diff options
| author | Paul Buetow <paul@buetow.org> | 2026-05-20 23:42:12 +0300 |
|---|---|---|
| committer | Paul Buetow <paul@buetow.org> | 2026-05-20 23:42:12 +0300 |
| commit | be6d4e8ffc722bf0d36c5b01ff46f817539a1525 (patch) | |
| tree | 7bb0aeb51e29cfbc6735af15bb812b888f4b3574 /internal/generate/testdata.go | |
| parent | 2156d6e51b18e29fe8dfe8e1a519e1a84e0a1fe6 (diff) | |
task-47: add KindExec for execve paths
Diffstat (limited to 'internal/generate/testdata.go')
| -rw-r--r-- | internal/generate/testdata.go | 32 |
1 files changed, 32 insertions, 0 deletions
diff --git a/internal/generate/testdata.go b/internal/generate/testdata.go index 2bc041e..d94c141 100644 --- a/internal/generate/testdata.go +++ b/internal/generate/testdata.go @@ -1098,6 +1098,38 @@ format: print fmt: "0x%lx", REC->ret ` +const FormatExecveat = `name: sys_enter_execveat +ID: 869 +format: + field:unsigned short common_type; offset:0; size:2; signed:0; + field:unsigned char common_flags; offset:2; size:1; signed:0; + field:unsigned char common_preempt_count; offset:3; size:1; signed:0; + field:int common_pid; offset:4; size:4; signed:1; + + field:int __syscall_nr; offset:8; size:4; signed:1; + field:int dfd; offset:16; size:8; signed:0; + field:const char * filename; offset:24; size:8; signed:0; + field:const char *const * argv; offset:32; size:8; signed:0; + field:const char *const * envp; offset:40; size:8; signed:0; + field:int flags; offset:48; size:8; signed:0; + +print fmt: "dfd: 0x%08lx, filename: 0x%08lx, argv: 0x%08lx, envp: 0x%08lx, flags: 0x%08lx", ((unsigned long)(REC->dfd)), ((unsigned long)(REC->filename)), ((unsigned long)(REC->argv)), ((unsigned long)(REC->envp)), ((unsigned long)(REC->flags)) +` + +const FormatExitExecveat = `name: sys_exit_execveat +ID: 868 +format: + field:unsigned short common_type; offset:0; size:2; signed:0; + field:unsigned char common_flags; offset:2; size:1; signed:0; + field:unsigned char common_preempt_count; offset:3; size:1; signed:0; + field:int common_pid; offset:4; size:4; signed:1; + + field:int __syscall_nr; offset:8; size:4; signed:1; + field:long ret; offset:16; size:8; signed:1; + +print fmt: "0x%lx", REC->ret +` + const FormatMknod = `name: sys_enter_mknod ID: 894 format: |