diff --git a/cmake/modules/CompilerFlags.cmake b/cmake/modules/CompilerFlags.cmake index 46de869ce4..4b277ecb18 100644 --- a/cmake/modules/CompilerFlags.cmake +++ b/cmake/modules/CompilerFlags.cmake @@ -25,7 +25,7 @@ if(NOT WIN32) set(FALCOSECURITY_LIBS_COMMON_FLAGS "${FALCOSECURITY_LIBS_COMMON_FLAGS} -Wextra -Werror ${CMAKE_SUPPRESSED_WARNINGS}") endif() - set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} ${FALCOSECURITY_LIBS_COMMON_FLAGS}") + set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} ${FALCOSECURITY_LIBS_COMMON_FLAGS} -std=gnu99") set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} ${FALCOSECURITY_LIBS_COMMON_FLAGS} -std=c++0x") set(CMAKE_C_FLAGS_DEBUG "${FALCOSECURITY_LIBS_DEBUG_FLAGS}") diff --git a/driver/.gitignore b/driver/.gitignore new file mode 100644 index 0000000000..1c9516db85 --- /dev/null +++ b/driver/.gitignore @@ -0,0 +1 @@ +syscall_table.c diff --git a/driver/CMakeLists.txt b/driver/CMakeLists.txt index 485909a70f..340f2fbd46 100644 --- a/driver/CMakeLists.txt +++ b/driver/CMakeLists.txt @@ -60,6 +60,15 @@ configure_file(dkms.conf.in src/dkms.conf) configure_file(Makefile.in src/Makefile) configure_file(driver_config.h.in src/driver_config.h) +# Find m4 executable to compile our syscall_table.m4 script into syscall_table.c +find_program(M4_EXECUTABLE m4 DOC "The M4 macro processor, used to automatically generate syscall_table.c" REQUIRED) +# Run at cmake time +execute_process(COMMAND ${M4_EXECUTABLE} syscall_table.m4 + OUTPUT_FILE syscall_table.c + WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}) +# Keep it in sync with its m4 script +set_property(DIRECTORY APPEND PROPERTY CMAKE_CONFIGURE_DEPENDS syscall_table.m4) + set(DRIVER_SOURCES dynamic_params_table.c event_table.c diff --git a/driver/bpf/fillers.h b/driver/bpf/fillers.h index f05b617a5e..887fea076d 100644 --- a/driver/bpf/fillers.h +++ b/driver/bpf/fillers.h @@ -2751,24 +2751,25 @@ FILLER(sys_unshare_e, true) FILLER(sys_generic, true) { - long *scap_id; + int sysdig_id; int native_id; int res; + const struct syscall_evt_pair *sc_evt; native_id = bpf_syscall_get_nr(data->ctx); - scap_id = bpf_map_lookup_elem(&syscall_code_routing_table, &native_id); - if (!scap_id) { + sc_evt = get_syscall_info(native_id); + if (!sc_evt) { bpf_printk("no routing for syscall %d\n", native_id); return PPM_FAILURE_BUG; } - - if (*scap_id == PPM_SC_UNKNOWN) + sysdig_id = sc_evt->ppm_code; + if (sysdig_id == PPM_SC_UNKNOWN) bpf_printk("no syscall for id %d\n", native_id); /* * id */ - res = bpf_val_to_ring(data, *scap_id); + res = bpf_val_to_ring(data, sysdig_id); if (res != PPM_SUCCESS) return res; diff --git a/driver/bpf/maps.h b/driver/bpf/maps.h index 1031358ba5..78a52aee14 100644 --- a/driver/bpf/maps.h +++ b/driver/bpf/maps.h @@ -34,13 +34,6 @@ struct bpf_map_def __bpf_section("maps") tail_map = { .max_entries = PPM_FILLER_MAX, }; -struct bpf_map_def __bpf_section("maps") syscall_code_routing_table = { - .type = BPF_MAP_TYPE_ARRAY, - .key_size = sizeof(u32), - .value_size = sizeof(u64), - .max_entries = SYSCALL_TABLE_SIZE, -}; - struct bpf_map_def __bpf_section("maps") syscall_table = { .type = BPF_MAP_TYPE_ARRAY, .key_size = sizeof(u32), diff --git a/driver/bpf/types.h b/driver/bpf/types.h index 5f51a332bd..5f474586f0 100644 --- a/driver/bpf/types.h +++ b/driver/bpf/types.h @@ -171,19 +171,18 @@ struct perf_event_sample { #endif /* __KERNEL__ */ -enum scap_map_types { +enum sysdig_map_types { SCAP_PERF_MAP = 0, SCAP_TAIL_MAP = 1, - SCAP_SYSCALL_CODE_ROUTING_TABLE = 2, - SCAP_SYSCALL_TABLE = 3, - SCAP_EVENT_INFO_TABLE = 4, - SCAP_FILLERS_TABLE = 5, - SCAP_FRAME_SCRATCH_MAP = 6, - SCAP_TMP_SCRATCH_MAP = 7, - SCAP_SETTINGS_MAP = 8, - SCAP_LOCAL_STATE_MAP = 9, + SCAP_SYSCALL_TABLE = 2, + SCAP_EVENT_INFO_TABLE = 3, + SCAP_FILLERS_TABLE = 4, + SCAP_FRAME_SCRATCH_MAP = 5, + SCAP_TMP_SCRATCH_MAP = 6, + SCAP_SETTINGS_MAP = 7, + SCAP_LOCAL_STATE_MAP = 8, #ifndef BPF_SUPPORTS_RAW_TRACEPOINTS - SCAP_STASH_MAP = 10, + SCAP_STASH_MAP = 9, #endif }; diff --git a/driver/main.c b/driver/main.c index ed5e1f9d88..d6ed28ddc1 100644 --- a/driver/main.c +++ b/driver/main.c @@ -89,7 +89,7 @@ struct event_data_t { struct { struct pt_regs *regs; long id; - const enum ppm_syscall_code *cur_g_syscall_code_routing_table; + const struct syscall_evt_pair *cur_g_syscall_table; } syscall_data; struct { @@ -1753,12 +1753,12 @@ static int record_event_consumer(struct ppm_consumer_t *consumer, if (event_datap->category == PPMC_SYSCALL) { args.regs = event_datap->event_info.syscall_data.regs; args.syscall_id = event_datap->event_info.syscall_data.id; - args.cur_g_syscall_code_routing_table = event_datap->event_info.syscall_data.cur_g_syscall_code_routing_table; + args.cur_g_syscall_table = event_datap->event_info.syscall_data.cur_g_syscall_table; args.compat = event_datap->compat; } else { args.regs = NULL; args.syscall_id = -1; - args.cur_g_syscall_code_routing_table = NULL; + args.cur_g_syscall_table = NULL; args.compat = false; } @@ -1923,7 +1923,6 @@ TRACEPOINT_PROBE(syscall_enter_probe, struct pt_regs *regs, long id) { long table_index; const struct syscall_evt_pair *cur_g_syscall_table = g_syscall_table; - const enum ppm_syscall_code *cur_g_syscall_code_routing_table = g_syscall_code_routing_table; bool compat = false; #ifdef __NR_socketcall int socketcall_syscall = __NR_socketcall; @@ -1942,7 +1941,6 @@ TRACEPOINT_PROBE(syscall_enter_probe, struct pt_regs *regs, long id) if (unlikely(task_thread_info(current)->status & TS_COMPAT)) { #endif cur_g_syscall_table = g_syscall_ia32_table; - cur_g_syscall_code_routing_table = g_syscall_ia32_code_routing_table; socketcall_syscall = __NR_ia32_socketcall; compat = true; } @@ -1980,7 +1978,7 @@ TRACEPOINT_PROBE(syscall_enter_probe, struct pt_regs *regs, long id) event_data.category = PPMC_SYSCALL; event_data.event_info.syscall_data.regs = regs; event_data.event_info.syscall_data.id = id; - event_data.event_info.syscall_data.cur_g_syscall_code_routing_table = cur_g_syscall_code_routing_table; + event_data.event_info.syscall_data.cur_g_syscall_table = cur_g_syscall_table; event_data.socketcall_syscall = socketcall_syscall; event_data.compat = compat; @@ -1996,7 +1994,6 @@ TRACEPOINT_PROBE(syscall_exit_probe, struct pt_regs *regs, long ret) int id; long table_index; const struct syscall_evt_pair *cur_g_syscall_table = g_syscall_table; - const enum ppm_syscall_code *cur_g_syscall_code_routing_table = g_syscall_code_routing_table; bool compat = false; #ifdef __NR_socketcall int socketcall_syscall = __NR_socketcall; @@ -2019,7 +2016,6 @@ TRACEPOINT_PROBE(syscall_exit_probe, struct pt_regs *regs, long ret) if (unlikely((task_thread_info(current)->status & TS_COMPAT) && id != __NR_execve)) { #endif cur_g_syscall_table = g_syscall_ia32_table; - cur_g_syscall_code_routing_table = g_syscall_ia32_code_routing_table; socketcall_syscall = __NR_ia32_socketcall; compat = true; } @@ -2057,7 +2053,7 @@ TRACEPOINT_PROBE(syscall_exit_probe, struct pt_regs *regs, long ret) event_data.category = PPMC_SYSCALL; event_data.event_info.syscall_data.regs = regs; event_data.event_info.syscall_data.id = id; - event_data.event_info.syscall_data.cur_g_syscall_code_routing_table = cur_g_syscall_code_routing_table; + event_data.event_info.syscall_data.cur_g_syscall_table = cur_g_syscall_table; event_data.socketcall_syscall = socketcall_syscall; event_data.compat = compat; diff --git a/driver/ppm.h b/driver/ppm.h index 1c65645cad..d0b0037786 100644 --- a/driver/ppm.h +++ b/driver/ppm.h @@ -131,11 +131,9 @@ long ppm_strncpy_from_user(char *to, const char __user *from, unsigned long n); extern const struct syscall_evt_pair g_syscall_table[]; extern const struct ppm_event_info g_event_info[]; -extern const enum ppm_syscall_code g_syscall_code_routing_table[]; #if defined(CONFIG_X86_64) && defined(CONFIG_IA32_EMULATION) extern const struct syscall_evt_pair g_syscall_ia32_table[]; -extern const enum ppm_syscall_code g_syscall_ia32_code_routing_table[]; #endif #ifndef UDIG diff --git a/driver/ppm_events.h b/driver/ppm_events.h index 31ec4e16d0..4e19ceb0b7 100644 --- a/driver/ppm_events.h +++ b/driver/ppm_events.h @@ -41,7 +41,7 @@ struct event_filler_arguments { char *buffer; /* the buffer that will be filled with the data */ u32 buffer_size; /* the space in the ring buffer available for this event */ u32 syscall_id; /* the system call ID */ - const enum ppm_syscall_code *cur_g_syscall_code_routing_table; + const struct syscall_evt_pair *cur_g_syscall_table; #ifdef PPM_ENABLE_SENTINEL u32 sentinel; #endif diff --git a/driver/ppm_events_public.h b/driver/ppm_events_public.h index 620e4ad1f9..4ce5dd98e8 100644 --- a/driver/ppm_events_public.h +++ b/driver/ppm_events_public.h @@ -1618,6 +1618,7 @@ struct ppm_evt_hdr { uint32_t len; /* the event len, including the header */ uint16_t type; /* the event type */ uint32_t nparams; /* the number of parameters of the event */ + uint8_t payload[]; /* Flexible array member for event payload, ie: both len headers + event data */ }; #if defined __sun #pragma pack() @@ -1740,6 +1741,7 @@ struct syscall_evt_pair { int flags; enum ppm_event_type enter_event_type; enum ppm_event_type exit_event_type; + enum ppm_syscall_code ppm_code; } _packed; #define SYSCALL_TABLE_SIZE 512 diff --git a/driver/ppm_fillers.c b/driver/ppm_fillers.c index 8eb6babf4b..e3e86bfe56 100644 --- a/driver/ppm_fillers.c +++ b/driver/ppm_fillers.c @@ -119,7 +119,7 @@ int f_sys_generic(struct event_filler_arguments *args) { int res; long table_index = args->syscall_id - SYSCALL_TABLE_ID0; - const enum ppm_syscall_code *cur_g_syscall_code_routing_table = args->cur_g_syscall_code_routing_table; + const struct syscall_evt_pair *cur_g_syscall_table = args->cur_g_syscall_table; #ifdef _HAS_SOCKETCALL if (unlikely(args->syscall_id == args->socketcall_syscall)) { @@ -137,7 +137,7 @@ int f_sys_generic(struct event_filler_arguments *args) if (likely(table_index >= 0 && table_index < SYSCALL_TABLE_SIZE)) { - enum ppm_syscall_code sc_code = cur_g_syscall_code_routing_table[table_index]; + enum ppm_syscall_code sc_code = cur_g_syscall_table[table_index].ppm_code; /* * ID diff --git a/driver/syscall_table.c b/driver/syscall_table.c deleted file mode 100644 index 54cf4707e5..0000000000 --- a/driver/syscall_table.c +++ /dev/null @@ -1,1913 +0,0 @@ -/* - -Copyright (C) 2021 The Falco Authors. - -This file is dual licensed under either the MIT or GPL 2. See MIT.txt -or GPL2.txt for full copies of the license. - -*/ - -#ifdef __KERNEL__ -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 20) -#include "ppm_syscall.h" -#else -#include -#endif -#else /* __KERNEL__ */ - -#ifdef WDIG -#include -#else /* WDIG */ -#ifdef UDIG -#include -#else /* UDIG */ -#include -#endif /* UDIG */ -#endif /* WDIG */ -#ifdef __mips__ -#define SYSCALL_TABLE_ID0 __NR_Linux -#else /* __mips__ */ -#define SYSCALL_TABLE_ID0 0 -#endif /* __mips__ */ -#endif /* __KERNEL__ */ - - -#include "ppm_events_public.h" -#ifdef __KERNEL__ -#include "ppm.h" -#if defined(CONFIG_IA32_EMULATION) && !defined(__NR_ia32_socketcall) -#include "ppm_compat_unistd_32.h" -#endif -#endif /* __KERNEL__ */ - -/* - * SYSCALL TABLE - */ -const struct syscall_evt_pair g_syscall_table[SYSCALL_TABLE_SIZE] = { -#ifdef __NR_open - [__NR_open - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP, PPME_SYSCALL_OPEN_E, PPME_SYSCALL_OPEN_X}, -#endif -#ifdef __NR_creat - [__NR_creat - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP, PPME_SYSCALL_CREAT_E, PPME_SYSCALL_CREAT_X}, -#endif - [__NR_close - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP | UF_SIMPLEDRIVER_KEEP, PPME_SYSCALL_CLOSE_E, PPME_SYSCALL_CLOSE_X}, - [__NR_brk - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_BRK_4_E, PPME_SYSCALL_BRK_4_X}, - [__NR_read - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_READ_E, PPME_SYSCALL_READ_X}, - [__NR_write - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_WRITE_E, PPME_SYSCALL_WRITE_X}, - [__NR_execve - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP | UF_SIMPLEDRIVER_KEEP, PPME_SYSCALL_EXECVE_19_E, PPME_SYSCALL_EXECVE_19_X}, - [__NR_clone - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP | UF_SIMPLEDRIVER_KEEP, PPME_SYSCALL_CLONE_20_E, PPME_SYSCALL_CLONE_20_X}, -#ifdef __NR_fork - [__NR_fork - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP | UF_SIMPLEDRIVER_KEEP, PPME_SYSCALL_FORK_20_E, PPME_SYSCALL_FORK_20_X}, -#endif -#ifdef __NR_vfork - [__NR_vfork - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP | UF_SIMPLEDRIVER_KEEP, PPME_SYSCALL_VFORK_20_E, PPME_SYSCALL_VFORK_20_X}, -#endif -#ifdef __NR_pipe - [__NR_pipe - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP, PPME_SYSCALL_PIPE_E, PPME_SYSCALL_PIPE_X}, -#endif - [__NR_pipe2 - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP, PPME_SYSCALL_PIPE_E, PPME_SYSCALL_PIPE_X}, -#ifdef __NR_eventfd - [__NR_eventfd - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP, PPME_SYSCALL_EVENTFD_E, PPME_SYSCALL_EVENTFD_X}, -#endif - [__NR_eventfd2 - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP, PPME_SYSCALL_EVENTFD_E, PPME_SYSCALL_EVENTFD_X}, - [__NR_futex - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_FUTEX_E, PPME_SYSCALL_FUTEX_X}, -#ifdef __NR_stat - [__NR_stat - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_STAT_E, PPME_SYSCALL_STAT_X}, -#endif -#ifdef __NR_lstat - [__NR_lstat - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_LSTAT_E, PPME_SYSCALL_LSTAT_X}, -#endif - [__NR_fstat - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_FSTAT_E, PPME_SYSCALL_FSTAT_X}, -#ifdef __NR_epoll_wait - [__NR_epoll_wait - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_EPOLLWAIT_E, PPME_SYSCALL_EPOLLWAIT_X}, -#endif -#ifdef __NR_poll - [__NR_poll - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_POLL_E, PPME_SYSCALL_POLL_X}, -#endif -#ifdef __NR_select - [__NR_select - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_SELECT_E, PPME_SYSCALL_SELECT_X}, -#endif - [__NR_lseek - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_LSEEK_E, PPME_SYSCALL_LSEEK_X}, - [__NR_ioctl - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_IOCTL_3_E, PPME_SYSCALL_IOCTL_3_X}, - [__NR_getcwd - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_GETCWD_E, PPME_SYSCALL_GETCWD_X}, -#ifdef __NR_capset - [__NR_capset - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_CAPSET_E, PPME_SYSCALL_CAPSET_X}, -#endif - [__NR_chdir - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP | UF_SIMPLEDRIVER_KEEP, PPME_SYSCALL_CHDIR_E, PPME_SYSCALL_CHDIR_X}, - [__NR_fchdir - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP | UF_SIMPLEDRIVER_KEEP, PPME_SYSCALL_FCHDIR_E, PPME_SYSCALL_FCHDIR_X}, -#ifdef __NR_mkdir - [__NR_mkdir - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_MKDIR_2_E, PPME_SYSCALL_MKDIR_2_X}, -#endif -#ifdef __NR_rmdir - [__NR_rmdir - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_RMDIR_2_E, PPME_SYSCALL_RMDIR_2_X}, -#endif - [__NR_openat - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP, PPME_SYSCALL_OPENAT_2_E, PPME_SYSCALL_OPENAT_2_X}, - [__NR_mkdirat - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_MKDIRAT_E, PPME_SYSCALL_MKDIRAT_X}, -#ifdef __NR_link - [__NR_link - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_LINK_2_E, PPME_SYSCALL_LINK_2_X}, -#endif - [__NR_linkat - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_LINKAT_2_E, PPME_SYSCALL_LINKAT_2_X}, -#ifdef __NR_unlink - [__NR_unlink - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_UNLINK_2_E, PPME_SYSCALL_UNLINK_2_X}, -#endif - [__NR_unlinkat - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_UNLINKAT_2_E, PPME_SYSCALL_UNLINKAT_2_X}, - [__NR_pread64 - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_PREAD_E, PPME_SYSCALL_PREAD_X}, - [__NR_pwrite64 - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_PWRITE_E, PPME_SYSCALL_PWRITE_X}, - [__NR_readv - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_READV_E, PPME_SYSCALL_READV_X}, - [__NR_writev - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_WRITEV_E, PPME_SYSCALL_WRITEV_X}, - [__NR_preadv - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_PREADV_E, PPME_SYSCALL_PREADV_X}, - [__NR_pwritev - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_PWRITEV_E, PPME_SYSCALL_PWRITEV_X}, - [__NR_dup - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP | UF_SIMPLEDRIVER_KEEP, PPME_SYSCALL_DUP_E, PPME_SYSCALL_DUP_X}, -#ifdef __NR_dup2 - [__NR_dup2 - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP | UF_SIMPLEDRIVER_KEEP, PPME_SYSCALL_DUP_E, PPME_SYSCALL_DUP_X}, -#endif - [__NR_dup3 - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP | UF_SIMPLEDRIVER_KEEP, PPME_SYSCALL_DUP_E, PPME_SYSCALL_DUP_X}, -#ifdef __NR_signalfd - [__NR_signalfd - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP, PPME_SYSCALL_SIGNALFD_E, PPME_SYSCALL_SIGNALFD_X}, -#endif - [__NR_signalfd4 - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP, PPME_SYSCALL_SIGNALFD_E, PPME_SYSCALL_SIGNALFD_X}, - [__NR_kill - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_KILL_E, PPME_SYSCALL_KILL_X}, - [__NR_tkill - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_TKILL_E, PPME_SYSCALL_TKILL_X}, - [__NR_tgkill - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_TGKILL_E, PPME_SYSCALL_TGKILL_X}, - [__NR_nanosleep - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_NANOSLEEP_E, PPME_SYSCALL_NANOSLEEP_X}, - [__NR_timerfd_create - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP, PPME_SYSCALL_TIMERFD_CREATE_E, PPME_SYSCALL_TIMERFD_CREATE_X}, -#ifdef __NR_inotify_init - [__NR_inotify_init - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP, PPME_SYSCALL_INOTIFY_INIT_E, PPME_SYSCALL_INOTIFY_INIT_X}, -#endif - [__NR_inotify_init1 - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP, PPME_SYSCALL_INOTIFY_INIT_E, PPME_SYSCALL_INOTIFY_INIT_X}, - [__NR_fchmodat - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_FCHMODAT_E, PPME_SYSCALL_FCHMODAT_X}, - [__NR_fchmod - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_FCHMOD_E, PPME_SYSCALL_FCHMOD_X}, -#ifdef __NR_getrlimit - [__NR_getrlimit - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP, PPME_SYSCALL_GETRLIMIT_E, PPME_SYSCALL_GETRLIMIT_X}, -#endif - [__NR_setrlimit - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP, PPME_SYSCALL_SETRLIMIT_E, PPME_SYSCALL_SETRLIMIT_X}, -#ifdef __NR_prlimit64 - [__NR_prlimit64 - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP, PPME_SYSCALL_PRLIMIT_E, PPME_SYSCALL_PRLIMIT_X}, -#endif -#ifdef __NR_ugetrlimit - [__NR_ugetrlimit - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP, PPME_SYSCALL_GETRLIMIT_E, PPME_SYSCALL_GETRLIMIT_X}, -#endif - [__NR_fcntl - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_FCNTL_E, PPME_SYSCALL_FCNTL_X}, -#ifdef __NR_fcntl64 - [__NR_fcntl64 - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_FCNTL_E, PPME_SYSCALL_FCNTL_X}, -#endif -/* [__NR_old_select - SYSCALL_TABLE_ID0] = {UF_USED, PPME_GENERIC_E, PPME_GENERIC_X}, */ - [__NR_pselect6 - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_GENERIC_E, PPME_GENERIC_X}, -#ifdef __NR_epoll_create - [__NR_epoll_create - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_GENERIC_E, PPME_GENERIC_X}, -#endif - [__NR_epoll_ctl - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_GENERIC_E, PPME_GENERIC_X}, -#ifdef __NR_uselib - [__NR_uselib - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_GENERIC_E, PPME_GENERIC_X}, -#endif - [__NR_sched_setparam - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_GENERIC_E, PPME_GENERIC_X}, - [__NR_sched_getparam - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_GENERIC_E, PPME_GENERIC_X}, - [__NR_syslog - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_GENERIC_E, PPME_GENERIC_X}, -#ifdef __NR_chmod - [__NR_chmod - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_CHMOD_E, PPME_SYSCALL_CHMOD_X}, -#endif -#ifdef __NR_lchown - [__NR_lchown - SYSCALL_TABLE_ID0] = {UF_USED, PPME_GENERIC_E, PPME_GENERIC_X}, -#endif -#ifdef __NR_utime - [__NR_utime - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_GENERIC_E, PPME_GENERIC_X}, -#endif - [__NR_mount - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_MOUNT_E, PPME_SYSCALL_MOUNT_X}, - [__NR_umount2 - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_UMOUNT_E, PPME_SYSCALL_UMOUNT_X}, - [__NR_ptrace - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_PTRACE_E, PPME_SYSCALL_PTRACE_X}, -#ifdef __NR_alarm - [__NR_alarm - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_GENERIC_E, PPME_GENERIC_X}, -#endif -#ifdef __NR_pause - [__NR_pause - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_GENERIC_E, PPME_GENERIC_X}, -#endif - -#ifndef __NR_socketcall - [__NR_socket - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP | UF_SIMPLEDRIVER_KEEP, PPME_SOCKET_SOCKET_E, PPME_SOCKET_SOCKET_X}, - [__NR_bind - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP, PPME_SOCKET_BIND_E, PPME_SOCKET_BIND_X}, - [__NR_connect - SYSCALL_TABLE_ID0] = {UF_USED | UF_SIMPLEDRIVER_KEEP, PPME_SOCKET_CONNECT_E, PPME_SOCKET_CONNECT_X}, - [__NR_listen - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SOCKET_LISTEN_E, PPME_SOCKET_LISTEN_X}, - [__NR_accept - SYSCALL_TABLE_ID0] = {UF_USED | UF_SIMPLEDRIVER_KEEP, PPME_SOCKET_ACCEPT_5_E, PPME_SOCKET_ACCEPT_5_X}, - [__NR_getsockname - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SOCKET_GETSOCKNAME_E, PPME_SOCKET_GETSOCKNAME_X}, - [__NR_getpeername - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SOCKET_GETPEERNAME_E, PPME_SOCKET_GETPEERNAME_X}, - [__NR_socketpair - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP, PPME_SOCKET_SOCKETPAIR_E, PPME_SOCKET_SOCKETPAIR_X}, - [__NR_sendto - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SOCKET_SENDTO_E, PPME_SOCKET_SENDTO_X}, - [__NR_recvfrom - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SOCKET_RECVFROM_E, PPME_SOCKET_RECVFROM_X}, - [__NR_shutdown - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SOCKET_SHUTDOWN_E, PPME_SOCKET_SHUTDOWN_X}, - [__NR_setsockopt - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SOCKET_SETSOCKOPT_E, PPME_SOCKET_SETSOCKOPT_X}, - [__NR_getsockopt - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SOCKET_GETSOCKOPT_E, PPME_SOCKET_GETSOCKOPT_X}, - [__NR_sendmsg - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SOCKET_SENDMSG_E, PPME_SOCKET_SENDMSG_X}, - [__NR_accept4 - SYSCALL_TABLE_ID0] = {UF_USED | UF_SIMPLEDRIVER_KEEP, PPME_SOCKET_ACCEPT4_5_E, PPME_SOCKET_ACCEPT4_5_X}, -#endif - -#ifdef __NR_sendmmsg - [__NR_sendmmsg - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SOCKET_SENDMMSG_E, PPME_SOCKET_SENDMMSG_X}, -#endif -#ifdef __NR_recvmsg - [__NR_recvmsg - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SOCKET_RECVMSG_E, PPME_SOCKET_RECVMSG_X}, -#endif -#ifdef __NR_recvmmsg - [__NR_recvmmsg - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SOCKET_RECVMMSG_E, PPME_SOCKET_RECVMMSG_X}, -#endif -#ifdef __NR_stat64 - [__NR_stat64 - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_STAT64_E, PPME_SYSCALL_STAT64_X}, -#endif -#ifdef __NR_fstat64 - [__NR_fstat64 - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_FSTAT64_E, PPME_SYSCALL_FSTAT64_X}, -#endif -#ifdef __NR__llseek - [__NR__llseek - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_LLSEEK_E, PPME_SYSCALL_LLSEEK_X}, -#endif -#ifdef __NR_mmap - [__NR_mmap - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_MMAP_E, PPME_SYSCALL_MMAP_X}, -#endif -#ifdef __NR_mmap2 - [__NR_mmap2 - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_MMAP2_E, PPME_SYSCALL_MMAP2_X}, -#endif - [__NR_munmap - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_MUNMAP_E, PPME_SYSCALL_MUNMAP_X}, - [__NR_splice - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_SPLICE_E, PPME_SYSCALL_SPLICE_X}, -#ifdef __NR_process_vm_readv - [__NR_process_vm_readv - SYSCALL_TABLE_ID0] = {UF_USED, PPME_GENERIC_E, PPME_GENERIC_X}, -#endif -#ifdef __NR_process_vm_writev - [__NR_process_vm_writev - SYSCALL_TABLE_ID0] = {UF_USED, PPME_GENERIC_E, PPME_GENERIC_X}, -#endif - -#ifdef __NR_rename - [__NR_rename - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_RENAME_E, PPME_SYSCALL_RENAME_X}, -#endif - [__NR_renameat - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_RENAMEAT_E, PPME_SYSCALL_RENAMEAT_X}, -#ifdef __NR_symlink - [__NR_symlink - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_SYMLINK_E, PPME_SYSCALL_SYMLINK_X}, -#endif - [__NR_symlinkat - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_SYMLINKAT_E, PPME_SYSCALL_SYMLINKAT_X}, - [__NR_sendfile - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_SENDFILE_E, PPME_SYSCALL_SENDFILE_X}, -#ifdef __NR_sendfile64 - [__NR_sendfile64 - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_SENDFILE_E, PPME_SYSCALL_SENDFILE_X}, -#endif -#ifdef __NR_quotactl - [__NR_quotactl - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_QUOTACTL_E, PPME_SYSCALL_QUOTACTL_X}, -#endif -#ifdef __NR_setresuid - [__NR_setresuid - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_SETRESUID_E, PPME_SYSCALL_SETRESUID_X }, -#endif -#ifdef __NR_setresuid32 - [__NR_setresuid32 - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_SETRESUID_E, PPME_SYSCALL_SETRESUID_X }, -#endif -#ifdef __NR_setresgid - [__NR_setresgid - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_SETRESGID_E, PPME_SYSCALL_SETRESGID_X }, -#endif -#ifdef __NR_setresgid32 - [__NR_setresgid32 - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_SETRESGID_E, PPME_SYSCALL_SETRESGID_X }, -#endif -#ifdef __NR_setuid - [__NR_setuid - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_SETUID_E, PPME_SYSCALL_SETUID_X }, -#endif -#ifdef __NR_setuid32 - [__NR_setuid32 - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_SETUID_E, PPME_SYSCALL_SETUID_X }, -#endif -#ifdef __NR_setgid - [__NR_setgid - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_SETGID_E, PPME_SYSCALL_SETGID_X }, -#endif -#ifdef __NR_setgid32 - [__NR_setgid32 - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_SETGID_E, PPME_SYSCALL_SETGID_X }, -#endif -#ifdef __NR_getuid - [__NR_getuid - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_GETUID_E, PPME_SYSCALL_GETUID_X }, -#endif -#ifdef __NR_getuid32 - [__NR_getuid32 - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_GETUID_E, PPME_SYSCALL_GETUID_X }, -#endif -#ifdef __NR_geteuid - [__NR_geteuid - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_GETEUID_E, PPME_SYSCALL_GETEUID_X }, -#endif -#ifdef __NR_geteuid32 - [__NR_geteuid32 - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_GETEUID_E, PPME_SYSCALL_GETEUID_X }, -#endif -#ifdef __NR_getgid - [__NR_getgid - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_GETGID_E, PPME_SYSCALL_GETGID_X }, -#endif -#ifdef __NR_getgid32 - [__NR_getgid32 - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_GETGID_E, PPME_SYSCALL_GETGID_X }, -#endif -#ifdef __NR_getegid - [__NR_getegid - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_GETEGID_E, PPME_SYSCALL_GETEGID_X }, -#endif -#ifdef __NR_getegid32 - [__NR_getegid32 - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_GETEGID_E, PPME_SYSCALL_GETEGID_X }, -#endif -#ifdef __NR_getresuid - [__NR_getresuid - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_GETRESUID_E, PPME_SYSCALL_GETRESUID_X }, -#endif -#ifdef __NR_getresuid32 - [__NR_getresuid32 - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_GETRESUID_E, PPME_SYSCALL_GETRESUID_X }, -#endif -#ifdef __NR_getresgid - [__NR_getresgid - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_GETRESGID_E, PPME_SYSCALL_GETRESGID_X }, -#endif -#ifdef __NR_getresgid32 - [__NR_getresgid32 - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_GETRESGID_E, PPME_SYSCALL_GETRESGID_X }, -#endif -#ifdef __NR_getdents - [__NR_getdents - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_GETDENTS_E, PPME_SYSCALL_GETDENTS_X}, -#endif - [__NR_getdents64 - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_GETDENTS64_E, PPME_SYSCALL_GETDENTS64_X}, -#ifdef __NR_setns - [__NR_setns - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_SETNS_E, PPME_SYSCALL_SETNS_X}, -#endif -#ifdef __NR_unshare - [__NR_unshare - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_UNSHARE_E, PPME_SYSCALL_UNSHARE_X}, -#endif - [__NR_flock - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_FLOCK_E, PPME_SYSCALL_FLOCK_X}, -#ifdef __NR_semop - [__NR_semop - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_SEMOP_E, PPME_SYSCALL_SEMOP_X}, -#endif -#ifdef __NR_semget - [__NR_semget - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_SEMGET_E, PPME_SYSCALL_SEMGET_X}, -#endif -#ifdef __NR_semctl - [__NR_semctl - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_SEMCTL_E, PPME_SYSCALL_SEMCTL_X}, -#endif - [__NR_ppoll - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_PPOLL_E, PPME_SYSCALL_PPOLL_X}, -#ifdef __NR_access - [__NR_access - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_ACCESS_E, PPME_SYSCALL_ACCESS_X}, -#endif -#ifdef __NR_chroot - [__NR_chroot - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP, PPME_SYSCALL_CHROOT_E, PPME_SYSCALL_CHROOT_X}, -#endif - [__NR_setsid - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_SETSID_E, PPME_SYSCALL_SETSID_X}, - [__NR_setpgid - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_SETPGID_E, PPME_SYSCALL_SETPGID_X}, -#ifdef __NR_bpf - [__NR_bpf - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_BPF_E, PPME_SYSCALL_BPF_X}, -#endif -#ifdef __NR_seccomp - [__NR_seccomp - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_SECCOMP_E, PPME_SYSCALL_SECCOMP_X}, -#endif -#ifdef __NR_renameat2 - [__NR_renameat2 - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_RENAMEAT2_E, PPME_SYSCALL_RENAMEAT2_X}, -#endif -#ifdef __NR_userfaultfd - [__NR_userfaultfd - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP, PPME_SYSCALL_USERFAULTFD_E, PPME_SYSCALL_USERFAULTFD_X}, -#endif -#ifdef __NR_openat2 - [__NR_openat2 - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_OPENAT2_E, PPME_SYSCALL_OPENAT2_X}, -#endif -#ifdef __NR_clone3 - [__NR_clone3 - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP | UF_SIMPLEDRIVER_KEEP, PPME_SYSCALL_CLONE3_E, PPME_SYSCALL_CLONE3_X}, -#endif -#ifdef __NR_mprotect - [__NR_mprotect - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_MPROTECT_E, PPME_SYSCALL_MPROTECT_X}, -#endif -#ifdef __NR_execveat - [__NR_execveat - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP | UF_SIMPLEDRIVER_KEEP, PPME_SYSCALL_EXECVEAT_E, PPME_SYSCALL_EXECVEAT_X}, -#endif -#ifdef __NR_io_uring_setup - [__NR_io_uring_setup - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_IO_URING_SETUP_E, PPME_SYSCALL_IO_URING_SETUP_X}, -#endif -#ifdef __NR_io_uring_enter - [__NR_io_uring_enter - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_IO_URING_ENTER_E, PPME_SYSCALL_IO_URING_ENTER_X}, -#endif -#ifdef __NR_io_uring_register - [__NR_io_uring_register - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_IO_URING_REGISTER_E, PPME_SYSCALL_IO_URING_REGISTER_X}, -#endif -#ifdef __NR_copy_file_range - [__NR_copy_file_range - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_COPY_FILE_RANGE_E, PPME_SYSCALL_COPY_FILE_RANGE_X}, -#endif -#ifdef __NR_open_by_handle_at - [__NR_open_by_handle_at - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_OPEN_BY_HANDLE_AT_E, PPME_SYSCALL_OPEN_BY_HANDLE_AT_X}, -#endif -#ifdef __NR_mlock - [__NR_mlock - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_MLOCK_E, PPME_SYSCALL_MLOCK_X}, -#endif -#ifdef __NR_munlock - [__NR_munlock - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_MUNLOCK_E, PPME_SYSCALL_MUNLOCK_X}, -#endif -#ifdef __NR_mlockall - [__NR_mlockall - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_MLOCKALL_E, PPME_SYSCALL_MLOCKALL_X}, -#endif -#ifdef __NR_munlockall - [__NR_munlockall - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_MUNLOCKALL_E, PPME_SYSCALL_MUNLOCKALL_X}, -#endif -}; - -/* - * SYSCALL ROUTING TABLE - */ -const enum ppm_syscall_code g_syscall_code_routing_table[SYSCALL_TABLE_SIZE] = { - [__NR_restart_syscall - SYSCALL_TABLE_ID0] = PPM_SC_RESTART_SYSCALL, - [__NR_exit - SYSCALL_TABLE_ID0] = PPM_SC_EXIT, - [__NR_read - SYSCALL_TABLE_ID0] = PPM_SC_READ, - [__NR_write - SYSCALL_TABLE_ID0] = PPM_SC_WRITE, - [__NR_execve - SYSCALL_TABLE_ID0] = PPM_SC_EXECVE, -#ifdef __NR_open - [__NR_open - SYSCALL_TABLE_ID0] = PPM_SC_OPEN, -#endif - [__NR_close - SYSCALL_TABLE_ID0] = PPM_SC_CLOSE, -#ifdef __NR_open - [__NR_creat - SYSCALL_TABLE_ID0] = PPM_SC_CREAT, -#endif -#ifdef __NR_link - [__NR_link - SYSCALL_TABLE_ID0] = PPM_SC_LINK, -#endif -#ifdef __NR_unlink - [__NR_unlink - SYSCALL_TABLE_ID0] = PPM_SC_UNLINK, -#endif - [__NR_chdir - SYSCALL_TABLE_ID0] = PPM_SC_CHDIR, -#ifdef __NR_time - [__NR_time - SYSCALL_TABLE_ID0] = PPM_SC_TIME, -#endif -#ifdef __NR_mknod - [__NR_mknod - SYSCALL_TABLE_ID0] = PPM_SC_MKNOD, -#endif -#ifdef __NR_chmod - [__NR_chmod - SYSCALL_TABLE_ID0] = PPM_SC_CHMOD, -#endif -/* [__NR_lchown16 - SYSCALL_TABLE_ID0] = PPM_SC_NR_LCHOWN16, */ -#ifdef __NR_stat - [__NR_stat - SYSCALL_TABLE_ID0] = PPM_SC_STAT, -#endif - [__NR_lseek - SYSCALL_TABLE_ID0] = PPM_SC_LSEEK, - [__NR_getpid - SYSCALL_TABLE_ID0] = PPM_SC_GETPID, - [__NR_mount - SYSCALL_TABLE_ID0] = PPM_SC_MOUNT, - [__NR_umount2 - SYSCALL_TABLE_ID0] = PPM_SC_UMOUNT2, -/* [__NR_oldumount - SYSCALL_TABLE_ID0] = PPM_SC_NR_OLDUMOUNT, */ -/* [__NR_setuid16 - SYSCALL_TABLE_ID0] = PPM_SC_NR_SETUID16, */ -/* [__NR_getuid16 - SYSCALL_TABLE_ID0] = PPM_SC_NR_GETUID16, */ - [__NR_ptrace - SYSCALL_TABLE_ID0] = PPM_SC_PTRACE, -#ifdef __NR_alarm - [__NR_alarm - SYSCALL_TABLE_ID0] = PPM_SC_ALARM, -#endif - [__NR_fstat - SYSCALL_TABLE_ID0] = PPM_SC_FSTAT, -#ifdef __NR_pause - [__NR_pause - SYSCALL_TABLE_ID0] = PPM_SC_PAUSE, -#endif -#ifdef __NR_utime - [__NR_utime - SYSCALL_TABLE_ID0] = PPM_SC_UTIME, -#endif - [__NR_sync - SYSCALL_TABLE_ID0] = PPM_SC_SYNC, - [__NR_kill - SYSCALL_TABLE_ID0] = PPM_SC_KILL, -#ifdef __NR_rename - [__NR_rename - SYSCALL_TABLE_ID0] = PPM_SC_RENAME, -#endif -#ifdef __NR_mkdir - [__NR_mkdir - SYSCALL_TABLE_ID0] = PPM_SC_MKDIR, -#endif -#ifdef __NR_rmdir - [__NR_rmdir - SYSCALL_TABLE_ID0] = PPM_SC_RMDIR, -#endif - [__NR_dup - SYSCALL_TABLE_ID0] = PPM_SC_DUP, -#ifdef __NR_pipe - [__NR_pipe - SYSCALL_TABLE_ID0] = PPM_SC_PIPE, -#endif - [__NR_times - SYSCALL_TABLE_ID0] = PPM_SC_TIMES, - [__NR_brk - SYSCALL_TABLE_ID0] = PPM_SC_BRK, -/* [__NR_setgid16 - SYSCALL_TABLE_ID0] = PPM_SC_NR_SETGID16, */ -/* [__NR_getgid16 - SYSCALL_TABLE_ID0] = PPM_SC_NR_GETGID16, */ -/* [__NR_geteuid16 - SYSCALL_TABLE_ID0] = PPM_SC_NR_GETEUID16, */ -/* [__NR_getegid16 - SYSCALL_TABLE_ID0] = PPM_SC_NR_GETEGID16, */ - [__NR_acct - SYSCALL_TABLE_ID0] = PPM_SC_ACCT, - [__NR_ioctl - SYSCALL_TABLE_ID0] = PPM_SC_IOCTL, - [__NR_fcntl - SYSCALL_TABLE_ID0] = PPM_SC_FCNTL, - [__NR_setpgid - SYSCALL_TABLE_ID0] = PPM_SC_SETPGID, - [__NR_umask - SYSCALL_TABLE_ID0] = PPM_SC_UMASK, - [__NR_chroot - SYSCALL_TABLE_ID0] = PPM_SC_CHROOT, -#ifdef __NR_ustat - [__NR_ustat - SYSCALL_TABLE_ID0] = PPM_SC_USTAT, -#endif -#ifdef __NR_dup2 - [__NR_dup2 - SYSCALL_TABLE_ID0] = PPM_SC_DUP2, -#endif - [__NR_getppid - SYSCALL_TABLE_ID0] = PPM_SC_GETPPID, -#ifdef __NR_getpgrp - [__NR_getpgrp - SYSCALL_TABLE_ID0] = PPM_SC_GETPGRP, -#endif - [__NR_setsid - SYSCALL_TABLE_ID0] = PPM_SC_SETSID, - [__NR_sethostname - SYSCALL_TABLE_ID0] = PPM_SC_SETHOSTNAME, - [__NR_setrlimit - SYSCALL_TABLE_ID0] = PPM_SC_SETRLIMIT, -/* [__NR_old_getrlimit - SYSCALL_TABLE_ID0] = PPM_SC_NR_OLD_GETRLIMIT, */ - [__NR_getrusage - SYSCALL_TABLE_ID0] = PPM_SC_GETRUSAGE, - [__NR_gettimeofday - SYSCALL_TABLE_ID0] = PPM_SC_GETTIMEOFDAY, - [__NR_settimeofday - SYSCALL_TABLE_ID0] = PPM_SC_SETTIMEOFDAY, -/* [__NR_getgroups16 - SYSCALL_TABLE_ID0] = PPM_SC_NR_GETGROUPS16, */ -/* [__NR_setgroups16 - SYSCALL_TABLE_ID0] = PPM_SC_NR_SETGROUPS16, */ -/* [__NR_old_select - SYSCALL_TABLE_ID0] = PPM_SC_NR_OLD_SELECT, */ -#ifdef __NR_symlink - [__NR_symlink - SYSCALL_TABLE_ID0] = PPM_SC_SYMLINK, -#endif -#ifdef __NR_lstat - [__NR_lstat - SYSCALL_TABLE_ID0] = PPM_SC_LSTAT, -#endif -#ifdef __NR_readlink - [__NR_readlink - SYSCALL_TABLE_ID0] = PPM_SC_READLINK, -#endif -#ifdef __NR_uselib - [__NR_uselib - SYSCALL_TABLE_ID0] = PPM_SC_USELIB, -#endif - [__NR_swapon - SYSCALL_TABLE_ID0] = PPM_SC_SWAPON, - [__NR_reboot - SYSCALL_TABLE_ID0] = PPM_SC_REBOOT, -/* [__NR_old_readdir - SYSCALL_TABLE_ID0] = PPM_SC_NR_OLD_READDIR, */ -/* [__NR_old_mmap - SYSCALL_TABLE_ID0] = PPM_SC_NR_OLD_MMAP, */ -#ifdef __NR_mmap - [__NR_mmap - SYSCALL_TABLE_ID0] = PPM_SC_MMAP, -#endif - [__NR_munmap - SYSCALL_TABLE_ID0] = PPM_SC_MUNMAP, - [__NR_truncate - SYSCALL_TABLE_ID0] = PPM_SC_TRUNCATE, - [__NR_ftruncate - SYSCALL_TABLE_ID0] = PPM_SC_FTRUNCATE, - [__NR_fchmod - SYSCALL_TABLE_ID0] = PPM_SC_FCHMOD, -/* [__NR_fchown16 - SYSCALL_TABLE_ID0] = PPM_SC_NR_FCHOWN16, */ - [__NR_getpriority - SYSCALL_TABLE_ID0] = PPM_SC_GETPRIORITY, - [__NR_setpriority - SYSCALL_TABLE_ID0] = PPM_SC_SETPRIORITY, - [__NR_statfs - SYSCALL_TABLE_ID0] = PPM_SC_STATFS, - [__NR_fstatfs - SYSCALL_TABLE_ID0] = PPM_SC_FSTATFS, - [__NR_syslog - SYSCALL_TABLE_ID0] = PPM_SC_SYSLOG, - [__NR_setitimer - SYSCALL_TABLE_ID0] = PPM_SC_SETITIMER, - [__NR_getitimer - SYSCALL_TABLE_ID0] = PPM_SC_GETITIMER, -/* [__NR_newstat - SYSCALL_TABLE_ID0] = PPM_SC_NR_NEWSTAT, */ -/* [__NR_newlstat - SYSCALL_TABLE_ID0] = PPM_SC_NR_NEWLSTAT, */ -/* [__NR_newfstat - SYSCALL_TABLE_ID0] = PPM_SC_NR_NEWFSTAT, */ - [__NR_uname - SYSCALL_TABLE_ID0] = PPM_SC_UNAME, - [__NR_vhangup - SYSCALL_TABLE_ID0] = PPM_SC_VHANGUP, - [__NR_wait4 - SYSCALL_TABLE_ID0] = PPM_SC_WAIT4, - [__NR_swapoff - SYSCALL_TABLE_ID0] = PPM_SC_SWAPOFF, - [__NR_sysinfo - SYSCALL_TABLE_ID0] = PPM_SC_SYSINFO, - [__NR_fsync - SYSCALL_TABLE_ID0] = PPM_SC_FSYNC, - [__NR_setdomainname - SYSCALL_TABLE_ID0] = PPM_SC_SETDOMAINNAME, -/* [__NR_newuname - SYSCALL_TABLE_ID0] = PPM_SC_NR_NEWUNAME, */ - [__NR_adjtimex - SYSCALL_TABLE_ID0] = PPM_SC_ADJTIMEX, - [__NR_mprotect - SYSCALL_TABLE_ID0] = PPM_SC_MPROTECT, - [__NR_init_module - SYSCALL_TABLE_ID0] = PPM_SC_INIT_MODULE, - [__NR_delete_module - SYSCALL_TABLE_ID0] = PPM_SC_DELETE_MODULE, - [__NR_getpgid - SYSCALL_TABLE_ID0] = PPM_SC_GETPGID, - [__NR_fchdir - SYSCALL_TABLE_ID0] = PPM_SC_FCHDIR, -#ifdef __NR_sysfs - [__NR_sysfs - SYSCALL_TABLE_ID0] = PPM_SC_SYSFS, -#endif - [__NR_personality - SYSCALL_TABLE_ID0] = PPM_SC_PERSONALITY, -/* [__NR_setfsuid16 - SYSCALL_TABLE_ID0] = PPM_SC_NR_SETFSUID16, */ -/* [__NR_setfsgid16 - SYSCALL_TABLE_ID0] = PPM_SC_NR_SETFSGID16, */ -/* [__NR_llseek - SYSCALL_TABLE_ID0] = PPM_SC_NR_LLSEEK, */ -#ifdef __NR_getdents - [__NR_getdents - SYSCALL_TABLE_ID0] = PPM_SC_GETDENTS, -#endif -#ifdef __NR_select - [__NR_select - SYSCALL_TABLE_ID0] = PPM_SC_SELECT, -#endif - [__NR_flock - SYSCALL_TABLE_ID0] = PPM_SC_FLOCK, - [__NR_msync - SYSCALL_TABLE_ID0] = PPM_SC_MSYNC, - [__NR_readv - SYSCALL_TABLE_ID0] = PPM_SC_READV, - [__NR_writev - SYSCALL_TABLE_ID0] = PPM_SC_WRITEV, - [__NR_getsid - SYSCALL_TABLE_ID0] = PPM_SC_GETSID, - [__NR_fdatasync - SYSCALL_TABLE_ID0] = PPM_SC_FDATASYNC, -/* [__NR_sysctl - SYSCALL_TABLE_ID0] = PPM_SC_NR_SYSCTL, */ - [__NR_mlock - SYSCALL_TABLE_ID0] = PPM_SC_MLOCK, - [__NR_munlock - SYSCALL_TABLE_ID0] = PPM_SC_MUNLOCK, - [__NR_mlockall - SYSCALL_TABLE_ID0] = PPM_SC_MLOCKALL, - [__NR_munlockall - SYSCALL_TABLE_ID0] = PPM_SC_MUNLOCKALL, - [__NR_sched_setparam - SYSCALL_TABLE_ID0] = PPM_SC_SCHED_SETPARAM, - [__NR_sched_getparam - SYSCALL_TABLE_ID0] = PPM_SC_SCHED_GETPARAM, - [__NR_sched_setscheduler - SYSCALL_TABLE_ID0] = PPM_SC_SCHED_SETSCHEDULER, - [__NR_sched_getscheduler - SYSCALL_TABLE_ID0] = PPM_SC_SCHED_GETSCHEDULER, - [__NR_sched_yield - SYSCALL_TABLE_ID0] = PPM_SC_SCHED_YIELD, - [__NR_sched_get_priority_max - SYSCALL_TABLE_ID0] = PPM_SC_SCHED_GET_PRIORITY_MAX, - [__NR_sched_get_priority_min - SYSCALL_TABLE_ID0] = PPM_SC_SCHED_GET_PRIORITY_MIN, - [__NR_sched_rr_get_interval - SYSCALL_TABLE_ID0] = PPM_SC_SCHED_RR_GET_INTERVAL, - [__NR_nanosleep - SYSCALL_TABLE_ID0] = PPM_SC_NANOSLEEP, - [__NR_mremap - SYSCALL_TABLE_ID0] = PPM_SC_MREMAP, -/* [__NR_setresuid16 - SYSCALL_TABLE_ID0] = PPM_SC_NR_SETRESUID16, */ -/* [__NR_getresuid16 - SYSCALL_TABLE_ID0] = PPM_SC_NR_GETRESUID16, */ -#ifdef __NR_poll - [__NR_poll - SYSCALL_TABLE_ID0] = PPM_SC_POLL, -#endif -/* [__NR_setresgid16 - SYSCALL_TABLE_ID0] = PPM_SC_NR_SETRESGID16, */ -/* [__NR_getresgid16 - SYSCALL_TABLE_ID0] = PPM_SC_NR_GETRESGID16, */ - [__NR_prctl - SYSCALL_TABLE_ID0] = PPM_SC_PRCTL, -#ifdef __NR_arch_prctl - [__NR_arch_prctl - SYSCALL_TABLE_ID0] = PPM_SC_ARCH_PRCTL, -#endif - [__NR_rt_sigaction - SYSCALL_TABLE_ID0] = PPM_SC_RT_SIGACTION, - [__NR_rt_sigprocmask - SYSCALL_TABLE_ID0] = PPM_SC_RT_SIGPROCMASK, - [__NR_rt_sigpending - SYSCALL_TABLE_ID0] = PPM_SC_RT_SIGPENDING, - [__NR_rt_sigtimedwait - SYSCALL_TABLE_ID0] = PPM_SC_RT_SIGTIMEDWAIT, - [__NR_rt_sigqueueinfo - SYSCALL_TABLE_ID0] = PPM_SC_RT_SIGQUEUEINFO, - [__NR_rt_sigsuspend - SYSCALL_TABLE_ID0] = PPM_SC_RT_SIGSUSPEND, -/* [__NR_chown16 - SYSCALL_TABLE_ID0] = PPM_SC_NR_CHOWN16, */ - [__NR_getcwd - SYSCALL_TABLE_ID0] = PPM_SC_GETCWD, - [__NR_capget - SYSCALL_TABLE_ID0] = PPM_SC_CAPGET, - [__NR_capset - SYSCALL_TABLE_ID0] = PPM_SC_CAPSET, - [__NR_sendfile - SYSCALL_TABLE_ID0] = PPM_SC_SENDFILE, -#ifdef __NR_getrlimit - [__NR_getrlimit - SYSCALL_TABLE_ID0] = PPM_SC_GETRLIMIT, -#endif -/* [__NR_mmap_pgoff - SYSCALL_TABLE_ID0] = PPM_SC_NR_MMAP_PGOFF, */ -#ifdef __NR_lchown - [__NR_lchown - SYSCALL_TABLE_ID0] = PPM_SC_LCHOWN, -#endif - [__NR_setreuid - SYSCALL_TABLE_ID0] = PPM_SC_SETREUID, - [__NR_setregid - SYSCALL_TABLE_ID0] = PPM_SC_SETREGID, - [__NR_getgroups - SYSCALL_TABLE_ID0] = PPM_SC_GETGROUPS, - [__NR_setgroups - SYSCALL_TABLE_ID0] = PPM_SC_SETGROUPS, - [__NR_fchown - SYSCALL_TABLE_ID0] = PPM_SC_FCHOWN, -#ifdef __NR_chown - [__NR_chown - SYSCALL_TABLE_ID0] = PPM_SC_CHOWN, -#endif - [__NR_setfsuid - SYSCALL_TABLE_ID0] = PPM_SC_SETFSUID, - [__NR_setfsgid - SYSCALL_TABLE_ID0] = PPM_SC_SETFSGID, - [__NR_pivot_root - SYSCALL_TABLE_ID0] = PPM_SC_PIVOT_ROOT, - [__NR_mincore - SYSCALL_TABLE_ID0] = PPM_SC_MINCORE, - [__NR_madvise - SYSCALL_TABLE_ID0] = PPM_SC_MADVISE, - [__NR_gettid - SYSCALL_TABLE_ID0] = PPM_SC_GETTID, - [__NR_setxattr - SYSCALL_TABLE_ID0] = PPM_SC_SETXATTR, - [__NR_lsetxattr - SYSCALL_TABLE_ID0] = PPM_SC_LSETXATTR, - [__NR_fsetxattr - SYSCALL_TABLE_ID0] = PPM_SC_FSETXATTR, - [__NR_getxattr - SYSCALL_TABLE_ID0] = PPM_SC_GETXATTR, - [__NR_lgetxattr - SYSCALL_TABLE_ID0] = PPM_SC_LGETXATTR, - [__NR_fgetxattr - SYSCALL_TABLE_ID0] = PPM_SC_FGETXATTR, - [__NR_listxattr - SYSCALL_TABLE_ID0] = PPM_SC_LISTXATTR, - [__NR_llistxattr - SYSCALL_TABLE_ID0] = PPM_SC_LLISTXATTR, - [__NR_flistxattr - SYSCALL_TABLE_ID0] = PPM_SC_FLISTXATTR, - [__NR_removexattr - SYSCALL_TABLE_ID0] = PPM_SC_REMOVEXATTR, - [__NR_lremovexattr - SYSCALL_TABLE_ID0] = PPM_SC_LREMOVEXATTR, - [__NR_fremovexattr - SYSCALL_TABLE_ID0] = PPM_SC_FREMOVEXATTR, - [__NR_tkill - SYSCALL_TABLE_ID0] = PPM_SC_TKILL, - [__NR_futex - SYSCALL_TABLE_ID0] = PPM_SC_FUTEX, - [__NR_sched_setaffinity - SYSCALL_TABLE_ID0] = PPM_SC_SCHED_SETAFFINITY, - [__NR_sched_getaffinity - SYSCALL_TABLE_ID0] = PPM_SC_SCHED_GETAFFINITY, -#ifdef __NR_set_thread_area - [__NR_set_thread_area - SYSCALL_TABLE_ID0] = PPM_SC_SET_THREAD_AREA, -#endif -#ifdef __NR_get_thread_area - [__NR_get_thread_area - SYSCALL_TABLE_ID0] = PPM_SC_GET_THREAD_AREA, -#endif - [__NR_io_setup - SYSCALL_TABLE_ID0] = PPM_SC_IO_SETUP, - [__NR_io_destroy - SYSCALL_TABLE_ID0] = PPM_SC_IO_DESTROY, - [__NR_io_getevents - SYSCALL_TABLE_ID0] = PPM_SC_IO_GETEVENTS, - [__NR_io_submit - SYSCALL_TABLE_ID0] = PPM_SC_IO_SUBMIT, - [__NR_io_cancel - SYSCALL_TABLE_ID0] = PPM_SC_IO_CANCEL, - [__NR_exit_group - SYSCALL_TABLE_ID0] = PPM_SC_EXIT_GROUP, -#ifdef __NR_epoll_create - [__NR_epoll_create - SYSCALL_TABLE_ID0] = PPM_SC_EPOLL_CREATE, -#endif - [__NR_epoll_ctl - SYSCALL_TABLE_ID0] = PPM_SC_EPOLL_CTL, -#ifdef __NR_epoll_wait - [__NR_epoll_wait - SYSCALL_TABLE_ID0] = PPM_SC_EPOLL_WAIT, -#endif - [__NR_remap_file_pages - SYSCALL_TABLE_ID0] = PPM_SC_REMAP_FILE_PAGES, - [__NR_set_tid_address - SYSCALL_TABLE_ID0] = PPM_SC_SET_TID_ADDRESS, - [__NR_timer_create - SYSCALL_TABLE_ID0] = PPM_SC_TIMER_CREATE, - [__NR_timer_settime - SYSCALL_TABLE_ID0] = PPM_SC_TIMER_SETTIME, - [__NR_timer_gettime - SYSCALL_TABLE_ID0] = PPM_SC_TIMER_GETTIME, - [__NR_timer_getoverrun - SYSCALL_TABLE_ID0] = PPM_SC_TIMER_GETOVERRUN, - [__NR_timer_delete - SYSCALL_TABLE_ID0] = PPM_SC_TIMER_DELETE, - [__NR_clock_settime - SYSCALL_TABLE_ID0] = PPM_SC_CLOCK_SETTIME, - [__NR_clock_gettime - SYSCALL_TABLE_ID0] = PPM_SC_CLOCK_GETTIME, - [__NR_clock_getres - SYSCALL_TABLE_ID0] = PPM_SC_CLOCK_GETRES, - [__NR_clock_nanosleep - SYSCALL_TABLE_ID0] = PPM_SC_CLOCK_NANOSLEEP, - [__NR_tgkill - SYSCALL_TABLE_ID0] = PPM_SC_TGKILL, -#ifdef __NR_utimes - [__NR_utimes - SYSCALL_TABLE_ID0] = PPM_SC_UTIMES, -#endif - [__NR_mq_open - SYSCALL_TABLE_ID0] = PPM_SC_MQ_OPEN, - [__NR_mq_unlink - SYSCALL_TABLE_ID0] = PPM_SC_MQ_UNLINK, - [__NR_mq_timedsend - SYSCALL_TABLE_ID0] = PPM_SC_MQ_TIMEDSEND, - [__NR_mq_timedreceive - SYSCALL_TABLE_ID0] = PPM_SC_MQ_TIMEDRECEIVE, - [__NR_mq_notify - SYSCALL_TABLE_ID0] = PPM_SC_MQ_NOTIFY, - [__NR_mq_getsetattr - SYSCALL_TABLE_ID0] = PPM_SC_MQ_GETSETATTR, - [__NR_kexec_load - SYSCALL_TABLE_ID0] = PPM_SC_KEXEC_LOAD, - [__NR_waitid - SYSCALL_TABLE_ID0] = PPM_SC_WAITID, - [__NR_add_key - SYSCALL_TABLE_ID0] = PPM_SC_ADD_KEY, - [__NR_request_key - SYSCALL_TABLE_ID0] = PPM_SC_REQUEST_KEY, - [__NR_keyctl - SYSCALL_TABLE_ID0] = PPM_SC_KEYCTL, - [__NR_ioprio_set - SYSCALL_TABLE_ID0] = PPM_SC_IOPRIO_SET, - [__NR_ioprio_get - SYSCALL_TABLE_ID0] = PPM_SC_IOPRIO_GET, -#ifdef __NR_inotify_init - [__NR_inotify_init - SYSCALL_TABLE_ID0] = PPM_SC_INOTIFY_INIT, -#endif - [__NR_inotify_add_watch - SYSCALL_TABLE_ID0] = PPM_SC_INOTIFY_ADD_WATCH, - [__NR_inotify_rm_watch - SYSCALL_TABLE_ID0] = PPM_SC_INOTIFY_RM_WATCH, - [__NR_openat - SYSCALL_TABLE_ID0] = PPM_SC_OPENAT, - [__NR_mkdirat - SYSCALL_TABLE_ID0] = PPM_SC_MKDIRAT, - [__NR_mknodat - SYSCALL_TABLE_ID0] = PPM_SC_MKNODAT, - [__NR_fchownat - SYSCALL_TABLE_ID0] = PPM_SC_FCHOWNAT, -#ifdef __NR_futimesat - [__NR_futimesat - SYSCALL_TABLE_ID0] = PPM_SC_FUTIMESAT, -#endif - [__NR_unlinkat - SYSCALL_TABLE_ID0] = PPM_SC_UNLINKAT, - [__NR_renameat - SYSCALL_TABLE_ID0] = PPM_SC_RENAMEAT, - [__NR_linkat - SYSCALL_TABLE_ID0] = PPM_SC_LINKAT, - [__NR_symlinkat - SYSCALL_TABLE_ID0] = PPM_SC_SYMLINKAT, - [__NR_readlinkat - SYSCALL_TABLE_ID0] = PPM_SC_READLINKAT, - [__NR_fchmodat - SYSCALL_TABLE_ID0] = PPM_SC_FCHMODAT, - [__NR_faccessat - SYSCALL_TABLE_ID0] = PPM_SC_FACCESSAT, - [__NR_pselect6 - SYSCALL_TABLE_ID0] = PPM_SC_PSELECT6, - [__NR_ppoll - SYSCALL_TABLE_ID0] = PPM_SC_PPOLL, - [__NR_unshare - SYSCALL_TABLE_ID0] = PPM_SC_UNSHARE, - [__NR_set_robust_list - SYSCALL_TABLE_ID0] = PPM_SC_SET_ROBUST_LIST, - [__NR_get_robust_list - SYSCALL_TABLE_ID0] = PPM_SC_GET_ROBUST_LIST, - [__NR_splice - SYSCALL_TABLE_ID0] = PPM_SC_SPLICE, - [__NR_tee - SYSCALL_TABLE_ID0] = PPM_SC_TEE, - [__NR_vmsplice - SYSCALL_TABLE_ID0] = PPM_SC_VMSPLICE, -#ifdef __NR_getcpu - [__NR_getcpu - SYSCALL_TABLE_ID0] = PPM_SC_GETCPU, -#endif - [__NR_epoll_pwait - SYSCALL_TABLE_ID0] = PPM_SC_EPOLL_PWAIT, - [__NR_utimensat - SYSCALL_TABLE_ID0] = PPM_SC_UTIMENSAT, -#ifdef __NR_signalfd - [__NR_signalfd - SYSCALL_TABLE_ID0] = PPM_SC_SIGNALFD, -#endif - [__NR_timerfd_create - SYSCALL_TABLE_ID0] = PPM_SC_TIMERFD_CREATE, -#ifdef __NR_eventfd - [__NR_eventfd - SYSCALL_TABLE_ID0] = PPM_SC_EVENTFD, -#endif - [__NR_timerfd_settime - SYSCALL_TABLE_ID0] = PPM_SC_TIMERFD_SETTIME, - [__NR_timerfd_gettime - SYSCALL_TABLE_ID0] = PPM_SC_TIMERFD_GETTIME, - [__NR_signalfd4 - SYSCALL_TABLE_ID0] = PPM_SC_SIGNALFD4, - [__NR_eventfd2 - SYSCALL_TABLE_ID0] = PPM_SC_EVENTFD2, - [__NR_epoll_create1 - SYSCALL_TABLE_ID0] = PPM_SC_EPOLL_CREATE1, - [__NR_dup3 - SYSCALL_TABLE_ID0] = PPM_SC_DUP3, - [__NR_pipe2 - SYSCALL_TABLE_ID0] = PPM_SC_PIPE2, - [__NR_inotify_init1 - SYSCALL_TABLE_ID0] = PPM_SC_INOTIFY_INIT1, - [__NR_preadv - SYSCALL_TABLE_ID0] = PPM_SC_PREADV, - [__NR_pwritev - SYSCALL_TABLE_ID0] = PPM_SC_PWRITEV, - [__NR_rt_tgsigqueueinfo - SYSCALL_TABLE_ID0] = PPM_SC_RT_TGSIGQUEUEINFO, - [__NR_perf_event_open - SYSCALL_TABLE_ID0] = PPM_SC_PERF_EVENT_OPEN, -#ifdef __NR_fanotify_init - [__NR_fanotify_init - SYSCALL_TABLE_ID0] = PPM_SC_FANOTIFY_INIT, -#endif -#ifdef __NR_prlimit64 - [__NR_prlimit64 - SYSCALL_TABLE_ID0] = PPM_SC_PRLIMIT64, -#endif -#ifdef __NR_clock_adjtime - [__NR_clock_adjtime - SYSCALL_TABLE_ID0] = PPM_SC_CLOCK_ADJTIME, -#endif -#ifdef __NR_syncfs - [__NR_syncfs - SYSCALL_TABLE_ID0] = PPM_SC_SYNCFS, -#endif - [__NR_getdents64 - SYSCALL_TABLE_ID0] = PPM_SC_GETDENTS64, -#ifndef __NR_socketcall - /* - * Non-multiplexed socket family - */ - [__NR_socket - SYSCALL_TABLE_ID0] = PPM_SC_SOCKET, - [__NR_bind - SYSCALL_TABLE_ID0] = PPM_SC_BIND, - [__NR_connect - SYSCALL_TABLE_ID0] = PPM_SC_CONNECT, - [__NR_listen - SYSCALL_TABLE_ID0] = PPM_SC_LISTEN, - [__NR_accept - SYSCALL_TABLE_ID0] = PPM_SC_ACCEPT, - [__NR_getsockname - SYSCALL_TABLE_ID0] = PPM_SC_GETSOCKNAME, - [__NR_getpeername - SYSCALL_TABLE_ID0] = PPM_SC_GETPEERNAME, - [__NR_socketpair - SYSCALL_TABLE_ID0] = PPM_SC_SOCKETPAIR, -/* [__NR_send - SYSCALL_TABLE_ID0] = PPM_SC_NR_SEND, */ - [__NR_sendto - SYSCALL_TABLE_ID0] = PPM_SC_SENDTO, -/* [__NR_recv - SYSCALL_TABLE_ID0] = PPM_SC_NR_RECV, */ - [__NR_recvfrom - SYSCALL_TABLE_ID0] = PPM_SC_RECVFROM, - [__NR_shutdown - SYSCALL_TABLE_ID0] = PPM_SC_SHUTDOWN, - [__NR_setsockopt - SYSCALL_TABLE_ID0] = PPM_SC_SETSOCKOPT, - [__NR_getsockopt - SYSCALL_TABLE_ID0] = PPM_SC_GETSOCKOPT, - [__NR_sendmsg - SYSCALL_TABLE_ID0] = PPM_SC_SENDMSG, - [__NR_recvmsg - SYSCALL_TABLE_ID0] = PPM_SC_RECVMSG, - [__NR_accept4 - SYSCALL_TABLE_ID0] = PPM_SC_ACCEPT4, -#else - [__NR_socketcall - SYSCALL_TABLE_ID0] = PPM_SC_SOCKETCALL, -#endif - - -#ifdef __NR_sendmmsg - [__NR_sendmmsg - SYSCALL_TABLE_ID0] = PPM_SC_SENDMMSG, -#endif -#ifdef __NR_recvmmsg - [__NR_recvmmsg - SYSCALL_TABLE_ID0] = PPM_SC_RECVMMSG, -#endif - /* - * Non-multiplexed IPC family - */ -#ifdef __NR_semop - [__NR_semop - SYSCALL_TABLE_ID0] = PPM_SC_SEMOP, -#endif -#ifdef __NR_semget - [__NR_semget - SYSCALL_TABLE_ID0] = PPM_SC_SEMGET, -#endif -#ifdef __NR_semctl - [__NR_semctl - SYSCALL_TABLE_ID0] = PPM_SC_SEMCTL, -#endif -#ifdef __NR_msgsnd - [__NR_msgsnd - SYSCALL_TABLE_ID0] = PPM_SC_MSGSND, -#endif -#ifdef __NR_msgrcv - [__NR_msgrcv - SYSCALL_TABLE_ID0] = PPM_SC_MSGRCV, -#endif -#ifdef __NR_msgget - [__NR_msgget - SYSCALL_TABLE_ID0] = PPM_SC_MSGGET, -#endif -#ifdef __NR_msgctl - [__NR_msgctl - SYSCALL_TABLE_ID0] = PPM_SC_MSGCTL, -#endif -/* [__NR_shmatcall - SYSCALL_TABLE_ID0] = PPM_SC_NR_SHMATCALL, */ -#ifdef __NR_shmdt - [__NR_shmdt - SYSCALL_TABLE_ID0] = PPM_SC_SHMDT, -#endif -#ifdef __NR_shmget - [__NR_shmget - SYSCALL_TABLE_ID0] = PPM_SC_SHMGET, -#endif -#ifdef __NR_shmctl - [__NR_shmctl - SYSCALL_TABLE_ID0] = PPM_SC_SHMCTL, -#endif -/* [__NR_fcntl64 - SYSCALL_TABLE_ID0] = PPM_SC_NR_FCNTL64, */ -#ifdef __NR_statfs64 - [__NR_statfs64 - SYSCALL_TABLE_ID0] = PPM_SC_STATFS64, -#endif -#ifdef __NR_fstatfs64 - [__NR_fstatfs64 - SYSCALL_TABLE_ID0] = PPM_SC_FSTATFS64, -#endif -#ifdef __NR_fstatat64 - [__NR_fstatat64 - SYSCALL_TABLE_ID0] = PPM_SC_FSTATAT64, -#endif -#ifdef __NR_sendfile64 - [__NR_sendfile64 - SYSCALL_TABLE_ID0] = PPM_SC_SENDFILE64, -#endif -#ifdef __NR_ugetrlimit - [__NR_ugetrlimit - SYSCALL_TABLE_ID0] = PPM_SC_UGETRLIMIT, -#endif -#ifdef __NR_bdflush - [__NR_bdflush - SYSCALL_TABLE_ID0] = PPM_SC_BDFLUSH, -#endif -#ifdef __NR_sigprocmask - [__NR_sigprocmask - SYSCALL_TABLE_ID0] = PPM_SC_SIGPROCMASK, -#endif -#ifdef __NR_ipc - [__NR_ipc - SYSCALL_TABLE_ID0] = PPM_SC_IPC, -#endif -#ifdef __NR_stat64 - [__NR_stat64 - SYSCALL_TABLE_ID0] = PPM_SC_STAT64, -#endif -#ifdef __NR_lstat64 - [__NR_lstat64 - SYSCALL_TABLE_ID0] = PPM_SC_LSTAT64, -#endif -#ifdef __NR_fstat64 - [__NR_fstat64 - SYSCALL_TABLE_ID0] = PPM_SC_FSTAT64, -#endif -#ifdef __NR_fcntl64 - [__NR_fcntl64 - SYSCALL_TABLE_ID0] = PPM_SC_FCNTL64, -#endif -#ifdef __NR_mmap2 - [__NR_mmap2 - SYSCALL_TABLE_ID0] = PPM_SC_MMAP2, -#endif -#ifdef __NR__newselect - [__NR__newselect - SYSCALL_TABLE_ID0] = PPM_SC__NEWSELECT, -#endif -#ifdef __NR_sgetmask - [__NR_sgetmask - SYSCALL_TABLE_ID0] = PPM_SC_SGETMASK, -#endif -#ifdef __NR_ssetmask - [__NR_ssetmask - SYSCALL_TABLE_ID0] = PPM_SC_SSETMASK, -#endif - -/* [__NR_setreuid16 - SYSCALL_TABLE_ID0] = PPM_SC_NR_SETREUID16, */ -/* [__NR_setregid16 - SYSCALL_TABLE_ID0] = PPM_SC_NR_SETREGID16, */ -#ifdef __NR_sigpending - [__NR_sigpending - SYSCALL_TABLE_ID0] = PPM_SC_SIGPENDING, -#endif -#ifdef __NR_olduname - [__NR_olduname - SYSCALL_TABLE_ID0] = PPM_SC_OLDUNAME, -#endif -#ifdef __NR_umount - [__NR_umount - SYSCALL_TABLE_ID0] = PPM_SC_UMOUNT, -#endif -#ifdef __NR_signal - [__NR_signal - SYSCALL_TABLE_ID0] = PPM_SC_SIGNAL, -#endif -#ifdef __NR_nice - [__NR_nice - SYSCALL_TABLE_ID0] = PPM_SC_NICE, -#endif -#ifdef __NR_stime - [__NR_stime - SYSCALL_TABLE_ID0] = PPM_SC_STIME, -#endif -#ifdef __NR__llseek - [__NR__llseek - SYSCALL_TABLE_ID0] = PPM_SC__LLSEEK, -#endif -#ifdef __NR_waitpid - [__NR_waitpid - SYSCALL_TABLE_ID0] = PPM_SC_WAITPID, -#endif -#ifdef __NR_pread64 - [__NR_pread64 - SYSCALL_TABLE_ID0] = PPM_SC_PREAD64, -#endif -#ifdef __NR_pwrite64 - [__NR_pwrite64 - SYSCALL_TABLE_ID0] = PPM_SC_PWRITE64, -#endif -#ifdef __NR_shmat - [__NR_shmat - SYSCALL_TABLE_ID0] = PPM_SC_SHMAT, -#endif -#ifdef __NR_rt_sigreturn - [__NR_rt_sigreturn - SYSCALL_TABLE_ID0] = PPM_SC_SIGRETURN, -#endif -#ifdef __NR_fallocate - [__NR_fallocate - SYSCALL_TABLE_ID0] = PPM_SC_FALLOCATE, -#endif -#ifdef __NR_newfstatat - [__NR_newfstatat - SYSCALL_TABLE_ID0] = PPM_SC_NEWFSSTAT, -#endif -#ifdef __NR_process_vm_readv - [__NR_process_vm_readv - SYSCALL_TABLE_ID0] = PPM_SC_PROCESS_VM_READV, -#endif -#ifdef __NR_process_vm_writev - [__NR_process_vm_writev - SYSCALL_TABLE_ID0] = PPM_SC_PROCESS_VM_WRITEV, -#endif -#ifdef __NR_fork - [__NR_fork - SYSCALL_TABLE_ID0] = PPM_SC_FORK, -#endif -#ifdef __NR_vfork - [__NR_vfork - SYSCALL_TABLE_ID0] = PPM_SC_VFORK, -#endif -#ifdef __NR_quotactl - [__NR_quotactl - SYSCALL_TABLE_ID0] = PPM_SC_QUOTACTL, -#endif -#ifdef __NR_setresuid - [__NR_setresuid - SYSCALL_TABLE_ID0] = PPM_SC_SETRESUID, -#endif -#ifdef __NR_setresuid32 - [__NR_setresuid32 - SYSCALL_TABLE_ID0] = PPM_SC_SETRESUID, -#endif -#ifdef __NR_setresgid - [__NR_setresgid - SYSCALL_TABLE_ID0] = PPM_SC_SETRESGID, -#endif -#ifdef __NR_setresgid32 - [__NR_setresgid32 - SYSCALL_TABLE_ID0] = PPM_SC_SETRESGID, -#endif -#ifdef __NR_setuid - [__NR_setuid - SYSCALL_TABLE_ID0] = PPM_SC_SETUID, -#endif -#ifdef __NR_setuid32 - [__NR_setuid32 - SYSCALL_TABLE_ID0] = PPM_SC_SETUID32, -#endif -#ifdef __NR_setgid - [__NR_setgid - SYSCALL_TABLE_ID0] = PPM_SC_SETGID, -#endif -#ifdef __NR_setgid32 - [__NR_setgid32 - SYSCALL_TABLE_ID0] = PPM_SC_SETGID32, -#endif -#ifdef __NR_getuid - [__NR_getuid - SYSCALL_TABLE_ID0] = PPM_SC_GETUID, -#endif -#ifdef __NR_getuid32 - [__NR_getuid32 - SYSCALL_TABLE_ID0] = PPM_SC_GETUID32, -#endif -#ifdef __NR_geteuid - [__NR_geteuid - SYSCALL_TABLE_ID0] = PPM_SC_GETEUID, -#endif -#ifdef __NR_geteuid32 - [__NR_geteuid32 - SYSCALL_TABLE_ID0] = PPM_SC_GETEUID, -#endif -#ifdef __NR_getgid - [__NR_getgid - SYSCALL_TABLE_ID0] = PPM_SC_GETGID, -#endif -#ifdef __NR_getgid32 - [__NR_getgid32 - SYSCALL_TABLE_ID0] = PPM_SC_GETGID, -#endif -#ifdef __NR_getegid - [__NR_getegid - SYSCALL_TABLE_ID0] = PPM_SC_GETEGID, -#endif -#ifdef __NR_getegid32 - [__NR_getegid32 - SYSCALL_TABLE_ID0] = PPM_SC_GETEGID, -#endif -#ifdef __NR_getresuid - [__NR_getresuid - SYSCALL_TABLE_ID0] = PPM_SC_GETRESUID, -#endif -#ifdef __NR_getresuid32 - [__NR_getresuid32 - SYSCALL_TABLE_ID0] = PPM_SC_GETRESUID32, -#endif -#ifdef __NR_getresgid - [__NR_getresgid - SYSCALL_TABLE_ID0] = PPM_SC_GETRESGID, -#endif -#ifdef __NR_getresgid32 - [__NR_getresgid32 - SYSCALL_TABLE_ID0] = PPM_SC_GETRESGID32, -#endif -#ifdef __NR_setns - [__NR_setns - SYSCALL_TABLE_ID0] = PPM_SC_SETNS, -#endif -#ifdef __NR_access - [__NR_access - SYSCALL_TABLE_ID0] = PPM_SC_ACCESS, -#endif -#ifdef __NR_finit_module - [__NR_finit_module - SYSCALL_TABLE_ID0] = PPM_SC_FINIT_MODULE, -#endif -#ifdef __NR_bpf - [__NR_bpf - SYSCALL_TABLE_ID0] = PPM_SC_BPF, -#endif -#ifdef __NR_seccomp - [__NR_seccomp - SYSCALL_TABLE_ID0] = PPM_SC_SECCOMP, -#endif -#ifdef __NR_sigaltstack - [__NR_sigaltstack - SYSCALL_TABLE_ID0] = PPM_SC_SIGALTSTACK, -#endif -#ifdef __NR_getrandom - [__NR_getrandom - SYSCALL_TABLE_ID0] = PPM_SC_GETRANDOM, -#endif -#ifdef __NR_fadvise64 - [__NR_fadvise64 - SYSCALL_TABLE_ID0] = PPM_SC_FADVISE64, -#endif -#ifdef __NR_renameat2 - [__NR_renameat2 - SYSCALL_TABLE_ID0] = PPM_SC_RENAMEAT2, -#endif -#ifdef __NR_userfaultfd - [__NR_userfaultfd - SYSCALL_TABLE_ID0] = PPM_SC_USERFAULTFD, -#endif -#ifdef __NR_openat2 - [__NR_openat2 - SYSCALL_TABLE_ID0] = PPM_SC_OPENAT2, -#endif -#ifdef __NR_execveat - [__NR_execveat - SYSCALL_TABLE_ID0] = PPM_SC_EXECVEAT, -#endif -#ifdef __NR_io_uring_setup - [__NR_io_uring_setup - SYSCALL_TABLE_ID0] = PPM_SC_IO_URING_SETUP, -#endif -#ifdef __NR_io_uring_enter - [__NR_io_uring_enter - SYSCALL_TABLE_ID0] = PPM_SC_IO_URING_ENTER, -#endif -#ifdef __NR_io_uring_register - [__NR_io_uring_register - SYSCALL_TABLE_ID0] = PPM_SC_IO_URING_REGISTER, -#endif -#ifdef __NR_copy_file_range - [__NR_copy_file_range - SYSCALL_TABLE_ID0] = PPM_SC_COPY_FILE_RANGE, -#endif - [__NR_clone - SYSCALL_TABLE_ID0] = PPM_SC_CLONE, -#ifdef __NR_clone3 - [__NR_clone3 - SYSCALL_TABLE_ID0] = PPM_SC_CLONE3, -#endif -#ifdef __NR_open_by_handle_at - [__NR_open_by_handle_at - SYSCALL_TABLE_ID0] = PPM_SC_OPEN_BY_HANDLE_AT, -#endif -}; - -#ifdef CONFIG_IA32_EMULATION -const struct syscall_evt_pair g_syscall_ia32_table[SYSCALL_TABLE_SIZE] = { - [__NR_ia32_open - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP, PPME_SYSCALL_OPEN_E, PPME_SYSCALL_OPEN_X}, - [__NR_ia32_creat - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP, PPME_SYSCALL_CREAT_E, PPME_SYSCALL_CREAT_X}, - [__NR_ia32_close - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP | UF_SIMPLEDRIVER_KEEP, PPME_SYSCALL_CLOSE_E, PPME_SYSCALL_CLOSE_X}, - [__NR_ia32_brk - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_BRK_4_E, PPME_SYSCALL_BRK_4_X}, - [__NR_ia32_read - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_READ_E, PPME_SYSCALL_READ_X}, - [__NR_ia32_write - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_WRITE_E, PPME_SYSCALL_WRITE_X}, - [__NR_ia32_execve - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP | UF_SIMPLEDRIVER_KEEP, PPME_SYSCALL_EXECVE_19_E, PPME_SYSCALL_EXECVE_19_X}, - [__NR_ia32_clone - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP | UF_SIMPLEDRIVER_KEEP, PPME_SYSCALL_CLONE_20_E, PPME_SYSCALL_CLONE_20_X}, - [__NR_ia32_fork - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP | UF_SIMPLEDRIVER_KEEP, PPME_SYSCALL_FORK_20_E, PPME_SYSCALL_FORK_20_X}, - [__NR_ia32_vfork - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP | UF_SIMPLEDRIVER_KEEP, PPME_SYSCALL_VFORK_20_E, PPME_SYSCALL_VFORK_20_X}, - [__NR_ia32_pipe - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP, PPME_SYSCALL_PIPE_E, PPME_SYSCALL_PIPE_X}, - [__NR_ia32_pipe2 - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP, PPME_SYSCALL_PIPE_E, PPME_SYSCALL_PIPE_X}, - [__NR_ia32_eventfd - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP, PPME_SYSCALL_EVENTFD_E, PPME_SYSCALL_EVENTFD_X}, - [__NR_ia32_eventfd2 - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP, PPME_SYSCALL_EVENTFD_E, PPME_SYSCALL_EVENTFD_X}, - [__NR_ia32_futex - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_FUTEX_E, PPME_SYSCALL_FUTEX_X}, - [__NR_ia32_stat - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_STAT_E, PPME_SYSCALL_STAT_X}, - [__NR_ia32_lstat - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_LSTAT_E, PPME_SYSCALL_LSTAT_X}, - [__NR_ia32_fstat - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_FSTAT_E, PPME_SYSCALL_FSTAT_X}, - [__NR_ia32_epoll_wait - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_EPOLLWAIT_E, PPME_SYSCALL_EPOLLWAIT_X}, - [__NR_ia32_poll - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_POLL_E, PPME_SYSCALL_POLL_X}, -#ifdef __NR_ia32_select - [__NR_ia32_select - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_SELECT_E, PPME_SYSCALL_SELECT_X}, -#endif - [__NR_ia32_lseek - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_LSEEK_E, PPME_SYSCALL_LSEEK_X}, - [__NR_ia32_ioctl - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_IOCTL_3_E, PPME_SYSCALL_IOCTL_3_X}, - [__NR_ia32_getcwd - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_GETCWD_E, PPME_SYSCALL_GETCWD_X}, -#ifdef __NR_ia32_capset - [__NR_ia32_capset - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_CAPSET_E, PPME_SYSCALL_CAPSET_X}, -#endif - [__NR_ia32_chdir - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP | UF_SIMPLEDRIVER_KEEP, PPME_SYSCALL_CHDIR_E, PPME_SYSCALL_CHDIR_X}, - [__NR_ia32_fchdir - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP | UF_SIMPLEDRIVER_KEEP, PPME_SYSCALL_FCHDIR_E, PPME_SYSCALL_FCHDIR_X}, - [__NR_ia32_mkdir - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_MKDIR_2_E, PPME_SYSCALL_MKDIR_2_X}, - [__NR_ia32_rmdir - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_RMDIR_2_E, PPME_SYSCALL_RMDIR_2_X}, - [__NR_ia32_openat - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP, PPME_SYSCALL_OPENAT_2_E, PPME_SYSCALL_OPENAT_2_X}, - [__NR_ia32_mkdirat - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_MKDIRAT_E, PPME_SYSCALL_MKDIRAT_X}, - [__NR_ia32_link - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_LINK_2_E, PPME_SYSCALL_LINK_2_X}, - [__NR_ia32_linkat - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_LINKAT_2_E, PPME_SYSCALL_LINKAT_2_X}, - [__NR_ia32_unlink - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_UNLINK_2_E, PPME_SYSCALL_UNLINK_2_X}, - [__NR_ia32_unlinkat - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_UNLINKAT_2_E, PPME_SYSCALL_UNLINKAT_2_X}, - [__NR_ia32_pread64 - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_PREAD_E, PPME_SYSCALL_PREAD_X}, - [__NR_ia32_pwrite64 - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_PWRITE_E, PPME_SYSCALL_PWRITE_X}, - [__NR_ia32_readv - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_READV_E, PPME_SYSCALL_READV_X}, - [__NR_ia32_writev - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_WRITEV_E, PPME_SYSCALL_WRITEV_X}, - [__NR_ia32_preadv - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_PREADV_E, PPME_SYSCALL_PREADV_X}, - [__NR_ia32_pwritev - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_PWRITEV_E, PPME_SYSCALL_PWRITEV_X}, - [__NR_ia32_dup - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP | UF_SIMPLEDRIVER_KEEP, PPME_SYSCALL_DUP_E, PPME_SYSCALL_DUP_X}, - [__NR_ia32_dup2 - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP | UF_SIMPLEDRIVER_KEEP, PPME_SYSCALL_DUP_E, PPME_SYSCALL_DUP_X}, - [__NR_ia32_dup3 - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP | UF_SIMPLEDRIVER_KEEP, PPME_SYSCALL_DUP_E, PPME_SYSCALL_DUP_X}, - [__NR_ia32_signalfd - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP, PPME_SYSCALL_SIGNALFD_E, PPME_SYSCALL_SIGNALFD_X}, - [__NR_ia32_signalfd4 - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP, PPME_SYSCALL_SIGNALFD_E, PPME_SYSCALL_SIGNALFD_X}, - [__NR_ia32_kill - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_KILL_E, PPME_SYSCALL_KILL_X}, - [__NR_ia32_tkill - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_TKILL_E, PPME_SYSCALL_TKILL_X}, - [__NR_ia32_tgkill - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_TGKILL_E, PPME_SYSCALL_TGKILL_X}, - [__NR_ia32_nanosleep - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_NANOSLEEP_E, PPME_SYSCALL_NANOSLEEP_X}, - [__NR_ia32_timerfd_create - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP, PPME_SYSCALL_TIMERFD_CREATE_E, PPME_SYSCALL_TIMERFD_CREATE_X}, - [__NR_ia32_inotify_init - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP, PPME_SYSCALL_INOTIFY_INIT_E, PPME_SYSCALL_INOTIFY_INIT_X}, - [__NR_ia32_inotify_init1 - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP, PPME_SYSCALL_INOTIFY_INIT_E, PPME_SYSCALL_INOTIFY_INIT_X}, - [__NR_ia32_getrlimit - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP, PPME_SYSCALL_GETRLIMIT_E, PPME_SYSCALL_GETRLIMIT_X}, - [__NR_ia32_setrlimit - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP, PPME_SYSCALL_SETRLIMIT_E, PPME_SYSCALL_SETRLIMIT_X}, - [__NR_ia32_fchmodat - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_FCHMODAT_E, PPME_SYSCALL_FCHMODAT_X}, - [__NR_ia32_fchmod - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_FCHMOD_E, PPME_SYSCALL_FCHMOD_X}, -#ifdef __NR_ia32_prlimit64 - [__NR_ia32_prlimit64 - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP, PPME_SYSCALL_PRLIMIT_E, PPME_SYSCALL_PRLIMIT_X}, -#endif -#ifdef __NR_ia32_ugetrlimit - [__NR_ia32_ugetrlimit - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP, PPME_SYSCALL_GETRLIMIT_E, PPME_SYSCALL_GETRLIMIT_X}, -#endif - [__NR_ia32_fcntl - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_FCNTL_E, PPME_SYSCALL_FCNTL_X}, -#ifdef __NR_ia32_fcntl64 - [__NR_ia32_fcntl64 - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_FCNTL_E, PPME_SYSCALL_FCNTL_X}, -#endif - [__NR_ia32_ppoll - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_PPOLL_E, PPME_SYSCALL_PPOLL_X}, -/* [__NR_ia32_old_select - SYSCALL_TABLE_ID0] = {UF_USED, PPME_GENERIC_E, PPME_GENERIC_X}, */ - [__NR_ia32_pselect6 - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_GENERIC_E, PPME_GENERIC_X}, - [__NR_ia32_epoll_create - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_GENERIC_E, PPME_GENERIC_X}, - [__NR_ia32_epoll_ctl - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_GENERIC_E, PPME_GENERIC_X}, - [__NR_ia32_uselib - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_GENERIC_E, PPME_GENERIC_X}, - [__NR_ia32_sched_setparam - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_GENERIC_E, PPME_GENERIC_X}, - [__NR_ia32_sched_getparam - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_GENERIC_E, PPME_GENERIC_X}, - [__NR_ia32_syslog - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_GENERIC_E, PPME_GENERIC_X}, - [__NR_ia32_chmod - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_CHMOD_E, PPME_SYSCALL_CHMOD_X}, - [__NR_ia32_lchown - SYSCALL_TABLE_ID0] = {UF_USED, PPME_GENERIC_E, PPME_GENERIC_X}, - [__NR_ia32_utime - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_GENERIC_E, PPME_GENERIC_X}, - [__NR_ia32_mount - SYSCALL_TABLE_ID0] = {UF_USED, PPME_GENERIC_E, PPME_GENERIC_X}, - [__NR_ia32_umount2 - SYSCALL_TABLE_ID0] = {UF_USED, PPME_GENERIC_E, PPME_GENERIC_X}, - [__NR_ia32_ptrace - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_PTRACE_E, PPME_SYSCALL_PTRACE_X}, - [__NR_ia32_alarm - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_GENERIC_E, PPME_GENERIC_X}, - [__NR_ia32_pause - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_GENERIC_E, PPME_GENERIC_X}, - -#ifndef __NR_ia32_socketcall - [__NR_ia32_socket - SYSCALL_TABLE_ID0] = {UF_USED | UF_SIMPLEDRIVER_KEEP, PPME_SOCKET_SOCKET_E, PPME_SOCKET_SOCKET_X}, - [__NR_ia32_bind - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SOCKET_BIND_E, PPME_SOCKET_BIND_X}, - [__NR_ia32_connect - SYSCALL_TABLE_ID0] = {UF_USED | UF_SIMPLEDRIVER_KEEP, PPME_SOCKET_CONNECT_E, PPME_SOCKET_CONNECT_X}, - [__NR_ia32_listen - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SOCKET_LISTEN_E, PPME_SOCKET_LISTEN_X}, - [__NR_ia32_accept - SYSCALL_TABLE_ID0] = {UF_USED | UF_SIMPLEDRIVER_KEEP, PPME_SOCKET_ACCEPT_E, PPME_SOCKET_ACCEPT_X}, - [__NR_ia32_getsockname - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SOCKET_GETSOCKNAME_E, PPME_SOCKET_GETSOCKNAME_X}, - [__NR_ia32_getpeername - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SOCKET_GETPEERNAME_E, PPME_SOCKET_GETPEERNAME_X}, - [__NR_ia32_socketpair - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP, PPME_SOCKET_SOCKETPAIR_E, PPME_SOCKET_SOCKETPAIR_X}, - [__NR_ia32_sendto - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SOCKET_SENDTO_E, PPME_SOCKET_SENDTO_X}, - [__NR_ia32_recvfrom - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SOCKET_RECVFROM_E, PPME_SOCKET_RECVFROM_X}, - [__NR_ia32_shutdown - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SOCKET_SHUTDOWN_E, PPME_SOCKET_SHUTDOWN_X}, - [__NR_ia32_setsockopt - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SOCKET_SETSOCKOPT_E, PPME_SOCKET_SETSOCKOPT_X}, - [__NR_ia32_getsockopt - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SOCKET_GETSOCKOPT_E, PPME_SOCKET_GETSOCKOPT_X}, - [__NR_ia32_sendmsg - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SOCKET_SENDMSG_E, PPME_SOCKET_SENDMSG_X}, - [__NR_ia32_accept4 - SYSCALL_TABLE_ID0] = {UF_USED | UF_SIMPLEDRIVER_KEEP, PPME_SOCKET_ACCEPT4_E, PPME_SOCKET_ACCEPT4_X}, -#endif - -#ifdef __NR_ia32_sendmmsg - [__NR_ia32_sendmmsg - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SOCKET_SENDMMSG_E, PPME_SOCKET_SENDMMSG_X}, -#endif -#ifdef __NR_ia32_recvmsg - [__NR_ia32_recvmsg - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SOCKET_RECVMSG_E, PPME_SOCKET_RECVMSG_X}, -#endif -#ifdef __NR_ia32_recvmmsg - [__NR_ia32_recvmmsg - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SOCKET_RECVMMSG_E, PPME_SOCKET_RECVMMSG_X}, -#endif -#ifdef __NR_ia32_stat64 - [__NR_ia32_stat64 - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_STAT64_E, PPME_SYSCALL_STAT64_X}, -#endif -#ifdef __NR_ia32_fstat64 - [__NR_ia32_fstat64 - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_FSTAT64_E, PPME_SYSCALL_FSTAT64_X}, -#endif -#ifdef __NR_ia32__llseek - [__NR_ia32__llseek - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_LLSEEK_E, PPME_SYSCALL_LLSEEK_X}, -#endif - [__NR_ia32_mmap - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_MMAP_E, PPME_SYSCALL_MMAP_X}, -#ifdef __NR_ia32_mmap2 - [__NR_ia32_mmap2 - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_MMAP2_E, PPME_SYSCALL_MMAP2_X}, -#endif - [__NR_ia32_munmap - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_MUNMAP_E, PPME_SYSCALL_MUNMAP_X}, - [__NR_ia32_splice - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_SPLICE_E, PPME_SYSCALL_SPLICE_X}, -#ifdef __NR_ia32_process_vm_readv - [__NR_ia32_process_vm_readv - SYSCALL_TABLE_ID0] = {UF_USED, PPME_GENERIC_E, PPME_GENERIC_X}, -#endif -#ifdef __NR_ia32_process_vm_writev - [__NR_ia32_process_vm_writev - SYSCALL_TABLE_ID0] = {UF_USED, PPME_GENERIC_E, PPME_GENERIC_X}, -#endif - - [__NR_ia32_rename - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_RENAME_E, PPME_SYSCALL_RENAME_X}, - [__NR_ia32_renameat - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_RENAMEAT_E, PPME_SYSCALL_RENAMEAT_X}, - [__NR_ia32_symlink - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_SYMLINK_E, PPME_SYSCALL_SYMLINK_X}, - [__NR_ia32_symlinkat - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_SYMLINKAT_E, PPME_SYSCALL_SYMLINKAT_X}, - [__NR_ia32_sendfile - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_SENDFILE_E, PPME_SYSCALL_SENDFILE_X}, -#ifdef __NR_ia32_sendfile64 - [__NR_ia32_sendfile64 - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_SENDFILE_E, PPME_SYSCALL_SENDFILE_X}, -#endif -#ifdef __NR_ia32_quotactl - [__NR_ia32_quotactl - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_QUOTACTL_E, PPME_SYSCALL_QUOTACTL_X}, -#endif -#ifdef __NR_ia32_setresuid - [__NR_ia32_setresuid - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_SETRESUID_E, PPME_SYSCALL_SETRESUID_X }, -#endif -#ifdef __NR_ia32_setresuid32 - [__NR_ia32_setresuid32 - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_SETRESUID_E, PPME_SYSCALL_SETRESUID_X }, -#endif -#ifdef __NR_ia32_setresgid - [__NR_ia32_setresgid - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_SETRESGID_E, PPME_SYSCALL_SETRESGID_X }, -#endif -#ifdef __NR_ia32_setresgid32 - [__NR_ia32_setresgid32 - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_SETRESGID_E, PPME_SYSCALL_SETRESGID_X }, -#endif -#ifdef __NR_ia32_setuid - [__NR_ia32_setuid - SYSCALL_TABLE_ID0] = { UF_USED, PPME_SYSCALL_SETUID_E, PPME_SYSCALL_SETUID_X }, -#endif -#ifdef __NR_ia32_setuid32 - [__NR_ia32_setuid32 - SYSCALL_TABLE_ID0] = { UF_USED, PPME_SYSCALL_SETUID_E, PPME_SYSCALL_SETUID_X }, -#endif -#ifdef __NR_ia32_setgid - [__NR_ia32_setgid - SYSCALL_TABLE_ID0] = { UF_USED, PPME_SYSCALL_SETGID_E, PPME_SYSCALL_SETGID_X }, -#endif -#ifdef __NR_ia32_setgid32 - [__NR_ia32_setgid32 - SYSCALL_TABLE_ID0] = { UF_USED, PPME_SYSCALL_SETGID_E, PPME_SYSCALL_SETGID_X }, -#endif -#ifdef __NR_ia32_getuid - [__NR_ia32_getuid - SYSCALL_TABLE_ID0] = { UF_USED, PPME_SYSCALL_GETUID_E, PPME_SYSCALL_GETUID_X }, -#endif -#ifdef __NR_ia32_getuid32 - [__NR_ia32_getuid32 - SYSCALL_TABLE_ID0] = { UF_USED, PPME_SYSCALL_GETUID_E, PPME_SYSCALL_GETUID_X }, -#endif -#ifdef __NR_ia32_geteuid - [__NR_ia32_geteuid - SYSCALL_TABLE_ID0] = { UF_USED, PPME_SYSCALL_GETEUID_E, PPME_SYSCALL_GETEUID_X }, -#endif -#ifdef __NR_ia32_geteuid32 - [__NR_ia32_geteuid32 - SYSCALL_TABLE_ID0] = { UF_USED, PPME_SYSCALL_GETEUID_E, PPME_SYSCALL_GETEUID_X }, -#endif -#ifdef __NR_ia32_getgid - [__NR_ia32_getgid - SYSCALL_TABLE_ID0] = { UF_USED, PPME_SYSCALL_GETGID_E, PPME_SYSCALL_GETGID_X }, -#endif -#ifdef __NR_ia32_getgid32 - [__NR_ia32_getgid32 - SYSCALL_TABLE_ID0] = { UF_USED, PPME_SYSCALL_GETGID_E, PPME_SYSCALL_GETGID_X }, -#endif -#ifdef __NR_ia32_getegid - [__NR_ia32_getegid - SYSCALL_TABLE_ID0] = { UF_USED, PPME_SYSCALL_GETEGID_E, PPME_SYSCALL_GETEGID_X }, -#endif -#ifdef __NR_ia32_getegid32 - [__NR_ia32_getegid32 - SYSCALL_TABLE_ID0] = { UF_USED, PPME_SYSCALL_GETEGID_E, PPME_SYSCALL_GETEGID_X }, -#endif -#ifdef __NR_ia32_getresuid - [__NR_ia32_getresuid - SYSCALL_TABLE_ID0] = { UF_USED, PPME_SYSCALL_GETRESUID_E, PPME_SYSCALL_GETRESUID_X }, -#endif -#ifdef __NR_ia32_getresuid32 - [__NR_ia32_getresuid32 - SYSCALL_TABLE_ID0] = { UF_USED, PPME_SYSCALL_GETRESUID_E, PPME_SYSCALL_GETRESUID_X }, -#endif -#ifdef __NR_ia32_getresgid - [__NR_ia32_getresgid - SYSCALL_TABLE_ID0] = { UF_USED, PPME_SYSCALL_GETRESGID_E, PPME_SYSCALL_GETRESGID_X }, -#endif -#ifdef __NR_ia32_getresgid32 - [__NR_ia32_getresgid32 - SYSCALL_TABLE_ID0] = { UF_USED, PPME_SYSCALL_GETRESGID_E, PPME_SYSCALL_GETRESGID_X }, -#endif -#ifdef __NR_ia32_semop - [__NR_ia32_semop - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_SEMOP_E, PPME_SYSCALL_SEMOP_X}, -#endif -#ifdef __NR_ia32_semget - [__NR_ia32_semget - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_SEMGET_E, PPME_SYSCALL_SEMGET_X}, -#endif -#ifdef __NR_ia32_semctl - [__NR_ia32_semctl - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_SEMCTL_E, PPME_SYSCALL_SEMCTL_X}, -#endif -#ifdef __NR_ia32_access - [__NR_ia32_access - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_ACCESS_E, PPME_SYSCALL_ACCESS_X}, -#endif -#ifdef __NR_ia32_chroot - [__NR_ia32_chroot - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP, PPME_SYSCALL_CHROOT_E, PPME_SYSCALL_CHROOT_X}, -#endif - [__NR_ia32_setsid - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_SETSID_E, PPME_SYSCALL_SETSID_X}, - [__NR_ia32_setpgid - SYSCALL_TABLE_ID0] = {UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_SETPGID_E, PPME_SYSCALL_SETPGID_X}, -#ifdef __NR_ia32_bpf - [__NR_ia32_bpf - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_BPF_E, PPME_SYSCALL_BPF_X}, -#endif -#ifdef __NR_ia32_seccomp - [__NR_ia32_seccomp - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_SECCOMP_E, PPME_SYSCALL_SECCOMP_X}, -#endif -#ifdef __NR_ia32_renameat2 - [__NR_ia32_renameat2 - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_RENAMEAT2_E, PPME_SYSCALL_RENAMEAT2_X}, -#endif -#ifdef __NR_ia32_userfaultfd - [__NR_ia32_userfaultfd - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP, PPME_SYSCALL_USERFAULTFD_E, PPME_SYSCALL_USERFAULTFD_X}, -#endif -#ifdef __NR_ia32_openat2 - [__NR_ia32_openat2 - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_OPENAT2_E, PPME_SYSCALL_OPENAT2_X}, -#endif -#ifdef __NR_ia32_clone3 - [__NR_ia32_clone3 - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP | UF_SIMPLEDRIVER_KEEP, PPME_SYSCALL_CLONE3_E, PPME_SYSCALL_CLONE3_X}, -#endif -#ifdef __NR_ia32_mprotect - [__NR_ia32_mprotect - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_MPROTECT_E, PPME_SYSCALL_MPROTECT_X}, -#endif -#ifdef __NR_ia32_execveat - [__NR_ia32_execveat - SYSCALL_TABLE_ID0] = {UF_USED | UF_NEVER_DROP | UF_SIMPLEDRIVER_KEEP, PPME_SYSCALL_EXECVEAT_E, PPME_SYSCALL_EXECVEAT_X}, -#endif -#ifdef __NR_ia32_io_uring_setup - [__NR_ia32_io_uring_setup - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_IO_URING_SETUP_E, PPME_SYSCALL_IO_URING_SETUP_X}, -#endif -#ifdef __NR_ia32_io_uring_enter - [__NR_ia32_io_uring_enter - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_IO_URING_ENTER_E, PPME_SYSCALL_IO_URING_ENTER_X}, -#endif -#ifdef __NR_ia32_io_uring_register - [__NR_ia32_io_uring_register - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_IO_URING_REGISTER_E, PPME_SYSCALL_IO_URING_REGISTER_X}, -#endif -#ifdef __NR_ia32_copy_file_range - [__NR_ia32_copy_file_range - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_COPY_FILE_RANGE_E, PPME_SYSCALL_COPY_FILE_RANGE_X}, -#endif -#ifdef __NR_ia32_open_by_handle_at - [__NR_ia32_open_by_handle_at - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_OPEN_BY_HANDLE_AT_E, PPME_SYSCALL_OPEN_BY_HANDLE_AT_X}, -#endif -#ifdef __NR_ia32_mlock - [__NR_ia32_mlock - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_MLOCK_E, PPME_SYSCALL_MLOCK_X}, -#endif -#ifdef __NR_ia32_munlock - [__NR_ia32_munlock - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_MUNLOCK_E, PPME_SYSCALL_MUNLOCK_X}, -#endif -#ifdef __NR_ia32_mlockall - [__NR_ia32_mlockall - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_MLOCKALL_E, PPME_SYSCALL_MLOCKALL_X}, -#endif -#ifdef __NR_ia32_munlockall - [__NR_ia32_munlockall - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_MUNLOCKALL_E, PPME_SYSCALL_MUNLOCKALL_X}, -#endif -}; - -/* - * SYSCALL ROUTING TABLE - */ -const enum ppm_syscall_code g_syscall_ia32_code_routing_table[SYSCALL_TABLE_SIZE] = { - [__NR_ia32_restart_syscall - SYSCALL_TABLE_ID0] = PPM_SC_RESTART_SYSCALL, - [__NR_ia32_exit - SYSCALL_TABLE_ID0] = PPM_SC_EXIT, - [__NR_ia32_read - SYSCALL_TABLE_ID0] = PPM_SC_READ, - [__NR_ia32_write - SYSCALL_TABLE_ID0] = PPM_SC_WRITE, - [__NR_ia32_execve - SYSCALL_TABLE_ID0] = PPM_SC_EXECVE, - [__NR_ia32_open - SYSCALL_TABLE_ID0] = PPM_SC_OPEN, - [__NR_ia32_close - SYSCALL_TABLE_ID0] = PPM_SC_CLOSE, - [__NR_ia32_creat - SYSCALL_TABLE_ID0] = PPM_SC_CREAT, - [__NR_ia32_link - SYSCALL_TABLE_ID0] = PPM_SC_LINK, - [__NR_ia32_unlink - SYSCALL_TABLE_ID0] = PPM_SC_UNLINK, - [__NR_ia32_chdir - SYSCALL_TABLE_ID0] = PPM_SC_CHDIR, - [__NR_ia32_time - SYSCALL_TABLE_ID0] = PPM_SC_TIME, - [__NR_ia32_mknod - SYSCALL_TABLE_ID0] = PPM_SC_MKNOD, - [__NR_ia32_chmod - SYSCALL_TABLE_ID0] = PPM_SC_CHMOD, -/* [__NR_ia32_lchown16 - SYSCALL_TABLE_ID0] = PPM_SC_NR_LCHOWN16, */ - [__NR_ia32_stat - SYSCALL_TABLE_ID0] = PPM_SC_STAT, - [__NR_ia32_lseek - SYSCALL_TABLE_ID0] = PPM_SC_LSEEK, - [__NR_ia32_getpid - SYSCALL_TABLE_ID0] = PPM_SC_GETPID, - [__NR_ia32_mount - SYSCALL_TABLE_ID0] = PPM_SC_MOUNT, - [__NR_ia32_umount2 - SYSCALL_TABLE_ID0] = PPM_SC_UMOUNT2, -/* [__NR_ia32_oldumount - SYSCALL_TABLE_ID0] = PPM_SC_NR_OLDUMOUNT, */ -/* [__NR_ia32_setuid16 - SYSCALL_TABLE_ID0] = PPM_SC_NR_SETUID16, */ -/* [__NR_ia32_getuid16 - SYSCALL_TABLE_ID0] = PPM_SC_NR_GETUID16, */ - [__NR_ia32_ptrace - SYSCALL_TABLE_ID0] = PPM_SC_PTRACE, - [__NR_ia32_alarm - SYSCALL_TABLE_ID0] = PPM_SC_ALARM, - [__NR_ia32_fstat - SYSCALL_TABLE_ID0] = PPM_SC_FSTAT, - [__NR_ia32_pause - SYSCALL_TABLE_ID0] = PPM_SC_PAUSE, - [__NR_ia32_utime - SYSCALL_TABLE_ID0] = PPM_SC_UTIME, - [__NR_ia32_access - SYSCALL_TABLE_ID0] = PPM_SC_ACCESS, - [__NR_ia32_sync - SYSCALL_TABLE_ID0] = PPM_SC_SYNC, - [__NR_ia32_kill - SYSCALL_TABLE_ID0] = PPM_SC_KILL, - [__NR_ia32_rename - SYSCALL_TABLE_ID0] = PPM_SC_RENAME, - [__NR_ia32_mkdir - SYSCALL_TABLE_ID0] = PPM_SC_MKDIR, - [__NR_ia32_rmdir - SYSCALL_TABLE_ID0] = PPM_SC_RMDIR, - [__NR_ia32_dup - SYSCALL_TABLE_ID0] = PPM_SC_DUP, - [__NR_ia32_pipe - SYSCALL_TABLE_ID0] = PPM_SC_PIPE, - [__NR_ia32_times - SYSCALL_TABLE_ID0] = PPM_SC_TIMES, - [__NR_ia32_brk - SYSCALL_TABLE_ID0] = PPM_SC_BRK, -/* [__NR_ia32_setgid16 - SYSCALL_TABLE_ID0] = PPM_SC_NR_SETGID16, */ -/* [__NR_ia32_getgid16 - SYSCALL_TABLE_ID0] = PPM_SC_NR_GETGID16, */ -/* [__NR_ia32_geteuid16 - SYSCALL_TABLE_ID0] = PPM_SC_NR_GETEUID16, */ -/* [__NR_ia32_getegid16 - SYSCALL_TABLE_ID0] = PPM_SC_NR_GETEGID16, */ - [__NR_ia32_acct - SYSCALL_TABLE_ID0] = PPM_SC_ACCT, - [__NR_ia32_ioctl - SYSCALL_TABLE_ID0] = PPM_SC_IOCTL, - [__NR_ia32_fcntl - SYSCALL_TABLE_ID0] = PPM_SC_FCNTL, - [__NR_ia32_setpgid - SYSCALL_TABLE_ID0] = PPM_SC_SETPGID, - [__NR_ia32_umask - SYSCALL_TABLE_ID0] = PPM_SC_UMASK, - [__NR_ia32_chroot - SYSCALL_TABLE_ID0] = PPM_SC_CHROOT, - [__NR_ia32_ustat - SYSCALL_TABLE_ID0] = PPM_SC_USTAT, - [__NR_ia32_dup2 - SYSCALL_TABLE_ID0] = PPM_SC_DUP2, - [__NR_ia32_getppid - SYSCALL_TABLE_ID0] = PPM_SC_GETPPID, - [__NR_ia32_getpgrp - SYSCALL_TABLE_ID0] = PPM_SC_GETPGRP, - [__NR_ia32_setsid - SYSCALL_TABLE_ID0] = PPM_SC_SETSID, - [__NR_ia32_sethostname - SYSCALL_TABLE_ID0] = PPM_SC_SETHOSTNAME, - [__NR_ia32_setrlimit - SYSCALL_TABLE_ID0] = PPM_SC_SETRLIMIT, -/* [__NR_ia32_old_getrlimit - SYSCALL_TABLE_ID0] = PPM_SC_NR_OLD_GETRLIMIT, */ - [__NR_ia32_getrusage - SYSCALL_TABLE_ID0] = PPM_SC_GETRUSAGE, - [__NR_ia32_gettimeofday - SYSCALL_TABLE_ID0] = PPM_SC_GETTIMEOFDAY, - [__NR_ia32_settimeofday - SYSCALL_TABLE_ID0] = PPM_SC_SETTIMEOFDAY, -/* [__NR_ia32_getgroups16 - SYSCALL_TABLE_ID0] = PPM_SC_NR_GETGROUPS16, */ -/* [__NR_ia32_setgroups16 - SYSCALL_TABLE_ID0] = PPM_SC_NR_SETGROUPS16, */ -/* [__NR_ia32_old_select - SYSCALL_TABLE_ID0] = PPM_SC_NR_OLD_SELECT, */ - [__NR_ia32_symlink - SYSCALL_TABLE_ID0] = PPM_SC_SYMLINK, - [__NR_ia32_lstat - SYSCALL_TABLE_ID0] = PPM_SC_LSTAT, - [__NR_ia32_readlink - SYSCALL_TABLE_ID0] = PPM_SC_READLINK, - [__NR_ia32_uselib - SYSCALL_TABLE_ID0] = PPM_SC_USELIB, - [__NR_ia32_swapon - SYSCALL_TABLE_ID0] = PPM_SC_SWAPON, - [__NR_ia32_reboot - SYSCALL_TABLE_ID0] = PPM_SC_REBOOT, -/* [__NR_ia32_old_readdir - SYSCALL_TABLE_ID0] = PPM_SC_NR_OLD_READDIR, */ -/* [__NR_ia32_old_mmap - SYSCALL_TABLE_ID0] = PPM_SC_NR_OLD_MMAP, */ - [__NR_ia32_mmap - SYSCALL_TABLE_ID0] = PPM_SC_MMAP, - [__NR_ia32_munmap - SYSCALL_TABLE_ID0] = PPM_SC_MUNMAP, - [__NR_ia32_truncate - SYSCALL_TABLE_ID0] = PPM_SC_TRUNCATE, - [__NR_ia32_ftruncate - SYSCALL_TABLE_ID0] = PPM_SC_FTRUNCATE, - [__NR_ia32_fchmod - SYSCALL_TABLE_ID0] = PPM_SC_FCHMOD, -/* [__NR_ia32_fchown16 - SYSCALL_TABLE_ID0] = PPM_SC_NR_FCHOWN16, */ - [__NR_ia32_getpriority - SYSCALL_TABLE_ID0] = PPM_SC_GETPRIORITY, - [__NR_ia32_setpriority - SYSCALL_TABLE_ID0] = PPM_SC_SETPRIORITY, - [__NR_ia32_statfs - SYSCALL_TABLE_ID0] = PPM_SC_STATFS, - [__NR_ia32_fstatfs - SYSCALL_TABLE_ID0] = PPM_SC_FSTATFS, - [__NR_ia32_syslog - SYSCALL_TABLE_ID0] = PPM_SC_SYSLOG, - [__NR_ia32_setitimer - SYSCALL_TABLE_ID0] = PPM_SC_SETITIMER, - [__NR_ia32_getitimer - SYSCALL_TABLE_ID0] = PPM_SC_GETITIMER, -/* [__NR_ia32_newstat - SYSCALL_TABLE_ID0] = PPM_SC_NR_NEWSTAT, */ -/* [__NR_ia32_newlstat - SYSCALL_TABLE_ID0] = PPM_SC_NR_NEWLSTAT, */ -/* [__NR_ia32_newfstat - SYSCALL_TABLE_ID0] = PPM_SC_NR_NEWFSTAT, */ - [__NR_ia32_uname - SYSCALL_TABLE_ID0] = PPM_SC_UNAME, - [__NR_ia32_vhangup - SYSCALL_TABLE_ID0] = PPM_SC_VHANGUP, - [__NR_ia32_wait4 - SYSCALL_TABLE_ID0] = PPM_SC_WAIT4, - [__NR_ia32_swapoff - SYSCALL_TABLE_ID0] = PPM_SC_SWAPOFF, - [__NR_ia32_sysinfo - SYSCALL_TABLE_ID0] = PPM_SC_SYSINFO, - [__NR_ia32_fsync - SYSCALL_TABLE_ID0] = PPM_SC_FSYNC, - [__NR_ia32_setdomainname - SYSCALL_TABLE_ID0] = PPM_SC_SETDOMAINNAME, -/* [__NR_ia32_newuname - SYSCALL_TABLE_ID0] = PPM_SC_NR_NEWUNAME, */ - [__NR_ia32_adjtimex - SYSCALL_TABLE_ID0] = PPM_SC_ADJTIMEX, - [__NR_ia32_mprotect - SYSCALL_TABLE_ID0] = PPM_SC_MPROTECT, - [__NR_ia32_init_module - SYSCALL_TABLE_ID0] = PPM_SC_INIT_MODULE, - [__NR_ia32_delete_module - SYSCALL_TABLE_ID0] = PPM_SC_DELETE_MODULE, - [__NR_ia32_quotactl - SYSCALL_TABLE_ID0] = PPM_SC_QUOTACTL, - [__NR_ia32_getpgid - SYSCALL_TABLE_ID0] = PPM_SC_GETPGID, - [__NR_ia32_fchdir - SYSCALL_TABLE_ID0] = PPM_SC_FCHDIR, - [__NR_ia32_sysfs - SYSCALL_TABLE_ID0] = PPM_SC_SYSFS, - [__NR_ia32_personality - SYSCALL_TABLE_ID0] = PPM_SC_PERSONALITY, -/* [__NR_ia32_setfsuid16 - SYSCALL_TABLE_ID0] = PPM_SC_NR_SETFSUID16, */ -/* [__NR_ia32_setfsgid16 - SYSCALL_TABLE_ID0] = PPM_SC_NR_SETFSGID16, */ -/* [__NR_ia32_llseek - SYSCALL_TABLE_ID0] = PPM_SC_NR_LLSEEK, */ - [__NR_ia32_getdents - SYSCALL_TABLE_ID0] = PPM_SC_GETDENTS, -#ifdef __NR_ia32_select - [__NR_ia32_select - SYSCALL_TABLE_ID0] = PPM_SC_SELECT, -#endif - [__NR_ia32_flock - SYSCALL_TABLE_ID0] = PPM_SC_FLOCK, - [__NR_ia32_msync - SYSCALL_TABLE_ID0] = PPM_SC_MSYNC, - [__NR_ia32_readv - SYSCALL_TABLE_ID0] = PPM_SC_READV, - [__NR_ia32_writev - SYSCALL_TABLE_ID0] = PPM_SC_WRITEV, - [__NR_ia32_getsid - SYSCALL_TABLE_ID0] = PPM_SC_GETSID, - [__NR_ia32_fdatasync - SYSCALL_TABLE_ID0] = PPM_SC_FDATASYNC, -/* [__NR_ia32_sysctl - SYSCALL_TABLE_ID0] = PPM_SC_NR_SYSCTL, */ - [__NR_ia32_mlock - SYSCALL_TABLE_ID0] = PPM_SC_MLOCK, - [__NR_ia32_munlock - SYSCALL_TABLE_ID0] = PPM_SC_MUNLOCK, - [__NR_ia32_mlockall - SYSCALL_TABLE_ID0] = PPM_SC_MLOCKALL, - [__NR_ia32_munlockall - SYSCALL_TABLE_ID0] = PPM_SC_MUNLOCKALL, - [__NR_ia32_sched_setparam - SYSCALL_TABLE_ID0] = PPM_SC_SCHED_SETPARAM, - [__NR_ia32_sched_getparam - SYSCALL_TABLE_ID0] = PPM_SC_SCHED_GETPARAM, - [__NR_ia32_sched_setscheduler - SYSCALL_TABLE_ID0] = PPM_SC_SCHED_SETSCHEDULER, - [__NR_ia32_sched_getscheduler - SYSCALL_TABLE_ID0] = PPM_SC_SCHED_GETSCHEDULER, - [__NR_ia32_sched_yield - SYSCALL_TABLE_ID0] = PPM_SC_SCHED_YIELD, - [__NR_ia32_sched_get_priority_max - SYSCALL_TABLE_ID0] = PPM_SC_SCHED_GET_PRIORITY_MAX, - [__NR_ia32_sched_get_priority_min - SYSCALL_TABLE_ID0] = PPM_SC_SCHED_GET_PRIORITY_MIN, - [__NR_ia32_sched_rr_get_interval - SYSCALL_TABLE_ID0] = PPM_SC_SCHED_RR_GET_INTERVAL, - [__NR_ia32_nanosleep - SYSCALL_TABLE_ID0] = PPM_SC_NANOSLEEP, - [__NR_ia32_mremap - SYSCALL_TABLE_ID0] = PPM_SC_MREMAP, -/* [__NR_ia32_setresuid16 - SYSCALL_TABLE_ID0] = PPM_SC_NR_SETRESUID16, */ -/* [__NR_ia32_getresuid16 - SYSCALL_TABLE_ID0] = PPM_SC_NR_GETRESUID16, */ - [__NR_ia32_poll - SYSCALL_TABLE_ID0] = PPM_SC_POLL, -/* [__NR_ia32_setresgid16 - SYSCALL_TABLE_ID0] = PPM_SC_NR_SETRESGID16, */ -/* [__NR_ia32_getresgid16 - SYSCALL_TABLE_ID0] = PPM_SC_NR_GETRESGID16, */ - [__NR_ia32_prctl - SYSCALL_TABLE_ID0] = PPM_SC_PRCTL, -#ifdef __NR_ia32_arch_prctl - [__NR_ia32_arch_prctl - SYSCALL_TABLE_ID0] = PPM_SC_ARCH_PRCTL, -#endif - [__NR_ia32_rt_sigaction - SYSCALL_TABLE_ID0] = PPM_SC_RT_SIGACTION, - [__NR_ia32_rt_sigprocmask - SYSCALL_TABLE_ID0] = PPM_SC_RT_SIGPROCMASK, - [__NR_ia32_rt_sigpending - SYSCALL_TABLE_ID0] = PPM_SC_RT_SIGPENDING, - [__NR_ia32_rt_sigtimedwait - SYSCALL_TABLE_ID0] = PPM_SC_RT_SIGTIMEDWAIT, - [__NR_ia32_rt_sigqueueinfo - SYSCALL_TABLE_ID0] = PPM_SC_RT_SIGQUEUEINFO, - [__NR_ia32_rt_sigsuspend - SYSCALL_TABLE_ID0] = PPM_SC_RT_SIGSUSPEND, -/* [__NR_ia32_chown16 - SYSCALL_TABLE_ID0] = PPM_SC_NR_CHOWN16, */ - [__NR_ia32_getcwd - SYSCALL_TABLE_ID0] = PPM_SC_GETCWD, - [__NR_ia32_capget - SYSCALL_TABLE_ID0] = PPM_SC_CAPGET, - [__NR_ia32_capset - SYSCALL_TABLE_ID0] = PPM_SC_CAPSET, - [__NR_ia32_sendfile - SYSCALL_TABLE_ID0] = PPM_SC_SENDFILE, - [__NR_ia32_getrlimit - SYSCALL_TABLE_ID0] = PPM_SC_GETRLIMIT, -/* [__NR_ia32_mmap_pgoff - SYSCALL_TABLE_ID0] = PPM_SC_NR_MMAP_PGOFF, */ - [__NR_ia32_lchown - SYSCALL_TABLE_ID0] = PPM_SC_LCHOWN, - [__NR_ia32_getuid - SYSCALL_TABLE_ID0] = PPM_SC_GETUID, - [__NR_ia32_getgid - SYSCALL_TABLE_ID0] = PPM_SC_GETGID, - [__NR_ia32_geteuid - SYSCALL_TABLE_ID0] = PPM_SC_GETEUID, - [__NR_ia32_getegid - SYSCALL_TABLE_ID0] = PPM_SC_GETEGID, - [__NR_ia32_setreuid - SYSCALL_TABLE_ID0] = PPM_SC_SETREUID, - [__NR_ia32_setregid - SYSCALL_TABLE_ID0] = PPM_SC_SETREGID, - [__NR_ia32_getgroups - SYSCALL_TABLE_ID0] = PPM_SC_GETGROUPS, - [__NR_ia32_setgroups - SYSCALL_TABLE_ID0] = PPM_SC_SETGROUPS, - [__NR_ia32_fchown - SYSCALL_TABLE_ID0] = PPM_SC_FCHOWN, - [__NR_ia32_setresuid - SYSCALL_TABLE_ID0] = PPM_SC_SETRESUID, - [__NR_ia32_getresuid - SYSCALL_TABLE_ID0] = PPM_SC_GETRESUID, - [__NR_ia32_setresgid - SYSCALL_TABLE_ID0] = PPM_SC_SETRESGID, - [__NR_ia32_getresgid - SYSCALL_TABLE_ID0] = PPM_SC_GETRESGID, - [__NR_ia32_chown - SYSCALL_TABLE_ID0] = PPM_SC_CHOWN, - [__NR_ia32_setfsuid - SYSCALL_TABLE_ID0] = PPM_SC_SETFSUID, - [__NR_ia32_setfsgid - SYSCALL_TABLE_ID0] = PPM_SC_SETFSGID, - [__NR_ia32_pivot_root - SYSCALL_TABLE_ID0] = PPM_SC_PIVOT_ROOT, - [__NR_ia32_mincore - SYSCALL_TABLE_ID0] = PPM_SC_MINCORE, - [__NR_ia32_madvise - SYSCALL_TABLE_ID0] = PPM_SC_MADVISE, - [__NR_ia32_gettid - SYSCALL_TABLE_ID0] = PPM_SC_GETTID, - [__NR_ia32_setxattr - SYSCALL_TABLE_ID0] = PPM_SC_SETXATTR, - [__NR_ia32_lsetxattr - SYSCALL_TABLE_ID0] = PPM_SC_LSETXATTR, - [__NR_ia32_fsetxattr - SYSCALL_TABLE_ID0] = PPM_SC_FSETXATTR, - [__NR_ia32_getxattr - SYSCALL_TABLE_ID0] = PPM_SC_GETXATTR, - [__NR_ia32_lgetxattr - SYSCALL_TABLE_ID0] = PPM_SC_LGETXATTR, - [__NR_ia32_fgetxattr - SYSCALL_TABLE_ID0] = PPM_SC_FGETXATTR, - [__NR_ia32_listxattr - SYSCALL_TABLE_ID0] = PPM_SC_LISTXATTR, - [__NR_ia32_llistxattr - SYSCALL_TABLE_ID0] = PPM_SC_LLISTXATTR, - [__NR_ia32_flistxattr - SYSCALL_TABLE_ID0] = PPM_SC_FLISTXATTR, - [__NR_ia32_removexattr - SYSCALL_TABLE_ID0] = PPM_SC_REMOVEXATTR, - [__NR_ia32_lremovexattr - SYSCALL_TABLE_ID0] = PPM_SC_LREMOVEXATTR, - [__NR_ia32_fremovexattr - SYSCALL_TABLE_ID0] = PPM_SC_FREMOVEXATTR, - [__NR_ia32_tkill - SYSCALL_TABLE_ID0] = PPM_SC_TKILL, - [__NR_ia32_futex - SYSCALL_TABLE_ID0] = PPM_SC_FUTEX, - [__NR_ia32_sched_setaffinity - SYSCALL_TABLE_ID0] = PPM_SC_SCHED_SETAFFINITY, - [__NR_ia32_sched_getaffinity - SYSCALL_TABLE_ID0] = PPM_SC_SCHED_GETAFFINITY, -#ifdef __NR_ia32_set_thread_area - [__NR_ia32_set_thread_area - SYSCALL_TABLE_ID0] = PPM_SC_SET_THREAD_AREA, -#endif -#ifdef __NR_ia32_get_thread_area - [__NR_ia32_get_thread_area - SYSCALL_TABLE_ID0] = PPM_SC_GET_THREAD_AREA, -#endif - [__NR_ia32_io_setup - SYSCALL_TABLE_ID0] = PPM_SC_IO_SETUP, - [__NR_ia32_io_destroy - SYSCALL_TABLE_ID0] = PPM_SC_IO_DESTROY, - [__NR_ia32_io_getevents - SYSCALL_TABLE_ID0] = PPM_SC_IO_GETEVENTS, - [__NR_ia32_io_submit - SYSCALL_TABLE_ID0] = PPM_SC_IO_SUBMIT, - [__NR_ia32_io_cancel - SYSCALL_TABLE_ID0] = PPM_SC_IO_CANCEL, - [__NR_ia32_exit_group - SYSCALL_TABLE_ID0] = PPM_SC_EXIT_GROUP, - [__NR_ia32_epoll_create - SYSCALL_TABLE_ID0] = PPM_SC_EPOLL_CREATE, - [__NR_ia32_epoll_ctl - SYSCALL_TABLE_ID0] = PPM_SC_EPOLL_CTL, - [__NR_ia32_epoll_wait - SYSCALL_TABLE_ID0] = PPM_SC_EPOLL_WAIT, - [__NR_ia32_remap_file_pages - SYSCALL_TABLE_ID0] = PPM_SC_REMAP_FILE_PAGES, - [__NR_ia32_set_tid_address - SYSCALL_TABLE_ID0] = PPM_SC_SET_TID_ADDRESS, - [__NR_ia32_timer_create - SYSCALL_TABLE_ID0] = PPM_SC_TIMER_CREATE, - [__NR_ia32_timer_settime - SYSCALL_TABLE_ID0] = PPM_SC_TIMER_SETTIME, - [__NR_ia32_timer_gettime - SYSCALL_TABLE_ID0] = PPM_SC_TIMER_GETTIME, - [__NR_ia32_timer_getoverrun - SYSCALL_TABLE_ID0] = PPM_SC_TIMER_GETOVERRUN, - [__NR_ia32_timer_delete - SYSCALL_TABLE_ID0] = PPM_SC_TIMER_DELETE, - [__NR_ia32_clock_settime - SYSCALL_TABLE_ID0] = PPM_SC_CLOCK_SETTIME, - [__NR_ia32_clock_gettime - SYSCALL_TABLE_ID0] = PPM_SC_CLOCK_GETTIME, - [__NR_ia32_clock_getres - SYSCALL_TABLE_ID0] = PPM_SC_CLOCK_GETRES, - [__NR_ia32_clock_nanosleep - SYSCALL_TABLE_ID0] = PPM_SC_CLOCK_NANOSLEEP, - [__NR_ia32_tgkill - SYSCALL_TABLE_ID0] = PPM_SC_TGKILL, - [__NR_ia32_utimes - SYSCALL_TABLE_ID0] = PPM_SC_UTIMES, - [__NR_ia32_mq_open - SYSCALL_TABLE_ID0] = PPM_SC_MQ_OPEN, - [__NR_ia32_mq_unlink - SYSCALL_TABLE_ID0] = PPM_SC_MQ_UNLINK, - [__NR_ia32_mq_timedsend - SYSCALL_TABLE_ID0] = PPM_SC_MQ_TIMEDSEND, - [__NR_ia32_mq_timedreceive - SYSCALL_TABLE_ID0] = PPM_SC_MQ_TIMEDRECEIVE, - [__NR_ia32_mq_notify - SYSCALL_TABLE_ID0] = PPM_SC_MQ_NOTIFY, - [__NR_ia32_mq_getsetattr - SYSCALL_TABLE_ID0] = PPM_SC_MQ_GETSETATTR, - [__NR_ia32_kexec_load - SYSCALL_TABLE_ID0] = PPM_SC_KEXEC_LOAD, - [__NR_ia32_waitid - SYSCALL_TABLE_ID0] = PPM_SC_WAITID, - [__NR_ia32_add_key - SYSCALL_TABLE_ID0] = PPM_SC_ADD_KEY, - [__NR_ia32_request_key - SYSCALL_TABLE_ID0] = PPM_SC_REQUEST_KEY, - [__NR_ia32_keyctl - SYSCALL_TABLE_ID0] = PPM_SC_KEYCTL, - [__NR_ia32_ioprio_set - SYSCALL_TABLE_ID0] = PPM_SC_IOPRIO_SET, - [__NR_ia32_ioprio_get - SYSCALL_TABLE_ID0] = PPM_SC_IOPRIO_GET, - [__NR_ia32_inotify_init - SYSCALL_TABLE_ID0] = PPM_SC_INOTIFY_INIT, - [__NR_ia32_inotify_add_watch - SYSCALL_TABLE_ID0] = PPM_SC_INOTIFY_ADD_WATCH, - [__NR_ia32_inotify_rm_watch - SYSCALL_TABLE_ID0] = PPM_SC_INOTIFY_RM_WATCH, - [__NR_ia32_openat - SYSCALL_TABLE_ID0] = PPM_SC_OPENAT, - [__NR_ia32_mkdirat - SYSCALL_TABLE_ID0] = PPM_SC_MKDIRAT, - [__NR_ia32_mknodat - SYSCALL_TABLE_ID0] = PPM_SC_MKNODAT, - [__NR_ia32_fchownat - SYSCALL_TABLE_ID0] = PPM_SC_FCHOWNAT, - [__NR_ia32_futimesat - SYSCALL_TABLE_ID0] = PPM_SC_FUTIMESAT, - [__NR_ia32_unlinkat - SYSCALL_TABLE_ID0] = PPM_SC_UNLINKAT, - [__NR_ia32_renameat - SYSCALL_TABLE_ID0] = PPM_SC_RENAMEAT, - [__NR_ia32_linkat - SYSCALL_TABLE_ID0] = PPM_SC_LINKAT, - [__NR_ia32_symlinkat - SYSCALL_TABLE_ID0] = PPM_SC_SYMLINKAT, - [__NR_ia32_readlinkat - SYSCALL_TABLE_ID0] = PPM_SC_READLINKAT, - [__NR_ia32_fchmodat - SYSCALL_TABLE_ID0] = PPM_SC_FCHMODAT, - [__NR_ia32_faccessat - SYSCALL_TABLE_ID0] = PPM_SC_FACCESSAT, - [__NR_ia32_pselect6 - SYSCALL_TABLE_ID0] = PPM_SC_PSELECT6, - [__NR_ia32_ppoll - SYSCALL_TABLE_ID0] = PPM_SC_PPOLL, - [__NR_ia32_unshare - SYSCALL_TABLE_ID0] = PPM_SC_UNSHARE, - [__NR_ia32_set_robust_list - SYSCALL_TABLE_ID0] = PPM_SC_SET_ROBUST_LIST, - [__NR_ia32_get_robust_list - SYSCALL_TABLE_ID0] = PPM_SC_GET_ROBUST_LIST, - [__NR_ia32_splice - SYSCALL_TABLE_ID0] = PPM_SC_SPLICE, - [__NR_ia32_tee - SYSCALL_TABLE_ID0] = PPM_SC_TEE, - [__NR_ia32_vmsplice - SYSCALL_TABLE_ID0] = PPM_SC_VMSPLICE, -#ifdef __NR_ia32_getcpu - [__NR_ia32_getcpu - SYSCALL_TABLE_ID0] = PPM_SC_GETCPU, -#endif - [__NR_ia32_epoll_pwait - SYSCALL_TABLE_ID0] = PPM_SC_EPOLL_PWAIT, - [__NR_ia32_utimensat - SYSCALL_TABLE_ID0] = PPM_SC_UTIMENSAT, - [__NR_ia32_signalfd - SYSCALL_TABLE_ID0] = PPM_SC_SIGNALFD, - [__NR_ia32_timerfd_create - SYSCALL_TABLE_ID0] = PPM_SC_TIMERFD_CREATE, - [__NR_ia32_eventfd - SYSCALL_TABLE_ID0] = PPM_SC_EVENTFD, - [__NR_ia32_timerfd_settime - SYSCALL_TABLE_ID0] = PPM_SC_TIMERFD_SETTIME, - [__NR_ia32_timerfd_gettime - SYSCALL_TABLE_ID0] = PPM_SC_TIMERFD_GETTIME, - [__NR_ia32_signalfd4 - SYSCALL_TABLE_ID0] = PPM_SC_SIGNALFD4, - [__NR_ia32_eventfd2 - SYSCALL_TABLE_ID0] = PPM_SC_EVENTFD2, - [__NR_ia32_epoll_create1 - SYSCALL_TABLE_ID0] = PPM_SC_EPOLL_CREATE1, - [__NR_ia32_dup3 - SYSCALL_TABLE_ID0] = PPM_SC_DUP3, - [__NR_ia32_pipe2 - SYSCALL_TABLE_ID0] = PPM_SC_PIPE2, - [__NR_ia32_inotify_init1 - SYSCALL_TABLE_ID0] = PPM_SC_INOTIFY_INIT1, - [__NR_ia32_preadv - SYSCALL_TABLE_ID0] = PPM_SC_PREADV, - [__NR_ia32_pwritev - SYSCALL_TABLE_ID0] = PPM_SC_PWRITEV, - [__NR_ia32_rt_tgsigqueueinfo - SYSCALL_TABLE_ID0] = PPM_SC_RT_TGSIGQUEUEINFO, - [__NR_ia32_perf_event_open - SYSCALL_TABLE_ID0] = PPM_SC_PERF_EVENT_OPEN, -#ifdef __NR_ia32_fanotify_init - [__NR_ia32_fanotify_init - SYSCALL_TABLE_ID0] = PPM_SC_FANOTIFY_INIT, -#endif -#ifdef __NR_ia32_prlimit64 - [__NR_ia32_prlimit64 - SYSCALL_TABLE_ID0] = PPM_SC_PRLIMIT64, -#endif -#ifdef __NR_ia32_clock_adjtime - [__NR_ia32_clock_adjtime - SYSCALL_TABLE_ID0] = PPM_SC_CLOCK_ADJTIME, -#endif -#ifdef __NR_ia32_syncfs - [__NR_ia32_syncfs - SYSCALL_TABLE_ID0] = PPM_SC_SYNCFS, -#endif -#ifdef __NR_ia32_setns - [__NR_ia32_setns - SYSCALL_TABLE_ID0] = PPM_SC_SETNS, -#endif - [__NR_ia32_getdents64 - SYSCALL_TABLE_ID0] = PPM_SC_GETDENTS64, -#ifndef __NR_ia32_socketcall - /* - * Non-multiplexed socket family - */ - [__NR_ia32_socket - SYSCALL_TABLE_ID0] = PPM_SC_SOCKET, - [__NR_ia32_bind - SYSCALL_TABLE_ID0] = PPM_SC_BIND, - [__NR_ia32_connect - SYSCALL_TABLE_ID0] = PPM_SC_CONNECT, - [__NR_ia32_listen - SYSCALL_TABLE_ID0] = PPM_SC_LISTEN, - [__NR_ia32_accept - SYSCALL_TABLE_ID0] = PPM_SC_ACCEPT, - [__NR_ia32_getsockname - SYSCALL_TABLE_ID0] = PPM_SC_GETSOCKNAME, - [__NR_ia32_getpeername - SYSCALL_TABLE_ID0] = PPM_SC_GETPEERNAME, - [__NR_ia32_socketpair - SYSCALL_TABLE_ID0] = PPM_SC_SOCKETPAIR, -/* [__NR_ia32_send - SYSCALL_TABLE_ID0] = PPM_SC_NR_SEND, */ - [__NR_ia32_sendto - SYSCALL_TABLE_ID0] = PPM_SC_SENDTO, -/* [__NR_ia32_recv - SYSCALL_TABLE_ID0] = PPM_SC_NR_RECV, */ - [__NR_ia32_recvfrom - SYSCALL_TABLE_ID0] = PPM_SC_RECVFROM, - [__NR_ia32_shutdown - SYSCALL_TABLE_ID0] = PPM_SC_SHUTDOWN, - [__NR_ia32_setsockopt - SYSCALL_TABLE_ID0] = PPM_SC_SETSOCKOPT, - [__NR_ia32_getsockopt - SYSCALL_TABLE_ID0] = PPM_SC_GETSOCKOPT, - [__NR_ia32_sendmsg - SYSCALL_TABLE_ID0] = PPM_SC_SENDMSG, - [__NR_ia32_recvmsg - SYSCALL_TABLE_ID0] = PPM_SC_RECVMSG, - [__NR_ia32_accept4 - SYSCALL_TABLE_ID0] = PPM_SC_ACCEPT4, -#else - [__NR_ia32_socketcall - SYSCALL_TABLE_ID0] = PPM_SC_SOCKETCALL, -#endif - - -#ifdef __NR_ia32_sendmmsg - [__NR_ia32_sendmmsg - SYSCALL_TABLE_ID0] = PPM_SC_SENDMMSG, -#endif -#ifdef __NR_ia32_recvmmsg - [__NR_ia32_recvmmsg - SYSCALL_TABLE_ID0] = PPM_SC_RECVMMSG, -#endif - /* - * Non-multiplexed IPC family - */ -#ifdef __NR_ia32_semop - [__NR_ia32_semop - SYSCALL_TABLE_ID0] = PPM_SC_SEMOP, -#endif -#ifdef __NR_ia32_semget - [__NR_ia32_semget - SYSCALL_TABLE_ID0] = PPM_SC_SEMGET, -#endif -#ifdef __NR_ia32_semctl - [__NR_ia32_semctl - SYSCALL_TABLE_ID0] = PPM_SC_SEMCTL, -#endif -#ifdef __NR_ia32_msgsnd - [__NR_ia32_msgsnd - SYSCALL_TABLE_ID0] = PPM_SC_MSGSND, -#endif -#ifdef __NR_ia32_msgrcv - [__NR_ia32_msgrcv - SYSCALL_TABLE_ID0] = PPM_SC_MSGRCV, -#endif -#ifdef __NR_ia32_msgget - [__NR_ia32_msgget - SYSCALL_TABLE_ID0] = PPM_SC_MSGGET, -#endif -#ifdef __NR_ia32_msgctl - [__NR_ia32_msgctl - SYSCALL_TABLE_ID0] = PPM_SC_MSGCTL, -#endif -/* [__NR_ia32_shmatcall - SYSCALL_TABLE_ID0] = PPM_SC_NR_SHMATCALL, */ -#ifdef __NR_ia32_shmdt - [__NR_ia32_shmdt - SYSCALL_TABLE_ID0] = PPM_SC_SHMDT, -#endif -#ifdef __NR_ia32_shmget - [__NR_ia32_shmget - SYSCALL_TABLE_ID0] = PPM_SC_SHMGET, -#endif -#ifdef __NR_ia32_shmctl - [__NR_ia32_shmctl - SYSCALL_TABLE_ID0] = PPM_SC_SHMCTL, -#endif -/* [__NR_ia32_fcntl64 - SYSCALL_TABLE_ID0] = PPM_SC_NR_FCNTL64, */ -#ifdef __NR_ia32_statfs64 - [__NR_ia32_statfs64 - SYSCALL_TABLE_ID0] = PPM_SC_STATFS64, -#endif -#ifdef __NR_ia32_fstatfs64 - [__NR_ia32_fstatfs64 - SYSCALL_TABLE_ID0] = PPM_SC_FSTATFS64, -#endif -#ifdef __NR_ia32_fstatat64 - [__NR_ia32_fstatat64 - SYSCALL_TABLE_ID0] = PPM_SC_FSTATAT64, -#endif -#ifdef __NR_ia32_sendfile64 - [__NR_ia32_sendfile64 - SYSCALL_TABLE_ID0] = PPM_SC_SENDFILE64, -#endif -#ifdef __NR_ia32_ugetrlimit - [__NR_ia32_ugetrlimit - SYSCALL_TABLE_ID0] = PPM_SC_UGETRLIMIT, -#endif -#ifdef __NR_ia32_bdflush - [__NR_ia32_bdflush - SYSCALL_TABLE_ID0] = PPM_SC_BDFLUSH, -#endif -#ifdef __NR_ia32_sigprocmask - [__NR_ia32_sigprocmask - SYSCALL_TABLE_ID0] = PPM_SC_SIGPROCMASK, -#endif -#ifdef __NR_ia32_ipc - [__NR_ia32_ipc - SYSCALL_TABLE_ID0] = PPM_SC_IPC, -#endif -#ifdef __NR_ia32_stat64 - [__NR_ia32_stat64 - SYSCALL_TABLE_ID0] = PPM_SC_STAT64, -#endif -#ifdef __NR_ia32_lstat64 - [__NR_ia32_lstat64 - SYSCALL_TABLE_ID0] = PPM_SC_LSTAT64, -#endif -#ifdef __NR_ia32_fstat64 - [__NR_ia32_fstat64 - SYSCALL_TABLE_ID0] = PPM_SC_FSTAT64, -#endif -#ifdef __NR_ia32_fcntl64 - [__NR_ia32_fcntl64 - SYSCALL_TABLE_ID0] = PPM_SC_FCNTL64, -#endif -#ifdef __NR_ia32_mmap2 - [__NR_ia32_mmap2 - SYSCALL_TABLE_ID0] = PPM_SC_MMAP2, -#endif -#ifdef __NR_ia32__newselect - [__NR_ia32__newselect - SYSCALL_TABLE_ID0] = PPM_SC__NEWSELECT, -#endif -#ifdef __NR_ia32_sgetmask - [__NR_ia32_sgetmask - SYSCALL_TABLE_ID0] = PPM_SC_SGETMASK, -#endif -#ifdef __NR_ia32_ssetmask - [__NR_ia32_ssetmask - SYSCALL_TABLE_ID0] = PPM_SC_SSETMASK, -#endif - -/* [__NR_ia32_setreuid16 - SYSCALL_TABLE_ID0] = PPM_SC_NR_SETREUID16, */ -/* [__NR_ia32_setregid16 - SYSCALL_TABLE_ID0] = PPM_SC_NR_SETREGID16, */ -#ifdef __NR_ia32_sigpending - [__NR_ia32_sigpending - SYSCALL_TABLE_ID0] = PPM_SC_SIGPENDING, -#endif -#ifdef __NR_ia32_olduname - [__NR_ia32_olduname - SYSCALL_TABLE_ID0] = PPM_SC_OLDUNAME, -#endif -#ifdef __NR_ia32_umount - [__NR_ia32_umount - SYSCALL_TABLE_ID0] = PPM_SC_UMOUNT, -#endif -#ifdef __NR_ia32_signal - [__NR_ia32_signal - SYSCALL_TABLE_ID0] = PPM_SC_SIGNAL, -#endif -#ifdef __NR_ia32_nice - [__NR_ia32_nice - SYSCALL_TABLE_ID0] = PPM_SC_NICE, -#endif -#ifdef __NR_ia32_stime - [__NR_ia32_stime - SYSCALL_TABLE_ID0] = PPM_SC_STIME, -#endif -#ifdef __NR_ia32__llseek - [__NR_ia32__llseek - SYSCALL_TABLE_ID0] = PPM_SC__LLSEEK, -#endif -#ifdef __NR_ia32_waitpid - [__NR_ia32_waitpid - SYSCALL_TABLE_ID0] = PPM_SC_WAITPID, -#endif -#ifdef __NR_ia32_pread64 - [__NR_ia32_pread64 - SYSCALL_TABLE_ID0] = PPM_SC_PREAD64, -#endif -#ifdef __NR_ia32_pwrite64 - [__NR_ia32_pwrite64 - SYSCALL_TABLE_ID0] = PPM_SC_PWRITE64, -#endif -#ifdef __NR_ia32_shmat - [__NR_ia32_shmat - SYSCALL_TABLE_ID0] = PPM_SC_SHMAT, -#endif -#ifdef __NR_ia32_rt_sigreturn - [__NR_ia32_rt_sigreturn - SYSCALL_TABLE_ID0] = PPM_SC_SIGRETURN, -#endif -#ifdef __NR_ia32_fallocate - [__NR_ia32_fallocate - SYSCALL_TABLE_ID0] = PPM_SC_FALLOCATE, -#endif -#ifdef __NR_ia32_newfstatat - [__NR_ia32_newfstatat - SYSCALL_TABLE_ID0] = PPM_SC_NEWFSSTAT, -#endif -#ifdef __NR_ia32_process_vm_readv - [__NR_ia32_process_vm_readv - SYSCALL_TABLE_ID0] = PPM_SC_PROCESS_VM_READV, -#endif -#ifdef __NR_ia32_process_vm_writev - [__NR_ia32_process_vm_writev - SYSCALL_TABLE_ID0] = PPM_SC_PROCESS_VM_WRITEV, -#endif -#ifdef __NR_ia32_fork - [__NR_ia32_fork - SYSCALL_TABLE_ID0] = PPM_SC_FORK, -#endif -#ifdef __NR_ia32_vfork - [__NR_ia32_vfork - SYSCALL_TABLE_ID0] = PPM_SC_VFORK, -#endif -#ifdef __NR_ia32_quotactl - [__NR_ia32_quotactl - SYSCALL_TABLE_ID0] = PPM_SC_QUOTACTL, -#endif -#ifdef __NR_ia32_setresuid - [__NR_ia32_setresuid - SYSCALL_TABLE_ID0] = PPM_SC_SETRESUID, -#endif -#ifdef __NR_ia32_setresuid32 - [__NR_ia32_setresuid32 - SYSCALL_TABLE_ID0] = PPM_SC_SETRESUID, -#endif -#ifdef __NR_ia32_setresgid - [__NR_ia32_setresgid - SYSCALL_TABLE_ID0] = PPM_SC_SETRESGID, -#endif -#ifdef __NR_ia32_setresgid32 - [__NR_ia32_setresgid32 - SYSCALL_TABLE_ID0] = PPM_SC_SETRESGID, -#endif -#ifdef __NR_ia32_setuid - [__NR_ia32_setuid - SYSCALL_TABLE_ID0] = PPM_SC_SETUID, -#endif -#ifdef __NR_ia32_setuid32 - [__NR_ia32_setuid32 - SYSCALL_TABLE_ID0] = PPM_SC_SETUID32, -#endif -#ifdef __NR_ia32_setgid - [__NR_ia32_setgid - SYSCALL_TABLE_ID0] = PPM_SC_SETGID, -#endif -#ifdef __NR_ia32_setgid32 - [__NR_ia32_setgid32 - SYSCALL_TABLE_ID0] = PPM_SC_SETGID32, -#endif -#ifdef __NR_ia32_getuid - [__NR_ia32_getuid - SYSCALL_TABLE_ID0] = PPM_SC_GETUID, -#endif -#ifdef __NR_ia32_getuid32 - [__NR_ia32_getuid32 - SYSCALL_TABLE_ID0] = PPM_SC_GETUID32, -#endif -#ifdef __NR_ia32_geteuid - [__NR_ia32_geteuid - SYSCALL_TABLE_ID0] = PPM_SC_GETEUID, -#endif -#ifdef __NR_ia32_geteuid32 - [__NR_ia32_geteuid32 - SYSCALL_TABLE_ID0] = PPM_SC_GETEUID, -#endif -#ifdef __NR_ia32_getgid - [__NR_ia32_getgid - SYSCALL_TABLE_ID0] = PPM_SC_GETGID, -#endif -#ifdef __NR_ia32_getgid32 - [__NR_ia32_getgid32 - SYSCALL_TABLE_ID0] = PPM_SC_GETGID, -#endif -#ifdef __NR_ia32_getegid - [__NR_ia32_getegid - SYSCALL_TABLE_ID0] = PPM_SC_GETEGID, -#endif -#ifdef __NR_ia32_getegid32 - [__NR_ia32_getegid32 - SYSCALL_TABLE_ID0] = PPM_SC_GETEGID, -#endif -#ifdef __NR_ia32_getresuid - [__NR_ia32_getresuid - SYSCALL_TABLE_ID0] = PPM_SC_GETRESUID, -#endif -#ifdef __NR_ia32_getresuid32 - [__NR_ia32_getresuid32 - SYSCALL_TABLE_ID0] = PPM_SC_GETRESUID32, -#endif -#ifdef __NR_ia32_getresgid - [__NR_ia32_getresgid - SYSCALL_TABLE_ID0] = PPM_SC_GETRESGID, -#endif -#ifdef __NR_ia32_getresgid32 - [__NR_ia32_getresgid32 - SYSCALL_TABLE_ID0] = PPM_SC_GETRESGID32, -#endif -#ifdef __NR_ia32_finit_module - [__NR_ia32_finit_module - SYSCALL_TABLE_ID0] = PPM_SC_FINIT_MODULE, -#endif -#ifdef __NR_ia32_bpf - [__NR_ia32_bpf - SYSCALL_TABLE_ID0] = PPM_SC_BPF, -#endif -#ifdef __NR_ia32_seccomp - [__NR_ia32_seccomp - SYSCALL_TABLE_ID0] = PPM_SC_SECCOMP, -#endif -#ifdef __NR_ia32_sigaltstack - [__NR_ia32_sigaltstack - SYSCALL_TABLE_ID0] = PPM_SC_SIGALTSTACK, -#endif -#ifdef __NR_ia32_getrandom - [__NR_ia32_getrandom - SYSCALL_TABLE_ID0] = PPM_SC_GETRANDOM, -#endif -#ifdef __NR_ia32_fadvise64 - [__NR_ia32_fadvise64 - SYSCALL_TABLE_ID0] = PPM_SC_FADVISE64, -#endif -#ifdef __NR_ia32_renameat2 - [__NR_ia32_renameat2 - SYSCALL_TABLE_ID0] = PPM_SC_RENAMEAT2, -#endif -#ifdef __NR_ia32_userfaultfd - [__NR_ia32_userfaultfd - SYSCALL_TABLE_ID0] = PPM_SC_USERFAULTFD, -#endif -#ifdef __NR_ia32_openat2 - [__NR_ia32_openat2 - SYSCALL_TABLE_ID0] = PPM_SC_OPENAT2, -#endif -#ifdef __NR_ia32_execveat - [__NR_ia32_execveat - SYSCALL_TABLE_ID0] = PPM_SC_EXECVEAT, -#endif -#ifdef __NR_ia32_io_uring_setup - [__NR_ia32_io_uring_setup - SYSCALL_TABLE_ID0] = PPM_SC_IO_URING_SETUP, -#endif -#ifdef __NR_ia32_io_uring_enter - [__NR_ia32_io_uring_enter - SYSCALL_TABLE_ID0] = PPM_SC_IO_URING_ENTER, -#endif -#ifdef __NR_ia32_io_uring_register - [__NR_ia32_io_uring_register - SYSCALL_TABLE_ID0] = PPM_SC_IO_URING_REGISTER, -#endif -#ifdef __NR_ia32_copy_file_range - [__NR_ia32_copy_file_range - SYSCALL_TABLE_ID0] = PPM_SC_COPY_FILE_RANGE, -#endif - [__NR_ia32_clone - SYSCALL_TABLE_ID0] = PPM_SC_CLONE, -#ifdef __NR_ia32_clone3 - [__NR_ia32_clone3 - SYSCALL_TABLE_ID0] = PPM_SC_CLONE3, -#endif -#ifdef __NR_ia32_open_by_handle_at - [__NR_ia32_open_by_handle_at - SYSCALL_TABLE_ID0] = PPM_SC_OPEN_BY_HANDLE_AT, -#endif -}; - -#endif /* CONFIG_IA32_EMULATION */ diff --git a/driver/syscall_table.m4 b/driver/syscall_table.m4 new file mode 100644 index 0000000000..9f8d1c2c60 --- /dev/null +++ b/driver/syscall_table.m4 @@ -0,0 +1,444 @@ +/* + +Copyright (C) 2021 The Falco Authors. + +This file is dual licensed under either the MIT or GPL 2. See MIT.txt +or GPL2.txt for full copies of the license. + +*/ + +#ifdef __KERNEL__ +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 20) +#include "ppm_syscall.h" +#else +#include +#endif +#else /* __KERNEL__ */ + +#ifdef WDIG +#include +#else /* WDIG */ +#ifdef UDIG +#include +#else /* UDIG */ +#include +#endif /* UDIG */ +#endif /* WDIG */ +#ifdef __mips__ +#define SYSCALL_TABLE_ID0 __NR_Linux +#else /* __mips__ */ +#define SYSCALL_TABLE_ID0 0 +#endif /* __mips__ */ +#endif /* __KERNEL__ */ + + +#include "ppm_events_public.h" +#ifdef __KERNEL__ +#include "ppm.h" +#if defined(CONFIG_IA32_EMULATION) && !defined(__NR_ia32_socketcall) +#include "ppm_compat_unistd_32.h" +#endif +#endif /* __KERNEL__ */ + +/* + * List of supported syscalls, used for both __NR_x ones and __NR_ia32_x ones. + * + * Meanings: + * SYSCALL() macro -> declare a syscall with attached flags, events and ppm_sc code, only if the __NR_(ia32_)symbol is defined. + * SOCKETCALL() macro -> same as SYSCALL but check for __NR_(ia32_)socketcall symbol defined instead (it is used by various socket related syscalls) + * SYSCALL_NO_EV() -> mapped syscalls (where defined) that have no flags and no events; the macro will create an entry with only ppm_code set to PPM_SC_$upper($syscall_name), + * useful when mapping a new syscall that only has a PPM_SC_ code, but no real events attached. + * + * Ideally, you'd most probably want to use the SYSCALL() macro. + * + * Append your new syscall below, any position is good (as the index is the syscall nr anyway) + */ +define(`X_SYSCALLS', ` + SYSCALL(open, `UF_USED | UF_NEVER_DROP, PPME_SYSCALL_OPEN_E, PPME_SYSCALL_OPEN_X, PPM_SC_OPEN') \ + SYSCALL(creat, `UF_USED | UF_NEVER_DROP, PPME_SYSCALL_CREAT_E, PPME_SYSCALL_CREAT_X,PPM_SC_CREAT') \ + SYSCALL(close, `UF_USED | UF_NEVER_DROP | UF_SIMPLEDRIVER_KEEP, PPME_SYSCALL_CLOSE_E, PPME_SYSCALL_CLOSE_X, PPM_SC_CLOSE') \ + SYSCALL(brk, `UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_BRK_4_E, PPME_SYSCALL_BRK_4_X, PPM_SC_BRK') \ + SYSCALL(read, `UF_USED, PPME_SYSCALL_READ_E, PPME_SYSCALL_READ_X, PPM_SC_READ') \ + SYSCALL(write, `UF_USED, PPME_SYSCALL_WRITE_E, PPME_SYSCALL_WRITE_X, PPM_SC_WRITE') \ + SYSCALL(execve, `UF_USED | UF_NEVER_DROP | UF_SIMPLEDRIVER_KEEP, PPME_SYSCALL_EXECVE_19_E, PPME_SYSCALL_EXECVE_19_X, PPM_SC_EXECVE') \ + SYSCALL(clone, `UF_USED | UF_NEVER_DROP | UF_SIMPLEDRIVER_KEEP, PPME_SYSCALL_CLONE_20_E, PPME_SYSCALL_CLONE_20_X') \ + SYSCALL(fork, `UF_USED | UF_NEVER_DROP | UF_SIMPLEDRIVER_KEEP, PPME_SYSCALL_FORK_20_E, PPME_SYSCALL_FORK_20_X, PPM_SC_FORK') \ + SYSCALL(vfork, `UF_USED | UF_NEVER_DROP | UF_SIMPLEDRIVER_KEEP, PPME_SYSCALL_VFORK_20_E, PPME_SYSCALL_VFORK_20_X, PPM_SC_VFORK') \ + SYSCALL(pipe, `UF_USED | UF_NEVER_DROP, PPME_SYSCALL_PIPE_E, PPME_SYSCALL_PIPE_X, PPM_SC_PIPE') \ + SYSCALL(pipe2, `UF_USED | UF_NEVER_DROP, PPME_SYSCALL_PIPE_E, PPME_SYSCALL_PIPE_X, PPM_SC_PIPE2') \ + SYSCALL(eventfd, `UF_USED | UF_NEVER_DROP, PPME_SYSCALL_EVENTFD_E, PPME_SYSCALL_EVENTFD_X, PPM_SC_EVENTFD') \ + SYSCALL(eventfd2, `UF_USED | UF_NEVER_DROP, PPME_SYSCALL_EVENTFD_E, PPME_SYSCALL_EVENTFD_X, PPM_SC_EVENTFD2') \ + SYSCALL(futex, `UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_FUTEX_E, PPME_SYSCALL_FUTEX_X, PPM_SC_FUTEX') \ + SYSCALL(stat, `UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_STAT_E, PPME_SYSCALL_STAT_X, PPM_SC_STAT') \ + SYSCALL(lstat, `UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_LSTAT_E, PPME_SYSCALL_LSTAT_X, PPM_SC_LSTAT') \ + SYSCALL(fstat, `UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_FSTAT_E, PPME_SYSCALL_FSTAT_X, PPM_SC_FSTAT') \ + SYSCALL(epoll_wait, `UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_EPOLLWAIT_E, PPME_SYSCALL_EPOLLWAIT_X, PPM_SC_EPOLL_WAIT') \ + SYSCALL(poll, `UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_POLL_E, PPME_SYSCALL_POLL_X, PPM_SC_POLL') \ + SYSCALL(select, `UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_SELECT_E, PPME_SYSCALL_SELECT_X, PPM_SC_SELECT') \ + SYSCALL(lseek, `UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_LSEEK_E, PPME_SYSCALL_LSEEK_X, PPM_SC_LSEEK') \ + SYSCALL(ioctl, `UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_IOCTL_3_E, PPME_SYSCALL_IOCTL_3_X, PPM_SC_IOCTL') \ + SYSCALL(getcwd, `UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_GETCWD_E, PPME_SYSCALL_GETCWD_X, PPM_SC_GETCWD') \ + SYSCALL(chdir, `UF_USED | UF_NEVER_DROP | UF_SIMPLEDRIVER_KEEP, PPME_SYSCALL_CHDIR_E, PPME_SYSCALL_CHDIR_X, PPM_SC_CHDIR') \ + SYSCALL(fchdir, `UF_USED | UF_NEVER_DROP | UF_SIMPLEDRIVER_KEEP, PPME_SYSCALL_FCHDIR_E, PPME_SYSCALL_FCHDIR_X, PPM_SC_FCHDIR') \ + SYSCALL(mkdir, `UF_USED, PPME_SYSCALL_MKDIR_2_E, PPME_SYSCALL_MKDIR_2_X, PPM_SC_MKDIR') \ + SYSCALL(rmdir, `UF_USED, PPME_SYSCALL_RMDIR_2_E, PPME_SYSCALL_RMDIR_2_X, PPM_SC_RMDIR') \ + SYSCALL(openat, `UF_USED | UF_NEVER_DROP, PPME_SYSCALL_OPENAT_2_E, PPME_SYSCALL_OPENAT_2_X, PPM_SC_OPENAT') \ + SYSCALL(mkdirat, `UF_USED, PPME_SYSCALL_MKDIRAT_E, PPME_SYSCALL_MKDIRAT_X, PPM_SC_MKDIRAT') \ + SYSCALL(link, `UF_USED, PPME_SYSCALL_LINK_2_E, PPME_SYSCALL_LINK_2_X, PPM_SC_LINK') \ + SYSCALL(linkat, `UF_USED, PPME_SYSCALL_LINKAT_2_E, PPME_SYSCALL_LINKAT_2_X, PPM_SC_LINKAT') \ + SYSCALL(unlink, `UF_USED, PPME_SYSCALL_UNLINK_2_E, PPME_SYSCALL_UNLINK_2_X, PPM_SC_UNLINK') \ + SYSCALL(unlinkat, `UF_USED, PPME_SYSCALL_UNLINKAT_2_E, PPME_SYSCALL_UNLINKAT_2_X, PPM_SC_UNLINKAT') \ + SYSCALL(pread64, `UF_USED, PPME_SYSCALL_PREAD_E, PPME_SYSCALL_PREAD_X, PPM_SC_PREAD64') \ + SYSCALL(pwrite64, `UF_USED, PPME_SYSCALL_PWRITE_E, PPME_SYSCALL_PWRITE_X, PPM_SC_PWRITE64') \ + SYSCALL(readv, `UF_USED, PPME_SYSCALL_READV_E, PPME_SYSCALL_READV_X, PPM_SC_READV') \ + SYSCALL(writev, `UF_USED, PPME_SYSCALL_WRITEV_E, PPME_SYSCALL_WRITEV_X, PPM_SC_WRITEV') \ + SYSCALL(preadv, `UF_USED, PPME_SYSCALL_PREADV_E, PPME_SYSCALL_PREADV_X, PPM_SC_PREADV') \ + SYSCALL(pwritev, `UF_USED, PPME_SYSCALL_PWRITEV_E, PPME_SYSCALL_PWRITEV_X, PPM_SC_PWRITEV') \ + SYSCALL(dup, `UF_USED | UF_NEVER_DROP | UF_SIMPLEDRIVER_KEEP, PPME_SYSCALL_DUP_E, PPME_SYSCALL_DUP_X, PPM_SC_DUP') \ + SYSCALL(dup2, `UF_USED | UF_NEVER_DROP | UF_SIMPLEDRIVER_KEEP, PPME_SYSCALL_DUP_E, PPME_SYSCALL_DUP_X, PPM_SC_DUP2') \ + SYSCALL(dup3, `UF_USED | UF_NEVER_DROP | UF_SIMPLEDRIVER_KEEP, PPME_SYSCALL_DUP_E, PPME_SYSCALL_DUP_X, PPM_SC_DUP3') \ + SYSCALL(signalfd, `UF_USED | UF_NEVER_DROP, PPME_SYSCALL_SIGNALFD_E, PPME_SYSCALL_SIGNALFD_X, PPM_SC_SIGNALFD') \ + SYSCALL(signalfd4, `UF_USED | UF_NEVER_DROP, PPME_SYSCALL_SIGNALFD_E, PPME_SYSCALL_SIGNALFD_X, PPM_SC_SIGNALFD4') \ + SYSCALL(kill, `UF_USED, PPME_SYSCALL_KILL_E, PPME_SYSCALL_KILL_X, PPM_SC_KILL') \ + SYSCALL(tkill, `UF_USED, PPME_SYSCALL_TKILL_E, PPME_SYSCALL_TKILL_X, PPM_SC_TKILL') \ + SYSCALL(tgkill, `UF_USED, PPME_SYSCALL_TGKILL_E, PPME_SYSCALL_TGKILL_X, PPM_SC_TGKILL') \ + SYSCALL(nanosleep, `UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_NANOSLEEP_E, PPME_SYSCALL_NANOSLEEP_X, PPM_SC_NANOSLEEP') \ + SYSCALL(timerfd_create, `UF_USED | UF_NEVER_DROP, PPME_SYSCALL_TIMERFD_CREATE_E, PPME_SYSCALL_TIMERFD_CREATE_X, PPM_SC_TIMERFD_CREATE') \ + SYSCALL(inotify_init, `UF_USED | UF_NEVER_DROP, PPME_SYSCALL_INOTIFY_INIT_E, PPME_SYSCALL_INOTIFY_INIT_X, PPM_SC_INOTIFY_INIT') \ + SYSCALL(inotify_init1, `UF_USED | UF_NEVER_DROP, PPME_SYSCALL_INOTIFY_INIT_E, PPME_SYSCALL_INOTIFY_INIT_X, PPM_SC_INOTIFY_INIT1') \ + SYSCALL(fchmodat, `UF_USED, PPME_SYSCALL_FCHMODAT_E, PPME_SYSCALL_FCHMODAT_X, PPM_SC_FCHMODAT') \ + SYSCALL(fchmod, `UF_USED, PPME_SYSCALL_FCHMOD_E, PPME_SYSCALL_FCHMOD_X, PPM_SC_FCHMOD') \ + SYSCALL(getrlimit, `UF_USED | UF_NEVER_DROP, PPME_SYSCALL_GETRLIMIT_E, PPME_SYSCALL_GETRLIMIT_X, PPM_SC_GETRLIMIT') \ + SYSCALL(setrlimit, `UF_USED | UF_NEVER_DROP, PPME_SYSCALL_SETRLIMIT_E, PPME_SYSCALL_SETRLIMIT_X, PPM_SC_SETRLIMIT') \ + SYSCALL(prlimit64, `UF_USED | UF_NEVER_DROP, PPME_SYSCALL_PRLIMIT_E, PPME_SYSCALL_PRLIMIT_X, PPM_SC_PRLIMIT64') \ + SYSCALL(ugetrlimit, `UF_USED | UF_NEVER_DROP, PPME_SYSCALL_GETRLIMIT_E, PPME_SYSCALL_GETRLIMIT_X, PPM_SC_UGETRLIMIT') \ + SYSCALL(fcntl, `UF_USED, PPME_SYSCALL_FCNTL_E, PPME_SYSCALL_FCNTL_X, PPM_SC_FCNTL') \ + SYSCALL(fcntl64, `UF_USED, PPME_SYSCALL_FCNTL_E, PPME_SYSCALL_FCNTL_X, PPM_SC_FCNTL64') \ + SYSCALL(pselect6, `UF_USED | UF_ALWAYS_DROP, PPME_GENERIC_E, PPME_GENERIC_X, PPM_SC_PSELECT6') \ + SYSCALL(epoll_create, `UF_USED | UF_ALWAYS_DROP, PPME_GENERIC_E, PPME_GENERIC_X, PPM_SC_EPOLL_CREATE') \ + SYSCALL(epoll_ctl, `UF_USED | UF_ALWAYS_DROP, PPME_GENERIC_E, PPME_GENERIC_X, PPM_SC_EPOLL_CTL') \ + SYSCALL(uselib, `UF_USED | UF_ALWAYS_DROP, PPME_GENERIC_E, PPME_GENERIC_X, PPM_SC_USELIB') \ + SYSCALL(sched_setparam, `UF_USED | UF_ALWAYS_DROP, PPME_GENERIC_E, PPME_GENERIC_X, PPM_SC_SCHED_SETPARAM') \ + SYSCALL(sched_getparam, `UF_USED | UF_ALWAYS_DROP, PPME_GENERIC_E, PPME_GENERIC_X, PPM_SC_SCHED_GETPARAM') \ + SYSCALL(syslog, `UF_USED | UF_ALWAYS_DROP, PPME_GENERIC_E, PPME_GENERIC_X, PPM_SC_SYSLOG') \ + SYSCALL(chmod, `UF_USED, PPME_SYSCALL_CHMOD_E, PPME_SYSCALL_CHMOD_X, PPM_SC_CHMOD') \ + SYSCALL(lchown, `UF_USED, PPME_GENERIC_E, PPME_GENERIC_X, PPM_SC_LCHOWN') \ + SYSCALL(utime, `UF_USED | UF_ALWAYS_DROP, PPME_GENERIC_E, PPME_GENERIC_X, PPM_SC_UTIME') \ + SYSCALL(mount, `UF_USED, PPME_SYSCALL_MOUNT_E, PPME_SYSCALL_MOUNT_X, PPM_SC_MOUNT') \ + SYSCALL(umount2, `UF_USED, PPME_SYSCALL_UMOUNT_E, PPME_SYSCALL_UMOUNT_X, PPM_SC_UMOUNT2') \ + SYSCALL(ptrace, `UF_USED, PPME_SYSCALL_PTRACE_E, PPME_SYSCALL_PTRACE_X, PPM_SC_PTRACE') \ + SYSCALL(alarm, `UF_USED | UF_ALWAYS_DROP, PPME_GENERIC_E, PPME_GENERIC_X, PPM_SC_ALARM') \ + SYSCALL(pause, `UF_USED | UF_ALWAYS_DROP, PPME_GENERIC_E, PPME_GENERIC_X, PPM_SC_PAUSE') \ + SOCKETCALL(socket, `UF_USED | UF_NEVER_DROP | UF_SIMPLEDRIVER_KEEP, PPME_SOCKET_SOCKET_E, PPME_SOCKET_SOCKET_X, PPM_SC_SOCKET') \ + SOCKETCALL(bind, `UF_USED | UF_NEVER_DROP, PPME_SOCKET_BIND_E, PPME_SOCKET_BIND_X, PPM_SC_BIND') \ + SOCKETCALL(connect, `UF_USED | UF_SIMPLEDRIVER_KEEP, PPME_SOCKET_CONNECT_E, PPME_SOCKET_CONNECT_X, PPM_SC_CONNECT') \ + SOCKETCALL(listen, `UF_USED, PPME_SOCKET_LISTEN_E, PPME_SOCKET_LISTEN_X, PPM_SC_LISTEN') \ + SOCKETCALL(accept, `UF_USED | UF_SIMPLEDRIVER_KEEP, PPME_SOCKET_ACCEPT_5_E, PPME_SOCKET_ACCEPT_5_X, PPM_SC_ACCEPT') \ + SOCKETCALL(getsockname, `UF_USED | UF_ALWAYS_DROP, PPME_SOCKET_GETSOCKNAME_E, PPME_SOCKET_GETSOCKNAME_X, PPM_SC_GETSOCKNAME') \ + SOCKETCALL(getpeername, `UF_USED | UF_ALWAYS_DROP, PPME_SOCKET_GETPEERNAME_E, PPME_SOCKET_GETPEERNAME_X, PPM_SC_GETPEERNAME') \ + SOCKETCALL(socketpair, `UF_USED | UF_NEVER_DROP, PPME_SOCKET_SOCKETPAIR_E, PPME_SOCKET_SOCKETPAIR_X, PPM_SC_SOCKETPAIR') \ + SOCKETCALL(sendto, `UF_USED, PPME_SOCKET_SENDTO_E, PPME_SOCKET_SENDTO_X, PPM_SC_SENDTO') \ + SOCKETCALL(recvfrom, `UF_USED, PPME_SOCKET_RECVFROM_E, PPME_SOCKET_RECVFROM_X, PPM_SC_RECVFROM') \ + SOCKETCALL(shutdown, `UF_USED, PPME_SOCKET_SHUTDOWN_E, PPME_SOCKET_SHUTDOWN_X, PPM_SC_SHUTDOWN') \ + SOCKETCALL(setsockopt, `UF_USED | UF_ALWAYS_DROP, PPME_SOCKET_SETSOCKOPT_E, PPME_SOCKET_SETSOCKOPT_X, PPM_SC_SETSOCKOPT') \ + SOCKETCALL(getsockopt, `UF_USED, PPME_SOCKET_GETSOCKOPT_E, PPME_SOCKET_GETSOCKOPT_X, PPM_SC_GETSOCKOPT') \ + SOCKETCALL(sendmsg, `UF_USED, PPME_SOCKET_SENDMSG_E, PPME_SOCKET_SENDMSG_X, PPM_SC_SENDMSG') \ + SOCKETCALL(accept4, `UF_USED | UF_SIMPLEDRIVER_KEEP, PPME_SOCKET_ACCEPT4_5_E, PPME_SOCKET_ACCEPT4_5_X, PPM_SC_ACCEPT4') \ + SYSCALL(socketcall, `.ppm_code = PPM_SC_SOCKETCALL') \ + SYSCALL(sendmmsg, `UF_USED, PPME_SOCKET_SENDMMSG_E, PPME_SOCKET_SENDMMSG_X, PPM_SC_SENDMMSG') \ + SYSCALL(recvmsg, `UF_USED, PPME_SOCKET_RECVMSG_E, PPME_SOCKET_RECVMSG_X, PPM_SC_RECVMSG') \ + SYSCALL(recvmmsg, `UF_USED, PPME_SOCKET_RECVMMSG_E, PPME_SOCKET_RECVMMSG_X, PPM_SC_RECVMMSG') \ + SYSCALL(stat64, `UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_STAT64_E, PPME_SYSCALL_STAT64_X, PPM_SC_STAT64') \ + SYSCALL(fstat64, `UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_FSTAT64_E, PPME_SYSCALL_FSTAT64_X, PPM_SC_FSTAT64') \ + SYSCALL(llseek, `UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_LLSEEK_E, PPME_SYSCALL_LLSEEK_X, PPM_SC__LLSEEK') \ + SYSCALL(mmap, `UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_MMAP_E, PPME_SYSCALL_MMAP_X, PPM_SC_MMAP') \ + SYSCALL(mmap2, `UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_MMAP2_E, PPME_SYSCALL_MMAP2_X, PPM_SC_MMAP2') \ + SYSCALL(munmap, `UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_MUNMAP_E, PPME_SYSCALL_MUNMAP_X, PPM_SC_MUNMAP') \ + SYSCALL(splice, `UF_USED, PPME_SYSCALL_SPLICE_E, PPME_SYSCALL_SPLICE_X, PPM_SC_SPLICE') \ + SYSCALL(process_vm_readv, `UF_USED, PPME_GENERIC_E, PPME_GENERIC_X, PPM_SC_PROCESS_VM_READV') \ + SYSCALL(process_vm_writev, `UF_USED, PPME_GENERIC_E, PPME_GENERIC_X, PPM_SC_PROCESS_VM_WRITEV') \ + SYSCALL(rename, `UF_USED, PPME_SYSCALL_RENAME_E, PPME_SYSCALL_RENAME_X, PPM_SC_RENAME') \ + SYSCALL(renameat, `UF_USED, PPME_SYSCALL_RENAMEAT_E, PPME_SYSCALL_RENAMEAT_X, PPM_SC_RENAMEAT') \ + SYSCALL(symlink, `UF_USED, PPME_SYSCALL_SYMLINK_E, PPME_SYSCALL_SYMLINK_X, PPM_SC_SYMLINK') \ + SYSCALL(symlinkat, `UF_USED, PPME_SYSCALL_SYMLINKAT_E, PPME_SYSCALL_SYMLINKAT_X, PPM_SC_SYMLINKAT') \ + SYSCALL(sendfile, `UF_USED, PPME_SYSCALL_SENDFILE_E, PPME_SYSCALL_SENDFILE_X, PPM_SC_SENDFILE') \ + SYSCALL(sendfile64, `UF_USED, PPME_SYSCALL_SENDFILE_E, PPME_SYSCALL_SENDFILE_X, PPM_SC_SENDFILE64') \ + SYSCALL(quotactl, `UF_USED, PPME_SYSCALL_QUOTACTL_E, PPME_SYSCALL_QUOTACTL_X, PPM_SC_QUOTACTL') \ + SYSCALL(setresuid, `UF_USED, PPME_SYSCALL_SETRESUID_E, PPME_SYSCALL_SETRESUID_X, PPM_SC_SETRESUID') \ + SYSCALL(setresuid32, `UF_USED, PPME_SYSCALL_SETRESUID_E, PPME_SYSCALL_SETRESUID_X, PPM_SC_SETRESUID') \ + SYSCALL(setresgid, `UF_USED, PPME_SYSCALL_SETRESGID_E, PPME_SYSCALL_SETRESGID_X, PPM_SC_SETRESGID') \ + SYSCALL(setresgid32, `UF_USED, PPME_SYSCALL_SETRESGID_E, PPME_SYSCALL_SETRESGID_X, PPM_SC_SETRESGID') \ + SYSCALL(setuid, `UF_USED, PPME_SYSCALL_SETUID_E, PPME_SYSCALL_SETUID_X, PPM_SC_SETUID') \ + SYSCALL(setuid32, `UF_USED, PPME_SYSCALL_SETUID_E, PPME_SYSCALL_SETUID_X, PPM_SC_SETUID32') \ + SYSCALL(setgid, `UF_USED, PPME_SYSCALL_SETGID_E, PPME_SYSCALL_SETGID_X, PPM_SC_SETGID') \ + SYSCALL(setgid32, `UF_USED, PPME_SYSCALL_SETGID_E, PPME_SYSCALL_SETGID_X, PPM_SC_SETGID32') \ + SYSCALL(getuid, `UF_USED, PPME_SYSCALL_GETUID_E, PPME_SYSCALL_GETUID_X, PPM_SC_GETUID') \ + SYSCALL(getuid32, `UF_USED, PPME_SYSCALL_GETUID_E, PPME_SYSCALL_GETUID_X, PPM_SC_GETUID32') \ + SYSCALL(geteuid, `UF_USED, PPME_SYSCALL_GETEUID_E, PPME_SYSCALL_GETEUID_X, PPM_SC_GETEUID') \ + SYSCALL(geteuid32, `UF_USED, PPME_SYSCALL_GETEUID_E, PPME_SYSCALL_GETEUID_X, PPM_SC_GETEUID') \ + SYSCALL(getgid, `UF_USED, PPME_SYSCALL_GETGID_E, PPME_SYSCALL_GETGID_X, PPM_SC_GETGID') \ + SYSCALL(getgid32, `UF_USED, PPME_SYSCALL_GETGID_E, PPME_SYSCALL_GETGID_X, PPM_SC_GETGID') \ + SYSCALL(getegid, `UF_USED, PPME_SYSCALL_GETEGID_E, PPME_SYSCALL_GETEGID_X, PPM_SC_GETEGID') \ + SYSCALL(getegid32, `UF_USED, PPME_SYSCALL_GETEGID_E, PPME_SYSCALL_GETEGID_X, PPM_SC_GETEGID') \ + SYSCALL(getresuid, `UF_USED, PPME_SYSCALL_GETRESUID_E, PPME_SYSCALL_GETRESUID_X, PPM_SC_GETRESUID') \ + SYSCALL(getresuid32, `UF_USED, PPME_SYSCALL_GETRESUID_E, PPME_SYSCALL_GETRESUID_X, PPM_SC_GETRESUID32') \ + SYSCALL(getresgid, `UF_USED, PPME_SYSCALL_GETRESGID_E, PPME_SYSCALL_GETRESGID_X, PPM_SC_GETRESGID') \ + SYSCALL(getresgid32, `UF_USED, PPME_SYSCALL_GETRESGID_E, PPME_SYSCALL_GETRESGID_X, PPM_SC_GETRESGID32') \ + SYSCALL(getdents, `UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_GETDENTS_E, PPME_SYSCALL_GETDENTS_X, PPM_SC_GETDENTS') \ + SYSCALL(getdents64, `UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_GETDENTS64_E, PPME_SYSCALL_GETDENTS64_X, PPM_SC_GETDENTS64') \ + SYSCALL(setns, `UF_USED, PPME_SYSCALL_SETNS_E, PPME_SYSCALL_SETNS_X, PPM_SC_SETNS') \ + SYSCALL(unshare, `UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_UNSHARE_E, PPME_SYSCALL_UNSHARE_X, PPM_SC_UNSHARE') \ + SYSCALL(flock, `UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_FLOCK_E, PPME_SYSCALL_FLOCK_X, PPM_SC_FLOCK') \ + SYSCALL(semop, `UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_SEMOP_E, PPME_SYSCALL_SEMOP_X, PPM_SC_SEMOP') \ + SYSCALL(semget, `UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_SEMGET_E, PPME_SYSCALL_SEMGET_X, PPM_SC_SEMGET') \ + SYSCALL(semctl, `UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_SEMCTL_E, PPME_SYSCALL_SEMCTL_X, PPM_SC_SEMCTL') \ + SYSCALL(ppoll, `UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_PPOLL_E, PPME_SYSCALL_PPOLL_X, PPM_SC_PPOLL') \ + SYSCALL(access, `UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_ACCESS_E, PPME_SYSCALL_ACCESS_X, PPM_SC_ACCESS') \ + SYSCALL(chroot, `UF_USED | UF_NEVER_DROP, PPME_SYSCALL_CHROOT_E, PPME_SYSCALL_CHROOT_X, PPM_SC_CHROOT') \ + SYSCALL(setsid, `UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_SETSID_E, PPME_SYSCALL_SETSID_X, PPM_SC_SETSID') \ + SYSCALL(setpgid, `UF_USED | UF_ALWAYS_DROP, PPME_SYSCALL_SETPGID_E, PPME_SYSCALL_SETPGID_X, PPM_SC_SETPGID') \ + SYSCALL(bpf, `UF_USED, PPME_SYSCALL_BPF_E, PPME_SYSCALL_BPF_X, PPM_SC_BPF') \ + SYSCALL(seccomp, `UF_USED, PPME_SYSCALL_SECCOMP_E, PPME_SYSCALL_SECCOMP_X, PPM_SC_SECCOMP') \ + SYSCALL(renameat2, `UF_USED, PPME_SYSCALL_RENAMEAT2_E, PPME_SYSCALL_RENAMEAT2_X, PPM_SC_RENAMEAT2') \ + SYSCALL(userfaultfd, `UF_USED | UF_NEVER_DROP, PPME_SYSCALL_USERFAULTFD_E, PPME_SYSCALL_USERFAULTFD_X, PPM_SC_USERFAULTFD') \ + SYSCALL(openat2, `UF_USED, PPME_SYSCALL_OPENAT2_E, PPME_SYSCALL_OPENAT2_X, PPM_SC_OPENAT2') \ + SYSCALL(clone3, `UF_USED | UF_NEVER_DROP | UF_SIMPLEDRIVER_KEEP, PPME_SYSCALL_CLONE3_E, PPME_SYSCALL_CLONE3_X, PPM_SC_CLONE3') \ + SYSCALL(mprotect, `UF_USED, PPME_SYSCALL_MPROTECT_E, PPME_SYSCALL_MPROTECT_X, PPM_SC_MPROTECT') \ + SYSCALL(execveat, `UF_USED | UF_NEVER_DROP | UF_SIMPLEDRIVER_KEEP, PPME_SYSCALL_EXECVEAT_E, PPME_SYSCALL_EXECVEAT_X, PPM_SC_EXECVEAT') \ + SYSCALL(io_uring_setup, `UF_USED, PPME_SYSCALL_IO_URING_SETUP_E, PPME_SYSCALL_IO_URING_SETUP_X, PPM_SC_IO_URING_SETUP') \ + SYSCALL(io_uring_enter, `UF_USED, PPME_SYSCALL_IO_URING_ENTER_E, PPME_SYSCALL_IO_URING_ENTER_X, PPM_SC_IO_URING_ENTER') \ + SYSCALL(io_uring_register, `UF_USED, PPME_SYSCALL_IO_URING_REGISTER_E, PPME_SYSCALL_IO_URING_REGISTER_X, PPM_SC_IO_URING_REGISTER') \ + SYSCALL(copy_file_range, `UF_USED, PPME_SYSCALL_COPY_FILE_RANGE_E, PPME_SYSCALL_COPY_FILE_RANGE_X, PPM_SC_COPY_FILE_RANGE') \ + SYSCALL(open_by_handle_at, `UF_USED, PPME_SYSCALL_OPEN_BY_HANDLE_AT_E, PPME_SYSCALL_OPEN_BY_HANDLE_AT_X, PPM_SC_OPEN_BY_HANDLE_AT') \ + SYSCALL(mlock, `UF_USED, PPME_SYSCALL_MLOCK_E, PPME_SYSCALL_MLOCK_X, PPM_SC_MLOCK') \ + SYSCALL(munlock, `UF_USED, PPME_SYSCALL_MUNLOCK_E, PPME_SYSCALL_MUNLOCK_X, PPM_SC_MUNLOCK') \ + SYSCALL(mlockall, `UF_USED, PPME_SYSCALL_MLOCKALL_E, PPME_SYSCALL_MLOCKALL_X, PPM_SC_MLOCKALL') \ + SYSCALL(munlockall, `UF_USED, PPME_SYSCALL_MUNLOCKALL_E, PPME_SYSCALL_MUNLOCKALL_X, PPM_SC_MUNLOCKALL') \ + SYSCALL(capset, `UF_USED, PPME_SYSCALL_CAPSET_E, PPME_SYSCALL_CAPSET_X, PPM_SC_CAPSET') \ + SYSCALL_NO_EV(restart_syscall) \ + SYSCALL_NO_EV(exit) \ + SYSCALL_NO_EV(time) \ + SYSCALL_NO_EV(mknod) \ + SYSCALL_NO_EV(getpid) \ + SYSCALL_NO_EV(sync) \ + SYSCALL_NO_EV(times) \ + SYSCALL_NO_EV(acct) \ + SYSCALL_NO_EV(umask) \ + SYSCALL_NO_EV(ustat) \ + SYSCALL_NO_EV(getppid) \ + SYSCALL_NO_EV(getpgrp) \ + SYSCALL_NO_EV(sethostname) \ + SYSCALL_NO_EV(getrusage) \ + SYSCALL_NO_EV(gettimeofday) \ + SYSCALL_NO_EV(settimeofday) \ + SYSCALL_NO_EV(readlink) \ + SYSCALL_NO_EV(swapon) \ + SYSCALL_NO_EV(reboot) \ + SYSCALL_NO_EV(truncate) \ + SYSCALL_NO_EV(ftruncate) \ + SYSCALL_NO_EV(getpriority) \ + SYSCALL_NO_EV(setpriority) \ + SYSCALL_NO_EV(statfs) \ + SYSCALL_NO_EV(fstatfs) \ + SYSCALL_NO_EV(setitimer) \ + SYSCALL_NO_EV(getitimer) \ + SYSCALL_NO_EV(uname) \ + SYSCALL_NO_EV(vhangup) \ + SYSCALL_NO_EV(wait4) \ + SYSCALL_NO_EV(swapoff) \ + SYSCALL_NO_EV(sysinfo) \ + SYSCALL_NO_EV(fsync) \ + SYSCALL_NO_EV(setdomainname) \ + SYSCALL_NO_EV(adjtimex) \ + SYSCALL_NO_EV(init_module) \ + SYSCALL_NO_EV(delete_module) \ + SYSCALL_NO_EV(getpgid) \ + SYSCALL_NO_EV(sysfs) \ + SYSCALL_NO_EV(personality) \ + SYSCALL_NO_EV(msync) \ + SYSCALL_NO_EV(getsid) \ + SYSCALL_NO_EV(fdatasync) \ + SYSCALL_NO_EV(sched_setscheduler) \ + SYSCALL_NO_EV(sched_getscheduler) \ + SYSCALL_NO_EV(sched_yield) \ + SYSCALL_NO_EV(sched_get_priority_max) \ + SYSCALL_NO_EV(sched_get_priority_min) \ + SYSCALL_NO_EV(sched_rr_get_interval) \ + SYSCALL_NO_EV(mremap) \ + SYSCALL_NO_EV(prctl) \ + SYSCALL_NO_EV(arch_prctl) \ + SYSCALL_NO_EV(rt_sigaction) \ + SYSCALL_NO_EV(rt_sigprocmask) \ + SYSCALL_NO_EV(rt_sigpending) \ + SYSCALL_NO_EV(rt_sigtimedwait) \ + SYSCALL_NO_EV(rt_sigqueueinfo) \ + SYSCALL_NO_EV(rt_sigsuspend) \ + SYSCALL_NO_EV(capget) \ + SYSCALL_NO_EV(setreuid) \ + SYSCALL_NO_EV(setregid) \ + SYSCALL_NO_EV(getgroups) \ + SYSCALL_NO_EV(setgroups) \ + SYSCALL_NO_EV(fchown) \ + SYSCALL_NO_EV(chown) \ + SYSCALL_NO_EV(setfsuid) \ + SYSCALL_NO_EV(setfsgid) \ + SYSCALL_NO_EV(pivot_root) \ + SYSCALL_NO_EV(mincore) \ + SYSCALL_NO_EV(madvise) \ + SYSCALL_NO_EV(gettid) \ + SYSCALL_NO_EV(setxattr) \ + SYSCALL_NO_EV(lsetxattr) \ + SYSCALL_NO_EV(fsetxattr) \ + SYSCALL_NO_EV(getxattr) \ + SYSCALL_NO_EV(lgetxattr) \ + SYSCALL_NO_EV(fgetxattr) \ + SYSCALL_NO_EV(listxattr) \ + SYSCALL_NO_EV(llistxattr) \ + SYSCALL_NO_EV(flistxattr) \ + SYSCALL_NO_EV(removexattr) \ + SYSCALL_NO_EV(lremovexattr) \ + SYSCALL_NO_EV(fremovexattr) \ + SYSCALL_NO_EV(sched_setaffinity) \ + SYSCALL_NO_EV(sched_getaffinity) \ + SYSCALL_NO_EV(set_thread_area) \ + SYSCALL_NO_EV(get_thread_area) \ + SYSCALL_NO_EV(io_setup) \ + SYSCALL_NO_EV(io_destroy) \ + SYSCALL_NO_EV(io_getevents) \ + SYSCALL_NO_EV(io_submit) \ + SYSCALL_NO_EV(io_cancel) \ + SYSCALL_NO_EV(exit_group) \ + SYSCALL_NO_EV(remap_file_pages) \ + SYSCALL_NO_EV(set_tid_address) \ + SYSCALL_NO_EV(timer_create) \ + SYSCALL_NO_EV(timer_settime) \ + SYSCALL_NO_EV(timer_gettime) \ + SYSCALL_NO_EV(timer_getoverrun) \ + SYSCALL_NO_EV(timer_delete) \ + SYSCALL_NO_EV(clock_settime) \ + SYSCALL_NO_EV(clock_gettime) \ + SYSCALL_NO_EV(clock_getres) \ + SYSCALL_NO_EV(clock_nanosleep) \ + SYSCALL_NO_EV(utimes) \ + SYSCALL_NO_EV(mq_open) \ + SYSCALL_NO_EV(mq_unlink) \ + SYSCALL_NO_EV(mq_timedsend) \ + SYSCALL_NO_EV(mq_timedreceive) \ + SYSCALL_NO_EV(mq_notify) \ + SYSCALL_NO_EV(mq_getsetattr) \ + SYSCALL_NO_EV(kexec_load) \ + SYSCALL_NO_EV(waitid) \ + SYSCALL_NO_EV(add_key) \ + SYSCALL_NO_EV(request_key) \ + SYSCALL_NO_EV(keyctl) \ + SYSCALL_NO_EV(ioprio_set) \ + SYSCALL_NO_EV(ioprio_get) \ + SYSCALL_NO_EV(inotify_add_watch) \ + SYSCALL_NO_EV(inotify_rm_watch) \ + SYSCALL_NO_EV(mknodat) \ + SYSCALL_NO_EV(fchownat) \ + SYSCALL_NO_EV(futimesat) \ + SYSCALL_NO_EV(readlinkat) \ + SYSCALL_NO_EV(faccessat) \ + SYSCALL_NO_EV(set_robust_list) \ + SYSCALL_NO_EV(get_robust_list) \ + SYSCALL_NO_EV(tee) \ + SYSCALL_NO_EV(vmsplice) \ + SYSCALL_NO_EV(getcpu) \ + SYSCALL_NO_EV(epoll_pwait) \ + SYSCALL_NO_EV(utimensat) \ + SYSCALL_NO_EV(timerfd_settime) \ + SYSCALL_NO_EV(timerfd_gettime) \ + SYSCALL_NO_EV(epoll_create1) \ + SYSCALL_NO_EV(rt_tgsigqueueinfo) \ + SYSCALL_NO_EV(perf_event_open) \ + SYSCALL_NO_EV(fanotify_init) \ + SYSCALL_NO_EV(clock_adjtime) \ + SYSCALL_NO_EV(syncfs) \ + SYSCALL_NO_EV(msgsnd) \ + SYSCALL_NO_EV(msgrcv) \ + SYSCALL_NO_EV(msgget) \ + SYSCALL_NO_EV(msgctl) \ + SYSCALL_NO_EV(shmdt) \ + SYSCALL_NO_EV(shmget) \ + SYSCALL_NO_EV(shmctl) \ + SYSCALL_NO_EV(statfs64) \ + SYSCALL_NO_EV(fstatfs64) \ + SYSCALL_NO_EV(fstatat64) \ + SYSCALL_NO_EV(bdflush) \ + SYSCALL_NO_EV(sigprocmask) \ + SYSCALL_NO_EV(ipc) \ + SYSCALL_NO_EV(lstat64) \ + SYSCALL_NO_EV(_newselect) \ + SYSCALL_NO_EV(sgetmask) \ + SYSCALL_NO_EV(ssetmask) \ + SYSCALL_NO_EV(sigpending) \ + SYSCALL_NO_EV(olduname) \ + SYSCALL_NO_EV(umount) \ + SYSCALL_NO_EV(signal) \ + SYSCALL_NO_EV(nice) \ + SYSCALL_NO_EV(stime) \ + SYSCALL_NO_EV(waitpid) \ + SYSCALL_NO_EV(shmat) \ + SYSCALL(rt_sigreturn, `.ppm_code = PPM_SC_SIGRETURN') \ + SYSCALL_NO_EV(fallocate) \ + SYSCALL(newfstatat, `.ppm_code = PPM_SC_NEWFSSTAT') \ + SYSCALL_NO_EV(finit_module) \ + SYSCALL_NO_EV(sigaltstack) \ + SYSCALL_NO_EV(getrandom) \ + SYSCALL_NO_EV(fadvise64) +') + +define(`SYSCALL_NO_EV', `SYSCALL($1, `.ppm_code = translit(PPM_SC_$1, [a-z], [A-Z])')') + +const struct syscall_evt_pair g_syscall_table[SYSCALL_TABLE_SIZE] = { +define(`SYSCALL', ` +#ifdef __NR_$1 + [__NR_$1 - SYSCALL_TABLE_ID0] = { $2 }, +#endif +') +define(`SOCKETCALL', ` +#ifndef __NR_socketcall + [__NR_$1 - SYSCALL_TABLE_ID0] = { $2 }, +#endif +') + + X_SYSCALLS + +undefine(`SYSCALL') +undefine(`SOCKETCALL') +}; + +#ifdef CONFIG_IA32_EMULATION +const struct syscall_evt_pair g_syscall_ia32_table[SYSCALL_TABLE_SIZE] = { +define(`SYSCALL', ` +#ifdef __NR_ia32_$1 + [__NR_ia32_$1 - SYSCALL_TABLE_ID0] = { $2 }, +#endif +') +define(`SOCKETCALL', ` +#ifndef __NR_ia32_socketcall + [__NR_ia32_$1 - SYSCALL_TABLE_ID0] = { $2 }, +#endif +') + + X_SYSCALLS + +undefine(`SYSCALL') +undefine(`SOCKETCALL') +}; +#endif + +undefine(`SYSCALL_NO_EV') diff --git a/libs.kdev4 b/libs.kdev4 new file mode 100644 index 0000000000..c236e0911d --- /dev/null +++ b/libs.kdev4 @@ -0,0 +1,4 @@ +[Project] +CreatedFrom=CMakeLists.txt +Manager=KDevCMakeManager +Name=libs diff --git a/userspace/libscap/scap-int.h b/userspace/libscap/scap-int.h index 8324308f53..2291408043 100644 --- a/userspace/libscap/scap-int.h +++ b/userspace/libscap/scap-int.h @@ -405,7 +405,6 @@ struct ppm_proclist_info *scap_procfs_get_threadlist(scap_t *handle); #define SCAP_DRIVER_PROCINFO_INITIAL_SIZE 7 #define SCAP_DRIVER_PROCINFO_MAX_SIZE 128000 -extern const enum ppm_syscall_code g_syscall_code_routing_table[]; extern const struct syscall_evt_pair g_syscall_table[]; extern const struct ppm_event_info g_event_info[]; extern const struct ppm_syscall_desc g_syscall_info_table[]; diff --git a/userspace/libscap/scap.c b/userspace/libscap/scap.c index 2c5d56ca24..c7262855e9 100644 --- a/userspace/libscap/scap.c +++ b/userspace/libscap/scap.c @@ -343,7 +343,7 @@ scap_t* scap_open_live_int(char *error, int32_t *rc, for(int syscall_nr = 0; syscall_nr < SYSCALL_TABLE_SIZE; syscall_nr++) { // Find the match between the ppm_sc and the syscall_nr - if(g_syscall_code_routing_table[syscall_nr] == i) + if(g_syscall_table[syscall_nr].ppm_code == i) { // UF_NEVER_DROP syscalls must be always traced if (ppm_sc_of_interest->ppm_sc[i] || g_syscall_table[syscall_nr].flags & UF_NEVER_DROP) diff --git a/userspace/libscap/scap_bpf.c b/userspace/libscap/scap_bpf.c index 0d59a15c13..a5021fb0d4 100644 --- a/userspace/libscap/scap_bpf.c +++ b/userspace/libscap/scap_bpf.c @@ -775,23 +775,6 @@ static void *perf_event_mmap(scap_t *handle, int fd) return tmp; } -static int32_t populate_syscall_routing_table_map(scap_t *handle) -{ - int j; - - for(j = 0; j < SYSCALL_TABLE_SIZE; ++j) - { - long code = g_syscall_code_routing_table[j]; - if(bpf_map_update_elem(handle->m_bpf_map_fds[SCAP_SYSCALL_CODE_ROUTING_TABLE], &j, &code, BPF_ANY) != 0) - { - snprintf(handle->m_lasterr, SCAP_LASTERR_SIZE, "SCAP_SYSCALL_CODE_ROUTING_TABLE bpf_map_update_elem < 0"); - return SCAP_FAILURE; - } - } - - return bpf_map_freeze(handle->m_bpf_map_fds[SCAP_SYSCALL_CODE_ROUTING_TABLE]); -} - static int32_t populate_syscall_table_map(scap_t *handle) { static const struct syscall_evt_pair uninterested_pair = { .flags = UF_UNINTERESTING }; @@ -1438,11 +1421,6 @@ int32_t scap_bpf_load(scap_t *handle, const char *bpf_probe) return SCAP_FAILURE; } - if(populate_syscall_routing_table_map(handle) != SCAP_SUCCESS) - { - return SCAP_FAILURE; - } - if(populate_syscall_table_map(handle) != SCAP_SUCCESS) { return SCAP_FAILURE; diff --git a/userspace/libscap/scap_event.c b/userspace/libscap/scap_event.c index 384b5c67bf..0e5f715c6c 100644 --- a/userspace/libscap/scap_event.c +++ b/userspace/libscap/scap_event.c @@ -84,7 +84,7 @@ uint32_t scap_event_has_large_payload(const scap_evt* e) uint32_t scap_event_decode_params(const scap_evt *e, struct scap_sized_buffer *params) { - char *len_buf = (char*)e + sizeof(struct ppm_evt_hdr); + char *len_buf = (char *)e->payload; char *param_buf = len_buf; uint32_t is_large = scap_event_has_large_payload(e); uint32_t param_size_32; diff --git a/userspace/libscap/scap_procs.c b/userspace/libscap/scap_procs.c index a8eec5c2fc..28dcc0cdd2 100644 --- a/userspace/libscap/scap_procs.c +++ b/userspace/libscap/scap_procs.c @@ -1629,7 +1629,7 @@ int32_t scap_check_suppressed(scap_t *handle, scap_evt *pevent, bool *suppressed case PPME_SYSCALL_EXECVEAT_X: case PPME_SYSCALL_CLONE3_X: - lens = (uint16_t *)((char *)pevent + sizeof(struct ppm_evt_hdr)); + lens = (uint16_t *)pevent->payload; valptr = (char *)lens + pevent->nparams * sizeof(uint16_t); if(pevent->nparams < 14) diff --git a/userspace/libscap/scap_savefile.c b/userspace/libscap/scap_savefile.c index 20713d020e..24f61cd773 100755 --- a/userspace/libscap/scap_savefile.c +++ b/userspace/libscap/scap_savefile.c @@ -2940,7 +2940,7 @@ int32_t scap_next_offline(scap_t *handle, OUT scap_evt **pevent, OUT uint16_t *p // until size matches. // char *end = (char *)*pevent + (*pevent)->len; - uint16_t *lens = (uint16_t *)((char *)*pevent + sizeof(struct ppm_evt_hdr)); + uint16_t *lens = (uint16_t *)(*pevent)->payload; uint32_t nparams; bool done = false; for(nparams = g_event_info[(*pevent)->type].nparams; (int)nparams >= 0; nparams--) diff --git a/userspace/libsinsp/container.cpp b/userspace/libsinsp/container.cpp index 1f7829a3ee..8696fc083d 100644 --- a/userspace/libsinsp/container.cpp +++ b/userspace/libsinsp/container.cpp @@ -278,7 +278,7 @@ bool sinsp_container_manager::container_to_sinsp_event(const string& json, sinsp scapevt->type = PPME_CONTAINER_JSON_2_E; scapevt->nparams = 1; - uint32_t* lens = (uint32_t*)((char *)scapevt + sizeof(struct ppm_evt_hdr)); + uint32_t* lens = (uint32_t*)scapevt->payload; char* valptr = (char*)lens + sizeof(uint32_t); *lens = (uint32_t)json.length() + 1; diff --git a/userspace/libsinsp/parsers.cpp b/userspace/libsinsp/parsers.cpp index c0e9169518..8b2a633182 100644 --- a/userspace/libsinsp/parsers.cpp +++ b/userspace/libsinsp/parsers.cpp @@ -2069,7 +2069,7 @@ void schedule_more_evts(sinsp* inspector, void* data, T* client, ppm_event_type state->m_piscapevt->len = tot_len; state->m_piscapevt->nparams = 1; - uint16_t* plen = (uint16_t*)((char *)state->m_piscapevt + sizeof(struct ppm_evt_hdr)); + uint16_t* plen = (uint16_t*)state->m_piscapevt->payload; plen[0] = (uint16_t)payload.size() + 1; uint8_t* edata = (uint8_t*)plen + sizeof(uint16_t); memcpy(edata, payload.c_str(), plen[0]); @@ -3687,7 +3687,6 @@ uint32_t sinsp_parser::parse_tracer(sinsp_evt *evt, int64_t retval) // // Populate the user event that we will send up the stack instead of the write // - uint8_t* fakeevt_storage = (uint8_t*)m_fake_userevt; m_fake_userevt->ts = evt->m_pevt->ts; m_fake_userevt->tid = evt->m_pevt->tid; m_fake_userevt->nparams = 3; @@ -3703,14 +3702,14 @@ uint32_t sinsp_parser::parse_tracer(sinsp_evt *evt, int64_t retval) m_fake_userevt->type = PPME_TRACER_X; } - uint16_t *lens = (uint16_t *)(fakeevt_storage + sizeof(struct ppm_evt_hdr)); + uint16_t *lens = (uint16_t *)m_fake_userevt->payload; lens[0] = 8; lens[1] = 8; lens[2] = 8; - *(uint64_t *)(fakeevt_storage + sizeof(struct ppm_evt_hdr) + 6) = p->m_id; - *(uint64_t *)(fakeevt_storage + sizeof(struct ppm_evt_hdr) + 14) = (uint64_t)&p->m_tags; - *(uint64_t *)(fakeevt_storage + sizeof(struct ppm_evt_hdr) + 22) = (uint64_t)&p->m_args; + *(uint64_t *)(m_fake_userevt->payload + 6) = p->m_id; + *(uint64_t *)(m_fake_userevt->payload + 14) = (uint64_t)&p->m_tags; + *(uint64_t *)(m_fake_userevt->payload + 22) = (uint64_t)&p->m_args; } else { @@ -3730,7 +3729,7 @@ uint32_t sinsp_parser::parse_tracer(sinsp_evt *evt, int64_t retval) m_fake_userevt->type = PPME_TRACER_E; - uint16_t *lens = (uint16_t *)(fakeevt_storage + sizeof(struct ppm_evt_hdr)); + uint16_t *lens = (uint16_t *)m_fake_userevt->payload; lens[0] = 8; lens[1] = 8; lens[2] = 8; @@ -3738,9 +3737,9 @@ uint32_t sinsp_parser::parse_tracer(sinsp_evt *evt, int64_t retval) p->m_tags.clear(); m_tracer_error_string = "invalid tracer " + string(data, datalen) + ", len" + to_string(datalen); p->m_tags.push_back((char*)m_tracer_error_string.c_str()); - *(uint64_t *)(fakeevt_storage + sizeof(struct ppm_evt_hdr) + 6) = 0; - *(uint64_t *)(fakeevt_storage + sizeof(struct ppm_evt_hdr) + 14) = (uint64_t)&p->m_tags; - *(uint64_t *)(fakeevt_storage + sizeof(struct ppm_evt_hdr) + 22) = (uint64_t)&p->m_args; + *(uint64_t *)(m_fake_userevt->payload + 6) = 0; + *(uint64_t *)(m_fake_userevt->payload + 14) = (uint64_t)&p->m_tags; + *(uint64_t *)(m_fake_userevt->payload + 22) = (uint64_t)&p->m_args; } scap_evt* tevt = evt->m_pevt; diff --git a/userspace/libsinsp/sinsp.cpp b/userspace/libsinsp/sinsp.cpp index 96a22c0b18..b44ec03fd9 100644 --- a/userspace/libsinsp/sinsp.cpp +++ b/userspace/libsinsp/sinsp.cpp @@ -132,7 +132,7 @@ sinsp::sinsp(bool static_container, const std::string static_id, const std::stri m_meinfo.m_piscapevt->type = PPME_PROCINFO_E; m_meinfo.m_piscapevt->len = evlen; m_meinfo.m_piscapevt->nparams = 2; - uint16_t* lens = (uint16_t*)((char *)m_meinfo.m_piscapevt + sizeof(struct ppm_evt_hdr)); + uint16_t* lens = (uint16_t*)m_meinfo.m_piscapevt->payload; lens[0] = 8; lens[1] = 8; m_meinfo.m_piscapevt_vals = (uint64_t*)(lens + 2);