search for: yara_lib

...m xz + yara ) ifelse(FRUGALWARE,1, diff --git a/daemon/Makefile.am b/daemon/Makefile.am index 23f60eb..3a25f43 100644 --- a/daemon/Makefile.am +++ b/daemon/Makefile.am @@ -222,7 +222,8 @@ guestfsd_LDADD = \ $(LIBINTL) \ $(SERVENT_LIB) \ $(PCRE_LIBS) \ - $(TSK_LIBS) + $(TSK_LIBS) \ + $(YARA_LIBS) guestfsd_CPPFLAGS = \ -I$(top_srcdir)/gnulib/lib \ diff --git a/m4/guestfs_daemon.m4 b/m4/guestfs_daemon.m4 index 12123df..0018930 100644 --- a/m4/guestfs_daemon.m4 +++ b/m4/guestfs_daemon.m4 @@ -126,3 +126,17 @@ AC_CHECK_LIB([tsk],[tsk_version_print],[ AC_DEFINE([HAVE_LIBTSK], [1],...

...im xz + yara ) ifelse(FRUGALWARE,1, diff --git a/daemon/Makefile.am b/daemon/Makefile.am index 23f60eb..3a25f43 100644 --- a/daemon/Makefile.am +++ b/daemon/Makefile.am @@ -222,7 +222,8 @@ guestfsd_LDADD = \ $(LIBINTL) \ $(SERVENT_LIB) \ $(PCRE_LIBS) \ - $(TSK_LIBS) + $(TSK_LIBS) \ + $(YARA_LIBS) guestfsd_CPPFLAGS = \ -I$(top_srcdir)/gnulib/lib \ diff --git a/m4/guestfs_daemon.m4 b/m4/guestfs_daemon.m4 index 12123df..0018930 100644 --- a/m4/guestfs_daemon.m4 +++ b/m4/guestfs_daemon.m4 @@ -126,3 +126,17 @@ AC_CHECK_LIB([tsk],[tsk_version_print],[ AC_DEFINE([HAVE_LIBTSK], [1],...

...xz + yara ) ifelse(FRUGALWARE,1, diff --git a/daemon/Makefile.am b/daemon/Makefile.am index e3ad05350..9d73bb805 100644 --- a/daemon/Makefile.am +++ b/daemon/Makefile.am @@ -187,7 +187,8 @@ guestfsd_LDADD = \ $(SERVENT_LIB) \ $(PCRE_LIBS) \ $(TSK_LIBS) \ - $(RPC_LIBS) + $(RPC_LIBS) \ + $(YARA_LIBS) guestfsd_CPPFLAGS = \ -I$(top_srcdir)/gnulib/lib \ diff --git a/m4/guestfs_daemon.m4 b/m4/guestfs_daemon.m4 index eb5a6d5cf..522cd5f0e 100644 --- a/m4/guestfs_daemon.m4 +++ b/m4/guestfs_daemon.m4 @@ -126,3 +126,17 @@ AC_CHECK_LIB([tsk],[tsk_version_print],[ AC_DEFINE([HAVE_LIBTSK], [...

...xz + yara ) ifelse(FRUGALWARE,1, diff --git a/daemon/Makefile.am b/daemon/Makefile.am index 8632c3768..af4430f20 100644 --- a/daemon/Makefile.am +++ b/daemon/Makefile.am @@ -191,7 +191,8 @@ guestfsd_LDADD = \ $(SERVENT_LIB) \ $(PCRE_LIBS) \ $(TSK_LIBS) \ - $(RPC_LIBS) + $(RPC_LIBS) \ + $(YARA_LIBS) guestfsd_CPPFLAGS = \ -I$(top_srcdir)/gnulib/lib \ diff --git a/m4/guestfs_daemon.m4 b/m4/guestfs_daemon.m4 index eb5a6d5cf..522cd5f0e 100644 --- a/m4/guestfs_daemon.m4 +++ b/m4/guestfs_daemon.m4 @@ -126,3 +126,17 @@ AC_CHECK_LIB([tsk],[tsk_version_print],[ AC_DEFINE([HAVE_LIBTSK], [...

...ess libxml2 +libyara3 lsof lsscsi lvm2 diff --git a/daemon/Makefile.am b/daemon/Makefile.am index 23f60eb..3a25f43 100644 --- a/daemon/Makefile.am +++ b/daemon/Makefile.am @@ -222,7 +222,8 @@ guestfsd_LDADD = \ $(LIBINTL) \ $(SERVENT_LIB) \ $(PCRE_LIBS) \ - $(TSK_LIBS) + $(TSK_LIBS) \ + $(YARA_LIBS) guestfsd_CPPFLAGS = \ -I$(top_srcdir)/gnulib/lib \ diff --git a/m4/guestfs_daemon.m4 b/m4/guestfs_daemon.m4 index 12123df..9dc7c6c 100644 --- a/m4/guestfs_daemon.m4 +++ b/m4/guestfs_daemon.m4 @@ -126,3 +126,11 @@ AC_CHECK_LIB([tsk],[tsk_version_print],[ AC_DEFINE([HAVE_LIBTSK], [1],...

...dled/ocaml-augeas \ -L../common/mlpcre guestfsd_LDADD = \ - ../common/errnostring/liberrnostring.la \ - ../common/protocol/libprotocol.la \ - ../common/utils/libutils.la \ camldaemon.o \ $(ACL_LIBS) \ $(CAP_LIBS) \ @@ -236,7 +233,10 @@ guestfsd_LDADD = \ $(TSK_LIBS) \ $(RPC_LIBS) \ $(YARA_LIBS) \ - $(OCAML_LIBS) + $(OCAML_LIBS) \ + ../common/errnostring/liberrnostring.la \ + ../common/protocol/libprotocol.la \ + ../common/utils/libutils.la guestfsd_CPPFLAGS = \ -DCAML_NAME_SPACE \ -- 2.24.1

v6: - use new test functions - fix yara_detection struct field names - revert yara_load function to initial version With Pino we were exploring the idea of allowing Users to load multiple rule files with subsequent calls to yara_load API. https://www.redhat.com/archives/libguestfs/2016-November/msg00119.html It turns out impractical due to YARA API limitations. It is possible to load multiple

Yara is a rule based scanning engine aimed to help malware analysts in finding and classifying interesting samples. https://github.com/VirusTotal/yara This series adds Yara support to Libguestfs allowing to upload sets of rules and scanning files against them. Currently provided APIs: - yara_load: loads a set of rules - yara_destroy: free resources allocated by loaded rules - yara_scan:

v3: - allow to load multiple rule files - added optional namespace parameter to yara_load - move destructor logic in yara module - use generic file upload logic - use generic temporary path function Matteo Cafasso (6): appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests

Rebase patches on top of 1.35.25. No changes since last series. Matteo Cafasso (7): daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in | 4 + configure.ac | 1 + daemon/Makefile.am

v9: - fixes according to comments Matteo Cafasso (7): daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in | 4 + configure.ac | 1 + daemon/Makefile.am | 4 +-

v2: - Fix yara dependency in packagelist - Use pkg-config where available - Improve longdesc of yara_load API - Fix libyara initialization and finalization - Import CLEANUP_FCLOSE - Add custom CLEANUP_DESTROY_YARA_COMPILER - Add rules compilation error callback - Other small fixes according to comments Matteo Cafasso (6): appliance: add yara dependency New API: yara_load New API:

Rebase patches on top of 1.37.1. No changes since last series. Matteo Cafasso (7): daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in | 4 + configure.ac | 1 + daemon/Makefile.am

v5: - rebase on top of 1.37.9 - add missing actions_yara.* files Matteo Cafasso (7): daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in | 4 + configure.ac | 1 + daemon/Makefile.am

v8: - Ignore returned value in daemon/upload.c - Report serialization errors in lib/yara.c Matteo Cafasso (8): daemon: ignore unused return value in upload function daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in

v7: - Fixes according to comments - Rebase on top of 1.37.12 Matteo Cafasso (7): daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in | 4 + configure.ac | 1 + daemon/Makefile.am

...dutils guestfsd_LDADD = \ ../common/errnostring/liberrnostring.la \ ../common/protocol/libprotocol.la \ ../common/utils/libutils.la \ + camldaemon.o \ $(ACL_LIBS) \ $(CAP_LIBS) \ $(YAJL_LIBS) \ @@ -198,9 +225,12 @@ guestfsd_LDADD = \ $(PCRE_LIBS) \ $(TSK_LIBS) \ $(RPC_LIBS) \ - $(YARA_LIBS) + $(YARA_LIBS) \ + $(OCAML_LIBS) guestfsd_CPPFLAGS = \ + -I$(shell $(OCAMLC) -where) \ + -I$(shell $(OCAMLC) -where)/hivex \ -I$(top_srcdir)/gnulib/lib \ -I$(top_builddir)/gnulib/lib \ -I$(top_srcdir)/lib \ @@ -220,6 +250,69 @@ guestfsd_CFLAGS = \ $(YAJL_CFLAGS) \ $(PCRE_CFLAGS) +#...

This patch series is just FYI at the moment. However it does pass the tests. The daemon is a self-contained program. We don't need to write it all in C. Writing parts of it in OCaml would make it simpler and less error-prone. In particular if the daemon was written in a more sane programming language then we could move the inspection code to run entirely inside the appliance, which would

...dutils guestfsd_LDADD = \ ../common/errnostring/liberrnostring.la \ ../common/protocol/libprotocol.la \ ../common/utils/libutils.la \ + camldaemon.o \ $(ACL_LIBS) \ $(CAP_LIBS) \ $(YAJL_LIBS) \ @@ -198,9 +212,12 @@ guestfsd_LDADD = \ $(PCRE_LIBS) \ $(TSK_LIBS) \ $(RPC_LIBS) \ - $(YARA_LIBS) + $(YARA_LIBS) \ + $(OCAML_LIBS) guestfsd_CPPFLAGS = \ + -I$(shell $(OCAMLC) -where) \ + -I$(shell $(OCAMLC) -where)/hivex \ -I$(top_srcdir)/gnulib/lib \ -I$(top_builddir)/gnulib/lib \ -I$(top_srcdir)/lib \ @@ -220,6 +237,70 @@ guestfsd_CFLAGS = \ $(YAJL_CFLAGS) \ $(PCRE_CFLAGS) +#...

Version 1 was here: https://www.redhat.com/archives/libguestfs/2017-June/msg00003.html This patch series reimplements a few more APIs in OCaml, including some very important core APIs like ?list_filesystems? and ?mount?. All the tests pass after this. The selection of APIs that I have moved may look a little random, but in fact they are all APIs consumed by the inspection code (and some more