Skip to content

Commit 5ea79fb

Browse files
committed
fix: add version property as mandatory
Add version property as mandatory in validate_artifact function.
1 parent 311a467 commit 5ea79fb

11 files changed

+106
-68
lines changed

CHANGELOG.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,15 +47,19 @@ All notable changes to this project will be documented in this file.
4747
- `memory_dump/coredump.yaml`: Added collection of core dump, ABRT, Apport, and kdump files [esxi, linux, netbsd]. (by [mnrkbys](https://github.com/mnrkbys))
4848

4949
### Changed
50+
5051
- `files/logs/macos_unified_logs.yaml`: Updated to include collection of ASL logs [macos]. (by [Pierre-Gronau-ndaal](https://github.com/Pierre-Gronau-ndaal))
5152
- `live_response/packages/dpkg.yaml`: Updated to validate all installed packages by comparing the installed files against the package metadata stored in the dpkg database [linux]. (by [Pierre-Gronau-ndaal](https://github.com/Pierre-Gronau-ndaal))
5253
- `live_response/packages/snap.yaml`: Updated collection to display installed packages including all revisions [linux]. (by [Pierre-Gronau-ndaal](https://github.com/Pierre-Gronau-ndaal))
5354

5455
### Fixed
56+
5557
- Resolved an issue where the `hash` and `stat` collectors failed to function correctly when the `%user_home%` variable was included in the path property. ([#289](https://github.com/tclahr/uac/issues/289))
5658

5759
### Profiles
60+
5861
- Added `offline_ir_triage.yaml`: New 'offline_ir_triage' profile for offline triage collections. (by [clausing](https://github.com/clausing))
5962

6063
### New Artifact Properties
64+
6165
- Introduced `redirect_stderr_to_stdout`: When enabled, this property redirects error messages (stderr) to standard output (stdout). Useful for debugging and ensuring complete logs.

CODE_OF_CONDUCT.md

Lines changed: 35 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
# Code of Conduct
2+
13
An open-source and open community project is one in which participants choose to work together, and in that process experience differences in language, location, nationality, and experience. In such a diverse environment, misunderstandings and disagreements happen, which in most cases can be resolved informally. In rare cases, however, behavior can intimidate, harass, or otherwise disrupt one or more people in the community, which this project will not tolerate.
24

35
A **Code of Conduct** is useful to define accepted and acceptable behaviors and to promote high standards of professional practice. It also provides a benchmark for self evaluation and acts as a vehicle for better identity of the organization.
@@ -7,7 +9,9 @@ This code (**CoC**) applies to any participant in this project's community – d
79
## Statement of Intent
810

911
This project is committed to maintain a **positive** [work environment](#work-environment). This commitment calls for a workplace where [participants](#participant) at all levels behave according to the rules of the following code. A foundational concept of this code is that we all share responsibility for our work environment.
12+
1013
## Code
14+
1115
1. Treat each other with [respect](#respect), professionalism, fairness, and sensitivity to our many differences and strengths, including in situations of high pressure and urgency.
1216
1. Never [harass](#harassment) or [bully](#workplace-bullying) anyone verbally, physically or [sexually](#sexual-harassment).
1317
1. Never [discriminate](#discrimination) on the basis of personal characteristics or group membership.
@@ -21,37 +25,50 @@ This project is committed to maintain a **positive** [work environment](#work-en
2125
1. Step down considerately: Members of every project come and go, and the Hyperledger Project is no different. When you leave or disengage from the project, in whole or in part, we ask that you do so in a way that minimizes disruption to the project. This means you should tell people you are leaving and take the proper steps to ensure that others can pick up where you left off.
2226

2327
## Glossary
24-
#### Demeaning behavior
28+
29+
### Demeaning behavior
30+
2531
is acting in a way that reduces another person's dignity, sense of self-worth or respect within the community.
2632

27-
#### Discrimination
33+
### Discrimination
34+
2835
is the prejudicial treatment of an individual based on criteria such as: physical appearance, race, ethnic origin, genetic differences, national or social origin, name, religion, gender, sexual orientation, family or health situation, pregnancy, disability, age, education, wealth, domicile, political view, morals, employment, or union activity.
2936

30-
#### Insulting behavior
37+
### Insulting behavior
38+
3139
is treating another person with scorn or disrespect.
3240

33-
#### Acknowledgement
41+
### Acknowledgement
42+
3443
is a record of the origin(s) and author(s) of a contribution.
3544

36-
#### Harassment
45+
### Harassment
46+
3747
is any conduct, verbal or physical, that has the intent or effect of interfering with an individual, or that creates an intimidating, hostile, or offensive environment.
3848

39-
#### Leadership position
49+
### Leadership position
50+
4051
includes group Chairs, project maintainers, staff members, and Board members.
4152

42-
#### Participant
53+
### Participant
54+
4355
includes the following persons:
56+
4457
* Developers
4558
* Anyone from the Public partaking in this project's work environment (e.g. contribute code, comment on our code or specs, email us, attend our conferences, functions, etc)
4659

47-
#### Respect
60+
### Respect
61+
4862
is the genuine consideration you have for someone (if only because of their status as participant in Hyperledger Project, like yourself), and that you show by treating them in a polite and kind way.
4963

50-
#### Sexual harassment
64+
### Sexual harassment
65+
5166
includes visual displays of degrading sexual images, sexually suggestive conduct, offensive remarks of a sexual nature, requests for sexual favors, unwelcome physical contact, and sexual assault.
5267

53-
#### Unwelcome behavior
68+
### Unwelcome behavior
69+
5470
Hard to define? Some questions to ask yourself are:
71+
5572
* how would I feel if I were in the position of the recipient?
5673
* would my spouse, parent, child, sibling or friend like to be treated this way?
5774
* would I like an account of my behavior published in the organization's newsletter?
@@ -61,21 +78,25 @@ Hard to define? Some questions to ask yourself are:
6178

6279
_Summary_: if you are unsure whether something might be welcome or unwelcome, don't do it.
6380

64-
#### Unwelcome sexual advance
81+
### Unwelcome sexual advance
82+
6583
includes requests for sexual favors, and other verbal or physical conduct of a sexual nature, where:
84+
6685
* submission to such conduct is made either explicitly or implicitly a term or condition of an individual's employment,
6786
* submission to or rejection of such conduct by an individual is used as a basis for employment decisions affecting the individual,
6887
* such conduct has the purpose or effect of unreasonably interfering with an individual's work performance or creating an intimidating hostile or offensive working environment.
6988

70-
#### Workplace Bullying
89+
### Workplace Bullying
90+
7191
is a tendency of individuals or groups to use persistent aggressive or unreasonable behavior (e.g. verbal or written abuse, offensive conduct or any interference which undermines or impedes work) against a co-worker or any professional relations.
7292

73-
#### Work Environment
93+
### Work Environment
94+
7495
is the set of all available means of collaboration, including, but not limited to messages to mailing lists, private correspondence, Web pages, chat channels, phone and video teleconferences, and any kind of face-to-face meetings or discussions.
7596

7697
## Incident Procedure
7798

78-
To report incidents or to appeal reports of incidents, send email to [email protected] create email. Please include any available relevant information, including links to any publicly accessible material relating to the matter. Every effort will be taken to ensure a safe and collegial environment in which to collaborate on matters relating to the Project. In order to protect the community, the Project reserves the right to take appropriate action, potentially including the removal of an individual from any and all participation in the project. The Project will work towards an equitable resolution in the event of a misunderstanding.
99+
To report incidents or to appeal reports of incidents, send email to <[email protected]> create email. Please include any available relevant information, including links to any publicly accessible material relating to the matter. Every effort will be taken to ensure a safe and collegial environment in which to collaborate on matters relating to the Project. In order to protect the community, the Project reserves the right to take appropriate action, potentially including the removal of an individual from any and all participation in the project. The Project will work towards an equitable resolution in the event of a misunderstanding.
79100

80101
## Credits
81102

CONTRIBUTING.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -146,9 +146,9 @@ To ensure consistency throughout the source code, keep these rules in mind as yo
146146

147147
We have very precise rules over how our git commit messages can be formatted. This leads to more readable messages that are easy to follow when looking through the project history.
148148

149-
Each commit message consists of a **header**, a **blank line** and a **body**. The header has a special format that includes a **type** and a **subject**.
149+
Each commit message consists of a **header**, a **blank line** and a **body**. The header has a special format that includes a **type** and a **subject**.
150150

151-
```
151+
```text
152152
<type>: <subject>
153153
<BLANK LINE>
154154
<body>
@@ -158,7 +158,7 @@ Any line of the commit message cannot be longer than 100 characters! This allows
158158

159159
Samples:
160160

161-
```
161+
```text
162162
docs: update changelog to v2.0.0
163163
fix: fixed issue #15
164164
```

LICENSES.md

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,10 @@
1+
# Licenses
2+
13
Use of the following Third-Party Software is subject to the license agreements at the URLs listed in the table below.
24

35
|Product|Copyright|URL|
46
|---|---|---|
5-
|AVML|Use rights in accordance with the information displayed at: https://github.com/microsoft/avml/blob/main/LICENSE|https://github.com/microsoft/avml|
6-
|linux_procmemdump.sh|Use rights in accordance with the information displayed at: https://creativecommons.org/licenses/by-sa/4.0|
7-
|statx|Use rights in accordance with the information displayed at: https://github.com/tclahr/statx/blob/main/LICENSE|https://github.com/tclahr/statx|
8-
|zip|Use rights in accordance with the information displayed at: https://infozip.sourceforge.net/license.html|https://infozip.sourceforge.net|
7+
|AVML|Use rights in accordance with the information displayed at: <https://github.com/microsoft/avml/blob/main/LICENSE>|<https://github.com/microsoft/avml>|
8+
|linux_procmemdump.sh|Use rights in accordance with the information displayed at: <https://creativecommons.org/licenses/by-sa/4.0>||
9+
|statx|Use rights in accordance with the information displayed at: <https://github.com/tclahr/statx/blob/main/LICENSE>|<https://github.com/tclahr/statx>|
10+
|zip|Use rights in accordance with the information displayed at: <https://infozip.sourceforge.net/license.html>|<https://infozip.sourceforge.net>|

README.md

Lines changed: 19 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
<!-- markdownlint-disable MD033 -->
2+
<!-- markdownlint-disable MD041 -->
13
<p align="center">
24
<picture>
35
<source media="(prefers-color-scheme: dark)" srcset="logo/uac-light.svg">
@@ -8,13 +10,13 @@
810

911
<p align="center">
1012
<a href="https://github.com/tclahr/uac/actions/workflows/shellcheck.yaml" alt="Issues">
11-
<img src="https://github.com/tclahr/uac/actions/workflows/shellcheck.yaml/badge.svg" /></a>
13+
<img src="https://github.com/tclahr/uac/actions/workflows/shellcheck.yaml/badge.svg" alt="shellcheck_badge"/></a>
1214
<a href="https://bestpractices.coreinfrastructure.org/projects/5640" alt="CII Best Practices">
13-
<img src="https://bestpractices.coreinfrastructure.org/projects/5640/badge" /></a>
15+
<img src="https://bestpractices.coreinfrastructure.org/projects/5640/badge" alt="bestpractices_badge"/></a>
1416
<a href="https://github.com/tclahr/uac/releases" alt="GitHub release (latest by date including pre-releases)">
15-
<img src="https://img.shields.io/github/v/release/tclahr/uac?include_prereleases&style=flat-square" /></a>
17+
<img src="https://img.shields.io/github/v/release/tclahr/uac?include_prereleases&style=flat-square" alt="release_badge"/></a>
1618
<a href="https://github.com/tclahr/uac/LICENSE" alt="License">
17-
<img src="https://img.shields.io/github/license/tclahr/uac?style=flat-square" /></a>
19+
<img src="https://img.shields.io/github/license/tclahr/uac?style=flat-square" alt="license_badge"/></a>
1820
</p>
1921

2022
<p align="center">
@@ -34,16 +36,18 @@
3436
3537
<a href="#-license">License</a>
3638
</p>
37-
3839
</p>
40+
<!-- markdownlint-enable MD033 -->
41+
<!-- markdownlint-enable MD041 -->
3942

4043
## 🔎 About UAC
4144

4245
**UAC (Unix-like Artifacts Collector)** is a powerful and extensible incident response tool designed for forensic investigators, security analysts, and IT professionals. It automates the collection of artifacts from a wide range of Unix-like systems, including AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris.
4346

4447
Whether you're handling an intrusion, conducting forensic investigations, or performing compliance checks, UAC simplifies and accelerates data collection while minimizing reliance on external support during critical incidents.
4548

46-
### Key Highlights:
49+
### Key Highlights
50+
4751
- 📂 Fully customizable via YAML profiles for tailored data collection.
4852
- ⚡ Lightweight, portable, and requires no installation or dependencies.
4953
- 🔒 Adheres to the order of volatility to ensure reliable data acquisition.
@@ -87,27 +91,32 @@ UAC runs on any Unix-like system, regardless of the processor architecture. All
8791
UAC does not need to be installed on the target system. Simply download the latest version from the [releases page](https://github.com/tclahr/uac/releases), uncompress it, and launch. It's that simple!
8892

8993
### 🛠 Getting Started
94+
9095
1. Download the latest release from the [Releases page](https://github.com/tclahr/uac/releases).
9196
2. Uncompress the archive.
9297
3. Execute the tool directly from the terminal.
9398

9499
### Examples
95100

101+
<!-- markdownlint-disable MD033 -->
96102
<details>
97103
<summary>Click to view usage examples</summary>
98104

99105
**Collect all artifacts based on the ir_triage profile:**
100-
```bash
106+
107+
```shell
101108
./uac -p ir_triage /tmp
102109
```
103110

104111
**Collect memory dump and all artifacts based on the full profile:**
105-
```bash
112+
113+
```shell
106114
./uac -a ./artifacts/memory_dump/avml.yaml -p full /tmp
107115
```
108116

109117
**Collect all artifacts excluding a specific one:**
110-
```bash
118+
119+
```shell
111120
./uac -p full -a \!artifacts/bodyfile/bodyfile.yaml .
112121
```
113122

@@ -124,6 +133,7 @@ UAC does not need to be installed on the target system. Simply download the late
124133
```
125134

126135
</details>
136+
<!-- markdownlint-enable MD033 -->
127137

128138
## 💙 Contributing
129139

lib/find_based_collector.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -283,5 +283,5 @@ _find_based_collector()
283283
fi
284284
;;
285285
esac
286-
286+
287287
}

lib/list_artifacts.sh

Lines changed: 24 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -18,12 +18,14 @@ _list_artifacts()
1818
return 1
1919
fi
2020

21-
if [ "${__la_os}" = "all" ] || _is_in_list "${__la_os}" "aix|esxi|freebsd|linux|macos|netbsd|netscaler|openbsd|solaris"; then
22-
true
23-
else
24-
_error_msg "list artifacts: invalid operating system '${__la_os}'"
25-
return 1
26-
fi
21+
case "${__la_os}" in
22+
all|aix|esxi|freebsd|linux|macos|netbsd|netscaler|openbsd|solaris)
23+
;;
24+
*)
25+
_error_msg "list artifacts: invalid operating system '${__la_os}'"
26+
return 1
27+
;;
28+
esac
2729

2830
# Get artifacts for all or a specific operating system.
2931
# Arguments:
@@ -36,29 +38,22 @@ _list_artifacts()
3638
__oa_artifacts_dir="${1:-}"
3739
__oa_os="${2:-all}"
3840

39-
if [ "${__oa_os}" = "all" ]; then
40-
# shellcheck disable=SC2162
41-
find "${__oa_artifacts_dir}"/* -name "*.yaml" -print 2>/dev/null \
42-
| while read __oa_item || [ -n "${__oa_item}" ]; do
43-
if grep -q -E "modifier:.*true" "${__oa_item}" 2>/dev/null; then
44-
echo "${__oa_item} (modifier)" | sed -e "s|^${__oa_artifacts_dir}/||" 2>/dev/null
45-
else
46-
echo "${__oa_item}" | sed -e "s|^${__oa_artifacts_dir}/||" 2>/dev/null
47-
fi
48-
done
49-
else
50-
# shellcheck disable=SC2162
51-
find "${__oa_artifacts_dir}"/* -name "*.yaml" -print 2>/dev/null \
52-
| while read __oa_item || [ -n "${__oa_item}" ]; do
53-
if grep -q -E "supported_os:.*all|${__oa_os}" "${__oa_item}" 2>/dev/null; then
54-
if grep -q -E "modifier:.*true" "${__oa_item}" 2>/dev/null; then
55-
echo "${__oa_item} (modifier)" | sed -e "s|^${__oa_artifacts_dir}/||" 2>/dev/null
56-
else
57-
echo "${__oa_item}" | sed -e "s|^${__oa_artifacts_dir}/||" 2>/dev/null
58-
fi
59-
fi
60-
done
61-
fi
41+
# shellcheck disable=SC2162
42+
find "${__oa_artifacts_dir}"/* -name "*.yaml" -print 2>/dev/null \
43+
| sort -u \
44+
| while read __oa_item || [ -n "${__oa_item}" ]; do
45+
__oa_modifier=""
46+
47+
if grep -q -E "modifier:.*true" "${__oa_item}" 2>/dev/null; then
48+
__oa_modifier=" (modifier)"
49+
fi
50+
51+
if [ "${__oa_os}" = "all" ] || grep -q -E "supported_os:.*(all|${__oa_os})" "${__oa_item}"; then
52+
__oa_filename=`echo "${__oa_item}" | sed -e "s|^${__oa_artifacts_dir}/||" 2>/dev/null`
53+
echo "${__oa_filename}${__oa_modifier}"
54+
fi
55+
done
56+
6257
}
6358

6459
__la_selected_artifacts=`_get_operating_system_artifact_list "${__la_artifacts_dir}" "${__la_os}"`

lib/remove_non_regular_files.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ _remove_non_regular_files()
1414
_log_msg ERR "_remove_non_regular_files: no such file or directory '${__rn_file}'"
1515
return 1
1616
fi
17-
17+
1818
if [ ! -s "${__rn_file}" ]; then
1919
_log_msg DBG "_remove_non_regular_files: skipping empty file '${__rn_file}'"
2020
return 1

lib/run_command.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,5 +41,5 @@ _run_command()
4141
fi
4242

4343
return "${__rc_exit_code}"
44-
44+
4545
}

lib/usage.sh

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -8,10 +8,10 @@
88
# none
99
_usage()
1010
{
11-
printf "%s" "Usage: $0 [-h] [-V] [--debug] {-p PROFILE | -a ARTIFACT} DESTINATION
12-
13-
or: $0 --validate-artifact FILE
14-
or: $0 --validate-profile FILE
11+
printf "%s" "Usage: $0 [-h] [-V] [--debug] {-p PROFILE | -a ARTIFACT} DESTINATION
12+
13+
or: $0 --validate-artifact FILE
14+
or: $0 --validate-profile FILE
1515
1616
Optional Arguments:
1717
-h, --help Display this help and exit.
@@ -59,7 +59,7 @@ Collection Arguments:
5959
-s, --operating-system OPERATING_SYSTEM
6060
Specify the operating system.
6161
Options: aix, esxi, freebsd, linux, macos, netbsd
62-
netscaler, openbsd, solaris
62+
netscaler, openbsd, solaris
6363
-H, --hash-collected
6464
Hash all collected files.
6565
-u, --run-as-non-root
@@ -69,7 +69,7 @@ Collection Arguments:
6969
Enable artifacts that change the system state.
7070
--hostname HOSTNAME
7171
Specify the target system hostname.
72-
--temp-dir PATH
72+
--temp-dir PATH
7373
Write all temporary data to this directory.
7474
7575
Filter Arguments:

0 commit comments

Comments
 (0)