Repository navigation
test(lsmguard): pull the Load, Sync and Run decisions into pure helpers and test them - #335
Conversation
Vulnetix config planManager
0 to create, 1 to update, 0 to delete, 0 unchanged |
0x73746F66
left a comment
0x73746F66
left a comment
There was a problem hiding this comment.
Reuse review: the Load/Sync/Run decisions are extracted from guard_linux.go into pure functions (checkBPFLSM, resolveEntries, refusalFor) that the methods now call, so there is still one implementation; the tests use the existing statKey/Entry types. No changes needed.
0x73746F66
left a comment
0x73746F66
left a comment
There was a problem hiding this comment.
Reuse review: no reinvented Vulnetix patterns found. The change stays inside the package it covers, uses stdlib/testify helpers already used by the repo's tests, and adds no new client, auth, config-schema or shared-package duplicate (checked internal/testutils and sibling repos). Rebased onto current main locally: go vet and go test pass for every touched package. The earlier red checks (CodeQL Analyze, Install a release with verified provenance, Lockfile) were GitHub API rate-limit failures, not code failures; this will be re-run on a rebased head before merge.
…rs and test them Load's bpf LSM check (checkBPFLSM), Sync's resolution of entries to file identities (resolveEntries) and Run's naming of a refusal (refusalFor) needed a loaded collection or a live ring buffer to reach, so they had no tests. They are now plain functions the methods call, unchanged in behaviour, and tested without privileges: a list with and without bpf and an unreadable one; missing paths, a directory, a hard link to an earlier entry (first wins) and entry indexes; a known key, an unknown key falling back to the rule's path, and a rule index outside the entries. The lsmEntries wiring (item 4) is already covered by agent/lsm_test.go. Closes #291
c3ebfb7 to
7498722
Compare
Closes #291
What
internal/sensor/lsmguard/guard_linux.gohad three decisions that could only be reached with a loaded BPF collection or a live ring buffer, so nothing tested them. Each is now a plain function the method calls, with the same behaviour:checkBPFLSM(path): Load's early refusal when/sys/kernel/security/lsmdoes not list bpf (an unreadable list still leaves the decision to the attach).resolveEntries(entries, root): Sync's map of file identity -> entry index and path, and the missing list (unresolvable or non-regular paths); two entries naming one file keep the first.refusalFor(raw, entries, paths): Run's naming of a record: the synced path for its key, else the rule's own path, and the rule only when its index is one of the current entries.New
guard_helpers_linux_test.go(stdlib, no privileges): bpf present/absent/unreadable; missing file, a directory, a hard link to an earlier entry, entry indexes; known key, unknown key fallback, out-of-range rule index with and without a known key.Item 4 (
lsmEntriesemitting an entry per block-mode rule) is already covered byinternal/sensor/agent/lsm_test.go. Items 1/5 for the non-Linux stub are not added: CI runs on Linux, so a!linuxtest file would never run there; the stub is still compiled (checked withGOOS=darwin go build).Verified
go test -cover ./internal/sensor/lsmguard/ ./internal/sensor/agent/: pass (lsmguard 13.2% -> 34.3%).go veton both packages;GOOS=darwin go build ./internal/sensor/lsmguard/;gofmtclean.