migrate libbeat seccomp integ test to go

[leehinman]

Proposed commit message

• Converts the libbeat seccomp Python integration test (test_seccomp.py) to Go, consistent with the ongoing migration of system tests to the Go integration test framework.
• Adds TestSeccompInstalled in libbeat/tests/integration/seccomp_test.go, which verifies that the seccomp syscall filter is successfully installed on supported platforms (Linux ≥ 3.17, on i386/amd64/arm64).
• Removes the now-redundant libbeat/tests/system/test_seccomp.py.

Benefit is that we will eventually be able to remove python from our build/testing environment.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works. Where relevant, I have used the stresstest.sh script to run them under stress conditions and race detector to verify their stability.
• I have added an entry in ./changelog/fragments using the changelog tool.

Disruptive User Impact

None. Test code

Author's Checklist

• Run the same on macOS/Windows (or an unsupported arch) and confirm the test is skipped with the appropriate message. CI will do this.
• Confirm no other tests in the repo reference the deleted Python file. Done by hand.

How to test this PR locally

cd libbeat
mage goIntegTest

Related issues

• Relates Replace Python system tests with Go tests #48850

Use cases

Screenshots

Logs

[github-actions]

🤖 GitHub comments

Just comment with:

• run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)

[elasticmachine]

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: ffc8da60-f982-468e-b64c-86e752cb4a82

📥 Commits

Reviewing files that changed from the base of the PR and between 9dd7c3c and b2bc260.

📒 Files selected for processing (2)

• libbeat/tests/integration/seccomp_test.go
• libbeat/tests/system/test_seccomp.py

💤 Files with no reviewable changes (1)

• libbeat/tests/system/test_seccomp.py

---

📝 Walkthrough

Walkthrough

This change migrates seccomp testing infrastructure from Python to Go. The system test file libbeat/tests/system/test_seccomp.py is removed and replaced with a new integration test libbeat/tests/integration/seccomp_test.go. The new integration test introduces an isSeccompSupported helper function that validates Linux platform with kernel 3.17+ across supported architectures (386/amd64/arm64), a configuration string for mockbeat, and a test that starts a mockbeat instance with seccomp configuration, waits for the "Syscall filter successfully installed" log message with a 60-second timeout, then stops the process.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

• 🛠️ Update Documentation: Commit on current branch
• 🛠️ Update Documentation: Create PR

📝 Coding Plan

• Generate coding plan for human review comments

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Tip

CodeRabbit can use Trivy to scan for security misconfigurations and secrets in Infrastructure as Code files.

Add a .trivyignore file to your project to customize which findings Trivy reports.

[mauri870]

Thanks!