From 18e1127db964377ec034da88db2f3d5ebc10fd91 Mon Sep 17 00:00:00 2001
From: atcuno <andrew@memoryanalysis.net>
Date: Mon, 21 Jan 2013 17:46:04 +0000
Subject: [PATCH] Mac - add docs to plugins missing descriptions

---
 volatility/plugins/mac/ip_filters.py | 2 ++
 volatility/plugins/mac/lsmod.py      | 2 ++
 volatility/plugins/mac/pslist.py     | 2 ++
 volatility/plugins/mac/trustedbsd.py | 2 ++
 volatility/plugins/mac/vfs_events.py | 2 ++
 5 files changed, 10 insertions(+)

diff --git a/volatility/plugins/mac/ip_filters.py b/volatility/plugins/mac/ip_filters.py
index b51bef47..4a2c0f15 100644
--- a/volatility/plugins/mac/ip_filters.py
+++ b/volatility/plugins/mac/ip_filters.py
@@ -28,6 +28,8 @@ import common
 from lsmod import mac_lsmod as mac_lsmod
 
 class mac_ip_filters(mac_lsmod):
+    """ Reports any hooked IP filters """
+
     def check_filter(self, context, fname, ptr, kernel_symbol_addresses, kmods):
         if ptr == None:
             return
diff --git a/volatility/plugins/mac/lsmod.py b/volatility/plugins/mac/lsmod.py
index 8409c394..268b69a0 100644
--- a/volatility/plugins/mac/lsmod.py
+++ b/volatility/plugins/mac/lsmod.py
@@ -25,6 +25,8 @@ import volatility.obj as obj
 import common
 
 class mac_lsmod(common.AbstractMacCommand):
+    """ Lists loaded kernel modules """
+
     def calculate(self):
         common.set_plugin_members(self)
 
diff --git a/volatility/plugins/mac/pslist.py b/volatility/plugins/mac/pslist.py
index bf76478e..61b2c257 100644
--- a/volatility/plugins/mac/pslist.py
+++ b/volatility/plugins/mac/pslist.py
@@ -25,6 +25,8 @@ import volatility.obj as obj
 import common
 
 class mac_pslist(common.AbstractMacCommand):
+    """ List Running Processes """
+
     def __init__(self, config, *args):
         common.AbstractMacCommand.__init__(self, config, *args)
         self._config.add_option('PID', short_option = 'p', default = None, help = 'Operate on these Process IDs (comma-separated)', action = 'store', type = 'str')
diff --git a/volatility/plugins/mac/trustedbsd.py b/volatility/plugins/mac/trustedbsd.py
index 67f4fa82..356d23b0 100644
--- a/volatility/plugins/mac/trustedbsd.py
+++ b/volatility/plugins/mac/trustedbsd.py
@@ -29,6 +29,8 @@ import common
 from lsmod import mac_lsmod as mac_lsmod
 
 class mac_trustedbsd(mac_lsmod):
+    """ Lists malicious trustedbsd policies """
+
     def get_members(self):
         h = self.profile.types['mac_policy_ops']
         h = h.keywords["members"]
diff --git a/volatility/plugins/mac/vfs_events.py b/volatility/plugins/mac/vfs_events.py
index a4fcbcbd..0f4714cd 100644
--- a/volatility/plugins/mac/vfs_events.py
+++ b/volatility/plugins/mac/vfs_events.py
@@ -25,6 +25,8 @@ import volatility.obj as obj
 import common
 
 class mac_vfs_events(common.AbstractMacCommand):
+    """ Lists Mac VFS Events """
+
     def calculate(self):
         common.set_plugin_members(self)