test(presets): add unit tests for base and anonmapexec utility functions

Add unit test coverage for the pure-Go utility functions in the presets
subsystem as part of the test coverage audit tracked in #2130.

Two packages are covered:

presets/base/common_test.go:
- TestAddPolicyLogInfo: 6 table-driven cases covering empty policy,
  name-only, single tag, multiple tags, severity+message, and all-fields-set
  inputs. Verifies PolicyName, Tags (joined string), ATags (slice),
  Severity, Message, Type, and KubeArmorVersion fields.
- TestUpdateMatchPolicy: 5 table-driven cases covering zero-value policy,
  full policy, missing policyName key, high severity, and single-tag inputs.
  Verifies PolicyName, Severity (strconv.Itoa conversion), Message, and
  Tags fields are correctly mapped from SecurityPolicy.
- TestPresetConstants: verifies PRESET_ENFORCER, Audit, and Block constant
  values match their documented semantics.
- TestNsKeyConstruction: verifies NsKey struct construction with zero,
  typical, and max uint32 values.

presets/anonmapexec/utils_test.go:
- TestParseProtectionFlags: 9 table-driven cases covering all bitmask
  combinations of PROT_READ (0x1), PROT_WRITE (0x2), PROT_EXEC (0x4),
  zero flags, and high-bit passthrough values.
- TestParseMemoryFlags: 11 table-driven cases covering all 6 flag bits
  (MAP_SHARED, MAP_PRIVATE, MAP_FIXED, MAP_ANONYMOUS, MAP_GROWSDOWN,
  MAP_DENYWRITE) individually and in combination.

BPF-dependent sub-packages (exec/, filelessexec/) are intentionally
excluded — they require bpf2go codegen and cannot compile in standard
go test without a kernel BPF runtime.

Validation: GOOS=linux GOARCH=amd64 go vet and go test -c pass cleanly.
Execution is verified on Linux CI (macOS dev env has case-insensitive FS
and Linux-specific syscall constraints in transitive deps).

Part of #2130

Signed-off-by: cynox-66 <devj2311@gmail.com>

Author: cynox-66

KubeArmor/presets/anonmapexec/utils_test.go

@@ -0,0 +1,70 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 Authors of KubeArmor
+
+package anonmapexec
+
+import "testing"
+
+// ── ParseProtectionFlags ──────────────────────────────────────────────────────
+
+func TestParseProtectionFlags(t *testing.T) {
+	tests := []struct {
+		name     string
+		prot     uint64
+		expected string
+	}{
+		{"zero_flags", 0x0, ""},
+		{"read_only", 0x1, "PROT_READ"},
+		{"write_only", 0x2, "PROT_WRITE"},
+		{"exec_only", 0x4, "PROT_EXEC"},
+		{"read_write", 0x3, "PROT_READ|PROT_WRITE"},
+		{"read_exec", 0x5, "PROT_READ|PROT_EXEC"},
+		{"write_exec", 0x6, "PROT_WRITE|PROT_EXEC"},
+		{"all_flags", 0x7, "PROT_READ|PROT_WRITE|PROT_EXEC"},
+		{"high_bits_ignored", 0xFF, "PROT_READ|PROT_WRITE|PROT_EXEC"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := ParseProtectionFlags(tt.prot)
+			if got != tt.expected {
+				t.Errorf("ParseProtectionFlags(0x%x) = %q, want %q", tt.prot, got, tt.expected)
+			}
+		})
+	}
+}
+
+// ── ParseMemoryFlags ──────────────────────────────────────────────────────────
+
+func TestParseMemoryFlags(t *testing.T) {
+	tests := []struct {
+		name     string
+		flag     uint64
+		expected string
+	}{
+		{"zero_flags", 0x0, ""},
+		{"shared_only", 0x01, "MAP_SHARED"},
+		{"private_only", 0x02, "MAP_PRIVATE"},
+		{"fixed_only", 0x10, "MAP_FIXED"},
+		{"anonymous_only", 0x20, "MAP_ANONYMOUS"},
+		{"growsdown_only", 0x1000, "MAP_GROWSDOWN"},
+		{"denywrite_only", 0x0800, "MAP_DENYWRITE"},
+		{"shared_anonymous", 0x21, "MAP_SHARED|MAP_ANONYMOUS"},
+		{"private_anonymous", 0x22, "MAP_PRIVATE|MAP_ANONYMOUS"},
+		{"private_fixed_anonymous", 0x32, "MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS"},
+		{
+			"all_flags",
+			0x01 | 0x02 | 0x10 | 0x20 | 0x1000 | 0x0800,
+			"MAP_SHARED|MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_GROWSDOWN|MAP_DENYWRITE",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := ParseMemoryFlags(tt.flag)
+			if got != tt.expected {
+				t.Errorf("ParseMemoryFlags(0x%x) = %q, want %q", tt.flag, got, tt.expected)
+			}
+		})
+	}
+}

KubeArmor/presets/base/common_test.go

@@ -0,0 +1,297 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 Authors of KubeArmor
+
+package base
+
+import (
+	"testing"
+
+	"github.com/kubearmor/KubeArmor/KubeArmor/buildinfo"
+	tp "github.com/kubearmor/KubeArmor/KubeArmor/types"
+)
+
+// ── AddPolicyLogInfo ──────────────────────────────────────────────────────────
+
+func TestAddPolicyLogInfo(t *testing.T) {
+	tests := []struct {
+		name      string
+		ckv       ContainerVal
+		wantName  string
+		wantTags  string
+		wantATags []string
+		wantSev   string
+		wantMsg   string
+		wantType  string
+	}{
+		{
+			name:      "empty_policy",
+			ckv:       ContainerVal{},
+			wantName:  "",
+			wantTags:  "",
+			wantATags: nil,
+			wantSev:   "",
+			wantMsg:   "",
+			wantType:  "MatchedPolicy",
+		},
+		{
+			name: "policy_name_only",
+			ckv: ContainerVal{
+				Policy: tp.MatchPolicy{PolicyName: "test-policy"},
+			},
+			wantName:  "test-policy",
+			wantTags:  "",
+			wantATags: nil,
+			wantSev:   "",
+			wantMsg:   "",
+			wantType:  "MatchedPolicy",
+		},
+		{
+			name: "single_tag",
+			ckv: ContainerVal{
+				Policy: tp.MatchPolicy{
+					PolicyName: "p1",
+					Tags:       []string{"cis"},
+				},
+			},
+			wantName:  "p1",
+			wantTags:  "cis",
+			wantATags: []string{"cis"},
+			wantSev:   "",
+			wantMsg:   "",
+			wantType:  "MatchedPolicy",
+		},
+		{
+			name: "multiple_tags",
+			ckv: ContainerVal{
+				Policy: tp.MatchPolicy{
+					PolicyName: "p2",
+					Tags:       []string{"cis", "nist", "pci"},
+				},
+			},
+			wantName:  "p2",
+			wantTags:  "cis,nist,pci",
+			wantATags: []string{"cis", "nist", "pci"},
+			wantSev:   "",
+			wantMsg:   "",
+			wantType:  "MatchedPolicy",
+		},
+		{
+			name: "severity_and_message",
+			ckv: ContainerVal{
+				Policy: tp.MatchPolicy{
+					PolicyName: "p3",
+					Severity:   "5",
+					Message:    "suspicious exec detected",
+				},
+			},
+			wantName:  "p3",
+			wantTags:  "",
+			wantATags: nil,
+			wantSev:   "5",
+			wantMsg:   "suspicious exec detected",
+			wantType:  "MatchedPolicy",
+		},
+		{
+			name: "all_fields_set",
+			ckv: ContainerVal{
+				NsKey: NsKey{PidNS: 100, MntNS: 200},
+				Policy: tp.MatchPolicy{
+					PolicyName: "full-policy",
+					Severity:   "3",
+					Message:    "alert",
+					Tags:       []string{"cis", "nist"},
+				},
+			},
+			wantName:  "full-policy",
+			wantTags:  "cis,nist",
+			wantATags: []string{"cis", "nist"},
+			wantSev:   "3",
+			wantMsg:   "alert",
+			wantType:  "MatchedPolicy",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			log := &tp.Log{}
+			AddPolicyLogInfo(log, &tt.ckv)
+
+			if log.PolicyName != tt.wantName {
+				t.Errorf("PolicyName = %q, want %q", log.PolicyName, tt.wantName)
+			}
+			if log.Tags != tt.wantTags {
+				t.Errorf("Tags = %q, want %q", log.Tags, tt.wantTags)
+			}
+			if len(log.ATags) != len(tt.wantATags) {
+				t.Errorf("ATags length = %d, want %d", len(log.ATags), len(tt.wantATags))
+			} else {
+				for i := range tt.wantATags {
+					if log.ATags[i] != tt.wantATags[i] {
+						t.Errorf("ATags[%d] = %q, want %q", i, log.ATags[i], tt.wantATags[i])
+					}
+				}
+			}
+			if log.Severity != tt.wantSev {
+				t.Errorf("Severity = %q, want %q", log.Severity, tt.wantSev)
+			}
+			if log.Message != tt.wantMsg {
+				t.Errorf("Message = %q, want %q", log.Message, tt.wantMsg)
+			}
+			if log.Type != tt.wantType {
+				t.Errorf("Type = %q, want %q", log.Type, tt.wantType)
+			}
+			// KubeArmorVersion mirrors buildinfo.GitSummary at call time.
+			// In unit tests, GitSummary is "" (no build-time injection).
+			if log.KubeArmorVersion != buildinfo.GitSummary {
+				t.Errorf("KubeArmorVersion = %q, want %q (buildinfo.GitSummary)", log.KubeArmorVersion, buildinfo.GitSummary)
+			}
+		})
+	}
+}
+
+// ── UpdateMatchPolicy ─────────────────────────────────────────────────────────
+
+func TestUpdateMatchPolicy(t *testing.T) {
+	tests := []struct {
+		name     string
+		metadata map[string]string
+		severity int
+		message  string
+		tags     []string
+		wantName string
+		wantSev  string
+		wantMsg  string
+		wantTags []string
+	}{
+		{
+			name:     "zero_value_policy",
+			metadata: map[string]string{},
+			severity: 0,
+			message:  "",
+			tags:     nil,
+			wantName: "",
+			wantSev:  "0",
+			wantMsg:  "",
+			wantTags: nil,
+		},
+		{
+			name:     "full_policy",
+			metadata: map[string]string{"policyName": "block-exec"},
+			severity: 5,
+			message:  "blocked execution",
+			tags:     []string{"cis", "nist"},
+			wantName: "block-exec",
+			wantSev:  "5",
+			wantMsg:  "blocked execution",
+			wantTags: []string{"cis", "nist"},
+		},
+		{
+			name:     "missing_policyname_key",
+			metadata: map[string]string{"other": "value"},
+			severity: 3,
+			message:  "msg",
+			tags:     []string{"t1"},
+			wantName: "",
+			wantSev:  "3",
+			wantMsg:  "msg",
+			wantTags: []string{"t1"},
+		},
+		{
+			name:     "high_severity",
+			metadata: map[string]string{"policyName": "critical-policy"},
+			severity: 10,
+			message:  "critical",
+			tags:     []string{"critical"},
+			wantName: "critical-policy",
+			wantSev:  "10",
+			wantMsg:  "critical",
+			wantTags: []string{"critical"},
+		},
+		{
+			name:     "single_tag",
+			metadata: map[string]string{"policyName": "p"},
+			severity: 1,
+			message:  "",
+			tags:     []string{"pci"},
+			wantName: "p",
+			wantSev:  "1",
+			wantMsg:  "",
+			wantTags: []string{"pci"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ckv := &ContainerVal{}
+			secPolicy := &tp.SecurityPolicy{
+				Metadata: tt.metadata,
+				Spec: tp.SecuritySpec{
+					Severity: tt.severity,
+					Message:  tt.message,
+					Tags:     tt.tags,
+				},
+			}
+
+			UpdateMatchPolicy(ckv, secPolicy)
+
+			if ckv.Policy.PolicyName != tt.wantName {
+				t.Errorf("PolicyName = %q, want %q", ckv.Policy.PolicyName, tt.wantName)
+			}
+			if ckv.Policy.Severity != tt.wantSev {
+				t.Errorf("Severity = %q, want %q", ckv.Policy.Severity, tt.wantSev)
+			}
+			if ckv.Policy.Message != tt.wantMsg {
+				t.Errorf("Message = %q, want %q", ckv.Policy.Message, tt.wantMsg)
+			}
+			if len(ckv.Policy.Tags) != len(tt.wantTags) {
+				t.Errorf("Tags length = %d, want %d", len(ckv.Policy.Tags), len(tt.wantTags))
+			} else {
+				for i := range tt.wantTags {
+					if ckv.Policy.Tags[i] != tt.wantTags[i] {
+						t.Errorf("Tags[%d] = %q, want %q", i, ckv.Policy.Tags[i], tt.wantTags[i])
+					}
+				}
+			}
+		})
+	}
+}
+
+// ── Constants (basePreset.go) ─────────────────────────────────────────────────
+
+func TestPresetConstants(t *testing.T) {
+	if PRESET_ENFORCER != "PRESET-" {
+		t.Errorf("PRESET_ENFORCER = %q, want %q", PRESET_ENFORCER, "PRESET-")
+	}
+	if Audit != 1 {
+		t.Errorf("Audit = %d, want 1", Audit)
+	}
+	if Block != 2 {
+		t.Errorf("Block = %d, want 2", Block)
+	}
+}
+
+// ── Struct construction (basePreset.go) ───────────────────────────────────────
+
+func TestNsKeyConstruction(t *testing.T) {
+	tests := []struct {
+		name  string
+		pidNS uint32
+		mntNS uint32
+	}{
+		{"zero_values", 0, 0},
+		{"typical_values", 4026531836, 4026531840},
+		{"max_values", ^uint32(0), ^uint32(0)},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			key := NsKey{PidNS: tt.pidNS, MntNS: tt.mntNS}
+			if key.PidNS != tt.pidNS {
+				t.Errorf("PidNS = %d, want %d", key.PidNS, tt.pidNS)
+			}
+			if key.MntNS != tt.mntNS {
+				t.Errorf("MntNS = %d, want %d", key.MntNS, tt.mntNS)
+			}
+		})
+	}
+}