luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(go): add Phase 1 parity sidecar

Browse source
This commit is contained in:
Luna 2026-07-10 05:02:50 -07:00
parent 65f5be6420
commit f02509aab5
22 changed files with 947 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

28
go-agent/internal/detectors/deleted_exe_test.go Normal file
View file

@ -0,0 +1,28 @@
// SPDX-License-Identifier: GPL-3.0-or-later
package detectors
import (
"testing"
"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/model"
)
func TestDeletedExeMatchesPythonCases(t *testing.T) {
state := model.State{Processes: []model.Process{
{PID: 300, Comm: "tmp", Exe: "/tmp/x (deleted)"},
{PID: 301, Comm: "memfd", Exe: "/memfd:foo (deleted)"},
{PID: 302, Comm: "upgrade", Exe: "/usr/bin/x (deleted)"},
{PID: 303, Comm: "normal", Exe: "/usr/bin/x"},
}}
alerts := DeletedExe(state)
if len(alerts) != 2 {
t.Fatalf("expected two alerts, got %#v", alerts)
}
if alerts[0].SID != 100012 || alerts[0].Signature != "deleted_exe" || alerts[0].PIDs[0] != 300 {
t.Fatalf("unexpected alert: %#v", alerts[0])
}
if alerts[1].Key != "del:301" {
t.Fatalf("unexpected memfd alert: %#v", alerts[1])
}
}