int: refactored rule creation

procmon_linux.go

@@ -57,10 +57,7 @@ func (p *ProcessMonitor) MonitorProcesses(errc chan error) {
 			workingDirectory = "/home/runner"
 		}
 
-		auditRule := fmt.Sprintf("-a exit,always -F dir=%s -F perm=wa -S open -S openat -S rename -S renameat -k %s", workingDirectory, fileMonitorTag)
-		if runtime.GOARCH == "arm64" {
-			auditRule = fmt.Sprintf("-a exit,always -F dir=%s -F perm=wa -S openat -S renameat -k %s", workingDirectory, fileMonitorTag)
-		}
+		auditRule := fileMonitorAuditRule(workingDirectory, runtime.GOARCH)
 
 		r, _ := flags.Parse(auditRule)
 
@@ -157,6 +154,14 @@ func (p *ProcessMonitor) MonitorProcesses(errc chan error) {
 	p.receive(client)
 }
 
+func fileMonitorAuditRule(workingDirectory, goarch string) string {
+	if goarch == "arm64" {
+		return fmt.Sprintf("-a exit,always -F dir=%s -F perm=wa -S openat -S renameat -k %s", workingDirectory, fileMonitorTag)
+	}
+
+	return fmt.Sprintf("-a exit,always -F dir=%s -F perm=wa -S open -S openat -S rename -S renameat -k %s", workingDirectory, fileMonitorTag)
+}
+
 func (p *ProcessMonitor) receive(r *libaudit.AuditClient) error {
 
 	p.Events = make(map[int]*Event)

procmon_linux_test.go

@@ -8,6 +8,36 @@ import (
 	"testing"
 )
 
+func Test_fileMonitorAuditRule(t *testing.T) {
+	tests := []struct {
+		name             string
+		workingDirectory string
+		goarch           string
+		want             string
+	}{
+		{
+			name:             "arm64 excludes unsupported syscalls",
+			workingDirectory: "/home/runner/work/repo",
+			goarch:           "arm64",
+			want:             "-a exit,always -F dir=/home/runner/work/repo -F perm=wa -S openat -S renameat -k filemon",
+		},
+		{
+			name:             "default includes open and rename syscalls",
+			workingDirectory: "/home/runner/work/repo",
+			goarch:           "amd64",
+			want:             "-a exit,always -F dir=/home/runner/work/repo -F perm=wa -S open -S openat -S rename -S renameat -k filemon",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := fileMonitorAuditRule(tt.workingDirectory, tt.goarch); got != tt.want {
+				t.Errorf("fileMonitorAuditRule() = %q, want %q", got, tt.want)
+			}
+		})
+	}
+}
+
 func Test_getProcessExe(t *testing.T) {
 	type args struct {
 		pid string