chore(tetragon): consolidate action verification checks

pkg/selectors/kernel.go

@@ -1519,35 +1519,35 @@ func HasOverride(spec *v1alpha1.KProbeSpec) bool {
 	return false
 }
 
-func HasSigkillAction(kspec *v1alpha1.KProbeSpec) bool {
-	for i := range kspec.Selectors {
-		s := &kspec.Selectors[i]
-		for j := range s.MatchActions {
-			act := strings.ToLower(s.MatchActions[j].Action)
-			if act == "sigkill" {
+// HasAction returns true if any selector in the KProbeSpec has the specified action
+func HasAction(kspec *v1alpha1.KProbeSpec, actionName string) bool {
+	act := strings.ToLower(actionName)
+	for _, s := range kspec.Selectors {
+		for _, action := range s.MatchActions {
+			if strings.ToLower(action.Action) == act {
 				return true
 			}
 		}
 	}
 	return false
 }
 
-func HasFilter(selectors []v1alpha1.KProbeSelector, index uint32) bool {
-	for _, s := range selectors {
-		for _, a := range s.MatchArgs {
-			if a.Index == index {
+// HasActionType returns true if any selector in the KProbeSpec has the specified action type
+func HasActionType(kspec *v1alpha1.KProbeSpec, actionType int32) bool {
+	for _, s := range kspec.Selectors {
+		for _, action := range s.MatchActions {
+			if ActionTypeFromString(action.Action) == actionType {
 				return true
 			}
 		}
 	}
 	return false
 }
 
-// HasNotifyEnforcerAction returns true if any selector in the KProbeSpec has a NotifyEnforcer action
-func HasNotifyEnforcerAction(kspec *v1alpha1.KProbeSpec) bool {
-	for _, s := range kspec.Selectors {
-		for _, action := range s.MatchActions {
-			if action.Action == "NotifyEnforcer" {
+func HasFilter(selectors []v1alpha1.KProbeSelector, index uint32) bool {
+	for _, s := range selectors {
+		for _, a := range s.MatchArgs {
+			if a.Index == index {
 				return true
 			}
 		}

pkg/selectors/kernel_test.go

@@ -1350,3 +1350,71 @@ func TestParseCapabilityMask(t *testing.T) {
 	_, err = parseCapabilitiesMask("CAP_PIZZA")
 	assert.Error(t, err)
 }
+
+func TestHasAction(t *testing.T) {
+	tests := []struct {
+		name           string
+		spec           *v1alpha1.KProbeSpec
+		actionName     string
+		actionType     int32
+		expectedResult bool
+	}{
+		{
+			name: "has sigkill action - string match",
+			spec: &v1alpha1.KProbeSpec{
+				Selectors: []v1alpha1.KProbeSelector{
+					{
+						MatchActions: []v1alpha1.ActionSelector{
+							{Action: "sigkill"},
+						},
+					},
+				},
+			},
+			actionName:     "sigkill",
+			actionType:     ActionTypeSigKill,
+			expectedResult: true,
+		},
+		{
+			name: "has sigkill action - case insensitive",
+			spec: &v1alpha1.KProbeSpec{
+				Selectors: []v1alpha1.KProbeSelector{
+					{
+						MatchActions: []v1alpha1.ActionSelector{
+							{Action: "SIGKILL"},
+						},
+					},
+				},
+			},
+			actionName:     "sigkill",
+			actionType:     ActionTypeSigKill,
+			expectedResult: true,
+		},
+		{
+			name: "does not have action",
+			spec: &v1alpha1.KProbeSpec{
+				Selectors: []v1alpha1.KProbeSelector{
+					{
+						MatchActions: []v1alpha1.ActionSelector{
+							{Action: "post"},
+						},
+					},
+				},
+			},
+			actionName:     "sigkill",
+			actionType:     ActionTypeSigKill,
+			expectedResult: false,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			// Test string-based HasAction
+			result := HasAction(test.spec, test.actionName)
+			assert.Equal(t, test.expectedResult, result, "HasAction should match expected result")
+
+			// Test type-based HasActionType
+			result = HasActionType(test.spec, test.actionType)
+			assert.Equal(t, test.expectedResult, result, "HasActionType should match expected result")
+		})
+	}
+}

pkg/sensors/tracing/generickprobe.go

@@ -466,7 +466,7 @@ func preValidateKprobe(
 		}
 	}
 
-	if selectors.HasSigkillAction(f) && !config.EnableLargeProgs() {
+	if selectors.HasActionType(f, selectors.ActionTypeSigKill) && !config.EnableLargeProgs() {
 		return nil, errors.New("sigkill action requires kernel >= 5.3.0")
 	}
 
@@ -540,7 +540,7 @@ func preValidateKprobes(log logger.FieldLogger, kprobes []v1alpha1.KProbeSpec, l
 
 	// If the NotifyEnforcer action is specified, there must be at least one enforcer.
 	for _, kprobe := range kprobes {
-		if selectors.HasNotifyEnforcerAction(&kprobe) {
+		if selectors.HasActionType(&kprobe, selectors.ActionTypeNotifyEnforcer) {
 			if len(enforcers) == 0 {
 				return nil, errors.New("NotifyEnforcer action specified, but spec contains no enforcers")
 			}