addon fix for the old issue to /proc full paths not being recorded

[entlein]

We re seeing again :

• "/17/setgroups" → "/proc/17/setgroups"
• "/1/gid_map" → "/proc/1/gid_map", "/1/uid_map" → "/proc/1/uid_map"

This is a band-aid type patch for the resurface of #721

In my tests on dragonfly and argocd, it worked, but that list is not exhaustive, so will look if we have a real regression as soon as I have some time

Summary by CodeRabbit

• Bug Fixes
  • Improved handling of additional process metadata and mapping paths under /proc, including namespace, user/group mapping, status, and cgroup paths.
  • Preserved correct behavior for non-process paths that contain numeric path segments.

[coderabbitai]

📝 Walkthrough

Walkthrough

The headless proc path allowlist now covers additional process metadata and container setup paths. Regression tests verify these paths and confirm that numeric-looking segments in non-proc paths remain unchanged.

Changes

Headless proc path normalization

Layer / File(s)	Summary
Allowlist expansion and regression coverage pkg/utils/path.go, pkg/utils/normalize_path_test.go	headlessProcRegex recognizes additional /proc/<pid> entries. Table-driven tests cover the new paths and preserve non-proc /data/... paths.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• kubescape/node-agent#774: Introduced the NormalizePath allowlist and related tests that this change extends.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the fix for incomplete /proc paths, which is the main change in the pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

pkg/utils/normalize_path_test.go (1)

53-76: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Expand regression coverage for the full allowlist.

pkg/utils/path.go adds status, stat, cgroup, mountinfo, maps, environ, comm, cmdline, and ns, but this table tests only three of the new entries. Add one positive case for each remaining entry.

Use a numeric leading segment in the negative case. The current /data/appendonlydir/x input bypasses the matcher and does not test the allowlist boundary.

Suggested negative case

-			input:    "/data/appendonlydir/x",
-			expected: "/data/appendonlydir/x",
+			input:    "/123/data/appendonlydir/x",
+			expected: "/123/data/appendonlydir/x",

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/utils/normalize_path_test.go` around lines 53 - 76, Expand the table in
normalize_path_test.go with positive cases covering each missing allowlist entry
from path.go: status, stat, cgroup, mountinfo, maps, environ, comm, cmdline, and
ns, using numeric leading segments and expected /proc-prefixed paths. Replace
the current non-proc negative case with a numeric-leading path whose trailing
segment resembles a proc entry but is not allowlisted, verifying it remains
unchanged.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@pkg/utils/normalize_path_test.go`:
- Around line 53-76: Expand the table in normalize_path_test.go with positive
cases covering each missing allowlist entry from path.go: status, stat, cgroup,
mountinfo, maps, environ, comm, cmdline, and ns, using numeric leading segments
and expected /proc-prefixed paths. Replace the current non-proc negative case
with a numeric-leading path whose trailing segment resembles a proc entry but is
not allowlisted, verifying it remains unchanged.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: f59ae2fb-a7b1-4e45-8ff0-82f8aed1ccfa

📥 Commits

Reviewing files that changed from the base of the PR and between ce05eec and d48b8f4.

📒 Files selected for processing (2)

• pkg/utils/normalize_path_test.go
• pkg/utils/path.go