fix: linux 6.19 taint_flag.module removal

[the-rectifier]

Linux 6.19 removed the taint_flag.module attribute: https://lore.kernel.org/all/20251022082938.26670-1-petr.pavlu@suse.com/T/#u

As such, when running linux.lsmod for a snapshot of linux 6.19+ the whole framework backtraces:

  File "/usr/lib/python3.14/site-packages/volatility3/framework/symbols/linux/utilities/tainting.py", line 94, in _module_flags_taint_post_4_10_rc1
    if is_module and not taint_flag.module:
                         ^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.14/site-packages/volatility3/framework/objects/__init__.py", line 993, in __getattr__
    raise AttributeError(
        f"{agg_name} has no attribute: {self.vol.type_name}.{attr}"
    )
AttributeError: StructType has no attribute: symbol_table_name1!taint_flag.module

Also, update the taint table, and introduce a new taint flag J:
https://docs.kernel.org/admin-guide/tainted-kernels.html#table-for-decoding-tainted-state

Taints continue to appear when running linux.lsmod on a random snapshot:

Volatility 3 Framework 2.28.2
Progress:  100.00               Stacking attempts finished
Offset  Module Name     Code Size       Taints  Load Arguments  File Output
[...]
0xffffc06e6bc0  vboxsf  0x17000 OOT_MODULE,UNSIGNED_MODULE      follow_symlinks=None, disabled=None     N/A
[...]
0xffffc031b040  vboxguest       0x81000 OOT_MODULE,UNSIGNED_MODULE      r3_log_to_host=None, log_dest=None, log_flags=None, log=None, disabled=None     N/A

[ikelos]

Will this flag lots of false positives now, or was the taint_flag.module just a belt and braces check to reduce a few rare false positives?

[the-rectifier]

In my limited understanding, and based on the lore message, no, it shouldn't produce false positives.

The commit message claims that the per-module flags are always those added to module.taints by calls to add_taint_module().

Cross-checking those calls, they (8) exist inside the following:

• module_augment_kernel_taints()
• module_license_taint_check()
• try_to_force_load()

Along with a single direct set_bit() in inherit_taint()

The only flags that can reach mod->taints are P F O C E K N all of them already had the .module = true;

Actually, the error ran the other way around; the flags T and J were marked as per-module by mistake, which prompted the removal

[the-rectifier]

While we're at it, fix RANDSTRUCT as well

Silly me, marked FWCTL as a per-module... 🤡