Add support for Process category syscalls

[kov]

This adds support for 5 Process-related syscalls:

• kcmp: compare kernel resources between processes
• getgroups/setgroups: manage supplementary group IDs
• getresuid/getresgid: get real, effective, and saved UIDs/GIDs

Added format_kcmp_type() helper with 8 KCMP type constants. Specialized return value formatting:

• kcmp: shows comparison result (equal, less than, greater than, not equal)
• getgroups: shows count of groups returned
• setgroups, getresuid, getresgid: show success/error

Added 5 pretty printing tests in pinchy/src/tests/process.rs. All 535 tests passing.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR adds support for 5 process-related syscalls that manage process identity and comparison: kcmp (compare kernel resources between processes), getgroups/setgroups (manage supplementary group IDs), and getresuid/getresgid (retrieve real, effective, and saved user/group IDs). The implementation follows the established consolidated handler pattern used throughout the codebase.

Key changes:

• Added format_kcmp_type() helper with 8 KCMP type constants for kernel resource comparison
• Implemented specialized return value formatting for each syscall (equal/less than/greater than/not equal for kcmp, group count for getgroups, success/error for others)
• Added comprehensive test coverage including 5 unit tests and 1 integration test, with all 535 tests passing

Reviewed changes

Copilot reviewed 7 out of 8 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
pinchy-common/src/lib.rs	Added 5 data structures (KcmpData, GetgroupsData, SetgroupsData, GetresuidData, GetresgidData) to support the new syscalls, following existing patterns with proper #[repr(C)] and Default implementations
pinchy-ebpf/src/process.rs	Implemented eBPF handlers for all 5 syscalls in the consolidated process handler, with proper bounds checking and safe memory operations for reading group arrays and UID/GID values
pinchy/src/format_helpers.rs	Added format_kcmp_type() helper with 8 KCMP constants and extended format_return_value() to handle specialized return values for all new syscalls
pinchy/src/events.rs	Implemented event parsing for all 5 syscalls, including proper array formatting with truncation support for group lists
pinchy/src/server.rs	Registered all 5 syscalls in the PROCESS_SYSCALLS array for proper eBPF program loading
pinchy/src/tests/process.rs	Added 5 unit tests covering different scenarios (kcmp equality, getgroups with multiple groups, setgroups, getresuid, getresgid)
pinchy/tests/integration.rs	Added process_identity_test integration test with regex pattern matching for group lists
pinchy/src/bin/test-helper.rs	Implemented process_identity_test() helper function that exercises all 4 new identity-related syscalls in sequence

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".