feat(go): advance validation sidecar toward production

go-agent/internal/system/suid_test.go

@@ -0,0 +1,47 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package system
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestScanSUIDBinariesFindsPrivilegedRegularFiles(t *testing.T) {
+	root := t.TempDir()
+	ordinary := filepath.Join(root, "ordinary")
+	privileged := filepath.Join(root, "nested", "privileged")
+	if err := os.MkdirAll(filepath.Dir(privileged), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(ordinary, []byte("x"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(privileged, []byte("x"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Chmod(privileged, 0o755|os.ModeSetuid); err != nil {
+		t.Fatal(err)
+	}
+	got := ScanSUIDBinaries(root, nil)
+	if len(got) != 1 || got[0] != privileged {
+		t.Fatalf("unexpected scan: %#v", got)
+	}
+}
+
+func TestScanSUIDBinariesIncludesExtraDirectories(t *testing.T) {
+	root := t.TempDir()
+	extra := t.TempDir()
+	privileged := filepath.Join(extra, "sgid-tool")
+	if err := os.WriteFile(privileged, []byte("x"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Chmod(privileged, 0o755|os.ModeSetgid); err != nil {
+		t.Fatal(err)
+	}
+	got := ScanSUIDBinaries(root, []string{extra})
+	if len(got) != 1 || got[0] != privileged {
+		t.Fatalf("unexpected extra-dir scan: %#v", got)
+	}
+}