Source code for plaso.parsers.plist_plugins.macos_startup_item

# -*- coding: utf-8 -*-
"""Plist parser plugin for Mac OS startup item plist files."""

from plaso.containers import events
from plaso.parsers import plist
from plaso.parsers.plist_plugins import interface

[docs] class MacOSStartupItemEventData(events.EventData): """Mac OS startup item event data. Attributes: description (str): description of the startup item. order_preference (str): startup order preference. provides (list[str]): names of services provided by the startup item. requires (list[str]): services required prior to this startup item. uses (list[str]): services that should be started before this startup item. """ DATA_TYPE = 'macos:startup_item:entry'
[docs] def __init__(self): """Initializes event data.""" super(MacOSStartupItemEventData, self).__init__(data_type=self.DATA_TYPE) self.description = None self.order_preference = None self.provides = None self.requires = None self.uses = None
[docs] class MacOSStartupItemPlugin(interface.PlistPlugin): """Plist parser plugin for Mac OS startup item plist files.""" NAME = 'macos_startup_item_plist' DATA_FORMAT = 'Mac OS startup item plist file' PLIST_PATH_FILTERS = frozenset([ interface.PlistPathFilter('StartupParameters.plist')]) PLIST_KEYS = frozenset([]) # pylint: disable=arguments-differ def _ParsePlist(self, parser_mediator, top_level=None, **unused_kwargs): """Extracts startup item information from the plist. Args: parser_mediator (ParserMediator): mediates interactions between parsers and other components, such as storage and dfVFS. top_level (Optional[dict[str, object]]): plist top-level item. """ event_data = MacOSStartupItemEventData() event_data.description = top_level.get('Description') event_data.order_preference = top_level.get('OrderPreference') event_data.provides = top_level.get('Provides') event_data.requires = top_level.get('Requires') event_data.uses = top_level.get('Uses') parser_mediator.ProduceEventData(event_data)