Not all ELF files are for Linux (#55)

This stops tagging all ELF files as 'runnable:linux' and instead sets attempts to determine the most appropriate 'platform' and uses 'elf' as the extension.
CERT-Polska · Jan 23, 2023 · 3142429 · 3142429
1 parent 821437d
commit 3142429
Show file tree

Hide file tree

Showing 2 changed files with 18 additions and 3 deletions.
diff --git a/karton/classifier/classifier.py b/karton/classifier/classifier.py
@@ -240,8 +240,22 @@ def zip_has_file(path: str) -> bool:
             return sample_class
 
         # Is ELF file?
+        elf_assoc = {
+            "linux": "(GNU/Linux)",
+            "freebsd": "(FreeBSD)",
+            "netbsd": "(NetBSD)",
+            "openbsd": "(SYSV)",
+            "solaris": "(Solaris)",
+        }
         if magic.startswith("ELF"):
-            sample_class.update({"kind": "runnable", "platform": "linux"})
+            for platform, platform_full in elf_assoc.items():
+                if platform_full in magic:
+                    sample_class.update(
+                        {"kind": "runnable", "platform": platform, "extension": "elf"}
+                    )
+                    return sample_class
+
+            sample_class.update({"kind": "runnable", "extension": "elf"})
             return sample_class
 
         # Is PKG file?

diff --git a/tests/test_classifier_runnable.py b/tests/test_classifier_runnable.py
@@ -44,11 +44,12 @@ def test_process_runnable_linux(self):
                 "quality": "high",
                 "kind": "runnable",
                 "mime": "application/x-executable",
-                "platform": "linux",
+                "extension": "elf",
+                "platform": "openbsd",
             },
             payload={
                 "sample": resource,
-                "tags": ["runnable:linux"],
+                "tags": ["runnable:openbsd:elf"],
                 "magic": magic,
             },
         )