security: implement real privilege dropping in daemoneye-agent (drop_privileges is a stub)

[unclesp1d3r]

Summary

BrokerManager::drop_privileges() (daemoneye-agent/src/broker_manager/state_machine.rs) is a stub — it logs "stub - not yet implemented" and returns Ok(()) without dropping any privileges. No UID/GID/capability boundary is enforced, and main.rs explicitly continues with elevated privileges on failure, so privilege separation is effectively disabled for daemoneye-agent.

A test (test_drop_privileges_stub) currently pins the stub behavior.

Why this is a dedicated issue (not fixed inline)

Surfaced by CodeRabbit on #191 (a pure mechanical refactor — the stub is pre-existing, moved verbatim). Implementing it correctly is a security feature, not a quick fix:

• Platform-specific privilege dropping: setgid/setuid (+ supplementary groups) and capability draining on Linux; equivalents on macOS; token restriction on Windows.
• A post-drop verification step that confirms privileges were actually relinquished.
• Fail-closed startup: monitoring must hard-gate (refuse to proceed elevated) if dropping fails, rather than the current continue-elevated behavior.
• Replace test_drop_privileges_stub with real behavioral tests.

This is a host-security control central to DaemonEye's least-privilege model and warrants its own design + review.

References

• File: daemoneye-agent/src/broker_manager/state_machine.rs (drop_privileges)
• Surfaced in: refactor: decompose source-file monoliths into focused submodules #191 (CodeRabbit, Critical)
• Related: feat(procmond): implement Windows privilege detection via token-privilege crate #150 (Windows privilege detection)