- lsof plugin: source code refactored
- lsof plugin: Added the 'device' column to complete the inode information. An inode number is specific to the filesystem/device it belongs to.
- lsof/sockstat plugins: Add threads support. Threads may or may not share the file descriptor table with the thread group leader, depending on whether the CLONE_FILES flag is included in the clone() syscall. Also, once started, a thread can unshare the fd table with its parent. Refer to the unshare() libc syscall wrapper man page, unshare(2). Additionally, note that the Linux lsof command in user space includes thread listings by default as well. Now, there are two columns to identify the thread group ID (PID) and the task/thread ID (TID).
- Added inode getters from both, the dentry and file structs. From kernels +3.9 the file struct cached the inode pointer. So, when possible, we get this value.
- Improve smear protection in these plugins and various APIs (https://github.com/volatilityfoundation/volatility3/pull/1243)
Pull-request #1173 bumped the version of the modules plugin (even though
this only needed to be a MINOR version bump, see
https://github.com/volatilityfoundation/volatility3/pull/1173#discussion_r1649614761), but failed
to verify that other plugins which relied on it were also updated to
make use of the new plugin. This was the version system working as
intended, but highlighted a review failure that the neither the author, nor the
reviewers, verified that the rest of the framework (specifically other plugins which
relied on modules) worked correctly with the new code (which this kind
of error is designed to fix).
Fixes#1244.
Sorry, I know I asked for it, but I hadn't quite figured out what was
going on. Things in the symbols/linux code are considered part of the
framework, and therefore it's the framework version that should have been
bumped. Since the framework comes packages with LinuxUtilities we can
rely on the version numbers to be suitable. This cleans up the mess I
caused, sorry for the extra work! 5:S
Gustavo Moreira