diff options
Diffstat (limited to 'internal')
| -rw-r--r-- | internal/c/generated_tracepoints.c | 4 | ||||
| -rw-r--r-- | internal/c/generated_tracepoints_result.txt | 2 | ||||
| -rw-r--r-- | internal/generate/classify.go | 3 | ||||
| -rw-r--r-- | internal/generate/retclassify_test.go | 3 |
4 files changed, 9 insertions, 3 deletions
diff --git a/internal/c/generated_tracepoints.c b/internal/c/generated_tracepoints.c index 5c72813..8c76e7a 100644 --- a/internal/c/generated_tracepoints.c +++ b/internal/c/generated_tracepoints.c @@ -6372,7 +6372,7 @@ int handle_sys_enter_getxattrat(struct syscall_trace_enter *ctx) { return 0; } -/// sys_exit_getxattrat is a struct ret_event (UNCLASSIFIED) (kind=ret) +/// sys_exit_getxattrat is a struct ret_event (READ_CLASSIFIED) (kind=ret) SEC("tracepoint/syscalls/sys_exit_getxattrat") int handle_sys_exit_getxattrat(struct syscall_trace_exit *ctx) { __u32 pid, tid; @@ -6392,7 +6392,7 @@ int handle_sys_exit_getxattrat(struct syscall_trace_exit *ctx) { ev->tid = tid; ev->time = bpf_ktime_get_boot_ns(); ev->ret = ctx->ret; - ev->ret_type = UNCLASSIFIED; + ev->ret_type = READ_CLASSIFIED; bpf_ringbuf_submit(ev, 0); return 0; diff --git a/internal/c/generated_tracepoints_result.txt b/internal/c/generated_tracepoints_result.txt index 971f92c..0842bda 100644 --- a/internal/c/generated_tracepoints_result.txt +++ b/internal/c/generated_tracepoints_result.txt @@ -474,7 +474,7 @@ sys_exit_gettid is a struct ret_event (UNCLASSIFIED) (kind=ret) sys_exit_gettimeofday is a struct ret_event (UNCLASSIFIED) (kind=ret) sys_exit_getuid is a struct ret_event (UNCLASSIFIED) (kind=ret) sys_exit_getxattr is a struct ret_event (READ_CLASSIFIED) (kind=ret) -sys_exit_getxattrat is a struct ret_event (UNCLASSIFIED) (kind=ret) +sys_exit_getxattrat is a struct ret_event (READ_CLASSIFIED) (kind=ret) sys_exit_init_module is a struct null_event (kind=module) sys_exit_inotify_add_watch is a struct ret_event (UNCLASSIFIED) (kind=ret) sys_exit_inotify_init is a struct eventfd_event (kind=eventfd) diff --git a/internal/generate/classify.go b/internal/generate/classify.go index f85cb93..3746bd9 100644 --- a/internal/generate/classify.go +++ b/internal/generate/classify.go @@ -588,6 +588,9 @@ var retClassifications = map[string]RetClassification{ "getdents": ReadClassified, "getdents64": ReadClassified, "getxattr": ReadClassified, + // getxattrat (Linux 6.13+) returns the size in bytes of the xattr value, + // exactly like getxattr/lgetxattr/fgetxattr, so it is a read byte-count. + "getxattrat": ReadClassified, "lgetxattr": ReadClassified, "listxattr": ReadClassified, "llistxattr": ReadClassified, diff --git a/internal/generate/retclassify_test.go b/internal/generate/retclassify_test.go index 25c5e71..acd019b 100644 --- a/internal/generate/retclassify_test.go +++ b/internal/generate/retclassify_test.go @@ -5,6 +5,9 @@ import "testing" func TestClassifyRetRead(t *testing.T) { reads := []string{ "fgetxattr", "flistxattr", "getdents", "getdents64", "getxattr", + // getxattrat (Linux 6.13+) returns the xattr value size in bytes, the + // same read byte-count as getxattr/lgetxattr/fgetxattr. + "getxattrat", "lgetxattr", "listxattr", "llistxattr", "pread64", "preadv", "preadv2", "process_vm_readv", "read", "readlink", "readlinkat", "readv", "recvmsg", "recvfrom", "syslog", "mq_timedreceive", "getrandom", "msgrcv", |