classifyEvent maps a stored event to a normalized effect. It returns ok=false for events that carry no diff-relevant effect. The security engine decides whether a credential-shaped read is a foreign secret (a real effect) or the agent's own creds (benign), so classification stays consistent with pol
(eng security.Engine, eventType, payload string)
| 63 | // agent's own creds (benign), so classification stays consistent with policy and |
| 64 | // immune to self-credential noise. |
| 65 | func classifyEvent(eng security.Engine, eventType, payload string) (EffectKind, string, bool) { |
| 66 | path, dstIP, command := extractEventFields(payload) |
| 67 | switch eventType { |
| 68 | case "execve": |
| 69 | return EffectProcessExec, command, true |
| 70 | case "metadata_ip": |
| 71 | return EffectMetadataEgress, orDefault(dstIP, "169.254.169.254"), true |
| 72 | case "private_cidr": |
| 73 | return EffectPrivateCIDR, dstIP, true |
| 74 | case "network_connect": |
| 75 | return EffectNetworkConnect, dstIP, true |
| 76 | case "file_write": |
| 77 | return EffectFileWrite, path, true |
| 78 | case "secret_path", "file_open", "openat": |
| 79 | // Foreign secret vs the agent's own creds: ask the policy engine. A |
| 80 | // secret_path_access (kill) verdict => foreign secret; a |
| 81 | // self_credential_access (allow) verdict => benign own-creds read. |
| 82 | d := eng.Evaluate(security.Event{EventType: "file_open", Path: path}) |
| 83 | if isForeignSecret(d) { |
| 84 | return EffectSecretRead, path, true |
| 85 | } |
| 86 | if eventType == "secret_path" { |
| 87 | return EffectFileRead, path, true |
| 88 | } |
| 89 | return EffectFileRead, path, true |
| 90 | } |
| 91 | return "", "", false |
| 92 | } |
| 93 | |
| 94 | // isForeignSecret reports whether the policy verdict marks this read as a real |
| 95 | // foreign-secret access (as opposed to the agent's own credentials, which the |
no test coverage detected