diff options
| author | Paul Buetow <paul@buetow.org> | 2026-05-29 09:57:50 +0300 |
|---|---|---|
| committer | Paul Buetow <paul@buetow.org> | 2026-05-29 09:57:50 +0300 |
| commit | 3bcdbe94d8b72ebcd829dbf7c1a582d2268fef45 (patch) | |
| tree | b050e3f4de81683414b9638d94f4825a454b2ab3 /internal | |
| parent | ff8774b5ce3f6b37e5152d0dc06ae46b7a36d1da (diff) | |
test(family): assert ioperm/iopl/modify_ldt classify as Misc
Audit of ioperm(2) confirmed the syscall is traced correctly: classified
as KindNull (name-only enter, no arg decoding) with the exit handler
capturing the raw int return value, matching the man-page semantics
(int ioperm(unsigned long from, unsigned long num, int turn_on) -> 0/-1).
ioperm and its x86 port/CPU-state siblings (iopl, modify_ldt) are not in
the explicit family table and intentionally fall through to Misc. Add
explicit family-classification assertions so a future regression that
accidentally remaps them is caught. No implementation change was needed.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Diffstat (limited to 'internal')
| -rw-r--r-- | internal/generate/family_test.go | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/internal/generate/family_test.go b/internal/generate/family_test.go index 93431b4..3d6f3bb 100644 --- a/internal/generate/family_test.go +++ b/internal/generate/family_test.go @@ -19,6 +19,13 @@ func TestClassifySyscallFamily(t *testing.T) { {"sys_enter_epoll_wait", FamilyPolling}, {"sys_enter_io_uring_enter", FamilyAIO}, {"sys_enter_bpf", FamilySecurity}, + // x86 I/O-port / CPU-state syscalls are not in the explicit family + // table and intentionally fall through to Misc (ioperm/iopl/modify_ldt + // set port-access or LDT state, not file I/O). arch_prctl/personality + // are deliberately classified as Process, so they are not listed here. + {"sys_enter_ioperm", FamilyMisc}, + {"sys_enter_iopl", FamilyMisc}, + {"sys_enter_modify_ldt", FamilyMisc}, {"sys_enter_unlisted_future_syscall", FamilyMisc}, } |