Allows other modules to use the same logic for uploading files. Signed-off-by: Matteo Cafasso <noxdafox(a)gmail.com&gt; --- daemon/daemon.h | 3 +++ daemon/upload.c | 70 ++++++++++++++++++++++++++++++++------------------------- 2 files changed, 42 insertions(+), 31 deletions(-) diff --git a/daemon/daemon.h b/daemon/daemon.h index 793074dea..bc89f78dd 100644 --- a/daemon/daemon.h +++ b/daemon/daemon.h @@ -258,6 +258,9 @@ extern int64_t ntfs_minimum_size (const char *device); extern int swap_set_uuid (const char *device, const char *uuid); extern int swap_set_label (const char *device, const char *label); +/*-- in upload.c --*/ +extern int upload_to_fd (int fd); + /* ordinary daemon functions use these to indicate errors * NB: you don't need to prefix the string with the current command, * it is added automatically by the client-side RPC stubs. diff --git a/daemon/upload.c b/daemon/upload.c index 655baf29d..144bb246c 100644 --- a/daemon/upload.c +++ b/daemon/upload.c @@ -54,60 +54,68 @@ write_cb (void *data_vp, const void *buf, size_t len) return 0; } +int +upload_to_fd (int fd) +{ + int ret = 0, err = 0; + struct write_cb_data data = { .fd = fd, .written = 0 }; + + ret = receive_file (write_cb, &data); + if (ret == -1) { /* write error */ + err = errno; + ret = cancel_receive (); + errno = err; + reply_with_error ("write error"); + close (fd); + return -1; + } + if (ret == -2) { /* cancellation from library */ + /* This error is ignored by the library since it initiated the + * cancel. Nevertheless we must send an error reply here. + */ + reply_with_error ("file upload cancelled"); + close (fd); + return -1; + } + + if (close (fd) == -1) { + reply_with_perror ("close"); + return -1; + } + + return 0; +} + /* Has one FileIn parameter. */ static int upload (const char *filename, int flags, int64_t offset) { - struct write_cb_data data = { .written = 0 }; - int err, r, is_dev; + int err, is_dev, fd; is_dev = STRPREFIX (filename, "/dev/"); if (!is_dev) CHROOT_IN; - data.fd = open (filename, flags, 0666); + fd = open (filename, flags, 0666); if (!is_dev) CHROOT_OUT; - if (data.fd == -1) { + if (fd == -1) { err = errno; - r = cancel_receive (); + cancel_receive (); errno = err; reply_with_perror ("%s", filename); return -1; } if (offset) { - if (lseek (data.fd, offset, SEEK_SET) == -1) { + if (lseek (fd, offset, SEEK_SET) == -1) { err = errno; - r = cancel_receive (); + cancel_receive (); errno = err; reply_with_perror ("lseek: %s", filename); return -1; } } - r = receive_file (write_cb, &data); - if (r == -1) { /* write error */ - err = errno; - r = cancel_receive (); - errno = err; - reply_with_error ("write error: %s", filename); - close (data.fd); - return -1; - } - if (r == -2) { /* cancellation from library */ - /* This error is ignored by the library since it initiated the - * cancel. Nevertheless we must send an error reply here. - */ - reply_with_error ("file upload cancelled"); - close (data.fd); - return -1; - } - - if (close (data.fd) == -1) { - reply_with_perror ("close: %s", filename); - return -1; - } - - return 0; + return upload_to_fd (fd); } /* Has one FileIn parameter. */ -- 2.11.0

The yara_load API allows to load a set of Yara rules contained within a file on the host. Rules can be in binary format, as when compiled with yarac command, or in source code format. In the latter case, the rules will be first compiled and then loaded. Subsequent calls of the yara_load API will result in the discard of the previously loaded rules. Signed-off-by: Matteo Cafasso <noxdafox(a)gmail.com&gt; --- daemon/Makefile.am | 1 + daemon/cleanups.c | 9 +++ daemon/cleanups.h | 2 + daemon/yara.c | 201 +++++++++++++++++++++++++++++++++++++++++++++++++++ generator/actions.ml | 21 ++++++ gobject/Makefile.inc | 6 +- 6 files changed, 238 insertions(+), 2 deletions(-) create mode 100644 daemon/yara.c diff --git a/daemon/Makefile.am b/daemon/Makefile.am index 2236abdd0..ba4256060 100644 --- a/daemon/Makefile.am +++ b/daemon/Makefile.am @@ -164,6 +164,7 @@ guestfsd_SOURCES = \ wc.c \ xattr.c \ xfs.c \ + yara.c \ zero.c \ zerofree.c diff --git a/daemon/cleanups.c b/daemon/cleanups.c index 092e493d7..3102cf94b 100644 --- a/daemon/cleanups.c +++ b/daemon/cleanups.c @@ -62,6 +62,15 @@ cleanup_close (void *ptr) } void +cleanup_fclose (void *ptr) +{ + FILE *f = * (FILE **) ptr; + + if (f) + fclose (f); +} + +void cleanup_aug_close (void *ptr) { augeas *aug = * (augeas **) ptr; diff --git a/daemon/cleanups.h b/daemon/cleanups.h index 6746e2744..a791244cb 100644 --- a/daemon/cleanups.h +++ b/daemon/cleanups.h @@ -26,6 +26,7 @@ extern void cleanup_free (void *ptr); extern void cleanup_free_string_list (void *ptr); extern void cleanup_unlink_free (void *ptr); extern void cleanup_close (void *ptr); +extern void cleanup_fclose (void *ptr); extern void cleanup_aug_close (void *ptr); extern void cleanup_free_stringsbuf (void *ptr); @@ -35,6 +36,7 @@ extern void cleanup_free_stringsbuf (void *ptr); __attribute__((cleanup(cleanup_free_string_list))) #define CLEANUP_UNLINK_FREE __attribute__((cleanup(cleanup_unlink_free))) #define CLEANUP_CLOSE __attribute__((cleanup(cleanup_close))) +#define CLEANUP_FCLOSE __attribute__((cleanup(cleanup_fclose))) #define CLEANUP_AUG_CLOSE __attribute__((cleanup(cleanup_aug_close))) #define CLEANUP_FREE_STRINGSBUF __attribute__((cleanup(cleanup_free_stringsbuf))) #else diff --git a/daemon/yara.c b/daemon/yara.c new file mode 100644 index 000000000..0e4128aed --- /dev/null +++ b/daemon/yara.c @@ -0,0 +1,201 @@ +/* libguestfs - the guestfsd daemon + * Copyright (C) 2016 Red Hat Inc. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include <config.h> + +#include <stdio.h> +#include <fcntl.h> +#include <stdlib.h> +#include <inttypes.h> +#include <string.h> +#include <unistd.h> +#include <stdbool.h> +#include <rpc/xdr.h> +#include <rpc/types.h> +#include <sys/types.h> +#include <sys/stat.h> + +#include "daemon.h" +#include "actions.h" +#include "optgroups.h" +#include "guestfs_protocol.h" + +#ifdef HAVE_YARA + +#include <yara.h> + +#define CLEANUP_DESTROY_YARA_COMPILER \ + __attribute__((cleanup(cleanup_destroy_yara_compiler))) + +struct write_callback_data { + int fd; + uint64_t written; +}; + +/* Yara compiled rules. */ +static YR_RULES *rules = NULL; +static bool initialized = false; + +static int compile_rules_file (const char *, const char *); +static void compile_error_callback (int, const char *, int, const char *, void *); +static void cleanup_destroy_yara_compiler (void *ptr); + +/* Has one FileIn parameter. + * Takes optional arguments, consult optargs_bitmask. + */ +int +do_yara_load (const char *namespace) +{ + int ret = 0; + CLEANUP_CLOSE int fd = -1; + char tmpfile[] = "/tmp/yaraXXXXXX"; + + fd = mkstemp (tmpfile); + if (fd == -1) { + reply_with_perror ("mkstemp"); + return -1; + } + + ret = upload_to_fd (fd); + if (ret < 0) { + unlink (tmpfile); + return -1; + } + + /* Initialize yara only once. */ + if (!initialized) { + ret = yr_initialize (); + if (ret != ERROR_SUCCESS) { + reply_with_error ("failed initializing yara"); + unlink (tmpfile); + return -1; + } + + initialized = true; + } + + /* Clear namespace if no optional parameter is given. */ + if (!(optargs_bitmask & GUESTFS_YARA_LOAD_NAMESPACE_BITMASK)) + namespace = NULL; + + /* Try to load the rules as compiled. + * If their are in source code format, compile them first. + */ + ret = yr_rules_load (tmpfile, &rules); + if (ret == ERROR_INVALID_FILE) + ret = compile_rules_file (tmpfile, namespace); + + unlink (tmpfile); + + return (ret == ERROR_SUCCESS) ? 0 : -1; +} + +/* Compile source code rules and load them. + * Return ERROR_SUCCESS on success, Yara error code type on error. + */ +static int +compile_rules_file (const char *rules_path, const char *namespace) +{ + int ret = 0; + CLEANUP_FCLOSE FILE *rule_file = NULL; + CLEANUP_DESTROY_YARA_COMPILER YR_COMPILER *compiler = NULL; + + ret = yr_compiler_create (&compiler); + if (ret != ERROR_SUCCESS) { + reply_with_error ("yr_compiler_create"); + return ret; + } + + yr_compiler_set_callback (compiler, compile_error_callback, NULL); + + rule_file = fopen (rules_path, "r"); + if (rule_file == NULL) { + reply_with_error ("unable to open rules file"); + return ret; + } + + ret = yr_compiler_add_file (compiler, rule_file, namespace, NULL); + if (ret > 0) + return ret; + + ret = yr_compiler_get_rules (compiler, &rules); + if (ret == ERROR_INSUFICIENT_MEMORY) { + errno = ENOMEM; + reply_with_perror ("yr_compiler_get_rules"); + } + + return ret; +} + +/* Yara compilation error callback. + * Reports back the compilation error message. + * Prints compilation warnings if verbose. + */ +static void +compile_error_callback(int level, const char *name, int line, + const char *message, void *data) +{ + if (level == YARA_ERROR_LEVEL_ERROR) + reply_with_error ("Yara error (line %d): %s", line, message); + else if (verbose) + fprintf (stderr, "Yara warning (line %d): %s\n", line, message); +} + +/* Clean up yara handle on daemon exit. */ +void yara_finalize (void) __attribute__((destructor)); + +void +yara_finalize (void) +{ + int ret = 0; + + if (!initialized) + return; + + if (rules != NULL) { + yr_rules_destroy (rules); + rules = NULL; + } + + ret = yr_finalize (); + if (ret != ERROR_SUCCESS) + perror ("yr_finalize"); + + initialized = false; +} + +static void +cleanup_destroy_yara_compiler (void *ptr) +{ + YR_COMPILER *compiler = * (YR_COMPILER **) ptr; + + if (compiler != NULL) + yr_compiler_destroy (compiler); +} + +int +optgroup_libyara_available (void) +{ + return 1; +} + +#else /* !HAVE_YARA */ + +OPTGROUP_YARA_NOT_AVAILABLE + +#endif /* !HAVE_YARA */ diff --git a/generator/actions.ml b/generator/actions.ml index 67db08c31..285c450bb 100644 --- a/generator/actions.ml +++ b/generator/actions.ml @@ -13309,6 +13309,27 @@ wildcards. Please note that this API may fail when used to compress directories with large files, such as the resulting squashfs will be over 3GB big." }; + { defaults with + name = "yara_load"; added = (1, 35, 26); + style = RErr, [FileIn "filename";], [OString "namespace"]; + proc_nr = Some 472; + progress = true; cancellable = true; + optional = Some "libyara"; + shortdesc = "load yara rules within libguestfs"; + longdesc = "\ +Load a set of Yara rules from F<filename> within libguestfs appliance. + +Rules can be in binary format, as when compiled with yarac command, or +in source code format. In the latter case, the rules will be first +compiled and then loaded. + +Rules in source code format cannot include external files. In such cases, +it is recommended to compile them first. + +Different rules files can be loaded sequentially. The optional parameter +C<namespace> can be used to distinguish rules with the same identifier +but belonging to different files." }; + ] (* Non-API meta-commands available only in guestfish. diff --git a/gobject/Makefile.inc b/gobject/Makefile.inc index 8fa8599d3..b0ebf15d9 100644 --- a/gobject/Makefile.inc +++ b/gobject/Makefile.inc @@ -111,7 +111,8 @@ guestfs_gobject_headers= \ include/guestfs-gobject/optargs-umount_local.h \ include/guestfs-gobject/optargs-xfs_admin.h \ include/guestfs-gobject/optargs-xfs_growfs.h \ - include/guestfs-gobject/optargs-xfs_repair.h + include/guestfs-gobject/optargs-xfs_repair.h \ + include/guestfs-gobject/optargs-yara_load.h guestfs_gobject_sources= \ src/session.c \ @@ -203,4 +204,5 @@ guestfs_gobject_sources= \ src/optargs-umount_local.c \ src/optargs-xfs_admin.c \ src/optargs-xfs_growfs.c \ - src/optargs-xfs_repair.c + src/optargs-xfs_repair.c \ + src/optargs-yara_load.c -- 2.11.0

The internal_yara_scan runs the Yara engine with the previously loaded rules against the given file. For each rule matching against the scanned file, a struct containing the file name and the rule identifier is returned. The gathered list of yara_detection structs is serialised into XDR format and written to a file. Signed-off-by: Matteo Cafasso <noxdafox(a)gmail.com&gt; --- daemon/yara.c | 86 ++++++++++++++++++++++++++++++++ generator/actions.ml | 10 ++++ generator/structs.ml | 9 ++++ gobject/Makefile.inc | 2 + java/Makefile.inc | 1 + java/com/redhat/et/libguestfs/.gitignore | 1 + lib/MAX_PROC_NR | 2 +- 7 files changed, 110 insertions(+), 1 deletion(-) diff --git a/daemon/yara.c b/daemon/yara.c index cb49593c7..471547341 100644 --- a/daemon/yara.c +++ b/daemon/yara.c @@ -54,6 +54,8 @@ static bool initialized = false; static int compile_rules_file (const char *, const char *); static void compile_error_callback (int, const char *, int, const char *, void *); static void cleanup_destroy_yara_compiler (void *ptr); +static int yara_rules_callback (int , void *, void *); +static int send_detection_info (const char *, YR_RULE *); /* Has one FileIn parameter. * Takes optional arguments, consult optargs_bitmask. @@ -119,6 +121,38 @@ do_yara_destroy (void) return 0; } +/* Has one FileOut parameter. */ +int +do_internal_yara_scan (const char *path) +{ + int ret = 0; + CLEANUP_CLOSE int fd = -1; + + if (rules == NULL) { + reply_with_error ("no yara rules loaded"); + return -1; + } + + CHROOT_IN; + fd = open (path, O_RDONLY|O_CLOEXEC); + CHROOT_OUT; + + if (fd < 0) { + reply_with_perror ("%s", path); + return -1; + } + + reply (NULL, NULL); /* Reply message. */ + + ret = yr_rules_scan_fd (rules, fd, 0, yara_rules_callback, (void *) path, 0); + if (ret == ERROR_SUCCESS) + ret = send_file_end (0); /* File transfer end. */ + else + send_file_end (1); /* Cancel file transfer. */ + + return 0; +} + /* Compile source code rules and load them. * Return ERROR_SUCCESS on success, Yara error code type on error. */ @@ -170,6 +204,58 @@ compile_error_callback(int level, const char *name, int line, fprintf (stderr, "Yara warning (line %d): %s\n", line, message); } +/* Yara scan callback, called by yr_rules_scan_file. + * Return 0 on success, -1 on error. + */ +static int +yara_rules_callback (int code, void *message, void *data) +{ + int ret = 0; + + if (code == CALLBACK_MSG_RULE_MATCHING) + ret = send_detection_info ((const char *)data, (YR_RULE *) message); + + return (ret == 0) ? CALLBACK_CONTINUE : CALLBACK_ERROR; +} + +/* Serialize file path and rule name and send it out. + * Return 0 on success, -1 on error. + */ +static int +send_detection_info (const char *name, YR_RULE *rule) +{ + XDR xdr; + int ret = 0; + size_t len = 0; + CLEANUP_FREE char *buf = NULL; + struct guestfs_int_yara_detection detection; + + detection.name = (char *) name; + detection.rule = (char *) rule->identifier; + + /* Serialize detection struct. */ + buf = malloc (GUESTFS_MAX_CHUNK_SIZE); + if (buf == NULL) { + perror ("malloc"); + return -1; + } + + xdrmem_create (&xdr, buf, GUESTFS_MAX_CHUNK_SIZE, XDR_ENCODE); + + ret = xdr_guestfs_int_yara_detection (&xdr, &detection); + if (ret == 0) { + perror ("xdr_guestfs_int_yara_detection"); + return -1; + } + + len = xdr_getpos (&xdr); + + xdr_destroy (&xdr); + + /* Send serialised yara_detection out. */ + return send_file_write (buf, len); +} + /* Clean up yara handle on daemon exit. */ void yara_finalize (void) __attribute__((destructor)); diff --git a/generator/actions.ml b/generator/actions.ml index 149c4a938..7e62e21af 100644 --- a/generator/actions.ml +++ b/generator/actions.ml @@ -13338,6 +13338,16 @@ but belonging to different files." }; shortdesc = "destroy previously loaded yara rules"; longdesc = "\ Destroy previously loaded Yara rules in order to free libguestfs resources." }; + + { defaults with + name = "internal_yara_scan"; added = (1, 35, 26); + style = RErr, [Pathname "path"; FileOut "filename";], []; + proc_nr = Some 474; + visibility = VInternal; + optional = Some "libyara"; + shortdesc = "scan a file with the loaded yara rules"; + longdesc = "Internal function for yara_scan." }; + ] (* Non-API meta-commands available only in guestfish. diff --git a/generator/structs.ml b/generator/structs.ml index c1c9b668e..01aa3d371 100644 --- a/generator/structs.ml +++ b/generator/structs.ml @@ -469,6 +469,15 @@ let structs = [ ]; s_camel_name = "TSKDirent" }; + (* Yara detection information. *) + { defaults with + s_name = "yara_detection"; + s_cols = [ + "name", FString; + "rule", FString; + ]; + s_camel_name = "YaraDetection" }; + ] (* end of structs *) let lookup_struct name = diff --git a/gobject/Makefile.inc b/gobject/Makefile.inc index b0ebf15d9..4b067d9e0 100644 --- a/gobject/Makefile.inc +++ b/gobject/Makefile.inc @@ -49,6 +49,7 @@ guestfs_gobject_headers= \ include/guestfs-gobject/struct-version.h \ include/guestfs-gobject/struct-xattr.h \ include/guestfs-gobject/struct-xfsinfo.h \ + include/guestfs-gobject/struct-yara_detection.h \ include/guestfs-gobject/optargs-add_domain.h \ include/guestfs-gobject/optargs-add_drive.h \ include/guestfs-gobject/optargs-add_drive_scratch.h \ @@ -142,6 +143,7 @@ guestfs_gobject_sources= \ src/struct-version.c \ src/struct-xattr.c \ src/struct-xfsinfo.c \ + src/struct-yara_detection.c \ src/optargs-add_domain.c \ src/optargs-add_drive.c \ src/optargs-add_drive_scratch.c \ diff --git a/java/Makefile.inc b/java/Makefile.inc index b0ddb5c3d..3a202cee0 100644 --- a/java/Makefile.inc +++ b/java/Makefile.inc @@ -46,4 +46,5 @@ java_built_sources = \ com/redhat/et/libguestfs/Version.java \ com/redhat/et/libguestfs/XAttr.java \ com/redhat/et/libguestfs/XFSInfo.java \ + com/redhat/et/libguestfs/YaraDetection.java \ com/redhat/et/libguestfs/GuestFS.java diff --git a/java/com/redhat/et/libguestfs/.gitignore b/java/com/redhat/et/libguestfs/.gitignore index 89d923949..bc03cb965 100644 --- a/java/com/redhat/et/libguestfs/.gitignore +++ b/java/com/redhat/et/libguestfs/.gitignore @@ -23,3 +23,4 @@ VG.java Version.java XAttr.java XFSInfo.java +YaraDetection.java diff --git a/lib/MAX_PROC_NR b/lib/MAX_PROC_NR index 68cfb10d1..5f3bb9813 100644 --- a/lib/MAX_PROC_NR +++ b/lib/MAX_PROC_NR @@ -1 +1 @@ -472 +474 -- 2.11.0

Signed-off-by: Matteo Cafasso <noxdafox(a)gmail.com&gt; --- configure.ac | 1 + tests/yara/Makefile.am | 26 ++++++++++++++++ tests/yara/test-yara-scan.sh | 72 ++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 99 insertions(+) create mode 100644 tests/yara/Makefile.am create mode 100755 tests/yara/test-yara-scan.sh diff --git a/configure.ac b/configure.ac index 1e25846e0..999c31184 100644 --- a/configure.ac +++ b/configure.ac @@ -295,6 +295,7 @@ AC_CONFIG_FILES([Makefile tests/tsk/Makefile tests/xfs/Makefile tests/xml/Makefile + tests/yara/Makefile tools/Makefile utils/boot-analysis/Makefile utils/boot-benchmark/Makefile diff --git a/tests/yara/Makefile.am b/tests/yara/Makefile.am new file mode 100644 index 000000000..e23d94e4c --- /dev/null +++ b/tests/yara/Makefile.am @@ -0,0 +1,26 @@ +# libguestfs +# Copyright (C) 2016 Red Hat Inc. +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + +include $(top_srcdir)/subdir-rules.mk + +TESTS = \ + test-yara-scan.sh + +TESTS_ENVIRONMENT = $(top_builddir)/run --test + +EXTRA_DIST = \ + $(TESTS) diff --git a/tests/yara/test-yara-scan.sh b/tests/yara/test-yara-scan.sh new file mode 100755 index 000000000..a899e33e4 --- /dev/null +++ b/tests/yara/test-yara-scan.sh @@ -0,0 +1,72 @@ +#!/bin/bash - +# libguestfs +# Copyright (C) 2016 Red Hat Inc. +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + +# Test the yara_scan command. + +set -e + +if [ -n "$SKIP_TEST_YARA_SCAN_SH" ]; then + echo "$0: test skipped because environment variable is set." + exit 77 +fi + +rm -f test-yara-rules.yar + +# Skip if Yara is not supported by the appliance. +if ! guestfish add /dev/null : run : available "libyara"; then + echo "$0: skipped because Yara is not available in the appliance" + exit 77 +fi + +if [ ! -s ../../test-data/phony-guests/blank-fs.img ]; then + echo "$0: skipped because blank-fs.img is zero-sized" + exit 77 +fi + +/bin/cat << EOF > test-yara-rules.yar +rule TestRule +{ + strings: + \$my_text_string = "some text" + + condition: + \$my_text_string +} +EOF + +output=$( +guestfish --ro -a ../../test-data/phony-guests/blank-fs.img <<EOF +run +mount /dev/sda1 / +write /text.txt "some text" +yara-load test-yara-rules.yar +yara-scan /text.txt +umount / +yara-destroy +EOF +) + +echo $output | grep -zq '{ name: /text.txt rule: TestRule }' +if [ $? != 0 ]; then + echo "$0: TestRule not found in detections list." + echo "Detections list:" + echo $output + exit 1 +fi + +rm -f test-yara-rules.yar -- 2.11.0