diff options
| author | Paul Buetow <paul@buetow.org> | 2026-05-30 10:35:59 +0300 |
|---|---|---|
| committer | Paul Buetow <paul@buetow.org> | 2026-05-30 10:35:59 +0300 |
| commit | edf4f5d586a65ce6258503e453c98b07429d82d1 (patch) | |
| tree | 9ac7f49136fa20cd172c16f95f7cbff91202099f /internal/eventloop_security_test.go | |
| parent | 7595c52029ddd83bdcc48481528f2af7c4ccb1a0 (diff) | |
test(generate): lock in tkill classification (Signals/null/UNCLASSIFIED)
Audit of tkill(2) (task 310) confirmed correct tracing: tkill(tid, sig)
is FamilySignals, kind=null, ret UNCLASSIFIED, matching its siblings
kill/tgkill/rt_sig*. tkill/tgkill are intentionally absent from the
name-only kind table; ClassifyFormat returns KindNone for them (the
pid_t tid is not matched by the fd rule, so the thread id is never
misread as a file descriptor) and classifyEnterForGeneration promotes
that to KindNull at generation time.
This was untested, so add lock-in coverage closing the gap:
- TestGenerateTkillHandler: enter emits null_event, captures no arg
(tid is not an fd), exit reports raw status as UNCLASSIFIED.
- TestClassifyTkillFallsThroughToNull: pins ClassifyFormat=KindNone and
the KindNull generation fallback, so a future fd-rule regression fails.
- TestClassifyRetTkillUnclassified: 0/-1 status is not a byte count.
- Extend TestClassifySyscallFamily with kill/tkill/tgkill (enter+exit)
so a stray reclassification out of FamilySignals trips the test.
No generated output or runtime behavior changed (mage generate clean).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Diffstat (limited to 'internal/eventloop_security_test.go')
0 files changed, 0 insertions, 0 deletions
