diff options
| author | Paul Buetow <paul@buetow.org> | 2026-06-01 15:24:28 +0300 |
|---|---|---|
| committer | Paul Buetow <paul@buetow.org> | 2026-06-01 15:24:28 +0300 |
| commit | 04c0c9abbf079922ce312fe786bdc9986c31b665 (patch) | |
| tree | edc406ce4ae78783323c0a1b5655cf46bda04636 /internal/tracepoints | |
| parent | 877cc685fe550f2c53a9dbdf230eaa28feaf3a16 (diff) | |
fix(classify): assign alarm to FamilyTime, not Misc
alarm(2) arranges for a SIGALRM after a given number of seconds; it is a
simplified setitimer(ITIMER_REAL) and, per alarm(2) NOTES, "alarm() and
setitimer(2) share the same timer; calls to one will interfere with use of
the other." The syscallFamilies table omitted alarm, so it fell through to
FamilyMisc while its siblings setitimer/getitimer/timer_create were correctly
FamilyTime — an adjtimex-style misclassification (cf. 7243b7c). Add
alarm -> FamilyTime and move it from Misc to Time in the tracing plan;
regenerate the family maps (trace IDs 468/469 now FamilyTime,
"alarm": "Time").
Kind classification (KindNull/null_event: the single arg is an unsigned int
seconds, no fd/path) and the UNCLASSIFIED return (seconds remaining, not a
byte count; alarm never fails) were already correct.
Also harden the misc-basic integration test with a deterministic
enter_alarm assertion (alarm(0) is issued unconditionally by the scenario;
the syscall-entry tracepoint always fires) so the alarm enter path is
covered end-to-end even though alarm is now FamilyTime rather than Misc.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Diffstat (limited to 'internal/tracepoints')
| -rw-r--r-- | internal/tracepoints/generated_tracepoints.go | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/internal/tracepoints/generated_tracepoints.go b/internal/tracepoints/generated_tracepoints.go index 152fcf5..1fa2a27 100644 --- a/internal/tracepoints/generated_tracepoints.go +++ b/internal/tracepoints/generated_tracepoints.go @@ -742,7 +742,7 @@ var syscallFamilies = map[string]string{ "acct": "Misc", "add_key": "Security", "adjtimex": "Time", - "alarm": "Misc", + "alarm": "Time", "arch_prctl": "Process", "bind": "Network", "bpf": "Security", |