29 lines
922 B
Go
29 lines
922 B
Go
// SPDX-License-Identifier: GPL-3.0-or-later
|
|
|
|
package detectors
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/model"
|
|
)
|
|
|
|
func TestLDPreloadMatchesGlobalAndWritableProcess(t *testing.T) {
|
|
state := model.State{
|
|
LDPreload: "/tmp/global.so\n/opt/second.so",
|
|
Processes: []model.Process{
|
|
{PID: 200, Comm: "sleep", Environ: map[string]string{"LD_PRELOAD": "/tmp/evil.so"}},
|
|
{PID: 201, Comm: "safe", Environ: map[string]string{"LD_PRELOAD": "/usr/lib/libfoo.so"}},
|
|
},
|
|
}
|
|
alerts := LDPreload(state)
|
|
if len(alerts) != 2 {
|
|
t.Fatalf("expected two alerts, got %#v", alerts)
|
|
}
|
|
if alerts[0].Key != "ldp:global" || alerts[0].Detail != "/etc/ld.so.preload is non-empty: [/tmp/global.so /opt/second.so]" {
|
|
t.Fatalf("unexpected global alert: %#v", alerts[0])
|
|
}
|
|
if alerts[1].Key != "ldp:200" || alerts[1].PIDs[0] != 200 {
|
|
t.Fatalf("unexpected process alert: %#v", alerts[1])
|
|
}
|
|
}
|