:py:mod:`dissect.target.plugins.os.unix.locate.mlocate`
=======================================================

.. py:module:: dissect.target.plugins.os.unix.locate.mlocate




Module Contents
---------------

Classes
~~~~~~~

.. autoapisummary::

   dissect.target.plugins.os.unix.locate.mlocate.MLocate
   dissect.target.plugins.os.unix.locate.mlocate.MLocateFile
   dissect.target.plugins.os.unix.locate.mlocate.MLocatePlugin




Attributes
~~~~~~~~~~

.. autoapisummary::

   dissect.target.plugins.os.unix.locate.mlocate.mlocate_def
   dissect.target.plugins.os.unix.locate.mlocate.MLocateRecord
   dissect.target.plugins.os.unix.locate.mlocate.c_mlocate


.. py:data:: mlocate_def
   :value: Multiline-String

   .. raw:: html

      <details><summary>Show Value</summary>

   .. code-block:: python

      """
      #define MAGIC 0x006d6c6f63617465             /* b'/x00mlocate' */
      
      struct header_config {
          int32 conf_size;
          int8 version;                            /* file format version */
          int8 require_visibility;
          int8 pad0[2];                             /* 32-bit total alignment */
          char root_database;
          char config_block[conf_size];
          int8 pad1;
      };
      
      enum DBE_TYPE: uint8 {                       /* database entry type */
          FILE         = 0x0,                      /* file */
          DIRECTORY    = 0x1,                      /* directory */
          END          = 0x2                       /* end of directory */
      };
      
      struct directory_entry {
          /* time is the 'maximum of st_ctime and
             st_mtime of the directory' according to docs */
          int64 time_seconds;
          int32 time_nanoseconds;
          int32 padding;
          char path[];
      };
      
      struct entry {
          char path[];
      };
      """

   .. raw:: html

      </details>



.. py:class:: MLocate

   .. py:attribute:: ts
      :type:  datetime.datetime


   .. py:attribute:: ts_ns
      :type:  int


   .. py:attribute:: parent
      :type:  str


   .. py:attribute:: path
      :type:  str


   .. py:attribute:: dbe_type
      :type:  str


.. py:data:: MLocateRecord

.. py:data:: c_mlocate

.. py:class:: MLocateFile(fh: BinaryIO)

   Parser for mlocate files.

   .. rubric:: References

   - https://manpages.debian.org/testing/mlocate/mlocate.db.5.en.html


   .. py:attribute:: fh


   .. py:attribute:: header


   .. py:method:: __iter__() -> collections.abc.Iterator[MLocateFile]


.. py:class:: MLocatePlugin(target: dissect.target.target.Target)

   Bases: :py:obj:`dissect.target.plugins.os.unix.locate.locate.BaseLocatePlugin`


   Unix mlocate plugin.


   .. py:attribute:: __namespace__
      :value: 'mlocate'


      Defines the plugin namespace.


   .. py:attribute:: path
      :value: '/var/lib/mlocate/mlocate.db'



   .. py:method:: check_compatible() -> None

      Perform a compatibility check with the target.

      This function should return ``None`` if the plugin is compatible with the current target (``self.target``).
      For example, check if a certain file exists. Otherwise it should raise an
      :class:`UnsupportedPluginError`.

      :raises UnsupportedPluginError: If the plugin could not be loaded.



   .. py:method:: locate() -> collections.abc.Iterator[MLocateRecord]

      Yield file and directory names from mlocate.db file.

      ``mlocate`` is a new implementation of GNU locate,
      but has been deprecated since Ubuntu 22.

      .. rubric:: References

      - https://manpages.debian.org/testing/mlocate/mlocate.db.5.en.html