Detailed Description
During triage (i.e. ir_triage) process uac calls the lshw tool if it exists. As I figured out it hangs indefinitely when VMWare Workstation is installed and vmware-networks.service is started, thus preventing the triage process from completion indefinitely.
Expected Behavior
Launching uac with ir_triage profile leads to successful collection of artifacts as the triage process finishes.
Current Behavior
uac hangs indefinitely on live_response/hardware/lshw.yaml step.
Possible Solution
Ideally this should be reported upstream to lshw but as a workaround I'm proposing PR #379 (the timeout values were selected just as some sane values). I've tested it and it works as intended: with vmware-networks.service stopped it produces the proper lshw output and with the service started it produces an empty output after the specified timeout.
Steps to Reproduce
- Install VMWare Workstation;
- Enable its virtual networks feature (VM network access) with
systemctl start vmware-networks.service;
- Launch
uac -p ir_triage /tmp;
- Watch it hang on
live_response/hardware/lshw.yaml step. Definitely worth noting that launching lshw independently (not during an uac invocation) produces the same results, and lshw hangs with "Network interfaces" status prompt.
Context (Environment)
I've reproduced this on 2 my PCs with VMWare Workstation 17.6.1 + lshw B.02.20 combo and 17.6.3+B.02.20 (respectively). Both are running Arch Linux as OS.
Possible Implementation
That can be investigated deeper (i.e. strace, gdb on lshw) and reported upstream to lshw.
Detailed Description
During triage (i.e.
ir_triage) process uac calls the lshw tool if it exists. As I figured out it hangs indefinitely when VMWare Workstation is installed andvmware-networks.serviceis started, thus preventing the triage process from completion indefinitely.Expected Behavior
Launching uac with
ir_triageprofile leads to successful collection of artifacts as the triage process finishes.Current Behavior
uac hangs indefinitely on
live_response/hardware/lshw.yamlstep.Possible Solution
Ideally this should be reported upstream to lshw but as a workaround I'm proposing PR #379 (the timeout values were selected just as some sane values). I've tested it and it works as intended: with
vmware-networks.servicestopped it produces the proper lshw output and with the service started it produces an empty output after the specified timeout.Steps to Reproduce
systemctl start vmware-networks.service;uac -p ir_triage /tmp;live_response/hardware/lshw.yamlstep. Definitely worth noting that launching lshw independently (not during an uac invocation) produces the same results, and lshw hangs with "Network interfaces" status prompt.Context (Environment)
I've reproduced this on 2 my PCs with VMWare Workstation 17.6.1 + lshw B.02.20 combo and 17.6.3+B.02.20 (respectively). Both are running Arch Linux as OS.
Possible Implementation
That can be investigated deeper (i.e. strace, gdb on lshw) and reported upstream to lshw.