add file info tests

elastic · Oct 24, 2023 · f52c03c · f52c03c
1 parent 13ee1b1
commit f52c03c
Show file tree

Hide file tree

Showing 2 changed files with 54 additions and 7 deletions.
diff --git a/testing/testrunner/tests.go b/testing/testrunner/tests.go
@@ -177,6 +177,15 @@ func TestFileCreate(et *EventsTraceInstance) {
 
 	AssertPidInfoEqual(binOutput.PidInfo, fileCreateEvent.Pids)
 	AssertStringsEqual(fileCreateEvent.Path, binOutput.FileNameOrig)
+	// File Info
+	AssertStringsEqual(fileCreateEvent.Finfo.Type, "FILE")
+	AssertUint64NotEqual(fileCreateEvent.Finfo.Inode, 0)
+	AssertUint64Equal(fileCreateEvent.Finfo.Mode, 100644)
+	AssertUint64Equal(fileCreateEvent.Finfo.Size, 100)
+	AssertUint64NotEqual(fileCreateEvent.Finfo.Uid, 0)
+	AssertUint64NotEqual(fileCreateEvent.Finfo.Gid, 0)
+	AssertUint64NotEqual(fileCreateEvent.Finfo.Mtime, 0)
+	AssertUint64NotEqual(fileCreateEvent.Finfo.Ctime, 0)
 }
 
 func TestFileDelete(et *EventsTraceInstance) {
@@ -204,6 +213,15 @@ func TestFileDelete(et *EventsTraceInstance) {
 
 	AssertPidInfoEqual(binOutput.PidInfo, fileDeleteEvent.Pids)
 	AssertStringsEqual(fileDeleteEvent.Path, binOutput.FileNameNew)
+	// File Info
+	AssertStringsEqual(fileDeleteEvent.Finfo.Type, "FILE")
+	AssertUint64NotEqual(fileDeleteEvent.Finfo.Inode, 0)
+	AssertUint64Equal(fileDeleteEvent.Finfo.Mode, 100644)
+	AssertUint64Equal(fileDeleteEvent.Finfo.Size, 100)
+	AssertUint64NotEqual(fileDeleteEvent.Finfo.Uid, 0)
+	AssertUint64NotEqual(fileDeleteEvent.Finfo.Gid, 0)
+	AssertUint64NotEqual(fileDeleteEvent.Finfo.Mtime, 0)
+	AssertUint64NotEqual(fileDeleteEvent.Finfo.Ctime, 0)
 }
 
 func TestFileRename(et *EventsTraceInstance) {
@@ -232,6 +250,15 @@ func TestFileRename(et *EventsTraceInstance) {
 	AssertPidInfoEqual(binOutput.PidInfo, fileRenameEvent.Pids)
 	AssertStringsEqual(fileRenameEvent.OldPath, binOutput.FileNameOrig)
 	AssertStringsEqual(fileRenameEvent.NewPath, binOutput.FileNameNew)
+	// File Info
+	AssertStringsEqual(fileRenameEvent.Finfo.Type, "FILE")
+	AssertUint64NotEqual(fileRenameEvent.Finfo.Inode, 0)
+	AssertUint64Equal(fileRenameEvent.Finfo.Mode, 100644)
+	AssertUint64Equal(fileRenameEvent.Finfo.Size, 100)
+	AssertUint64NotEqual(fileRenameEvent.Finfo.Uid, 0)
+	AssertUint64NotEqual(fileRenameEvent.Finfo.Gid, 0)
+	AssertUint64NotEqual(fileRenameEvent.Finfo.Mtime, 0)
+	AssertUint64NotEqual(fileRenameEvent.Finfo.Ctime, 0)
 }
 
 func TestSetuid(et *EventsTraceInstance) {

diff --git a/testing/testrunner/utils.go b/testing/testrunner/utils.go
@@ -78,6 +78,17 @@ type NetInfo struct {
 	NetNs      int64  `json:"network_namespace"`
 }
 
+type FileInfo struct {
+	Type  string `json:"type"`
+	Inode uint64 `json:"inode"`
+	Mode  uint64 `json:"mode"`
+	Size  uint64 `json:"size"`
+	Uid   uint64 `json:"uid"`
+	Gid   uint64 `json:"gid"`
+	Mtime uint64 `json:"mtime"`
+	Ctime uint64 `json:"ctime"`
+}
+
 type ProcessForkEvent struct {
 	ParentPids PidInfo  `json:"parent_pids"`
 	ChildPids  PidInfo  `json:"child_pids"`
@@ -95,19 +106,22 @@ type ProcessExecEvent struct {
 }
 
 type FileCreateEvent struct {
-	Pids PidInfo `json:"pids"`
-	Path string  `json:"path"`
+	Pids  PidInfo  `json:"pids"`
+	Path  string   `json:"path"`
+	Finfo FileInfo `json:"file_info"`
 }
 
 type FileDeleteEvent struct {
-	Pids PidInfo `json:"pids"`
-	Path string  `json:"path"`
+	Pids  PidInfo  `json:"pids"`
+	Path  string   `json:"path"`
+	Finfo FileInfo `json:"file_info"`
 }
 
 type FileRenameEvent struct {
-	Pids    PidInfo `json:"pids"`
-	OldPath string  `json:"old_path"`
-	NewPath string  `json:"new_path"`
+	Pids    PidInfo  `json:"pids"`
+	OldPath string   `json:"old_path"`
+	NewPath string   `json:"new_path"`
+	Finfo   FileInfo `json:"file_info"`
 }
 
 type SetUidEvent struct {
@@ -234,6 +248,12 @@ func AssertUint64Equal(a, b uint64) {
 	}
 }
 
+func AssertUint64NotEqual(a, b uint64) {
+	if a == b {
+		TestFail(fmt.Sprintf("Test assertion failed 0x%016x == 0x%016x", a, b))
+	}
+}
+
 func PrintBPFDebugOutput() {
 	file, err := os.Open("/sys/kernel/debug/tracing/trace")
 	if err != nil {