feat(go): port process access detectors

go-agent/internal/detectors/input_snooper.go

@@ -0,0 +1,47 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package detectors
+
+import (
+	"fmt"
+
+	"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/config"
+	"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/model"
+)
+
+var inputDevicePrefixes = []string{
+	"/dev/input/event", "/dev/uinput", "/dev/hidraw",
+}
+
+// InputSnooper ports the Python input_snooper detector (SID 100032).
+func InputSnooper(state model.State, cfg config.Config) []model.Alert {
+	alerts := make([]model.Alert, 0)
+	for _, process := range state.Processes {
+		comm := process.Comm
+		if comm == "" {
+			comm = "?"
+		}
+		if cfg.InputSnooperAllowComms[comm] {
+			continue
+		}
+		for _, fd := range sortedFDs(process.FDTargets) {
+			target := process.FDTargets[fd]
+			if !hasAnyPrefix(target, inputDevicePrefixes) {
+				continue
+			}
+			alerts = append(alerts, model.Alert{
+				SID:       100032,
+				Severity:  "HIGH",
+				Signature: "input_snooper",
+				Classtype: "credential-keylogging",
+				Key:       fmt.Sprintf("input:%d:%s", process.PID, target),
+				Detail: fmt.Sprintf(
+					"pid=%d comm=%s fd=%s has input device open: %s",
+					process.PID, comm, fd, target),
+				PIDs: []int{process.PID},
+			})
+			break
+		}
+	}
+	return alerts
+}