls.do_get_path(rdentry, rmnt, dentry, vfsmnt)
 
     @classmethod
-    def _get_path_mnt(cls, task, mnt) -> str:
+    def get_path_mnt(cls, task, mnt) -> str:
         """Returns the mount point pathname relative to the task's root directory.
 
         Args: