artif: collect /boot

[halpomeranz]

/boot can contain attacker persistence mechanisms (see https://www.elastic.co/security-labs/the-grand-finale-on-linux-persistence). Also, stripped kernels can now be used to generate Volatility 3 profiles with btf2json (https://www.iblue.team/memory-forensics-1/volatility-plugins/generate-custom-profile-using-btf2json), making /boot/vmlinu* very useful when memory is also being collected.

[tclahr]

What about collect /boot/vmlinu* via avml.yaml instead? So we would update avml.yaml to run avml and also collect /boot/vmlinu*
Then boot.yaml could looks like this:

version: 1.0
artifacts:
  -
    description: Collect /boot to help build Volatility profiles
    supported_os: [linux]
    collector: file
    path: /boot
    exclude_name_pattern: ["vmlinu*"]

[tclahr]

I pushed some small changes to the artifacts. Please let me know what do you think. Thanks!

[halpomeranz]

Your changes look good to me.

I noticed while I was looking that you chose 64G as the default for avml_max_memory. Personally, I would set this higher-- maybe 256G.

[halpomeranz]

Oh shoot. We also need the System.map* files in addition to vmlinu*. We need to tweak the artifact to get System.map* too.