diff options
| author | Paul Buetow <paul@buetow.org> | 2026-06-02 21:51:06 +0300 |
|---|---|---|
| committer | Paul Buetow <paul@buetow.org> | 2026-06-02 21:51:06 +0300 |
| commit | bf433c995a6991607a8583bb613a404ce9bb1d6d (patch) | |
| tree | 5afbca3edf0841adfd0ce5a182a74e8e2fb29125 /internal/tracepoints | |
| parent | 4f44de8ee0ec51ee5c934048405030e362cc197f (diff) | |
fix(classify): assign fanotify_mark to FamilyIPC, not Misc
fanotify_mark(2) adds, removes, or modifies a mark on an fanotify
notification group. Its arg0 is the fanotify group fd returned by
fanotify_init(2); it carries a dirfd@arg3 and an optional pathname@arg4
and returns 0/-1 (not a byte count). It is the operation counterpart of
fanotify_init and the direct analog of inotify_add_watch (both register a
watch/mark on a filesystem object via the notification-group fd).
inotify_add_watch is FamilyIPC, and fanotify_init was just moved Misc->IPC
to sit with the fd-based event-notification primitives (eventfd, signalfd,
timerfd, userfaultfd, inotify_*). fanotify_mark, however, was still falling
through to FamilyMisc by omission from the explicit family table -- the same
alarm/adjtimex-style misclassification fixed for fanotify_init in 88769d4,
and flagged there as still-outstanding for fanotify_mark. Add it to the IPC
family map for sibling consistency and regenerate.
KIND is unchanged and correct: KindPathname capturing the optional
pathname at args[4]. This matches the *at() cohort convention (fchmodat,
fchownat, unlinkat, mkdirat, newfstatat, utimensat, name_to_handle_at all
carry a dirfd at arg0 yet capture the pathname), since fanotify_mark has a
dirfd@arg3 + pathname@arg4 pair. RET stays UNCLASSIFIED (returns 0/-1).
Docs plan updated to keep the docs-drift tests in sync.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Diffstat (limited to 'internal/tracepoints')
| -rw-r--r-- | internal/tracepoints/generated_tracepoints.go | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/internal/tracepoints/generated_tracepoints.go b/internal/tracepoints/generated_tracepoints.go index 1ca5f85..6b5ef6e 100644 --- a/internal/tracepoints/generated_tracepoints.go +++ b/internal/tracepoints/generated_tracepoints.go @@ -787,7 +787,7 @@ var syscallFamilies = map[string]string{ "fadvise64": "FS", "fallocate": "FS", "fanotify_init": "IPC", - "fanotify_mark": "Misc", + "fanotify_mark": "IPC", "fchdir": "FS", "fchmod": "FS", "fchmodat": "FS", |