Fix linter warnings

Fix linter warnings and upgrade go-libaudit to v2.5.0

NOTICE.txt

@@ -13674,11 +13674,11 @@ Contents of probable licence file $GOMODCACHE/github.com/elastic/go-elasticsearc
 
 --------------------------------------------------------------------------------
 Dependency : github.com/elastic/go-libaudit/v2
-Version: v2.4.0
+Version: v2.5.0
 Licence type (autodetected): Apache-2.0
 --------------------------------------------------------------------------------
 
-Contents of probable licence file $GOMODCACHE/github.com/elastic/go-libaudit/v2@v2.4.0/LICENSE.txt:
+Contents of probable licence file $GOMODCACHE/github.com/elastic/go-libaudit/v2@v2.5.0/LICENSE.txt:
 
 
                                  Apache License

go.mod

@@ -71,7 +71,7 @@ require (
 	github.com/eclipse/paho.mqtt.golang v1.3.5
 	github.com/elastic/elastic-agent-client/v7 v7.6.0
 	github.com/elastic/go-concert v0.2.0
-	github.com/elastic/go-libaudit/v2 v2.4.0
+	github.com/elastic/go-libaudit/v2 v2.5.0
 	github.com/elastic/go-licenser v0.4.1
 	github.com/elastic/go-lookslike v1.0.1
 	github.com/elastic/go-lumber v0.1.2-0.20220819171948-335fde24ea0f

go.sum

@@ -681,8 +681,8 @@ github.com/elastic/go-concert v0.2.0 h1:GAQrhRVXprnNjtvTP9pWJ1d4ToEA4cU5ci7TwTa2
 github.com/elastic/go-concert v0.2.0/go.mod h1:HWjpO3IAEJUxOeaJOWXWEp7imKd27foxz9V5vegC/38=
 github.com/elastic/go-elasticsearch/v8 v8.11.1 h1:1VgTgUTbpqQZ4uE+cPjkOvy/8aw1ZvKcU0ZUE5Cn1mc=
 github.com/elastic/go-elasticsearch/v8 v8.11.1/go.mod h1:GU1BJHO7WeamP7UhuElYwzzHtvf9SDmeVpSSy9+o6Qg=
-github.com/elastic/go-libaudit/v2 v2.4.0 h1:PqaGnB+dncrdUXqzQMyJu/dGysAtk6m5V3GIBMY473I=
-github.com/elastic/go-libaudit/v2 v2.4.0/go.mod h1:AjlnhinP+kKQuUJoXLVrqxBM8uyhQmkzoV6jjsCFP4Q=
+github.com/elastic/go-libaudit/v2 v2.5.0 h1:5OK919QRnGtcjVBz3n/cs5F42im1mPlVTA9TyIn2K54=
+github.com/elastic/go-libaudit/v2 v2.5.0/go.mod h1:AjlnhinP+kKQuUJoXLVrqxBM8uyhQmkzoV6jjsCFP4Q=
 github.com/elastic/go-licenser v0.4.1 h1:1xDURsc8pL5zYT9R29425J3vkHdt4RT5TNEMeRN48x4=
 github.com/elastic/go-licenser v0.4.1/go.mod h1:V56wHMpmdURfibNBggaSBfqgPxyT1Tldns1i87iTEvU=
 github.com/elastic/go-lookslike v1.0.1 h1:qVieyn6i/kx4xntar1cEB0qrGHVGNCX5KC8czAaTW/0=

x-pack/auditbeat/processors/add_session_metadata/add_session_metadata.go

@@ -78,7 +78,7 @@ func (p *addSessionMetadata) Run(ev *beat.Event) (*beat.Event, error) {
 	_, err := ev.GetValue(p.config.PidField)
 	if err != nil {
 		// Do not attempt to enrich events without PID; it's not a supported event
-		return ev, nil
+		return ev, nil //nolint:nilerr // Running on events without PID is expected
 	}
 
 	err = p.provider.UpdateDB(ev)
@@ -117,7 +117,10 @@ func (p *addSessionMetadata) enrich(ev *beat.Event) (*beat.Event, error) {
 
 	processMap := fullProcess.ToMap()
 
-	mapstr.MergeFieldsDeep(result.Fields["process"].(mapstr.M), processMap, true)
+	err = mapstr.MergeFieldsDeep(result.Fields["process"].(mapstr.M), processMap, true)
+	if err != nil {
+		return nil, fmt.Errorf("merging enriched fields with event: %w", err)
+	}
 
 	if p.config.ReplaceFields {
 		if err := p.replaceFields(result); err != nil {

x-pack/auditbeat/processors/add_session_metadata/add_session_metadata_test.go

@@ -241,7 +241,9 @@ func TestEnrich(t *testing.T) {
 			config: tt.config,
 		}
 
-		actual, err := s.enrich(&tt.input)
+		// avoid taking address of loop variable
+		i := tt.input
+		actual, err := s.enrich(&i)
 		if tt.expect_error {
 			assert.Error(t, err, "%s: error unexpectedly nil", tt.testName)
 		} else {

x-pack/auditbeat/processors/add_session_metadata/processdb/db_test.go

@@ -11,15 +11,12 @@ import (
 
 	"github.com/stretchr/testify/assert"
 
-	"github.com/elastic/beats/v7/x-pack/auditbeat/processors/add_session_metadata/procfs"
-
 	"github.com/elastic/elastic-agent-libs/logp"
 
 	"golang.org/x/sys/unix"
 )
 
 var logger = logp.NewLogger("processdb")
-var reader = procfs.NewMockReader()
 
 func TestGetTtyType(t *testing.T) {
 	assert.Equal(t, TtyConsole, getTtyType(4, 0))

x-pack/auditbeat/processors/add_session_metadata/provider/ebpf_provider/ebpf_provider.go

@@ -92,7 +92,10 @@ func NewProvider(ctx context.Context, logger *logp.Logger, db *processdb.DB) (pr
 							CapEffective: body.Creds.CapEffective,
 						},
 					}
-					p.db.InsertFork(pe)
+					if err := p.db.InsertFork(pe); err != nil {
+						p.logger.Errorf("insert fork: %w", err)
+						continue
+					}
 				case ebpfevents.EventTypeProcessExec:
 					body, ok := ev.Body.(*ebpfevents.ProcessExec)
 					if !ok {
@@ -127,7 +130,10 @@ func NewProvider(ctx context.Context, logger *logp.Logger, db *processdb.DB) (pr
 						Env:      deepcopy.Copy(body.Env).(map[string]string),
 						Filename: body.Filename,
 					}
-					p.db.InsertExec(pe)
+					if err := p.db.InsertExec(pe); err != nil {
+						p.logger.Errorf("insert exec: %w", err)
+						continue
+					}
 				case ebpfevents.EventTypeProcessExit:
 					body, ok := ev.Body.(*ebpfevents.ProcessExit)
 					if !ok {
@@ -145,7 +151,10 @@ func NewProvider(ctx context.Context, logger *logp.Logger, db *processdb.DB) (pr
 						},
 						ExitCode: body.ExitCode,
 					}
-					p.db.InsertExit(pe)
+					if err := p.db.InsertExit(pe); err != nil {
+						p.logger.Errorf("insert exit: %w", err)
+						continue
+					}
 				}
 				continue
 			}