diff options
| author | Paul Buetow <paul@buetow.org> | 2026-05-30 10:08:52 +0300 |
|---|---|---|
| committer | Paul Buetow <paul@buetow.org> | 2026-05-30 10:08:52 +0300 |
| commit | 23579dbdac320884bcdd670e46744b5f4ab45d5d (patch) | |
| tree | 47c228cd136850cd08e3888e0ff94252d8a4649e /internal/generate/classify_test.go | |
| parent | 66fdd29a27af496091bbfff827d5e16d8f168798 (diff) | |
fix(family): classify seteuid/setegid as Process for consistency
classify.go has KindNull entries for sys_enter_seteuid/sys_enter_setegid,
but family.go's FamilyProcess credential cluster omitted them, so
ClassifySyscallFamily returned Misc — inconsistent with their siblings
setuid/setgid/setresuid/setreuid/setfsuid. Add seteuid/setegid to the
FamilyProcess group with a comment noting they are latent: current kernels
expose no dedicated seteuid/setegid tracepoints (glibc wraps them over
setreuid/setresuid), so they never reach the generated tracepoint map or
docs/syscall-tracing-plan.md. mage generate confirmed idempotent with no
diff, so docs/drift test are untouched. Lock-in unit tests assert Process
for seteuid/setegid (enter+exit) by name directly, since no tracepoint exists.
Refs task 620.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Diffstat (limited to 'internal/generate/classify_test.go')
0 files changed, 0 insertions, 0 deletions