# SPDX-License-Identifier: GPL-3.0-or-later """Detector unit tests using injected fake state — no /proc, no root, no ss.""" import unittest from dataclasses import dataclass, field from enodia_sentinel.alert import Severity from enodia_sentinel.config import Config from enodia_sentinel.detectors import ( credential_access, deleted_exe, egress, input_snooper, ld_preload, new_listener, new_suid, reverse_shell, stealth_network, ) from enodia_sentinel.system import Socket, SystemState @dataclass class FakeProc: """Duck-typed stand-in for system.Process.""" pid: int comm: str = "bash" cmdline: str = "" exe: str = "" environ: dict = field(default_factory=dict) _stdio_inode: int | None = None ppid: int = 1 uid: int = 0 cwd: str = "/" fd_targets: dict = field(default_factory=dict) def stdio_socket_inode(self): return self._stdio_inode def cfg() -> Config: return Config() class TestReverseShell(unittest.TestCase): def test_interpreter_with_network_socket_alerts(self): proc = FakeProc(pid=100, comm="bash", _stdio_inode=999, cmdline="bash -i") sock = Socket("ESTAB", "127.0.0.1:55", "9.9.9.9:443", 999, "bash", 100) state = SystemState(processes=[proc], sockets=[sock]) alerts = list(reverse_shell.detect(state, cfg())) self.assertEqual(len(alerts), 1) self.assertEqual(alerts[0].signature, "reverse_shell") self.assertEqual(alerts[0].severity, Severity.CRITICAL) self.assertEqual(alerts[0].pids, (100,)) def test_non_interpreter_does_not_alert(self): proc = FakeProc(pid=101, comm="nginx", _stdio_inode=999) sock = Socket("ESTAB", "127.0.0.1:55", "9.9.9.9:443", 999, "nginx", 101) state = SystemState(processes=[proc], sockets=[sock]) self.assertEqual(list(reverse_shell.detect(state, cfg())), []) def test_unix_socket_stdio_does_not_alert(self): # stdio socket inode not present in the network socket table => benign proc = FakeProc(pid=102, comm="bash", _stdio_inode=777) state = SystemState(processes=[proc], sockets=[]) self.assertEqual(list(reverse_shell.detect(state, cfg())), []) class TestLdPreload(unittest.TestCase): def test_writable_path_alerts(self): proc = FakeProc(pid=200, comm="sleep", environ={"LD_PRELOAD": "/tmp/evil.so"}) state = SystemState(processes=[proc]) alerts = list(ld_preload.detect(state, cfg())) self.assertEqual(len(alerts), 1) self.assertEqual(alerts[0].severity, Severity.CRITICAL) def test_system_path_does_not_alert(self): proc = FakeProc(pid=201, environ={"LD_PRELOAD": "/usr/lib/libfoo.so"}) state = SystemState(processes=[proc]) self.assertEqual(list(ld_preload.detect(state, cfg())), []) class TestDeletedExe(unittest.TestCase): def test_deleted_in_tmp_alerts(self): proc = FakeProc(pid=300, comm="x", exe="/tmp/x (deleted)") state = SystemState(processes=[proc]) self.assertEqual(len(list(deleted_exe.detect(state, cfg()))), 1) def test_memfd_alerts(self): proc = FakeProc(pid=301, comm="x", exe="/memfd:foo (deleted)") state = SystemState(processes=[proc]) self.assertEqual(len(list(deleted_exe.detect(state, cfg()))), 1) def test_deleted_system_path_ignored(self): # daemon still running after a package upgrade — not fileless malware proc = FakeProc(pid=302, comm="x", exe="/usr/bin/x (deleted)") state = SystemState(processes=[proc]) self.assertEqual(list(deleted_exe.detect(state, cfg())), []) class TestInputSnooper(unittest.TestCase): def test_input_device_alerts(self): proc = FakeProc(pid=320, comm="hoxha", fd_targets={"7": "/dev/input/event3"}) alerts = list(input_snooper.detect(SystemState(processes=[proc]), cfg())) self.assertEqual(len(alerts), 1) self.assertEqual(alerts[0].signature, "input_snooper") self.assertEqual(alerts[0].severity, Severity.HIGH) def test_allowlisted_input_process_ignored(self): proc = FakeProc(pid=321, comm="Xorg", fd_targets={"7": "/dev/input/event3"}) self.assertEqual(list(input_snooper.detect(SystemState(processes=[proc]), cfg())), []) class TestCredentialAccess(unittest.TestCase): def test_shadow_access_alerts(self): proc = FakeProc(pid=330, comm="hoxha", fd_targets={"4": "/etc/shadow"}) alerts = list(credential_access.detect(SystemState(processes=[proc]), cfg())) self.assertEqual(len(alerts), 1) self.assertEqual(alerts[0].signature, "credential_access") self.assertEqual(alerts[0].severity, Severity.CRITICAL) def test_private_key_access_alerts(self): proc = FakeProc(pid=331, comm="collector", fd_targets={"5": "/home/luna/.ssh/id_ed25519"}) alerts = list(credential_access.detect(SystemState(processes=[proc]), cfg())) self.assertEqual(len(alerts), 1) self.assertIn("private SSH key", alerts[0].detail) def test_browser_access_by_browser_ignored(self): proc = FakeProc( pid=332, comm="firefox", fd_targets={"8": "/home/luna/.mozilla/firefox/a/key4.db"}, ) self.assertEqual(list(credential_access.detect(SystemState(processes=[proc]), cfg())), []) class TestStealthNetwork(unittest.TestCase): def test_sctp_public_peer_alerts(self): sock = Socket("ESTAB", "10.0.0.2:5000", "8.8.8.8:4443", 1, "hoxha", 340, "sctp") alerts = list(stealth_network.detect(SystemState(sockets=[sock]), cfg())) self.assertEqual(len(alerts), 1) self.assertEqual(alerts[0].signature, "stealth_network") self.assertEqual(alerts[0].severity, Severity.HIGH) def test_packet_socket_allowlisted_comm_ignored(self): sock = Socket("UNCONN", "*:eth0", "*", 1, "tcpdump", 341, "packet") self.assertEqual(list(stealth_network.detect(SystemState(sockets=[sock]), cfg())), []) def test_allowlisted_kind_ignored(self): c = Config() c.stealth_network_allow_kinds = frozenset({"mptcp"}) sock = Socket("ESTAB", "10.0.0.2:5000", "8.8.8.8:443", 1, "curl", 342, "mptcp") self.assertEqual(list(stealth_network.detect(SystemState(sockets=[sock]), c)), []) def test_tcp_ignored(self): sock = Socket("ESTAB", "10.0.0.2:5000", "8.8.8.8:443", 1, "python3", 343, "tcp") self.assertEqual(list(stealth_network.detect(SystemState(sockets=[sock]), cfg())), []) class TestNewSuid(unittest.TestCase): def test_new_in_writable_is_critical(self): state = SystemState( suid_binaries=["/tmp/evil", "/usr/bin/sudo"], suid_baseline={"/usr/bin/sudo"}, ) alerts = list(new_suid.detect(state, cfg())) self.assertEqual(len(alerts), 1) self.assertEqual(alerts[0].severity, Severity.CRITICAL) self.assertIn("/tmp/evil", alerts[0].detail) def test_new_in_system_path_is_high(self): state = SystemState( suid_binaries=["/usr/local/bin/newtool", "/usr/bin/sudo"], suid_baseline={"/usr/bin/sudo"}, ) alerts = list(new_suid.detect(state, cfg())) self.assertEqual(len(alerts), 1) self.assertEqual(alerts[0].severity, Severity.HIGH) def test_no_scan_no_alert(self): state = SystemState(suid_binaries=None, suid_baseline={"/usr/bin/sudo"}) self.assertEqual(list(new_suid.detect(state, cfg())), []) class TestEgress(unittest.TestCase): def test_interpreter_to_public_alerts(self): sock = Socket("ESTAB", "10.0.0.2:5000", "8.8.8.8:443", 1, "python3", 400) state = SystemState(sockets=[sock]) alerts = list(egress.detect(state, cfg())) self.assertEqual(len(alerts), 1) def test_interpreter_to_private_ignored(self): sock = Socket("ESTAB", "10.0.0.2:5000", "10.0.0.9:443", 1, "python3", 401) state = SystemState(sockets=[sock]) self.assertEqual(list(egress.detect(state, cfg())), []) def test_allowlisted_cidr_ignored(self): c = Config() c.egress_allow_cidrs = ("8.8.8.0/24",) sock = Socket("ESTAB", "10.0.0.2:5000", "8.8.8.8:443", 1, "bash", 402) state = SystemState(sockets=[sock]) self.assertEqual(list(egress.detect(state, c)), []) class TestNewListener(unittest.TestCase): def test_new_port_alerts(self): sock = Socket("LISTEN", "0.0.0.0:31337", "0.0.0.0:*", 1, "nc", 500) state = SystemState(sockets=[sock], listener_baseline=set()) alerts = list(new_listener.detect(state, cfg())) self.assertEqual(len(alerts), 1) self.assertEqual(alerts[0].severity, Severity.HIGH) def test_baseline_port_ignored(self): sock = Socket("LISTEN", "0.0.0.0:22", "0.0.0.0:*", 1, "sshd", 501) state = SystemState(sockets=[sock], listener_baseline={"22/sshd"}) self.assertEqual(list(new_listener.detect(state, cfg())), []) if __name__ == "__main__": unittest.main()