Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

FileSystemCollector skips Ubuntu directories

See original GitHub issue

I tried to collect a baseline in Ubuntu 20.04 but it looks like that it does not collect file system correctly (only shows scanning of /bin and /snap) and skips several directories, see details in screenshot.

I would expect ASA to scan directories listed in the screenshot (ls /). Note that there was a bug fix two years ago where some Ubuntu directories were skipped intentionally, see https://github.com/microsoft/AttackSurfaceAnalyzer/issues/555.

If I add --verbose, it looks like it goes through all directories (except /sys and /proc) as expected. Checking log file gives: administrator@focal:/tmp/ASA_linux_2.3.284$ cat asa.log.txt | grep "Scanning root" 2022-09-16 17:33:42.698 +03:00 [INF] Scanning root /bin 2022-09-16 17:34:42.862 +03:00 [INF] Scanning root /snap administrator@focal:/tmp/ASA_linux_2.3.284$

So, maybe all expected directories are collected as indicated by verbose output but it does not print “Scanning root” for all directories to the command line?

Issue Analytics

State:
Created a year ago
Comments:5 (4 by maintainers)

Top GitHub Comments

1reaction

gfscommented, Sep 17, 2022

That is peculiar. I’ll have to take a look at the logging behavior as it seems from your additional tests that the scanning is being done but the messages just aren’t hitting the console.

The second behavior is I think, expected. If you provide a list of selected directories they are scanned one at a time so you’ll with those arguments only get a message for /.

0reactions

gfscommented, Oct 7, 2022

Awesome. Glad that resolved it.

Top Results From Across the Web

How to force fix file systems during boot - fsck

A mounted volume isn't "clean", this is absolutely normal. Only unmounted volumes (or volumes mounted read-only) are to be expected to be ...

Why are hard links to directories not allowed in UNIX/Linux?

Allowing hard links to directories would break the directed acyclic graph structure of the filesystem, possibly creating directory loops and ...

LinuxFilesystemTreeOverview - Community Help Wiki

FilePermissions are another important part of the files organization system: they are superimposed to the directory structure and assign ...

Viewing and monitoring log files

These logs are invaluable for monitoring and troubleshooting your system. What you'll learn. Viewing logs with a simple GUI tool; Basic command-line commands ......

proc - process information pseudo-filesystem

1 Users may not access files and subdirectories inside any /proc/[pid] directories but their own (the /proc/[pid] directories themselves remain visible).