search for: libyara3

libyara3 on Debian/Ubuntu yara on SUSE/RedHat Signed-off-by: Matteo Cafasso <noxdafox@gmail.com> --- appliance/packagelist.in | 4 ++++ daemon/Makefile.am | 3 ++- m4/guestfs_daemon.m4 | 14 ++++++++++++++ 3 files changed, 20 insertions(+), 1 deletion(-) diff --git a/appliance/packageli...

libyara3 on Debian/Ubuntu yara on SUSE/RedHat Signed-off-by: Matteo Cafasso <noxdafox@gmail.com> --- appliance/packagelist.in | 4 ++++ daemon/Makefile.am | 3 ++- m4/guestfs_daemon.m4 | 14 ++++++++++++++ 3 files changed, 20 insertions(+), 1 deletion(-) diff --git a/appliance/packageli...

libyara3 on Debian/Ubuntu yara on SUSE/RedHat Signed-off-by: Matteo Cafasso <noxdafox@gmail.com> --- appliance/packagelist.in | 4 ++++ daemon/Makefile.am | 3 ++- m4/guestfs_daemon.m4 | 14 ++++++++++++++ 3 files changed, 20 insertions(+), 1 deletion(-) diff --git a/appliance/packageli...

libyara3 on Debian/Ubuntu yara on SUSE/RedHat Signed-off-by: Matteo Cafasso <noxdafox@gmail.com> --- appliance/packagelist.in | 4 ++++ daemon/Makefile.am | 3 ++- m4/guestfs_daemon.m4 | 14 ++++++++++++++ 3 files changed, 20 insertions(+), 1 deletion(-) diff --git a/appliance/packageli...

It looks like older versions of lvm2 (recent enough to have selectors) do not recognize '1' (and '0') as boolean values. Switch to 'yes', which seems to be supported. Updates commit 7367945647e774aec4b93c3bf13181212d3c6430. --- daemon/lvm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/daemon/lvm.c b/daemon/lvm.c index a270b13..c186a5a 100644 ---

...imal xz - yara zfs-fuse ) @@ -79,17 +70,7 @@ dnl iproute has been renamed to iproute2 iputils-tracepath isc-dhcp-client ldmtool - libaugeas0 libc-bin - libcap2 - libhivex0 - libjansson4 - libpcre3 - libsystemd0 - libsystemd-id128-0 - libsystemd-journal0 - libtirpc1 - libyara3 linux-image dnl syslinux 'suggests' mtools, but in reality it's a hard dependency: mtools @@ -107,19 +88,14 @@ dnl iproute has been renamed to iproute2 ) ifelse(ARCHLINUX,1, - augeas cdrkit cdrtools cryptsetup dhcpcd gptfdisk grub - hivex iproute2...

...- m4/guestfs_daemon.m4 | 8 ++++++++ 3 files changed, 11 insertions(+), 1 deletion(-) diff --git a/appliance/packagelist.in b/appliance/packagelist.in index f278f66..5982df8 100644 --- a/appliance/packagelist.in +++ b/appliance/packagelist.in @@ -232,6 +232,7 @@ jfsutils kmod less libxml2 +libyara3 lsof lsscsi lvm2 diff --git a/daemon/Makefile.am b/daemon/Makefile.am index 23f60eb..3a25f43 100644 --- a/daemon/Makefile.am +++ b/daemon/Makefile.am @@ -222,7 +222,8 @@ guestfsd_LDADD = \ $(LIBINTL) \ $(SERVENT_LIB) \ $(PCRE_LIBS) \ - $(TSK_LIBS) + $(TSK_LIBS) \ + $(YARA_LIBS) guestfsd_...

...appliance/packagelist.in | 1 + 1 file changed, 1 insertion(+) diff --git a/appliance/packagelist.in b/appliance/packagelist.in index 96d5ffc..9e50800 100644 --- a/appliance/packagelist.in +++ b/appliance/packagelist.in @@ -155,6 +155,7 @@ ifelse(SUSE,1, libselinux1 libtirpc3 libyajl2 + libyara3 mkisofs ntfsprogs ntfs-3g -- 2.9.3

v6: - use new test functions - fix yara_detection struct field names - revert yara_load function to initial version With Pino we were exploring the idea of allowing Users to load multiple rule files with subsequent calls to yara_load API. https://www.redhat.com/archives/libguestfs/2016-November/msg00119.html It turns out impractical due to YARA API limitations. It is possible to load multiple

...dnl for /sbin/reboot and udevd vim-minimal xz - yajl yara zfs-fuse ) @@ -81,12 +81,12 @@ dnl iproute has been renamed to iproute2 libc-bin libcap2 libhivex0 + libjansson4 libpcre3 libsystemd0 libsystemd-id128-0 libsystemd-journal0 libtirpc1 - libyajl2 libyara3 linux-image dnl syslinux 'suggests' mtools, but in reality it's a hard dependency: @@ -115,6 +115,7 @@ ifelse(ARCHLINUX,1, hivex iproute2 iputils + jansson libcap libtirpc linux @@ -130,7 +131,6 @@ ifelse(ARCHLINUX,1, systemd vim xz - yajl yara )...

...dnl for /sbin/reboot and udevd vim-minimal xz - yajl yara zfs-fuse ) @@ -81,12 +81,12 @@ dnl iproute has been renamed to iproute2 libc-bin libcap2 libhivex0 + libjansson4 libpcre3 libsystemd0 libsystemd-id128-0 libsystemd-journal0 libtirpc1 - libyajl2 libyara3 linux-image dnl syslinux 'suggests' mtools, but in reality it's a hard dependency: @@ -115,6 +115,7 @@ ifelse(ARCHLINUX,1, hivex iproute2 iputils + jansson libcap libtirpc linux @@ -130,7 +131,6 @@ ifelse(ARCHLINUX,1, systemd vim xz - yajl yara )...

Hi, recently, there was a discussion in the development list of libvirt on switching to a different JSON library than YAJL [1]. Since we use YAJL, and the points there IMHO apply to libguestfs as well, I decided to give a try in switching to Jansson [2]. The result IMHO is nice, with the additional APIs of Jansson that simplify some of our code. Unlike with YAJL, I did not set a minimum

v3: - allow to load multiple rule files - added optional namespace parameter to yara_load - move destructor logic in yara module - use generic file upload logic - use generic temporary path function Matteo Cafasso (6): appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests

Hi, recently, there was a discussion in the development list of libvirt on switching to a different JSON library than YAJL [1]. Since we use YAJL, and the points there IMHO apply to libguestfs as well, I decided to give a try in switching to Jansson [2]. The result IMHO is nice, with the additional APIs of Jansson that simplify some of our code. Unlike with YAJL, I did not set a minimum

Yara is a rule based scanning engine aimed to help malware analysts in finding and classifying interesting samples. https://github.com/VirusTotal/yara This series adds Yara support to Libguestfs allowing to upload sets of rules and scanning files against them. Currently provided APIs: - yara_load: loads a set of rules - yara_destroy: free resources allocated by loaded rules - yara_scan:

Rebase patches on top of 1.35.25. No changes since last series. Matteo Cafasso (7): daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in | 4 + configure.ac | 1 + daemon/Makefile.am

v9: - fixes according to comments Matteo Cafasso (7): daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in | 4 + configure.ac | 1 + daemon/Makefile.am | 4 +-

v2: - Fix yara dependency in packagelist - Use pkg-config where available - Improve longdesc of yara_load API - Fix libyara initialization and finalization - Import CLEANUP_FCLOSE - Add custom CLEANUP_DESTROY_YARA_COMPILER - Add rules compilation error callback - Other small fixes according to comments Matteo Cafasso (6): appliance: add yara dependency New API: yara_load New API:

Rebase patches on top of 1.37.1. No changes since last series. Matteo Cafasso (7): daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in | 4 + configure.ac | 1 + daemon/Makefile.am

v5: - rebase on top of 1.37.9 - add missing actions_yara.* files Matteo Cafasso (7): daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in | 4 + configure.ac | 1 + daemon/Makefile.am