Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add warning for OBJECT_UNUSED in journal plugin #971

Merged
merged 5 commits into from
Jan 16, 2025

Conversation

JSCU-CNI
Copy link
Contributor

@JSCU-CNI JSCU-CNI commented Dec 10, 2024

This PR adds an additional check for ObjectType OBJECT_UNUSED when iterating to a new journal entry array. It is possible that space is allocated in a journal file which is not yet used to store the next entry array (e.g. the object resides in memory and is not yet flushed to disk). The plugin would then attempt to read this empty data and return a ValueError since it is not expecting a zero byte.

We have changed this to a warning and added a break to stop iterating since this ObjectType can only be encountered at the end of a journal file.

@Schamper
Copy link
Member

Would it be possible to add a unit test?

@JSCU-CNI
Copy link
Contributor Author

Unfortunately we do not have a journal file we can share with OBJECT_UNUSED at this time.

@Schamper
Copy link
Member

Would it be possible to fabricate one with some hex editing or a cstruct write?

@JSCU-CNI
Copy link
Contributor Author

JSCU-CNI commented Jan 16, 2025

We have added a modified journal file in 3dc6d25.

@JSCU-CNI JSCU-CNI force-pushed the fix/journal-plugin-unused-struct branch from 35ff3db to 3dc6d25 Compare January 16, 2025 10:22
Copy link

codecov bot commented Jan 16, 2025

Codecov Report

Attention: Patch coverage is 83.33333% with 1 line in your changes missing coverage. Please review.

Project coverage is 77.76%. Comparing base (f774c22) to head (152ad26).
Report is 1 commits behind head on main.

Files with missing lines Patch % Lines
dissect/target/plugins/os/unix/log/journal.py 83.33% 1 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main     #971      +/-   ##
==========================================
+ Coverage   77.74%   77.76%   +0.01%     
==========================================
  Files         327      327              
  Lines       28623    28627       +4     
==========================================
+ Hits        22254    22261       +7     
+ Misses       6369     6366       -3     
Flag Coverage Δ
unittests 77.76% <83.33%> (+0.01%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@Schamper Schamper merged commit a8a085c into fox-it:main Jan 16, 2025
18 of 20 checks passed
@JSCU-CNI JSCU-CNI deleted the fix/journal-plugin-unused-struct branch January 16, 2025 13:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants