Fix enrich.uid_groups

src/coalesce.rs

@@ -362,14 +362,6 @@ impl<'a, 'ev> Coalesce<'a, 'ev> {
                     format!("unknown({})", d)
                 };
                 rec.push((Key::NameTranslated(r.clone()), Value::from(translated)));
-                if self.settings.enrich_uid_groups && r.as_slice() == b"uid" {
-                    if let Some(names) = self.userdb.get_user_groups(*d as _) {
-                        rec.push((
-                            Key::Literal("UID_GROUPS"),
-                            Value::List(names.iter().map(|n| Value::from(n.as_bytes())).collect()),
-                        ));
-                    }
-                }
                 true
             }
             (Key::NameGID(r), Value::Number(Number::Dec(d))) => {
@@ -387,6 +379,22 @@ impl<'a, 'ev> Coalesce<'a, 'ev> {
         }
     }
 
+    fn add_record_uid_groups(&mut self, rec: &mut Record, key: &Key, value: &Value) {
+        if !self.settings.enrich_uid_groups {
+            return;
+        }
+        if let (Key::NameUID(r), Value::Number(Number::Dec(d))) = (key, value) {
+            if r.as_slice() == b"uid" {
+                if let Some(names) = self.userdb.get_user_groups(*d as _) {
+                    rec.push((
+                        Key::Literal("UID_GROUPS"),
+                        Value::List(names.iter().map(|n| Value::from(n.as_bytes())).collect()),
+                    ));
+                }
+            }
+        }
+    }
+
     /// Enrich "pid" entries using `ppid`, `exe`, `ID` (generating
     /// event id) from the shadow process table
     fn enrich_pid(&mut self, rv: &mut Record, k: &Key, v: &Value) {
@@ -703,6 +711,7 @@ impl<'a, 'ev> Coalesce<'a, 'ev> {
                         };
                     }
                     _ => {
+                        self.add_record_uid_groups(&mut nrv, k, v);
                         if self.add_record_userdb(&mut nrv, k, v) && self.settings.drop_translated {
                             return false;
                         }
@@ -1287,6 +1296,22 @@ mod test {
         };
     }
 
+    #[test]
+    fn enrich_uid_groups() {
+        let ec: Rc<RefCell<Option<Event>>> = Rc::new(RefCell::new(None));
+
+        let mut c = Coalesce::new(mk_emit(&ec));
+        c.settings.translate_userdb = false;
+        c.settings.enrich_uid_groups = true;
+
+        process_record(&mut c, include_bytes!("testdata/record-execve.txt")).unwrap();
+
+        assert!(
+            event_to_json(ec.borrow().as_ref().unwrap()).contains(r#""UID_GROUPS":["#),
+            "enrich.uid_groups is performed regardless of translate.userdb"
+        );
+    }
+
     #[test]
     fn key_label() -> Result<(), Box<dyn Error>> {
         let ec: Rc<RefCell<Option<Event>>> = Rc::new(RefCell::new(None));