k7 classify process control and prctl syscalls

2 files changed, 18 insertions, 3 deletions

diff --git a/internal/tracepoints/dimension_selector_test.go b/internal/tracepoints/dimension_selector_test.go
index 2391ba3..4eb555b 100644
--- a/internal/tracepoints/dimension_selector_test.go
+++ b/internal/tracepoints/dimension_selector_test.go
@@ -186,6 +186,21 @@ func TestParseSelectorWithDimensionsFutexKindOnly(t *testing.T) {
 	}
 }
 
+func TestParseSelectorWithDimensionsPrctlKindOnly(t *testing.T) {
+	sel, err := ParseSelectorWithDimensions("", "", DimensionSelectorConfig{
+		TraceKinds: "prctl",
+	})
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !sel.ShouldAttach("sys_enter_prctl") {
+		t.Fatal("expected prctl to be attached for prctl kind")
+	}
+	if sel.ShouldAttach("sys_enter_openat") {
+		t.Fatal("expected openat to be excluded when only prctl kind is enabled")
+	}
+}
+
 func TestParseSelectorWithDimensionsSyscallOnly(t *testing.T) {
 	sel, err := ParseSelectorWithDimensions("", "", DimensionSelectorConfig{
 		TraceSyscalls: "openat",
diff --git a/internal/tracepoints/generated_tracepoints.go b/internal/tracepoints/generated_tracepoints.go
index dca04ea..bd641dd 100644
--- a/internal/tracepoints/generated_tracepoints.go
+++ b/internal/tracepoints/generated_tracepoints.go
@@ -1329,7 +1329,7 @@ var syscallKinds = map[string]string{
 	"pkey_mprotect":           "mem",
 	"poll":                    "poll",
 	"ppoll":                   "poll",
-	"prctl":                   "null",
+	"prctl":                   "prctl",
 	"pread64":                 "fd",
 	"preadv":                  "fd",
 	"preadv2":                 "fd",
@@ -1472,8 +1472,8 @@ var syscallKinds = map[string]string{
 	"vfork":                   "proc",
 	"vhangup":                 "null",
 	"vmsplice":                "fd",
-	"wait4":                   "null",
-	"waitid":                  "null",
+	"wait4":                   "proc",
+	"waitid":                  "proc",
 	"write":                   "fd",
 	"writev":                  "fd",
 }