feat(cel/parse): add 3-arg get_exec_path(args, comm, exepath) overload

[matthyx]

Summary

Adds a 3-arg parse.get_exec_path(args, comm, exepath) overload to the CEL parse library. This is the engine replacement for node-agent#805 — just the path-resolution helper the OSS R0040 rule needs, branched cleanly from main. The rule YAML and component tests from #805 move to kubescape/rulelibrary instead.

Details

main already carries the rest of the #805 engine — ap.was_executed_with_args, the ExecsByPath projection (incl. mock population), and storage v0.0.278. The only missing piece for R0040 was the exepath-aware path resolver, which this PR adds.

The existing 2-arg form resolves argv[0] → comm. The new 3-arg form resolves symmetrically with the recording side (pkg/containerprofilemanager/v1/event_reporting.go:resolveExecPath):

1. exepath — kernel-authoritative, spoof-resistant (argv[0] is user-controllable even when absolute, e.g. exec -a /bin/sh sleep).
2. argv[0] when non-empty AND exepath empty (fexecve / AT_EMPTY_PATH).
3. comm as final fallback.

This closes the fork-shell mismatch (sh -c … records /bin/sh, and the rule side now queries /bin/sh too) while preserving argv[0]-spoofing protection. The 2-arg overload is unchanged, so every existing rule keeps working — this is purely additive.

Why a new PR instead of #805

Per the issue discussion, #805 is being retired. Its engine already landed on main except this one overload; its rule content (R0040 + the get_exec_path migrations + binding) belongs in kubescape/rulelibrary, not bundled in node-agent. This PR is the minimal engine delta; the rule lives in rulelibrary#39, which will pin this commit via a go.mod pseudo-version.

Tests

TestGetExecPath_SymmetryWithRecordingSide pins exepath-wins, argv[0]-spoof, fexecve fallback, comm fallback, and busybox-symlink cases, mirroring TestResolveExecPath on the recording side.

ok  github.com/kubescape/node-agent/pkg/rulemanager/cel/libraries/parse
ok  github.com/kubescape/node-agent/pkg/rulemanager/cel/libraries/...   (full CEL subtree green)

Summary by CodeRabbit

• New Features

  • parse.get_exec_path now supports an additional 3-argument form that can use an explicit executable path when available.
  • Path resolution now prefers a provided executable path, then falls back to the previous argument-based logic.

• Bug Fixes

  • Improved consistency in path selection for cases where the executable path is empty, missing, or differs from command-name values.
  • Added validation so invalid path values are handled cleanly.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: c3756073-50c0-4120-94e4-3449a6864d82

📥 Commits

Reviewing files that changed from the base of the PR and between 6a05130 and 2ff5f05.

📒 Files selected for processing (3)

• pkg/rulemanager/cel/libraries/parse/parse.go
• pkg/rulemanager/cel/libraries/parse/parselib.go
• pkg/rulemanager/cel/libraries/parse/parsing_test.go

---

📝 Walkthrough

Walkthrough

The parse CEL library now accepts a 3-argument parse.get_exec_path(args, comm, exepath) overload, resolves exepath before falling back to args[0] or comm, and adds tests covering precedence and fallback cases.

Changes

Exec path overload

Layer / File(s)	Summary
Exec-path overload wiring pkg/rulemanager/cel/libraries/parse/parse.go, pkg/rulemanager/cel/libraries/parse/parselib.go	getExecPath keeps the 2-argument fallback path, getExecPathWithExePath returns a non-empty exepath first, and parse.get_exec_path registers the 3-argument overload.
Exec-path resolver tests pkg/rulemanager/cel/libraries/parse/parsing_test.go	A new CEL test suite compiles parse.get_exec_path(args, comm, exepath) expressions and verifies precedence, fallback, and spoofing-related cases.

Sequence Diagram(s)

sequenceDiagram
  participant CEL evaluator
  participant parseLibrary.Declarations
  participant getExecPathWithExePath
  participant getExecPath

  CEL evaluator->>parseLibrary.Declarations: invoke parse.get_exec_path(args, comm, exepath)
  parseLibrary.Declarations->>getExecPathWithExePath: dispatch 3-argument overload
  getExecPathWithExePath->>getExecPath: fallback when exepath is empty
  getExecPathWithExePath-->>CEL evaluator: resolved exec path string

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

• kubescape/node-agent#800: Updates the exec-path selection logic on the recording side with the same exepath-first, args[0]-then-comm precedence.

Poem

Hoppy paths! I leap through code so bright 🐰
exepath first, then argv takes flight
If empty, comm will guide the way
My whiskers twitch at every test today
Hop hop, resolved and snug in sight

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding a 3-argument get_exec_path overload to the parse CEL library.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/parse-get-exec-path-exepath-overload

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Performance Benchmark Results

Node-Agent Resource Usage

Metric	BEFORE	AFTER	Delta
Avg CPU (cores)	0.212	0.209	-1.2%
Peak CPU (cores)	0.225	0.223	-0.8%
Avg Memory (MiB)	333.964	336.442	+0.7%
Peak Memory (MiB)	335.484	346.621	+3.3%

Dedup Effectiveness

No data available.