test(userspace/libsinsp): test new threadinfo api get_ancestor_process

Signed-off-by: Lorenzo Susini <[email protected]>
falcosecurity · Jan 13, 2025 · d6ffd39 · d6ffd39
1 parent 41de136
commit d6ffd39
Show file tree

Hide file tree

Showing 2 changed files with 18 additions and 0 deletions.
diff --git a/userspace/libsinsp/test/events_proc.ut.cpp b/userspace/libsinsp/test/events_proc.ut.cpp
@@ -19,6 +19,7 @@ limitations under the License.
 #include <gtest/gtest.h>
 
 #include <sinsp_with_test_input.h>
+#include <helpers/threads_helpers.h>
 #include "test_utils.h"
 
 /* Assert if the thread `exepath` is set to the right value

diff --git a/userspace/libsinsp/test/thread_table.ut.cpp b/userspace/libsinsp/test/thread_table.ut.cpp
@@ -617,3 +617,20 @@ TEST_F(sinsp_with_test_input, THRD_TABLE_add_and_remove_many_children) {
 	/* Only init process */
 	ASSERT_EQ(m_inspector.m_thread_manager->get_thread_count(), 1);
 }
+
+TEST_F(sinsp_with_test_input, THRD_TABLE_proc_apid_ppid) {
+	DEFAULT_TREE
+
+	// Thread p5_t1_ptid is generated by p4_t2_tid, which is a thread
+	// Retrieve it to check apid and ppid
+	auto p5_t1_info = m_inspector.get_thread_ref(p5_t1_tid, false).get();
+	ASSERT_EQ(p5_t1_info->m_ptid, p4_t2_tid);
+
+	auto p4_t1_info = m_inspector.get_thread_ref(p4_t1_tid, false).get();
+	auto p5_t1_parent_info = p5_t1_info->get_ancestor_process();
+	ASSERT_EQ(p4_t1_info->m_pid, p5_t1_parent_info->m_pid);
+
+	auto p3_t1_info = m_inspector.get_thread_ref(p3_t1_tid, false).get();
+	auto p5_t1_gparent_info = p5_t1_info->get_ancestor_process(2);
+	ASSERT_EQ(p3_t1_info->m_pid, p5_t1_gparent_info->m_pid);
+}