search for: af4430f20

...n reality it's a hard dependency: mtools @@ -129,6 +131,7 @@ ifelse(ARCHLINUX,1, vim xz yajl + yara ) ifelse(SUSE,1, @@ -159,6 +162,7 @@ ifelse(SUSE,1, systemd vim xz + yara ) ifelse(FRUGALWARE,1, diff --git a/daemon/Makefile.am b/daemon/Makefile.am index 8632c3768..af4430f20 100644 --- a/daemon/Makefile.am +++ b/daemon/Makefile.am @@ -191,7 +191,8 @@ guestfsd_LDADD = \ $(SERVENT_LIB) \ $(PCRE_LIBS) \ $(TSK_LIBS) \ - $(RPC_LIBS) + $(RPC_LIBS) \ + $(YARA_LIBS) guestfsd_CPPFLAGS = \ -I$(top_srcdir)/gnulib/lib \ diff --git a/m4/guestfs_daemon.m4 b/m4/guestfs_daem...

...oc_nr.ml | 1 + lib/MAX_PROC_NR | 2 +- 10 files changed, 291 insertions(+), 2 deletions(-) create mode 100644 daemon/yara.c create mode 100644 generator/actions_yara.ml create mode 100644 generator/actions_yara.mli diff --git a/daemon/Makefile.am b/daemon/Makefile.am index af4430f20..e4679a8c5 100644 --- a/daemon/Makefile.am +++ b/daemon/Makefile.am @@ -168,6 +168,7 @@ guestfsd_SOURCES = \ wc.c \ xattr.c \ xfs.c \ + yara.c \ zero.c \ zerofree.c diff --git a/daemon/cleanups.c b/daemon/cleanups.c index 092e493d7..3102cf94b 100644 --- a/daemon/cleanups.c +++ b/daemon/c...

...ile.inc | 6 +- lib/MAX_PROC_NR | 2 +- 11 files changed, 288 insertions(+), 4 deletions(-) create mode 100644 daemon/yara.c create mode 100644 generator/actions_yara.ml create mode 100644 generator/actions_yara.mli diff --git a/daemon/Makefile.am b/daemon/Makefile.am index af4430f20..e4679a8c5 100644 --- a/daemon/Makefile.am +++ b/daemon/Makefile.am @@ -168,6 +168,7 @@ guestfsd_SOURCES = \ wc.c \ xattr.c \ xfs.c \ + yara.c \ zero.c \ zerofree.c diff --git a/daemon/cleanups.c b/daemon/cleanups.c index 092e493d7..3102cf94b 100644 --- a/daemon/cleanups.c +++ b/daemon/c...

v6: - use new test functions - fix yara_detection struct field names - revert yara_load function to initial version With Pino we were exploring the idea of allowing Users to load multiple rule files with subsequent calls to yara_load API. https://www.redhat.com/archives/libguestfs/2016-November/msg00119.html It turns out impractical due to YARA API limitations. It is possible to load multiple

v5: - rebase on top of 1.37.9 - add missing actions_yara.* files Matteo Cafasso (7): daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in | 4 + configure.ac | 1 + daemon/Makefile.am