luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(go): port process access detectors

Browse source
This commit is contained in:
Luna 2026-07-10 05:19:56 -07:00
parent f02509aab5
commit fc9b5f0448
22 changed files with 554 additions and 40 deletions
Download patch file Download diff file Expand all files Collapse all files

21
go-agent/internal/detectors/input_snooper_test.go Normal file
View file

@ -0,0 +1,21 @@
// SPDX-License-Identifier: GPL-3.0-or-later
package detectors
import (
"testing"
"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/config"
"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/model"
)
func TestInputSnooperAlertsAndHonorsAllowlist(t *testing.T) {
state := model.State{Processes: []model.Process{
{PID: 320, Comm: "hoxha", FDTargets: map[string]string{"7": "/dev/input/event3"}},
{PID: 321, Comm: "Xorg", FDTargets: map[string]string{"8": "/dev/hidraw0"}},
}}
alerts := InputSnooper(state, config.Default())
if len(alerts) != 1 || alerts[0].SID != 100032 || alerts[0].Key != "input:320:/dev/input/event3" {
t.Fatalf("unexpected alerts: %#v", alerts)
}
}