feat(go): port process access detectors

go-agent/internal/detectors/ld_preload_test.go

@@ -0,0 +1,29 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package detectors
+
+import (
+	"testing"
+
+	"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/model"
+)
+
+func TestLDPreloadMatchesGlobalAndWritableProcess(t *testing.T) {
+	state := model.State{
+		LDPreload: "/tmp/global.so\n/opt/second.so",
+		Processes: []model.Process{
+			{PID: 200, Comm: "sleep", Environ: map[string]string{"LD_PRELOAD": "/tmp/evil.so"}},
+			{PID: 201, Comm: "safe", Environ: map[string]string{"LD_PRELOAD": "/usr/lib/libfoo.so"}},
+		},
+	}
+	alerts := LDPreload(state)
+	if len(alerts) != 2 {
+		t.Fatalf("expected two alerts, got %#v", alerts)
+	}
+	if alerts[0].Key != "ldp:global" || alerts[0].Detail != "/etc/ld.so.preload is non-empty: [/tmp/global.so /opt/second.so]" {
+		t.Fatalf("unexpected global alert: %#v", alerts[0])
+	}
+	if alerts[1].Key != "ldp:200" || alerts[1].PIDs[0] != 200 {
+		t.Fatalf("unexpected process alert: %#v", alerts[1])
+	}
+}