diff --git a/.devcontainer/.devcontainer.json b/.devcontainer/.devcontainer.json new file mode 100644 index 0000000..c426c1d --- /dev/null +++ b/.devcontainer/.devcontainer.json @@ -0,0 +1,30 @@ +// For format details, see https://aka.ms/devcontainer.json. For config options, see the +// taken from: https://github.com/devcontainers/templates/tree/main/src/rust +{ + "name": "Rust", + // Or use a Dockerfile or Docker Compose file. More info: https://containers.dev/guide/dockerfile + "image": "mcr.microsoft.com/devcontainers/rust:1-1-bullseye", + + // Features to add to the dev container. More info: https://containers.dev/features. + // "features": {}, + + // Configure tool-specific properties. + "customizations": { + // Configure properties specific to VS Code. + "vscode": { + "settings": {}, + "extensions": [ + "streetsidesoftware.code-spell-checker" + ] + } + } + + // Use 'forwardPorts' to make a list of ports inside the container available locally. + // "forwardPorts": [], + + // Use 'postCreateCommand' to run commands after the container is created. + // "postCreateCommand": "rustc --version", + + // Uncomment to connect as root instead. More info: https://aka.ms/dev-containers-non-root. + // "remoteUser": "root" +} \ No newline at end of file diff --git a/src/modules/filesystem_scan.rs b/src/modules/filesystem_scan.rs index c3f5252..ff71020 100644 --- a/src/modules/filesystem_scan.rs +++ b/src/modules/filesystem_scan.rs @@ -248,7 +248,7 @@ pub fn scan_path ( // scan a file fn scan_file(rules: &Rules, file_handle: &File, scan_config: &ScanConfig, ext_vars: &ExtVars) -> ArrayVec { // Preparing the external variables - // Preparing the scanner + // Preparing the scanner using yara crate let mut scanner = rules.scanner().unwrap(); scanner.set_timeout(10); scanner.define_variable("filename", ext_vars.filename.as_str()).unwrap(); diff --git a/src/modules/process_check.rs b/src/modules/process_check.rs index 28f1513..55a8f33 100644 --- a/src/modules/process_check.rs +++ b/src/modules/process_check.rs @@ -26,7 +26,7 @@ pub fn scan_processes(compiled_rules: &Rules, scan_config: &ScanConfig) ->() { // Matches (all types) let mut proc_matches = ArrayVec::::new(); // ------------------------------------------------------------ - // YARA scanning + // YARA scanning via crate let yara_matches = compiled_rules.scan_process(pid, 30); log::trace!("YARA Scan result for PID: {} PROC_NAME: {} RESULT: {:?}", pid, proc_name, yara_matches); match &yara_matches {