generate: treat rt_sigreturn as noreturn (suppress dead exit handler)

rt_sigreturn(2) restores the pre-signal execution context off the signal
stack frame and resumes the interrupted instruction; it never returns to
the instruction after the syscall. man sigreturn(2) states plainly that
"sigreturn() never returns", and tracing against /sys/kernel/tracing
confirms it: sys_enter_rt_sigreturn fires once per signal-handler return
while sys_exit_rt_sigreturn never fires.

The generator previously emitted a dead handle_sys_exit_rt_sigreturn (it
can never run) and recorded a per-tid syscall_enter_state_map entry on the
enter path that nothing would ever delete (no exit fires), leaking entries
in the bounded map on every signal-handler return.

Add rt_sigreturn to noreturnSyscalls so codegen suppresses the dead exit
handler and routes the enter handler through ior_on_noreturn_syscall_enter
(sampling decision only, no map write), exactly like exit/exit_group. The
enter null_event is still emitted, and the FamilySignals/KindNull
classification is unchanged. Regenerated the C/Go artifacts and the result
baseline accordingly, and generalized the related comments.

Lock-in tests: TestRtSigreturnIsNoreturn asserts rt_sigreturn is noreturn;
TestRtSigSiblingsAreNotNoreturn guards that the returning rt_sig* siblings
are not; TestGenerateExitNoreturnHandlers now also covers rt_sigreturn.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

8 files changed, 83 insertions, 60 deletions

diff --git a/internal/c/filter.c b/internal/c/filter.c
index 48907d8..5440bcc 100644
--- a/internal/c/filter.c
+++ b/internal/c/filter.c
@@ -79,9 +79,11 @@ static __always_inline int ior_on_syscall_enter(__u32 tid, __u32 enter_trace_id)
 }
 
 // ior_on_noreturn_syscall_enter is the enter hook for noreturn syscalls
-// (exit, exit_group). Unlike ior_on_syscall_enter it deliberately does NOT
-// write a per-tid entry into syscall_enter_state_map. A noreturn syscall never
-// returns to userspace, so its sys_exit tracepoint never fires and the matching
+// (exit, exit_group, rt_sigreturn). Unlike ior_on_syscall_enter it deliberately
+// does NOT write a per-tid entry into syscall_enter_state_map. A noreturn
+// syscall never returns to the syscall site (exit/exit_group terminate;
+// rt_sigreturn restores the pre-signal context), so its sys_exit tracepoint
+// never fires and the matching
 // exit handler is suppressed by the generator (see internal/generate/codegen.go
 // isNoreturnSyscall). With no exit handler, nothing would ever look up or
 // bpf_map_delete_elem that enter-state entry, so recording it would only leave
diff --git a/internal/c/generated_tracepoints.c b/internal/c/generated_tracepoints.c
index a8437df..5c72813 100644
--- a/internal/c/generated_tracepoints.c
+++ b/internal/c/generated_tracepoints.c
@@ -732,7 +732,6 @@
 #define SYS_ENTER_IOPL 93
 #define SYS_EXIT_IOPL 92
 #define SYS_ENTER_RT_SIGRETURN 57
-#define SYS_EXIT_RT_SIGRETURN 56
 
 /// sys_enter_socket is a struct socket_event (kind=socket)
 SEC("tracepoint/syscalls/sys_enter_socket")
@@ -19659,7 +19658,7 @@ int handle_sys_enter_rt_sigreturn(struct syscall_trace_enter *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
-    if (!ior_on_syscall_enter(tid, SYS_ENTER_RT_SIGRETURN))
+    if (!ior_on_noreturn_syscall_enter(SYS_ENTER_RT_SIGRETURN))
         return 0;
 
     struct null_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct null_event), 0);
@@ -19676,29 +19675,3 @@ int handle_sys_enter_rt_sigreturn(struct syscall_trace_enter *ctx) {
     return 0;
 }
 
-/// sys_exit_rt_sigreturn is a struct ret_event (UNCLASSIFIED) (kind=ret)
-SEC("tracepoint/syscalls/sys_exit_rt_sigreturn")
-int handle_sys_exit_rt_sigreturn(struct syscall_trace_exit *ctx) {
-    __u32 pid, tid;
-    if (filter(&pid, &tid))
-        return 0;
-
-    if (!ior_on_syscall_exit(tid, SYS_ENTER_RT_SIGRETURN, ctx->ret))
-        return 0;
-
-    struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
-    if (!ev)
-        return 0;
-
-    ev->event_type = EXIT_RET_EVENT;
-    ev->trace_id = SYS_EXIT_RT_SIGRETURN;
-    ev->pid = pid;
-    ev->tid = tid;
-    ev->time = bpf_ktime_get_boot_ns();
-    ev->ret = ctx->ret;
-    ev->ret_type = UNCLASSIFIED;
-
-    bpf_ringbuf_submit(ev, 0);
-    return 0;
-}
-
diff --git a/internal/c/generated_tracepoints_result.txt b/internal/c/generated_tracepoints_result.txt
index 3587939..971f92c 100644
--- a/internal/c/generated_tracepoints_result.txt
+++ b/internal/c/generated_tracepoints_result.txt
@@ -622,7 +622,6 @@ sys_exit_rt_sigaction is a struct ret_event (UNCLASSIFIED) (kind=ret)
 sys_exit_rt_sigpending is a struct ret_event (UNCLASSIFIED) (kind=ret)
 sys_exit_rt_sigprocmask is a struct ret_event (UNCLASSIFIED) (kind=ret)
 sys_exit_rt_sigqueueinfo is a struct ret_event (UNCLASSIFIED) (kind=ret)
-sys_exit_rt_sigreturn is a struct ret_event (UNCLASSIFIED) (kind=ret)
 sys_exit_rt_sigsuspend is a struct ret_event (UNCLASSIFIED) (kind=ret)
 sys_exit_rt_sigtimedwait is a struct ret_event (UNCLASSIFIED) (kind=ret)
 sys_exit_rt_tgsigqueueinfo is a struct ret_event (UNCLASSIFIED) (kind=ret)
diff --git a/internal/generate/bpfhandler.go b/internal/generate/bpfhandler.go
index 1dff4d6..071e11d 100644
--- a/internal/generate/bpfhandler.go
+++ b/internal/generate/bpfhandler.go
@@ -36,10 +36,11 @@ func generateBPFHandler(tp GeneratedTracepoint) string {
 	// between kernel-assigned enter/exit IDs.
 	enterName := enterConstForHandler(f.Name, isEnter)
 
-	// Noreturn syscalls (exit, exit_group) get a special enter hook that skips
-	// the syscall_enter_state_map write. Their exit handler is suppressed (see
-	// codegen.go), so nothing would ever clear a recorded enter-state entry;
-	// recording it would only leak stale per-tid entries in the bounded map.
+	// Noreturn syscalls (exit, exit_group, rt_sigreturn) get a special enter
+	// hook that skips the syscall_enter_state_map write. Their exit handler is
+	// suppressed (see codegen.go), so nothing would ever clear a recorded
+	// enter-state entry; recording it would only leak stale per-tid entries in
+	// the bounded map.
 	noreturn := isEnter && isNoreturnSyscall(syscallName(f.Name))
 
 	return renderHandler(f.Name, ctxStruct, eventStruct, comment, eventTypeConst, extra, isEnter, noreturn, enterName)
diff --git a/internal/generate/codegen.go b/internal/generate/codegen.go
index 339dc1f..5b9ea7c 100644
--- a/internal/generate/codegen.go
+++ b/internal/generate/codegen.go
@@ -126,9 +126,10 @@ func classifySyscall(sc Syscall) ([]GeneratedTracepoint, string) {
 		result = append(result, GeneratedTracepoint{Format: sc.Enter, Classification: enterClass})
 	}
 	// Emit the exit handler only for syscalls that can actually return.
-	// Noreturn syscalls (exit, exit_group) never return to userspace, so their
-	// sys_exit tracepoint never fires; emitting a handler would be dead code in
-	// the generated BPF program. We still emit their enter handler above.
+	// Noreturn syscalls (exit, exit_group, rt_sigreturn) never return to the
+	// syscall site, so their sys_exit tracepoint never fires; emitting a handler
+	// would be dead code in the generated BPF program. We still emit their enter
+	// handler above.
 	if sc.Exit != nil && !isNoreturnSyscall(sc.Name) {
 		result = append(result, GeneratedTracepoint{Format: sc.Exit, Classification: exitClass})
 	}
@@ -150,13 +151,25 @@ func isEnterRejected(kind TracepointKind) bool {
 	return !lookupKind(kind).enterAccepted
 }
 
-// noreturnSyscalls lists syscalls that never return control to userspace.
+// noreturnSyscalls lists syscalls that never return to the syscall site.
 // Their sys_exit tracepoint can never fire, so the generator suppresses the
 // matching exit handler (see classifySyscall) to avoid dead code in the
-// generated BPF program.
+// generated BPF program, and the enter handler uses the noreturn enter hook
+// that skips the (otherwise un-reclaimable) syscall_enter_state_map write.
+//
+//   - exit / exit_group terminate the thread/process; control never returns.
+//   - rt_sigreturn restores the pre-signal execution context off the signal
+//     stack frame and resumes the interrupted instruction. It does NOT return
+//     to the instruction after the rt_sigreturn syscall, so the kernel never
+//     fires sys_exit_rt_sigreturn. Verified empirically against
+//     /sys/kernel/tracing: sys_enter_rt_sigreturn fires once per signal-handler
+//     return while sys_exit_rt_sigreturn never does. The man page (sigreturn(2))
+//     states plainly that "sigreturn() never returns". rt_sigreturn is emitted
+//     by the signal trampoline, not called directly by applications.
 var noreturnSyscalls = map[string]bool{
-	"exit":       true,
-	"exit_group": true,
+	"exit":         true,
+	"exit_group":   true,
+	"rt_sigreturn": true,
 }
 
 // isNoreturnSyscall reports whether the named syscall never returns and thus
diff --git a/internal/generate/codegen_test.go b/internal/generate/codegen_test.go
index 9545447..474b3d5 100644
--- a/internal/generate/codegen_test.go
+++ b/internal/generate/codegen_test.go
@@ -1161,15 +1161,47 @@ func TestClassifyRetSyncUnclassified(t *testing.T) {
 
 // TestSyncIsNotNoreturn locks in that bare sync(2) is NOT treated as a noreturn
 // syscall: it is void but returns control to userspace, so its exit handler must
-// be generated (see TestGenerateSyncHandler). Only exit(2)/exit_group(2) are
-// noreturn. This guards against sync accidentally being added to the noreturn
-// suppression list, which would silently drop its exit events.
+// be generated (see TestGenerateSyncHandler). Only exit(2)/exit_group(2)/
+// rt_sigreturn(2) are noreturn. This guards against sync accidentally being added
+// to the noreturn suppression list, which would silently drop its exit events.
 func TestSyncIsNotNoreturn(t *testing.T) {
 	if isNoreturnSyscall("sync") {
 		t.Error("sync must not be noreturn: it is void but DOES return, so its exit handler must be emitted")
 	}
 }
 
+// TestRtSigreturnIsNoreturn locks in that rt_sigreturn(2) is treated as a
+// noreturn syscall. rt_sigreturn restores the pre-signal execution context off
+// the signal-stack frame and resumes the interrupted instruction; it does NOT
+// return to the instruction after the syscall, so the kernel never fires
+// sys_exit_rt_sigreturn (verified empirically against /sys/kernel/tracing:
+// sys_enter_rt_sigreturn fires once per signal-handler return, sys_exit never
+// does). man sigreturn(2): "sigreturn() never returns". Suppressing the dead
+// exit handler also stops the bounded syscall_enter_state_map from leaking a
+// per-tid entry on every signal-handler return.
+func TestRtSigreturnIsNoreturn(t *testing.T) {
+	if !isNoreturnSyscall("rt_sigreturn") {
+		t.Error("rt_sigreturn must be noreturn: it never returns to the syscall site, so sys_exit_rt_sigreturn never fires and its exit handler must be suppressed")
+	}
+}
+
+// TestRtSigSiblingsAreNotNoreturn is the contrast to TestRtSigreturnIsNoreturn:
+// every OTHER rt_sig* syscall returns normally to its caller, so it must NOT be
+// in the noreturn set or its exit events (and durations) would be silently
+// dropped. Only rt_sigreturn is the kernel/libc signal-trampoline return path.
+func TestRtSigSiblingsAreNotNoreturn(t *testing.T) {
+	siblings := []string{
+		"rt_sigaction", "rt_sigprocmask", "rt_sigpending",
+		"rt_sigsuspend", "rt_sigtimedwait", "rt_sigqueueinfo",
+		"rt_tgsigqueueinfo",
+	}
+	for _, s := range siblings {
+		if isNoreturnSyscall(s) {
+			t.Errorf("%s must not be noreturn: it returns normally, so its exit handler must be emitted", s)
+		}
+	}
+}
+
 func TestGenerateIoUringEnterHandler(t *testing.T) {
 	output := generateFromPair(t, FormatIoUringEnter, FormatExitIoUringEnter)
 
@@ -2059,17 +2091,22 @@ func TestGenerateFallbackNullHandler(t *testing.T) {
 	requireContains(t, output, "ev->event_type = EXIT_RET_EVENT;")
 }
 
-// TestGenerateExitNoreturnHandlers locks in how the noreturn process-exit
-// syscalls are generated. Per exit(2)/exit_group(2): both take a single
-// `int status` argument and never return. ior classifies them as KindNull
-// (FamilyProcess), so:
+// TestGenerateExitNoreturnHandlers locks in how the noreturn syscalls are
+// generated. exit(2)/exit_group(2) take a single `int status` argument and
+// never return (they terminate the thread/process). rt_sigreturn(2) takes no
+// meaningful arguments and never returns to the syscall site: it restores the
+// pre-signal execution context off the signal-stack frame and resumes the
+// interrupted instruction (man sigreturn(2): "sigreturn() never returns";
+// verified empirically against /sys/kernel/tracing where sys_enter_rt_sigreturn
+// fires once per signal-handler return while sys_exit_rt_sigreturn never does).
+// All three are KindNull, so:
 //   - The enter handler emits a struct null_event and intentionally does NOT
-//     capture the int status arg (it is not an I/O resource like an fd/path).
-//   - The kernel still exposes sys_exit_{exit,exit_group} tracepoints, but
-//     those handlers can never fire at runtime because the syscall does not
-//     return. The generator suppresses the dead exit handlers.
+//     capture any arg (status/whatever is not an I/O resource like an fd/path).
+//   - The kernel still exposes the sys_exit_<name> tracepoints, but those
+//     handlers can never fire at runtime because the syscall does not return.
+//     The generator suppresses the dead exit handlers.
 func TestGenerateExitNoreturnHandlers(t *testing.T) {
-	for _, syscall := range []string{"exit", "exit_group"} {
+	for _, syscall := range []string{"exit", "exit_group", "rt_sigreturn"} {
 		t.Run(syscall, func(t *testing.T) {
 			output := GenerateTracepointsC(mustParseAll(t, syntheticPair(syscall)))
 
diff --git a/internal/tracepoints/generated_tracepoints.go b/internal/tracepoints/generated_tracepoints.go
index 3a8d241..0edb7c3 100644
--- a/internal/tracepoints/generated_tracepoints.go
+++ b/internal/tracepoints/generated_tracepoints.go
@@ -733,7 +733,6 @@ var List = []string{
 	"sys_enter_iopl",
 	"sys_exit_iopl",
 	"sys_enter_rt_sigreturn",
-	"sys_exit_rt_sigreturn",
 }
 
 var syscallFamilies = map[string]string{
diff --git a/internal/types/generated_types.go b/internal/types/generated_types.go
index 2394213..15fcec9 100644
--- a/internal/types/generated_types.go
+++ b/internal/types/generated_types.go
@@ -30,15 +30,15 @@ const (
 )
 
 var traceId2String = map[TraceId]string{
-	1847: "enter_socket", 1846: "exit_socket", 1845: "enter_socketpair", 1844: "exit_socketpair", 1843: "enter_bind", 1842: "exit_bind", 1841: "enter_listen", 1840: "exit_listen", 1839: "enter_accept4", 1838: "exit_accept4", 1837: "enter_accept", 1836: "exit_accept", 1835: "enter_connect", 1834: "exit_connect", 1833: "enter_getsockname", 1832: "exit_getsockname", 1831: "enter_getpeername", 1830: "exit_getpeername", 1829: "enter_sendto", 1828: "exit_sendto", 1827: "enter_recvfrom", 1826: "exit_recvfrom", 1825: "enter_setsockopt", 1824: "exit_setsockopt", 1823: "enter_getsockopt", 1822: "exit_getsockopt", 1821: "enter_shutdown", 1820: "exit_shutdown", 1819: "enter_sendmsg", 1818: "exit_sendmsg", 1817: "enter_sendmmsg", 1816: "exit_sendmmsg", 1815: "enter_recvmsg", 1814: "exit_recvmsg", 1813: "enter_recvmmsg", 1812: "exit_recvmmsg", 1575: "enter_getrandom", 1574: "exit_getrandom", 1528: "enter_io_uring_register", 1527: "exit_io_uring_register", 1509: "enter_io_uring_enter", 1508: "exit_io_uring_enter", 1507: "enter_io_uring_setup", 1506: "exit_io_uring_setup", 1491: "enter_ioprio_set", 1490: "exit_ioprio_set", 1489: "enter_ioprio_get", 1488: "exit_ioprio_get", 1463: "enter_landlock_create_ruleset", 1462: "exit_landlock_create_ruleset", 1461: "enter_landlock_add_rule", 1460: "exit_landlock_add_rule", 1459: "enter_landlock_restrict_self", 1458: "exit_landlock_restrict_self", 1456: "enter_lsm_set_self_attr", 1455: "exit_lsm_set_self_attr", 1454: "enter_lsm_get_self_attr", 1453: "exit_lsm_get_self_attr", 1452: "enter_lsm_list_modules", 1451: "exit_lsm_list_modules", 1449: "enter_add_key", 1448: "exit_add_key", 1447: "enter_request_key", 1446: "exit_request_key", 1445: "enter_keyctl", 1444: "exit_keyctl", 1443: "enter_mq_open", 1442: "exit_mq_open", 1441: "enter_mq_unlink", 1440: "exit_mq_unlink", 1439: "enter_mq_timedsend", 1438: "exit_mq_timedsend", 1437: "enter_mq_timedreceive", 1436: "exit_mq_timedreceive", 1435: "enter_mq_notify", 1434: "exit_mq_notify", 1433: "enter_mq_getsetattr", 1432: "exit_mq_getsetattr", 1431: "enter_shmget", 1430: "exit_shmget", 1429: "enter_shmctl", 1428: "exit_shmctl", 1427: "enter_shmat", 1426: "exit_shmat", 1425: "enter_shmdt", 1424: "exit_shmdt", 1423: "enter_semget", 1422: "exit_semget", 1421: "enter_semctl", 1420: "exit_semctl", 1419: "enter_semtimedop", 1418: "exit_semtimedop", 1417: "enter_semop", 1416: "exit_semop", 1415: "enter_msgget", 1414: "exit_msgget", 1413: "enter_msgctl", 1412: "exit_msgctl", 1411: "enter_msgsnd", 1410: "exit_msgsnd", 1409: "enter_msgrcv", 1408: "exit_msgrcv", 1164: "enter_quotactl", 1163: "exit_quotactl", 1162: "enter_quotactl_fd", 1161: "exit_quotactl_fd", 1146: "enter_name_to_handle_at", 1145: "exit_name_to_handle_at", 1144: "enter_open_by_handle_at", 1143: "exit_open_by_handle_at", 1130: "enter_flock", 1129: "exit_flock", 1111: "enter_io_setup", 1110: "exit_io_setup", 1109: "enter_io_destroy", 1108: "exit_io_destroy", 1107: "enter_io_submit", 1106: "exit_io_submit", 1105: "enter_io_cancel", 1104: "exit_io_cancel", 1103: "enter_io_getevents", 1102: "exit_io_getevents", 1101: "enter_io_pgetevents", 1100: "exit_io_pgetevents", 1099: "enter_userfaultfd", 1098: "exit_userfaultfd", 1097: "enter_eventfd2", 1096: "exit_eventfd2", 1095: "enter_eventfd", 1094: "exit_eventfd", 1093: "enter_timerfd_create", 1092: "exit_timerfd_create", 1091: "enter_timerfd_settime", 1090: "exit_timerfd_settime", 1089: "enter_timerfd_gettime", 1088: "exit_timerfd_gettime", 1087: "enter_signalfd4", 1086: "exit_signalfd4", 1085: "enter_signalfd", 1084: "exit_signalfd", 1083: "enter_epoll_create1", 1082: "exit_epoll_create1", 1081: "enter_epoll_create", 1080: "exit_epoll_create", 1079: "enter_epoll_ctl", 1078: "exit_epoll_ctl", 1077: "enter_epoll_wait", 1076: "exit_epoll_wait", 1075: "enter_epoll_pwait", 1074: "exit_epoll_pwait", 1073: "enter_epoll_pwait2", 1072: "exit_epoll_pwait2", 1071: "enter_fanotify_init", 1070: "exit_fanotify_init", 1069: "enter_fanotify_mark", 1068: "exit_fanotify_mark", 1067: "enter_inotify_init1", 1066: "exit_inotify_init1", 1065: "enter_inotify_init", 1064: "exit_inotify_init", 1063: "enter_inotify_add_watch", 1062: "exit_inotify_add_watch", 1061: "enter_inotify_rm_watch", 1060: "exit_inotify_rm_watch", 1059: "enter_file_getattr", 1058: "exit_file_getattr", 1057: "enter_file_setattr", 1056: "exit_file_setattr", 1055: "enter_fsopen", 1054: "exit_fsopen", 1053: "enter_fspick", 1052: "exit_fspick", 1051: "enter_fsconfig", 1050: "exit_fsconfig", 1049: "enter_statfs", 1048: "exit_statfs", 1047: "enter_fstatfs", 1046: "exit_fstatfs", 1045: "enter_ustat", 1044: "exit_ustat", 1043: "enter_getcwd", 1042: "exit_getcwd", 1041: "enter_utimensat", 1040: "exit_utimensat", 1039: "enter_futimesat", 1038: "exit_futimesat", 1037: "enter_utimes", 1036: "exit_utimes", 1035: "enter_utime", 1034: "exit_utime", 1033: "enter_sync", 1032: "exit_sync", 1031: "enter_syncfs", 1030: "exit_syncfs", 1029: "enter_fsync", 1028: "exit_fsync", 1027: "enter_fdatasync", 1026: "exit_fdatasync", 1025: "enter_sync_file_range", 1024: "exit_sync_file_range", 1023: "enter_vmsplice", 1022: "exit_vmsplice", 1021: "enter_splice", 1020: "exit_splice", 1019: "enter_tee", 1018: "exit_tee", 985: "enter_setxattrat", 984: "exit_setxattrat", 983: "enter_setxattr", 982: "exit_setxattr", 981: "enter_lsetxattr", 980: "exit_lsetxattr", 979: "enter_fsetxattr", 978: "exit_fsetxattr", 977: "enter_getxattrat", 976: "exit_getxattrat", 975: "enter_getxattr", 974: "exit_getxattr", 973: "enter_lgetxattr", 972: "exit_lgetxattr", 971: "enter_fgetxattr", 970: "exit_fgetxattr", 969: "enter_listxattrat", 968: "exit_listxattrat", 967: "enter_listxattr", 966: "exit_listxattr", 965: "enter_llistxattr", 964: "exit_llistxattr", 963: "enter_flistxattr", 962: "exit_flistxattr", 961: "enter_removexattrat", 960: "exit_removexattrat", 959: "enter_removexattr", 958: "exit_removexattr", 957: "enter_lremovexattr", 956: "exit_lremovexattr", 955: "enter_fremovexattr", 954: "exit_fremovexattr", 953: "enter_umount", 952: "exit_umount", 951: "enter_open_tree", 950: "exit_open_tree", 949: "enter_mount", 948: "exit_mount", 947: "enter_fsmount", 946: "exit_fsmount", 945: "enter_move_mount", 944: "exit_move_mount", 943: "enter_pivot_root", 942: "exit_pivot_root", 941: "enter_mount_setattr", 940: "exit_mount_setattr", 939: "enter_open_tree_attr", 938: "exit_open_tree_attr", 937: "enter_statmount", 936: "exit_statmount", 935: "enter_listmount", 934: "exit_listmount", 933: "enter_sysfs", 932: "exit_sysfs", 931: "enter_close_range", 930: "exit_close_range", 929: "enter_dup3", 928: "exit_dup3", 927: "enter_dup2", 926: "exit_dup2", 925: "enter_dup", 924: "exit_dup", 919: "enter_select", 918: "exit_select", 917: "enter_pselect6", 916: "exit_pselect6", 915: "enter_poll", 914: "exit_poll", 913: "enter_ppoll", 912: "exit_ppoll", 911: "enter_getdents", 910: "exit_getdents", 909: "enter_getdents64", 908: "exit_getdents64", 907: "enter_ioctl", 906: "exit_ioctl", 905: "enter_fcntl", 904: "exit_fcntl", 903: "enter_mknodat", 902: "exit_mknodat", 901: "enter_mknod", 900: "exit_mknod", 899: "enter_mkdirat", 898: "exit_mkdirat", 897: "enter_mkdir", 896: "exit_mkdir", 895: "enter_rmdir", 894: "exit_rmdir", 893: "enter_unlinkat", 892: "exit_unlinkat", 891: "enter_unlink", 890: "exit_unlink", 889: "enter_symlinkat", 888: "exit_symlinkat", 887: "enter_symlink", 886: "exit_symlink", 885: "enter_linkat", 884: "exit_linkat", 883: "enter_link", 882: "exit_link", 881: "enter_renameat2", 880: "exit_renameat2", 879: "enter_renameat", 878: "exit_renameat", 877: "enter_rename", 876: "exit_rename", 875: "enter_pipe2", 874: "exit_pipe2", 873: "enter_pipe", 872: "exit_pipe", 871: "enter_execve", 870: "exit_execve", 869: "enter_execveat", 868: "exit_execveat", 867: "enter_newstat", 866: "exit_newstat", 865: "enter_newlstat", 864: "exit_newlstat", 863: "enter_newfstatat", 862: "exit_newfstatat", 861: "enter_newfstat", 860: "exit_newfstat", 859: "enter_readlinkat", 858: "exit_readlinkat", 857: "enter_readlink", 856: "exit_readlink", 855: "enter_statx", 854: "exit_statx", 853: "enter_lseek", 852: "exit_lseek", 851: "enter_read", 850: "exit_read", 849: "enter_write", 848: "exit_write", 847: "enter_pread64", 846: "exit_pread64", 845: "enter_pwrite64", 844: "exit_pwrite64", 843: "enter_readv", 842: "exit_readv", 841: "enter_writev", 840: "exit_writev", 839: "enter_preadv", 838: "exit_preadv", 837: "enter_preadv2", 836: "exit_preadv2", 835: "enter_pwritev", 834: "exit_pwritev", 833: "enter_pwritev2", 832: "exit_pwritev2", 831: "enter_sendfile64", 830: "exit_sendfile64", 829: "enter_copy_file_range", 828: "exit_copy_file_range", 827: "enter_truncate", 826: "exit_truncate", 825: "enter_ftruncate", 824: "exit_ftruncate", 823: "enter_fallocate", 822: "exit_fallocate", 821: "enter_faccessat", 820: "exit_faccessat", 819: "enter_faccessat2", 818: "exit_faccessat2", 817: "enter_access", 816: "exit_access", 815: "enter_chdir", 814: "exit_chdir", 813: "enter_fchdir", 812: "exit_fchdir", 811: "enter_chroot", 810: "exit_chroot", 809: "enter_fchmod", 808: "exit_fchmod", 807: "enter_fchmodat2", 806: "exit_fchmodat2", 805: "enter_fchmodat", 804: "exit_fchmodat", 803: "enter_chmod", 802: "exit_chmod", 801: "enter_fchownat", 800: "exit_fchownat", 799: "enter_chown", 798: "exit_chown", 797: "enter_lchown", 796: "exit_lchown", 795: "enter_fchown", 794: "exit_fchown", 793: "enter_open", 792: "exit_open", 791: "enter_openat", 790: "exit_openat", 789: "enter_openat2", 788: "exit_openat2", 787: "enter_creat", 786: "exit_creat", 785: "enter_close", 784: "exit_close", 783: "enter_vhangup", 782: "exit_vhangup", 781: "enter_memfd_create", 780: "exit_memfd_create", 774: "enter_memfd_secret", 773: "exit_memfd_secret", 754: "enter_move_pages", 753: "exit_move_pages", 743: "enter_set_mempolicy_home_node", 742: "exit_set_mempolicy_home_node", 741: "enter_mbind", 740: "exit_mbind", 739: "enter_set_mempolicy", 738: "exit_set_mempolicy", 737: "enter_migrate_pages", 736: "exit_migrate_pages", 735: "enter_get_mempolicy", 734: "exit_get_mempolicy", 733: "enter_swapoff", 732: "exit_swapoff", 731: "enter_swapon", 730: "exit_swapon", 729: "enter_madvise", 728: "exit_madvise", 727: "enter_process_madvise", 726: "exit_process_madvise", 725: "enter_mseal", 724: "exit_mseal", 723: "enter_process_vm_readv", 722: "exit_process_vm_readv", 721: "enter_process_vm_writev", 720: "exit_process_vm_writev", 712: "enter_msync", 711: "exit_msync", 710: "enter_mremap", 709: "exit_mremap", 708: "enter_mprotect", 707: "exit_mprotect", 706: "enter_pkey_mprotect", 705: "exit_pkey_mprotect", 704: "enter_pkey_alloc", 703: "exit_pkey_alloc", 702: "enter_pkey_free", 701: "exit_pkey_free", 698: "enter_brk", 697: "exit_brk", 696: "enter_munmap", 695: "exit_munmap", 694: "enter_remap_file_pages", 693: "exit_remap_file_pages", 692: "enter_mlock", 691: "exit_mlock", 690: "enter_mlock2", 689: "exit_mlock2", 688: "enter_munlock", 687: "exit_munlock", 686: "enter_mlockall", 685: "exit_mlockall", 684: "enter_munlockall", 683: "exit_munlockall", 682: "enter_mincore", 681: "exit_mincore", 616: "enter_readahead", 615: "exit_readahead", 614: "enter_fadvise64", 613: "exit_fadvise64", 604: "enter_process_mrelease", 603: "exit_process_mrelease", 595: "enter_cachestat", 594: "exit_cachestat", 591: "enter_rseq", 590: "exit_rseq", 587: "enter_perf_event_open", 586: "exit_perf_event_open", 585: "enter_bpf", 584: "exit_bpf", 526: "enter_seccomp", 525: "exit_seccomp", 508: "enter_kexec_file_load", 507: "exit_kexec_file_load", 506: "enter_kexec_load", 505: "exit_kexec_load", 504: "enter_acct", 503: "exit_acct", 499: "enter_set_robust_list", 498: "exit_set_robust_list", 497: "enter_get_robust_list", 496: "exit_get_robust_list", 495: "enter_futex", 494: "exit_futex", 493: "enter_futex_waitv", 492: "exit_futex_waitv", 491: "enter_futex_wake", 490: "exit_futex_wake", 489: "enter_futex_wait", 488: "exit_futex_wait", 487: "enter_futex_requeue", 486: "exit_futex_requeue", 471: "enter_getitimer", 470: "exit_getitimer", 469: "enter_alarm", 468: "exit_alarm", 467: "enter_setitimer", 466: "exit_setitimer", 465: "enter_timer_create", 464: "exit_timer_create", 463: "enter_timer_gettime", 462: "exit_timer_gettime", 461: "enter_timer_getoverrun", 460: "exit_timer_getoverrun", 459: "enter_timer_settime", 458: "exit_timer_settime", 457: "enter_timer_delete", 456: "exit_timer_delete", 455: "enter_clock_settime", 454: "exit_clock_settime", 453: "enter_clock_gettime", 452: "exit_clock_gettime", 451: "enter_clock_adjtime", 450: "exit_clock_adjtime", 449: "enter_clock_getres", 448: "exit_clock_getres", 447: "enter_clock_nanosleep", 446: "exit_clock_nanosleep", 441: "enter_nanosleep", 440: "exit_nanosleep", 425: "enter_time", 424: "exit_time", 423: "enter_gettimeofday", 422: "exit_gettimeofday", 421: "enter_settimeofday", 420: "exit_settimeofday", 419: "enter_adjtimex", 418: "exit_adjtimex", 417: "enter_kcmp", 416: "exit_kcmp", 410: "enter_delete_module", 409: "exit_delete_module", 408: "enter_init_module", 407: "exit_init_module", 406: "enter_finit_module", 405: "exit_finit_module", 350: "enter_syslog", 349: "exit_syslog", 346: "enter_membarrier", 345: "exit_membarrier", 341: "enter_sched_setscheduler", 340: "exit_sched_setscheduler", 339: "enter_sched_setparam", 338: "exit_sched_setparam", 337: "enter_sched_setattr", 336: "exit_sched_setattr", 335: "enter_sched_getscheduler", 334: "exit_sched_getscheduler", 333: "enter_sched_getparam", 332: "exit_sched_getparam", 331: "enter_sched_getattr", 330: "exit_sched_getattr", 329: "enter_sched_setaffinity", 328: "exit_sched_setaffinity", 327: "enter_sched_getaffinity", 326: "exit_sched_getaffinity", 325: "enter_sched_yield", 324: "exit_sched_yield", 323: "enter_sched_get_priority_max", 322: "exit_sched_get_priority_max", 321: "enter_sched_get_priority_min", 320: "exit_sched_get_priority_min", 319: "enter_sched_rr_get_interval", 318: "exit_sched_rr_get_interval", 286: "enter_getgroups", 285: "exit_getgroups", 284: "enter_setgroups", 283: "exit_setgroups", 282: "enter_reboot", 281: "exit_reboot", 277: "enter_listns", 276: "exit_listns", 275: "enter_setns", 274: "exit_setns", 273: "enter_pidfd_open", 272: "exit_pidfd_open", 271: "enter_pidfd_getfd", 270: "exit_pidfd_getfd", 265: "enter_setpriority", 264: "exit_setpriority", 263: "enter_getpriority", 262: "exit_getpriority", 261: "enter_setregid", 260: "exit_setregid", 259: "enter_setgid", 258: "exit_setgid", 257: "enter_setreuid", 256: "exit_setreuid", 255: "enter_setuid", 254: "exit_setuid", 253: "enter_setresuid", 252: "exit_setresuid", 251: "enter_getresuid", 250: "exit_getresuid", 249: "enter_setresgid", 248: "exit_setresgid", 247: "enter_getresgid", 246: "exit_getresgid", 245: "enter_setfsuid", 244: "exit_setfsuid", 243: "enter_setfsgid", 242: "exit_setfsgid", 241: "enter_getpid", 240: "exit_getpid", 239: "enter_gettid", 238: "exit_gettid", 237: "enter_getppid", 236: "exit_getppid", 235: "enter_getuid", 234: "exit_getuid", 233: "enter_geteuid", 232: "exit_geteuid", 231: "enter_getgid", 230: "exit_getgid", 229: "enter_getegid", 228: "exit_getegid", 227: "enter_times", 226: "exit_times", 225: "enter_setpgid", 224: "exit_setpgid", 223: "enter_getpgid", 222: "exit_getpgid", 221: "enter_getpgrp", 220: "exit_getpgrp", 219: "enter_getsid", 218: "exit_getsid", 217: "enter_setsid", 216: "exit_setsid", 215: "enter_newuname", 214: "exit_newuname", 213: "enter_sethostname", 212: "exit_sethostname", 211: "enter_setdomainname", 210: "exit_setdomainname", 209: "enter_getrlimit", 208: "exit_getrlimit", 207: "enter_prlimit64", 206: "exit_prlimit64", 205: "enter_setrlimit", 204: "exit_setrlimit", 203: "enter_getrusage", 202: "exit_getrusage", 201: "enter_umask", 200: "exit_umask", 199: "enter_prctl", 198: "exit_prctl", 197: "enter_getcpu", 196: "exit_getcpu", 195: "enter_sysinfo", 194: "exit_sysinfo", 191: "enter_restart_syscall", 190: "exit_restart_syscall", 189: "enter_rt_sigprocmask", 188: "exit_rt_sigprocmask", 187: "enter_rt_sigpending", 186: "exit_rt_sigpending", 185: "enter_rt_sigtimedwait", 184: "exit_rt_sigtimedwait", 183: "enter_kill", 182: "exit_kill", 181: "enter_pidfd_send_signal", 180: "exit_pidfd_send_signal", 179: "enter_tgkill", 178: "exit_tgkill", 177: "enter_tkill", 176: "exit_tkill", 175: "enter_rt_sigqueueinfo", 174: "exit_rt_sigqueueinfo", 173: "enter_rt_tgsigqueueinfo", 172: "exit_rt_tgsigqueueinfo", 171: "enter_sigaltstack", 170: "exit_sigaltstack", 169: "enter_rt_sigaction", 168: "exit_rt_sigaction", 167: "enter_pause", 166: "exit_pause", 165: "enter_rt_sigsuspend", 164: "exit_rt_sigsuspend", 163: "enter_ptrace", 162: "exit_ptrace", 161: "enter_capget", 160: "exit_capget", 159: "enter_capset", 158: "exit_capset", 150: "enter_exit", 148: "enter_exit_group", 146: "enter_waitid", 145: "exit_waitid", 144: "enter_wait4", 143: "exit_wait4", 139: "enter_personality", 138: "exit_personality", 134: "enter_set_tid_address", 133: "exit_set_tid_address", 132: "enter_fork", 131: "exit_fork", 130: "enter_vfork", 129: "exit_vfork", 128: "enter_clone", 127: "exit_clone", 126: "enter_clone3", 125: "exit_clone3", 124: "enter_unshare", 123: "exit_unshare", 119: "enter_map_shadow_stack", 118: "exit_map_shadow_stack", 117: "enter_uretprobe", 116: "exit_uretprobe", 115: "enter_uprobe", 114: "exit_uprobe", 102: "enter_arch_prctl", 101: "exit_arch_prctl", 100: "enter_mmap", 99: "exit_mmap", 98: "enter_modify_ldt", 97: "exit_modify_ldt", 95: "enter_ioperm", 94: "exit_ioperm", 93: "enter_iopl", 92: "exit_iopl", 57: "enter_rt_sigreturn", 56: "exit_rt_sigreturn",
+	1847: "enter_socket", 1846: "exit_socket", 1845: "enter_socketpair", 1844: "exit_socketpair", 1843: "enter_bind", 1842: "exit_bind", 1841: "enter_listen", 1840: "exit_listen", 1839: "enter_accept4", 1838: "exit_accept4", 1837: "enter_accept", 1836: "exit_accept", 1835: "enter_connect", 1834: "exit_connect", 1833: "enter_getsockname", 1832: "exit_getsockname", 1831: "enter_getpeername", 1830: "exit_getpeername", 1829: "enter_sendto", 1828: "exit_sendto", 1827: "enter_recvfrom", 1826: "exit_recvfrom", 1825: "enter_setsockopt", 1824: "exit_setsockopt", 1823: "enter_getsockopt", 1822: "exit_getsockopt", 1821: "enter_shutdown", 1820: "exit_shutdown", 1819: "enter_sendmsg", 1818: "exit_sendmsg", 1817: "enter_sendmmsg", 1816: "exit_sendmmsg", 1815: "enter_recvmsg", 1814: "exit_recvmsg", 1813: "enter_recvmmsg", 1812: "exit_recvmmsg", 1575: "enter_getrandom", 1574: "exit_getrandom", 1528: "enter_io_uring_register", 1527: "exit_io_uring_register", 1509: "enter_io_uring_enter", 1508: "exit_io_uring_enter", 1507: "enter_io_uring_setup", 1506: "exit_io_uring_setup", 1491: "enter_ioprio_set", 1490: "exit_ioprio_set", 1489: "enter_ioprio_get", 1488: "exit_ioprio_get", 1463: "enter_landlock_create_ruleset", 1462: "exit_landlock_create_ruleset", 1461: "enter_landlock_add_rule", 1460: "exit_landlock_add_rule", 1459: "enter_landlock_restrict_self", 1458: "exit_landlock_restrict_self", 1456: "enter_lsm_set_self_attr", 1455: "exit_lsm_set_self_attr", 1454: "enter_lsm_get_self_attr", 1453: "exit_lsm_get_self_attr", 1452: "enter_lsm_list_modules", 1451: "exit_lsm_list_modules", 1449: "enter_add_key", 1448: "exit_add_key", 1447: "enter_request_key", 1446: "exit_request_key", 1445: "enter_keyctl", 1444: "exit_keyctl", 1443: "enter_mq_open", 1442: "exit_mq_open", 1441: "enter_mq_unlink", 1440: "exit_mq_unlink", 1439: "enter_mq_timedsend", 1438: "exit_mq_timedsend", 1437: "enter_mq_timedreceive", 1436: "exit_mq_timedreceive", 1435: "enter_mq_notify", 1434: "exit_mq_notify", 1433: "enter_mq_getsetattr", 1432: "exit_mq_getsetattr", 1431: "enter_shmget", 1430: "exit_shmget", 1429: "enter_shmctl", 1428: "exit_shmctl", 1427: "enter_shmat", 1426: "exit_shmat", 1425: "enter_shmdt", 1424: "exit_shmdt", 1423: "enter_semget", 1422: "exit_semget", 1421: "enter_semctl", 1420: "exit_semctl", 1419: "enter_semtimedop", 1418: "exit_semtimedop", 1417: "enter_semop", 1416: "exit_semop", 1415: "enter_msgget", 1414: "exit_msgget", 1413: "enter_msgctl", 1412: "exit_msgctl", 1411: "enter_msgsnd", 1410: "exit_msgsnd", 1409: "enter_msgrcv", 1408: "exit_msgrcv", 1164: "enter_quotactl", 1163: "exit_quotactl", 1162: "enter_quotactl_fd", 1161: "exit_quotactl_fd", 1146: "enter_name_to_handle_at", 1145: "exit_name_to_handle_at", 1144: "enter_open_by_handle_at", 1143: "exit_open_by_handle_at", 1130: "enter_flock", 1129: "exit_flock", 1111: "enter_io_setup", 1110: "exit_io_setup", 1109: "enter_io_destroy", 1108: "exit_io_destroy", 1107: "enter_io_submit", 1106: "exit_io_submit", 1105: "enter_io_cancel", 1104: "exit_io_cancel", 1103: "enter_io_getevents", 1102: "exit_io_getevents", 1101: "enter_io_pgetevents", 1100: "exit_io_pgetevents", 1099: "enter_userfaultfd", 1098: "exit_userfaultfd", 1097: "enter_eventfd2", 1096: "exit_eventfd2", 1095: "enter_eventfd", 1094: "exit_eventfd", 1093: "enter_timerfd_create", 1092: "exit_timerfd_create", 1091: "enter_timerfd_settime", 1090: "exit_timerfd_settime", 1089: "enter_timerfd_gettime", 1088: "exit_timerfd_gettime", 1087: "enter_signalfd4", 1086: "exit_signalfd4", 1085: "enter_signalfd", 1084: "exit_signalfd", 1083: "enter_epoll_create1", 1082: "exit_epoll_create1", 1081: "enter_epoll_create", 1080: "exit_epoll_create", 1079: "enter_epoll_ctl", 1078: "exit_epoll_ctl", 1077: "enter_epoll_wait", 1076: "exit_epoll_wait", 1075: "enter_epoll_pwait", 1074: "exit_epoll_pwait", 1073: "enter_epoll_pwait2", 1072: "exit_epoll_pwait2", 1071: "enter_fanotify_init", 1070: "exit_fanotify_init", 1069: "enter_fanotify_mark", 1068: "exit_fanotify_mark", 1067: "enter_inotify_init1", 1066: "exit_inotify_init1", 1065: "enter_inotify_init", 1064: "exit_inotify_init", 1063: "enter_inotify_add_watch", 1062: "exit_inotify_add_watch", 1061: "enter_inotify_rm_watch", 1060: "exit_inotify_rm_watch", 1059: "enter_file_getattr", 1058: "exit_file_getattr", 1057: "enter_file_setattr", 1056: "exit_file_setattr", 1055: "enter_fsopen", 1054: "exit_fsopen", 1053: "enter_fspick", 1052: "exit_fspick", 1051: "enter_fsconfig", 1050: "exit_fsconfig", 1049: "enter_statfs", 1048: "exit_statfs", 1047: "enter_fstatfs", 1046: "exit_fstatfs", 1045: "enter_ustat", 1044: "exit_ustat", 1043: "enter_getcwd", 1042: "exit_getcwd", 1041: "enter_utimensat", 1040: "exit_utimensat", 1039: "enter_futimesat", 1038: "exit_futimesat", 1037: "enter_utimes", 1036: "exit_utimes", 1035: "enter_utime", 1034: "exit_utime", 1033: "enter_sync", 1032: "exit_sync", 1031: "enter_syncfs", 1030: "exit_syncfs", 1029: "enter_fsync", 1028: "exit_fsync", 1027: "enter_fdatasync", 1026: "exit_fdatasync", 1025: "enter_sync_file_range", 1024: "exit_sync_file_range", 1023: "enter_vmsplice", 1022: "exit_vmsplice", 1021: "enter_splice", 1020: "exit_splice", 1019: "enter_tee", 1018: "exit_tee", 985: "enter_setxattrat", 984: "exit_setxattrat", 983: "enter_setxattr", 982: "exit_setxattr", 981: "enter_lsetxattr", 980: "exit_lsetxattr", 979: "enter_fsetxattr", 978: "exit_fsetxattr", 977: "enter_getxattrat", 976: "exit_getxattrat", 975: "enter_getxattr", 974: "exit_getxattr", 973: "enter_lgetxattr", 972: "exit_lgetxattr", 971: "enter_fgetxattr", 970: "exit_fgetxattr", 969: "enter_listxattrat", 968: "exit_listxattrat", 967: "enter_listxattr", 966: "exit_listxattr", 965: "enter_llistxattr", 964: "exit_llistxattr", 963: "enter_flistxattr", 962: "exit_flistxattr", 961: "enter_removexattrat", 960: "exit_removexattrat", 959: "enter_removexattr", 958: "exit_removexattr", 957: "enter_lremovexattr", 956: "exit_lremovexattr", 955: "enter_fremovexattr", 954: "exit_fremovexattr", 953: "enter_umount", 952: "exit_umount", 951: "enter_open_tree", 950: "exit_open_tree", 949: "enter_mount", 948: "exit_mount", 947: "enter_fsmount", 946: "exit_fsmount", 945: "enter_move_mount", 944: "exit_move_mount", 943: "enter_pivot_root", 942: "exit_pivot_root", 941: "enter_mount_setattr", 940: "exit_mount_setattr", 939: "enter_open_tree_attr", 938: "exit_open_tree_attr", 937: "enter_statmount", 936: "exit_statmount", 935: "enter_listmount", 934: "exit_listmount", 933: "enter_sysfs", 932: "exit_sysfs", 931: "enter_close_range", 930: "exit_close_range", 929: "enter_dup3", 928: "exit_dup3", 927: "enter_dup2", 926: "exit_dup2", 925: "enter_dup", 924: "exit_dup", 919: "enter_select", 918: "exit_select", 917: "enter_pselect6", 916: "exit_pselect6", 915: "enter_poll", 914: "exit_poll", 913: "enter_ppoll", 912: "exit_ppoll", 911: "enter_getdents", 910: "exit_getdents", 909: "enter_getdents64", 908: "exit_getdents64", 907: "enter_ioctl", 906: "exit_ioctl", 905: "enter_fcntl", 904: "exit_fcntl", 903: "enter_mknodat", 902: "exit_mknodat", 901: "enter_mknod", 900: "exit_mknod", 899: "enter_mkdirat", 898: "exit_mkdirat", 897: "enter_mkdir", 896: "exit_mkdir", 895: "enter_rmdir", 894: "exit_rmdir", 893: "enter_unlinkat", 892: "exit_unlinkat", 891: "enter_unlink", 890: "exit_unlink", 889: "enter_symlinkat", 888: "exit_symlinkat", 887: "enter_symlink", 886: "exit_symlink", 885: "enter_linkat", 884: "exit_linkat", 883: "enter_link", 882: "exit_link", 881: "enter_renameat2", 880: "exit_renameat2", 879: "enter_renameat", 878: "exit_renameat", 877: "enter_rename", 876: "exit_rename", 875: "enter_pipe2", 874: "exit_pipe2", 873: "enter_pipe", 872: "exit_pipe", 871: "enter_execve", 870: "exit_execve", 869: "enter_execveat", 868: "exit_execveat", 867: "enter_newstat", 866: "exit_newstat", 865: "enter_newlstat", 864: "exit_newlstat", 863: "enter_newfstatat", 862: "exit_newfstatat", 861: "enter_newfstat", 860: "exit_newfstat", 859: "enter_readlinkat", 858: "exit_readlinkat", 857: "enter_readlink", 856: "exit_readlink", 855: "enter_statx", 854: "exit_statx", 853: "enter_lseek", 852: "exit_lseek", 851: "enter_read", 850: "exit_read", 849: "enter_write", 848: "exit_write", 847: "enter_pread64", 846: "exit_pread64", 845: "enter_pwrite64", 844: "exit_pwrite64", 843: "enter_readv", 842: "exit_readv", 841: "enter_writev", 840: "exit_writev", 839: "enter_preadv", 838: "exit_preadv", 837: "enter_preadv2", 836: "exit_preadv2", 835: "enter_pwritev", 834: "exit_pwritev", 833: "enter_pwritev2", 832: "exit_pwritev2", 831: "enter_sendfile64", 830: "exit_sendfile64", 829: "enter_copy_file_range", 828: "exit_copy_file_range", 827: "enter_truncate", 826: "exit_truncate", 825: "enter_ftruncate", 824: "exit_ftruncate", 823: "enter_fallocate", 822: "exit_fallocate", 821: "enter_faccessat", 820: "exit_faccessat", 819: "enter_faccessat2", 818: "exit_faccessat2", 817: "enter_access", 816: "exit_access", 815: "enter_chdir", 814: "exit_chdir", 813: "enter_fchdir", 812: "exit_fchdir", 811: "enter_chroot", 810: "exit_chroot", 809: "enter_fchmod", 808: "exit_fchmod", 807: "enter_fchmodat2", 806: "exit_fchmodat2", 805: "enter_fchmodat", 804: "exit_fchmodat", 803: "enter_chmod", 802: "exit_chmod", 801: "enter_fchownat", 800: "exit_fchownat", 799: "enter_chown", 798: "exit_chown", 797: "enter_lchown", 796: "exit_lchown", 795: "enter_fchown", 794: "exit_fchown", 793: "enter_open", 792: "exit_open", 791: "enter_openat", 790: "exit_openat", 789: "enter_openat2", 788: "exit_openat2", 787: "enter_creat", 786: "exit_creat", 785: "enter_close", 784: "exit_close", 783: "enter_vhangup", 782: "exit_vhangup", 781: "enter_memfd_create", 780: "exit_memfd_create", 774: "enter_memfd_secret", 773: "exit_memfd_secret", 754: "enter_move_pages", 753: "exit_move_pages", 743: "enter_set_mempolicy_home_node", 742: "exit_set_mempolicy_home_node", 741: "enter_mbind", 740: "exit_mbind", 739: "enter_set_mempolicy", 738: "exit_set_mempolicy", 737: "enter_migrate_pages", 736: "exit_migrate_pages", 735: "enter_get_mempolicy", 734: "exit_get_mempolicy", 733: "enter_swapoff", 732: "exit_swapoff", 731: "enter_swapon", 730: "exit_swapon", 729: "enter_madvise", 728: "exit_madvise", 727: "enter_process_madvise", 726: "exit_process_madvise", 725: "enter_mseal", 724: "exit_mseal", 723: "enter_process_vm_readv", 722: "exit_process_vm_readv", 721: "enter_process_vm_writev", 720: "exit_process_vm_writev", 712: "enter_msync", 711: "exit_msync", 710: "enter_mremap", 709: "exit_mremap", 708: "enter_mprotect", 707: "exit_mprotect", 706: "enter_pkey_mprotect", 705: "exit_pkey_mprotect", 704: "enter_pkey_alloc", 703: "exit_pkey_alloc", 702: "enter_pkey_free", 701: "exit_pkey_free", 698: "enter_brk", 697: "exit_brk", 696: "enter_munmap", 695: "exit_munmap", 694: "enter_remap_file_pages", 693: "exit_remap_file_pages", 692: "enter_mlock", 691: "exit_mlock", 690: "enter_mlock2", 689: "exit_mlock2", 688: "enter_munlock", 687: "exit_munlock", 686: "enter_mlockall", 685: "exit_mlockall", 684: "enter_munlockall", 683: "exit_munlockall", 682: "enter_mincore", 681: "exit_mincore", 616: "enter_readahead", 615: "exit_readahead", 614: "enter_fadvise64", 613: "exit_fadvise64", 604: "enter_process_mrelease", 603: "exit_process_mrelease", 595: "enter_cachestat", 594: "exit_cachestat", 591: "enter_rseq", 590: "exit_rseq", 587: "enter_perf_event_open", 586: "exit_perf_event_open", 585: "enter_bpf", 584: "exit_bpf", 526: "enter_seccomp", 525: "exit_seccomp", 508: "enter_kexec_file_load", 507: "exit_kexec_file_load", 506: "enter_kexec_load", 505: "exit_kexec_load", 504: "enter_acct", 503: "exit_acct", 499: "enter_set_robust_list", 498: "exit_set_robust_list", 497: "enter_get_robust_list", 496: "exit_get_robust_list", 495: "enter_futex", 494: "exit_futex", 493: "enter_futex_waitv", 492: "exit_futex_waitv", 491: "enter_futex_wake", 490: "exit_futex_wake", 489: "enter_futex_wait", 488: "exit_futex_wait", 487: "enter_futex_requeue", 486: "exit_futex_requeue", 471: "enter_getitimer", 470: "exit_getitimer", 469: "enter_alarm", 468: "exit_alarm", 467: "enter_setitimer", 466: "exit_setitimer", 465: "enter_timer_create", 464: "exit_timer_create", 463: "enter_timer_gettime", 462: "exit_timer_gettime", 461: "enter_timer_getoverrun", 460: "exit_timer_getoverrun", 459: "enter_timer_settime", 458: "exit_timer_settime", 457: "enter_timer_delete", 456: "exit_timer_delete", 455: "enter_clock_settime", 454: "exit_clock_settime", 453: "enter_clock_gettime", 452: "exit_clock_gettime", 451: "enter_clock_adjtime", 450: "exit_clock_adjtime", 449: "enter_clock_getres", 448: "exit_clock_getres", 447: "enter_clock_nanosleep", 446: "exit_clock_nanosleep", 441: "enter_nanosleep", 440: "exit_nanosleep", 425: "enter_time", 424: "exit_time", 423: "enter_gettimeofday", 422: "exit_gettimeofday", 421: "enter_settimeofday", 420: "exit_settimeofday", 419: "enter_adjtimex", 418: "exit_adjtimex", 417: "enter_kcmp", 416: "exit_kcmp", 410: "enter_delete_module", 409: "exit_delete_module", 408: "enter_init_module", 407: "exit_init_module", 406: "enter_finit_module", 405: "exit_finit_module", 350: "enter_syslog", 349: "exit_syslog", 346: "enter_membarrier", 345: "exit_membarrier", 341: "enter_sched_setscheduler", 340: "exit_sched_setscheduler", 339: "enter_sched_setparam", 338: "exit_sched_setparam", 337: "enter_sched_setattr", 336: "exit_sched_setattr", 335: "enter_sched_getscheduler", 334: "exit_sched_getscheduler", 333: "enter_sched_getparam", 332: "exit_sched_getparam", 331: "enter_sched_getattr", 330: "exit_sched_getattr", 329: "enter_sched_setaffinity", 328: "exit_sched_setaffinity", 327: "enter_sched_getaffinity", 326: "exit_sched_getaffinity", 325: "enter_sched_yield", 324: "exit_sched_yield", 323: "enter_sched_get_priority_max", 322: "exit_sched_get_priority_max", 321: "enter_sched_get_priority_min", 320: "exit_sched_get_priority_min", 319: "enter_sched_rr_get_interval", 318: "exit_sched_rr_get_interval", 286: "enter_getgroups", 285: "exit_getgroups", 284: "enter_setgroups", 283: "exit_setgroups", 282: "enter_reboot", 281: "exit_reboot", 277: "enter_listns", 276: "exit_listns", 275: "enter_setns", 274: "exit_setns", 273: "enter_pidfd_open", 272: "exit_pidfd_open", 271: "enter_pidfd_getfd", 270: "exit_pidfd_getfd", 265: "enter_setpriority", 264: "exit_setpriority", 263: "enter_getpriority", 262: "exit_getpriority", 261: "enter_setregid", 260: "exit_setregid", 259: "enter_setgid", 258: "exit_setgid", 257: "enter_setreuid", 256: "exit_setreuid", 255: "enter_setuid", 254: "exit_setuid", 253: "enter_setresuid", 252: "exit_setresuid", 251: "enter_getresuid", 250: "exit_getresuid", 249: "enter_setresgid", 248: "exit_setresgid", 247: "enter_getresgid", 246: "exit_getresgid", 245: "enter_setfsuid", 244: "exit_setfsuid", 243: "enter_setfsgid", 242: "exit_setfsgid", 241: "enter_getpid", 240: "exit_getpid", 239: "enter_gettid", 238: "exit_gettid", 237: "enter_getppid", 236: "exit_getppid", 235: "enter_getuid", 234: "exit_getuid", 233: "enter_geteuid", 232: "exit_geteuid", 231: "enter_getgid", 230: "exit_getgid", 229: "enter_getegid", 228: "exit_getegid", 227: "enter_times", 226: "exit_times", 225: "enter_setpgid", 224: "exit_setpgid", 223: "enter_getpgid", 222: "exit_getpgid", 221: "enter_getpgrp", 220: "exit_getpgrp", 219: "enter_getsid", 218: "exit_getsid", 217: "enter_setsid", 216: "exit_setsid", 215: "enter_newuname", 214: "exit_newuname", 213: "enter_sethostname", 212: "exit_sethostname", 211: "enter_setdomainname", 210: "exit_setdomainname", 209: "enter_getrlimit", 208: "exit_getrlimit", 207: "enter_prlimit64", 206: "exit_prlimit64", 205: "enter_setrlimit", 204: "exit_setrlimit", 203: "enter_getrusage", 202: "exit_getrusage", 201: "enter_umask", 200: "exit_umask", 199: "enter_prctl", 198: "exit_prctl", 197: "enter_getcpu", 196: "exit_getcpu", 195: "enter_sysinfo", 194: "exit_sysinfo", 191: "enter_restart_syscall", 190: "exit_restart_syscall", 189: "enter_rt_sigprocmask", 188: "exit_rt_sigprocmask", 187: "enter_rt_sigpending", 186: "exit_rt_sigpending", 185: "enter_rt_sigtimedwait", 184: "exit_rt_sigtimedwait", 183: "enter_kill", 182: "exit_kill", 181: "enter_pidfd_send_signal", 180: "exit_pidfd_send_signal", 179: "enter_tgkill", 178: "exit_tgkill", 177: "enter_tkill", 176: "exit_tkill", 175: "enter_rt_sigqueueinfo", 174: "exit_rt_sigqueueinfo", 173: "enter_rt_tgsigqueueinfo", 172: "exit_rt_tgsigqueueinfo", 171: "enter_sigaltstack", 170: "exit_sigaltstack", 169: "enter_rt_sigaction", 168: "exit_rt_sigaction", 167: "enter_pause", 166: "exit_pause", 165: "enter_rt_sigsuspend", 164: "exit_rt_sigsuspend", 163: "enter_ptrace", 162: "exit_ptrace", 161: "enter_capget", 160: "exit_capget", 159: "enter_capset", 158: "exit_capset", 150: "enter_exit", 148: "enter_exit_group", 146: "enter_waitid", 145: "exit_waitid", 144: "enter_wait4", 143: "exit_wait4", 139: "enter_personality", 138: "exit_personality", 134: "enter_set_tid_address", 133: "exit_set_tid_address", 132: "enter_fork", 131: "exit_fork", 130: "enter_vfork", 129: "exit_vfork", 128: "enter_clone", 127: "exit_clone", 126: "enter_clone3", 125: "exit_clone3", 124: "enter_unshare", 123: "exit_unshare", 119: "enter_map_shadow_stack", 118: "exit_map_shadow_stack", 117: "enter_uretprobe", 116: "exit_uretprobe", 115: "enter_uprobe", 114: "exit_uprobe", 102: "enter_arch_prctl", 101: "exit_arch_prctl", 100: "enter_mmap