diff --git a/dissect/target/plugins/os/unix/etc/etc.py b/dissect/target/plugins/os/unix/etc/etc.py index 04c8a2ad6..5f8ea411a 100644 --- a/dissect/target/plugins/os/unix/etc/etc.py +++ b/dissect/target/plugins/os/unix/etc/etc.py @@ -1,7 +1,7 @@ import fnmatch import re from pathlib import Path -from typing import Iterator +from typing import Iterator, Union from dissect.target import Target from dissect.target.helpers.record import TargetRecordDescriptor @@ -28,7 +28,9 @@ class EtcTree(ConfigurationTreePlugin): def __init__(self, target: Target): super().__init__(target, "/etc") - def _sub(self, items: ConfigurationEntry, entry: Path, pattern: str) -> Iterator[UnixConfigTreeRecord]: + def _sub( + self, items: Union[ConfigurationEntry, dict], entry: Path, orig_path: Path, pattern: str + ) -> Iterator[UnixConfigTreeRecord]: index = 0 config_entry = items if not isinstance(items, dict): @@ -39,7 +41,7 @@ def _sub(self, items: ConfigurationEntry, entry: Path, pattern: str) -> Iterator path = Path(entry) / Path(key) if isinstance(value, dict): - yield from self._sub(value, path, pattern) + yield from self._sub(value, path, orig_path, pattern) continue if not isinstance(value, list): @@ -48,7 +50,9 @@ def _sub(self, items: ConfigurationEntry, entry: Path, pattern: str) -> Iterator if fnmatch.fnmatch(path, pattern): data = { "_target": self.target, - "source": self.target.fs.path(config_entry.entry.path if hasattr(config_entry,"entry") else path), + "source": self.target.fs.path( + config_entry.entry.path if hasattr(config_entry, "entry") else orig_path + ), "path": path, "key": key, "value": value, @@ -68,7 +72,7 @@ def etc(self, pattern: str) -> Iterator[UnixConfigTreeRecord]: try: config_object = self.get(str(Path(entry) / Path(item))) if isinstance(config_object, ConfigurationEntry): - yield from self._sub(config_object, Path(entry) / Path(item), pattern) + yield from self._sub(config_object, Path(entry) / Path(item), Path(entry) / Path(item), pattern) except Exception: self.target.log.warning("Could not open configuration item: %s", item) pass