Startup-SBOM

Startup-SBOM is a universal utility designed to provide an insider view of which packages are executed during the startup of a Linux system or within a Docker container.

By analyzing service files, init scripts, and container entrypoints, the tool maps every booting process to its originating package, providing a clear perspective on actual system execution.

Features

• Universal Init Support: Automatically detects and analyzes Systemd, SysVinit, and OpenRC.
• Docker Support: Analyze running or stopped containers directly using --docker.
• Multi-Package Manager Support: Supports APT (Debian/Ubuntu), RPM (Fedora/CentOS/RHEL), Pacman (Arch), and APK (Alpine).
• CVE Analysis: Integrated vulnerability scanning using NVD data.
• Graphical Output: Generates service dependency flowcharts.
• CycloneDX Export: Generate industry-standard SBOMs.

Installation

The packages needed are mentioned in the requirements.txt file and can be installed using pip:

pip3 install -r requirements.txt

Usage

Usage Examples

1. Analyze a Docker Container

python3 main.py --docker my-container --cve-analysis --save-file sbom.json

2. Analyze a Mounted Volume (Static Service Mode)

python3 main.py --volume-path /mnt/target_root --static-type service --save-file output.json

3. Chroot Analysis with Graphical Output

python3 main.py --analysis-mode chroot --volume-path /mnt/target_root --info-graphic True

Supported Combinations

Inner Workings

For detailed documentation on the methodology and process, please visit the Wiki.

TODO

• Support for RPM
• Support for APT
• Support for Pacman
• Support for APK (Alpine)
• Support for Universal Init (Systemd, SysVinit, OpenRC)
• Support for Docker Container Analysis
• Support for CVE Analysis
• Support for organized graphical output
• Support for CycloneDX Export

Ideas and Discussions

Ideas regarding this topic are welcome in the discussions page.