def GetKnowledgeBase(rdf_client_obj, allow_uninitialized=False):
"""Returns a knowledgebase from an rdf client object."""
if not allow_uninitialized:
if rdf_client_obj is None:
raise artifact_utils.KnowledgeBaseUninitializedError(
"No client snapshot given.")
if rdf_client_obj.knowledge_base is None:
raise artifact_utils.KnowledgeBaseUninitializedError(
"KnowledgeBase empty for %s." % rdf_client_obj.client_id)
kb = rdf_client_obj.knowledge_base
if not kb.os:
raise artifact_utils.KnowledgeBaseAttributesMissingError(
"KnowledgeBase missing OS for %s. Knowledgebase content: %s" %
(rdf_client_obj.client_id, kb))
if rdf_client_obj is None or rdf_client_obj.knowledge_base is None:
return rdf_client.KnowledgeBase()
version = rdf_client_obj.os_version.split(".")
kb = rdf_client_obj.knowledge_base
try:
kb.os_major_version = int(version[0])
if len(version) > 1:
kb.os_minor_version = int(version[1])
except ValueError:
pass
return kb
def GetArtifactKnowledgeBase(client_obj, allow_uninitialized=False):
"""This generates an artifact knowledge base from a GRR client.
Args:
client_obj: A GRRClient object which is opened for reading.
allow_uninitialized: If True we accept an uninitialized knowledge_base.
Returns:
A KnowledgeBase semantic value.
Raises:
ArtifactProcessingError: If called when the knowledge base has not been
initialized.
KnowledgeBaseUninitializedError: If we failed to initialize the knowledge
base.
This is needed so that the artifact library has a standardized
interface to the data that is actually stored in the GRRClient object in
the GRR datastore.
We expect that the client KNOWLEDGE_BASE is already filled out through the,
KnowledgeBaseInitialization flow, but attempt to make some intelligent
guesses if things failed.
"""
client_schema = client_obj.Schema
kb = client_obj.Get(client_schema.KNOWLEDGE_BASE)
if not allow_uninitialized:
if not kb:
raise artifact_utils.KnowledgeBaseUninitializedError(
"KnowledgeBase empty for %s." % client_obj.urn)
if not kb.os:
raise artifact_utils.KnowledgeBaseAttributesMissingError(
"KnowledgeBase missing OS for %s. Knowledgebase content: %s" %
(client_obj.urn, kb))
if not kb:
kb = client_schema.KNOWLEDGE_BASE()
SetCoreGRRKnowledgeBaseValues(kb, client_obj)
if kb.os == "Windows":
# Add fallback values.
if not kb.environ_allusersappdata and kb.environ_allusersprofile:
# Guess if we don't have it already.
if kb.os_major_version >= 6:
kb.environ_allusersappdata = u"c:\\programdata"
kb.environ_allusersprofile = u"c:\\programdata"
else:
kb.environ_allusersappdata = (
u"c:\\documents and settings\\All Users\\"
"Application Data")
kb.environ_allusersprofile = u"c:\\documents and settings\\All Users"
return kb
