summaryrefslogtreecommitdiff
path: root/internal/eventloop_security_test.go
diff options
context:
space:
mode:
authorPaul Buetow <paul@buetow.org>2026-05-30 10:35:59 +0300
committerPaul Buetow <paul@buetow.org>2026-05-30 10:35:59 +0300
commitedf4f5d586a65ce6258503e453c98b07429d82d1 (patch)
tree9ac7f49136fa20cd172c16f95f7cbff91202099f /internal/eventloop_security_test.go
parent7595c52029ddd83bdcc48481528f2af7c4ccb1a0 (diff)
test(generate): lock in tkill classification (Signals/null/UNCLASSIFIED)
Audit of tkill(2) (task 310) confirmed correct tracing: tkill(tid, sig) is FamilySignals, kind=null, ret UNCLASSIFIED, matching its siblings kill/tgkill/rt_sig*. tkill/tgkill are intentionally absent from the name-only kind table; ClassifyFormat returns KindNone for them (the pid_t tid is not matched by the fd rule, so the thread id is never misread as a file descriptor) and classifyEnterForGeneration promotes that to KindNull at generation time. This was untested, so add lock-in coverage closing the gap: - TestGenerateTkillHandler: enter emits null_event, captures no arg (tid is not an fd), exit reports raw status as UNCLASSIFIED. - TestClassifyTkillFallsThroughToNull: pins ClassifyFormat=KindNone and the KindNull generation fallback, so a future fd-rule regression fails. - TestClassifyRetTkillUnclassified: 0/-1 status is not a byte count. - Extend TestClassifySyscallFamily with kill/tkill/tgkill (enter+exit) so a stray reclassification out of FamilySignals trips the test. No generated output or runtime behavior changed (mage generate clean). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Diffstat (limited to 'internal/eventloop_security_test.go')
0 files changed, 0 insertions, 0 deletions