Test no escalate in exec

[caleblloyd]

Tests that an exec'd binary cannot call seteuid(0) or setegid(0)

[Copilot]

PR Overview

This PR introduces a new test executable to verify that an exec’d binary cannot escalate its privileges by calling seteuid(0) and setegid(0).

• Adds a standalone Go file that checks both system calls fail as expected.
• Exits with success if both calls fail, and with failure if at least one call unexpectedly succeeds.

Reviewed Changes

File	Description
test-no-escalate/test-no-escalate.go	Implements tests to ensure privilege escalation failure

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Comments suppressed due to low confidence (2)

test-no-escalate/test-no-escalate.go:17

• Consider checking the errors from syscall.Seteuid(0) and syscall.Setegid(0) separately to provide more granular feedback when one call fails while the other unexpectedly succeeds.

if euidError != nil && egidError != nil {

test-no-escalate/test-no-escalate.go:24

• [nitpick] Consider using fmt.Fprintf to write error messages to os.Stderr rather than fmt.Printf to better distinguish error output from standard output.

if euidError == nil {

[Copilot]

PR Overview

This pull request introduces a new Go test to ensure that an exec'd binary is prevented from escalating its privileges by successfully calling seteuid(0) or setegid(0).

• Implements a test binary that logs the current UID/GID and attempts to set effective IDs to 0
• Exits with success only if both operations fail, ensuring no unintended privilege escalation

Reviewed Changes

File	Description
test-no-escalate/test-no-escalate.go	New test that validates failure of seteuid(0) and setegid(0) for security

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Comments suppressed due to low confidence (2)

test-no-escalate/test-no-escalate.go:21

• [nitpick] Consider validating each syscall error individually (for example, by checking expected error codes or messages) to provide more granular feedback when only one of the calls fails.

if euidError != nil && egidError != nil {

test-no-escalate/test-no-escalate.go:22

• [nitpick] Consider enhancing the logged error message with additional context regarding the expected failure reason to improve debugging clarity.

logger.Printf("Got expected error when setting EUID to 0: %v", euidError)