feat: add mount/fs management syscall tracing for c7

1 files changed, 12 insertions, 0 deletions

diff --git a/internal/eventloop_exit.go b/internal/eventloop_exit.go
index 7a69774..faaa9e1 100644
--- a/internal/eventloop_exit.go
+++ b/internal/eventloop_exit.go
@@ -40,6 +40,8 @@ func (e *eventLoop) handleTracepointExit(ep *event.Pair) bool {
 		return e.handleEpollCtlExit(ep, ev)
 	case *types.PollEvent:
 		return e.handlePollExit(ep, ev)
+	case *types.TwoFdEvent:
+		return e.handleTwoFdExit(ep, ev)
 	case *types.MemEvent:
 		return e.handleMemExit(ep, ev)
 	case *types.SleepEvent:
@@ -410,6 +412,16 @@ func (e *eventLoop) handlePollExit(ep *event.Pair, pollEv *types.PollEvent) bool
 	return true
 }
 
+func (e *eventLoop) handleTwoFdExit(ep *event.Pair, twoFdEv *types.TwoFdEvent) bool {
+	ep.File = e.fdState().resolve(twoFdEv.FdA, twoFdEv.Pid)
+	ep.Comm = e.comm(twoFdEv.GetTid())
+	if !e.Filter().MatchPair(ep) {
+		ep.Recycle()
+		return false
+	}
+	return true
+}
+
 func (e *eventLoop) handleMemExit(ep *event.Pair, memEv *types.MemEvent) bool {
 	ep.Comm = e.comm(memEv.GetTid())
 	if !e.Filter().MatchPair(ep) {