32 lines
1.3 KiB
Go
32 lines
1.3 KiB
Go
// SPDX-License-Identifier: GPL-3.0-or-later
|
|
|
|
package detectors
|
|
|
|
import (
|
|
"strings"
|
|
"testing"
|
|
|
|
"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/config"
|
|
"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/model"
|
|
)
|
|
|
|
func TestCredentialAccessMatchesKindsAndAllowlist(t *testing.T) {
|
|
cfg := config.Default()
|
|
cfg.CredentialAccessExtraPaths = []string{"/srv/secrets/"}
|
|
state := model.State{Processes: []model.Process{
|
|
{PID: 330, Comm: "hoxha", FDTargets: map[string]string{"4": "/etc/shadow"}},
|
|
{PID: 331, Comm: "collector", FDTargets: map[string]string{"5": "/home/luna/.ssh/id_ed25519"}},
|
|
{PID: 332, Comm: "firefox", FDTargets: map[string]string{"8": "/home/luna/.mozilla/firefox/a/key4.db"}},
|
|
{PID: 333, Comm: "backup", FDTargets: map[string]string{"9": "/srv/secrets/token (deleted)"}},
|
|
}}
|
|
alerts := CredentialAccess(state, cfg)
|
|
if len(alerts) != 3 {
|
|
t.Fatalf("expected three alerts, got %#v", alerts)
|
|
}
|
|
if alerts[0].Key != "cred:330:/etc/shadow" || !strings.Contains(alerts[1].Detail, "private SSH key") {
|
|
t.Fatalf("unexpected alerts: %#v", alerts)
|
|
}
|
|
if !strings.Contains(alerts[2].Detail, "configured credential path") || strings.Contains(alerts[2].Key, "(deleted)") {
|
|
t.Fatalf("deleted suffix or extra path mismatch: %#v", alerts[2])
|
|
}
|
|
}
|