we need a seperate not overloaded wildcard for execs

Signed-off-by: entlein <einentlein@gmail.com>

Author: entlein

go.mod

@@ -34,7 +34,7 @@ require (
 	github.com/joncrlsn/dque v0.0.0-20241024143830-7723fd131a64
 	github.com/kubescape/backend v0.0.39
 	github.com/kubescape/go-logger v0.0.32
-	github.com/kubescape/k8s-interface v0.0.213
+	github.com/kubescape/k8s-interface v0.0.214
 	github.com/kubescape/storage v0.0.278
 	github.com/kubescape/workerpool v0.0.0-20250526074519-0e4a4e7f44cf
 	github.com/moby/sys/mountinfo v0.7.2

go.sum

@@ -903,6 +903,8 @@ github.com/kubescape/go-logger v0.0.32 h1:4mI+XJOV8VFCMewrEE9VIFEIOhzXokYT3nFpNf
 github.com/kubescape/go-logger v0.0.32/go.mod h1:Alj7JBQ8/WCxbXe8Ura6ZheSRK45E0p21M3xeqedX90=
 github.com/kubescape/k8s-interface v0.0.213 h1:JaEVzgE5qwQ3rEjQ8tBMp48YX4yveitLfYNaCIk8j/A=
 github.com/kubescape/k8s-interface v0.0.213/go.mod h1:WNYUG93aZ5kDmuaRKFLtVhp18Yc6EfaHdD1gLYtVTN4=
+github.com/kubescape/k8s-interface v0.0.214 h1:j7KP0/5VvYOoQdBGV2+gRM3qnR8PWLAGF8RM/k/DmJ0=
+github.com/kubescape/k8s-interface v0.0.214/go.mod h1:WNYUG93aZ5kDmuaRKFLtVhp18Yc6EfaHdD1gLYtVTN4=
 github.com/kubescape/storage v0.0.278 h1:/pOtKul443yb2Fzg/4MFq29oOaFoJg1okQaCGbcEVOk=
 github.com/kubescape/storage v0.0.278/go.mod h1:FpV6tCrYXlp2kKWza4yr7zf2Y1q7IGgx871ndN7SMNo=
 github.com/kubescape/storage v0.0.278 h1:/pOtKul443yb2Fzg/4MFq29oOaFoJg1okQaCGbcEVOk=

pkg/objectcache/containerprofilecache/test32_realpipeline_test.go

@@ -24,7 +24,7 @@ import (
 // R0040 silence comes from the projection (missing/empty vector) or from
 // somewhere else (capture-side args).
 func TestTest32_RealProjectionPipeline(t *testing.T) {
-	const wild = dynamicpathdetector.WildcardIdentifier
+	const wild = dynamicpathdetector.ExecArgsWildcard
 
 	// curl-32-overlay user AP. Container name MUST be "nginx" to match the
 	// InstanceID that primeSharedData/eventContainer build. The argv shapes
@@ -140,7 +140,7 @@ func keysOf(m map[string]struct{}) []string {
 // raw-CompareExecArgs walk (deployed behaviour) returns the WRONG answer and
 // the MatchExecArgs (strict) walk (the fix) returns the RIGHT answer.
 func TestTest32_BaseCPBareVectorPoisonsR0040(t *testing.T) {
-	const wild = dynamicpathdetector.WildcardIdentifier
+	const wild = dynamicpathdetector.ExecArgsWildcard
 
 	// Base consolidated CP: the recorded /bin/busybox startup exec, bare args.
 	baseCP := &v1beta1.ContainerProfile{

pkg/rulemanager/cel/libraries/applicationprofile/exec.go

@@ -114,9 +114,11 @@ func (l *apLibrary) wasExecutedWithArgs(containerID, path, args ref.Val) ref.Val
 	//        an empty recorded vector matches ONLY an empty runtime argv, so
 	//        a recorder/synthetic "ran with no args" entry does NOT act as a
 	//        wildcard and poison the multi-vector OR (the #805 production
-	//        failure). The matcher handles WildcardIdentifier "*", bare
-	//        DynamicIdentifier "⋯", and embedded-⋯ path tokens (the postgres
-	//        versioned-binary case) — see storage's compare_exec_args.go.
+	//        failure). In exec args the wildcards are dedicated sentinels:
+	//        ExecArgsWildcard "⋯⋯" (zero-or-more whole args), DynamicIdentifier
+	//        "⋯" (one arg / one embedded segment — the postgres versioned-binary
+	//        case); a "*" is a LITERAL character, never a wildcard — see
+	//        storage's compare_exec_args.go.
 	if _, ok := cp.Execs.Values[pathStr]; ok {
 		if vectors, ok := cp.ExecsByPath[pathStr]; ok {
 			for _, profileArgs := range vectors {

pkg/rulemanager/cel/libraries/applicationprofile/exec_test.go

@@ -476,9 +476,9 @@ func TestExecWithArgsCompilation(t *testing.T) {
 //
 // Test_32 has 4 subtests; this pins the contract for each:
 //
-//	sh_dash_c_matches_wildcard_trailing — argv matches profile [sh, -c, *].
+//	sh_dash_c_matches_wildcard_trailing — argv matches profile [sh, -c, ⋯⋯].
 //	sh_dash_x_mismatches_R0040          — argv mismatches at literal anchor.
-//	echo_hello_matches_wildcard_trailing — argv matches profile [echo, hello, *].
+//	echo_hello_matches_wildcard_trailing — argv matches profile [echo, hello, ⋯⋯].
 //	echo_goodbye_mismatches_R0040       — argv mismatches at literal "hello".
 func TestExecWithArgsBusyboxMultiVector(t *testing.T) {
 	objCache := objectcachev1.RuleObjectCacheMock{
@@ -499,9 +499,9 @@ func TestExecWithArgsBusyboxMultiVector(t *testing.T) {
 			// shapes. The projection layer appends them all into
 			// ExecsByPath["/bin/busybox"]; the matcher walks every
 			// vector and accepts if ANY matches.
-			{Path: "/bin/busybox", Args: []string{"/bin/sleep", dynamicpathdetector.WildcardIdentifier}},
-			{Path: "/bin/busybox", Args: []string{"/bin/sh", "-c", dynamicpathdetector.WildcardIdentifier}},
-			{Path: "/bin/busybox", Args: []string{"/bin/echo", "hello", dynamicpathdetector.WildcardIdentifier}},
+			{Path: "/bin/busybox", Args: []string{"/bin/sleep", dynamicpathdetector.ExecArgsWildcard}},
+			{Path: "/bin/busybox", Args: []string{"/bin/sh", "-c", dynamicpathdetector.ExecArgsWildcard}},
+			{Path: "/bin/busybox", Args: []string{"/bin/echo", "hello", dynamicpathdetector.ExecArgsWildcard}},
 		},
 	})
 	objCache.SetApplicationProfile(profile)
@@ -583,7 +583,7 @@ func TestExecWithArgsBusyboxMultiVector(t *testing.T) {
 // every argv mismatch in #805 CT runs through the "side-effects" tip.
 //
 // In a real merged profile the SAME path can carry both a constrained vector
-// (from the user-defined ApplicationProfile, e.g. [echo, hello, *]) AND a
+// (from the user-defined ApplicationProfile, e.g. [echo, hello, ⋯⋯]) AND a
 // bare vector with no args (from the recorder, or a synthesised base CP, e.g.
 // /bin/busybox observed with empty Args). extractExecsByPath stores the bare
 // entry as an empty []string{}.
@@ -615,8 +615,8 @@ func TestExecWithArgsEmptyVectorDoesNotPoisonMatch(t *testing.T) {
 			// the clean multi-vector test above.
 			{Path: "/bin/busybox", Args: nil},
 			// User-defined constrained vectors.
-			{Path: "/bin/busybox", Args: []string{"/bin/echo", "hello", dynamicpathdetector.WildcardIdentifier}},
-			{Path: "/bin/busybox", Args: []string{"/bin/sh", "-c", dynamicpathdetector.WildcardIdentifier}},
+			{Path: "/bin/busybox", Args: []string{"/bin/echo", "hello", dynamicpathdetector.ExecArgsWildcard}},
+			{Path: "/bin/busybox", Args: []string{"/bin/sh", "-c", dynamicpathdetector.ExecArgsWildcard}},
 		},
 	})
 	objCache.SetApplicationProfile(profile)

tests/chart/templates/node-agent/default-rules.yaml

@@ -692,7 +692,7 @@ spec:
       - name: "Unexpected process arguments"
         enabled: true
         id: "R0040"
-        description: "Detects an exec event whose path IS in the profile but whose argv vector does not match any recorded argv pattern for that path. Consumes ap.was_executed_with_args, which walks the ExecsByPath projection surface added by node-agent#807 and delegates argv comparison to dynamicpathdetector.CompareExecArgs (storage). Stays silent when the path is unknown (R0001 covers that case) and when the argv vector matches any recorded pattern (including the trailing-wildcard form `[…, *]`)."
+        description: "Detects an exec event whose path IS in the profile but whose argv vector does not match any recorded argv pattern for that path. Consumes ap.was_executed_with_args, which walks the ExecsByPath projection surface added by node-agent#807 and delegates argv comparison to dynamicpathdetector.MatchExecArgs (storage). Stays silent when the path is unknown (R0001 covers that case) and when the argv vector matches any recorded pattern (including the trailing zero-or-more form `[…, ⋯⋯]` and the single-arg form `[…, ⋯]`); a `*` in a recorded arg is a literal character, not a wildcard."
         expressions:
           message: "'Unexpected process arguments: ' + event.comm + ' with PID ' + string(event.pid) + ' argv=' + event.args.map(a, string(a)).join(' ')"
           uniqueId: "event.comm + '_' + event.exepath + '_' + event.args.map(a, string(a)).join(' ')"