artif: dump /etc/ld.so.preload with debugfs/xfs_db

[mnrkbys]

Add a new artifact to collect /etc/ld.so.preload.
Although LD_PRELOAD rootkits may hide /etc/ld.so.preload, it can be read via debugfs.

[tclahr]

This is cool, but I need some time for testing it. I will release UAC v3.0.0 and move this to 3.1.0. Thanks!

[tclahr]

Before merging into develop, I had to do some small changes.

1. During some tests, I noticed that any files that contain the string ld.so.preload is hooked by the rootkit, so UAC (or any other tool) cannot write to files like etc_ld.so.preload.txt. So I changed the output_file to etc_ld_so_preload.txt

2. I changed your .sh script name to reflect what it is doing.

3. I moved the condition to check the file system from the command to condition property. This is due to the fact even systems that use xfs also have debugfs installed as /boot uses to be formatted as ext. So I think it would be better checking the file system among with the debugfs in the condition property.

4. I noticed that stat can retrieve file stats for the /etc/ld.so.preload even if the rootkit is enabled. So I added a collector for that.

5. I added %mount_point% in the command as this artifact can also be run in offline disks.

[mnrkbys]

Thanks for your detailed review.