From 5356927b4a0f9772d84e707a2f5e1c507902085f Mon Sep 17 00:00:00 2001 From: Paul Buetow Date: Sat, 12 Jul 2025 00:54:24 +0300 Subject: initial classification --- internal/c/generate_tracepoints_c.raku | 385 +- internal/c/generated_tracepoints.c | 5481 ++------------------------- internal/c/generated_tracepoints_result.txt | 2 + internal/c/types.h | 5 + 4 files changed, 614 insertions(+), 5259 deletions(-) (limited to 'internal/c') diff --git a/internal/c/generate_tracepoints_c.raku b/internal/c/generate_tracepoints_c.raku index ad8a83b..11c4e0f 100644 --- a/internal/c/generate_tracepoints_c.raku +++ b/internal/c/generate_tracepoints_c.raku @@ -134,10 +134,389 @@ class PathnameTracepoint does TracepointTemplate { } } -class RetTracepoint does TracepointTemplate { +role TracepointClassification { + has %!map = + accept => 'noio', + accept4 => 'noio', + access => 'noio', + acct => 'noio', + add_key => 'noio', + adjtimex => 'noio', + alarm => 'noio', + arch_prctl => 'noio', + bind => 'noio', + bpf => 'noio', + brk => 'noio', + cachestat => 'noio', + capget => 'noio', + capset => 'noio', + chdir => 'noio', + chmod => 'noio', + chown => 'noio', + chroot => 'noio', + clock_adjtime => 'noio', + clock_getres => 'noio', + clock_gettime => 'noio', + clock_nanosleep => 'noio', + clock_settime => 'noio', + clone => 'noio', + clone3 => 'noio', + close => 'noio', + close_range => 'noio', + connect => 'noio', + copy_file_range => 'transfer', + creat => 'noio', + delete_module => 'noio', + dup => 'noio', + dup2 => 'noio', + dup3 => 'noio', + epoll_create => 'noio', + epoll_create1 => 'noio', + epoll_ctl => 'noio', + epoll_pwait => 'noio', + epoll_pwait2 => 'noio', + epoll_wait => 'noio', + eventfd => 'noio', + eventfd2 => 'noio', + execve => 'noio', + execveat => 'noio', + exit => 'noio', + exit_group => 'noio', + faccessat => 'noio', + faccessat2 => 'noio', + fadvise64 => 'noio', + fallocate => 'noio', + fanotify_init => 'noio', + fanotify_mark => 'noio', + fchdir => 'noio', + fchmod => 'noio', + fchmodat => 'noio', + fchmodat2 => 'noio', + fchown => 'noio', + fchownat => 'noio', + fcntl => 'noio', + fdatasync => 'noio', + fgetxattr => 'noio', + finit_module => 'noio', + flistxattr => 'noio', + flock => 'noio', + fork => 'noio', + fremovexattr => 'noio', + fsconfig => 'noio', + fsetxattr => 'noio', + fsmount => 'noio', + fsopen => 'noio', + fspick => 'noio', + fstatfs => 'noio', + fsync => 'noio', + ftruncate => 'noio', + futex => 'noio', + futex_requeue => 'noio', + futex_wait => 'noio', + futex_waitv => 'noio', + futex_wake => 'noio', + futimesat => 'noio', + get_mempolicy => 'noio', + get_robust_list => 'noio', + getcpu => 'noio', + getcwd => 'noio', + getdents => 'read', + getdents64 => 'read', + getegid => 'noio', + geteuid => 'noio', + getgid => 'noio', + getgroups => 'noio', + getitimer => 'noio', + getpeername => 'noio', + getpgid => 'noio', + getpgrp => 'noio', + getpid => 'noio', + getppid => 'noio', + getpriority => 'noio', + getrandom => 'noio', + getresgid => 'noio', + getresuid => 'noio', + getrlimit => 'noio', + getrusage => 'noio', + getsid => 'noio', + getsockname => 'noio', + getsockopt => 'noio', + gettid => 'noio', + gettimeofday => 'noio', + getuid => 'noio', + getxattr => 'noio', + getxattrat => 'noio', + init_module => 'noio', + inotify_add_watch => 'noio', + inotify_init => 'noio', + inotify_init1 => 'noio', + inotify_rm_watch => 'noio', + io_cancel => 'noio', + io_destroy => 'noio', + io_getevents => 'noio', + io_pgetevents => 'noio', + io_setup => 'noio', + io_submit => 'noio', + io_uring_enter => 'noio', + io_uring_register => 'noio', + io_uring_setup => 'noio', + ioctl => 'noio', + ioperm => 'noio', + iopl => 'noio', + ioprio_get => 'noio', + ioprio_set => 'noio', + kcmp => 'noio', + kexec_file_load => 'noio', + kexec_load => 'noio', + keyctl => 'noio', + kill => 'noio', + landlock_add_rule => 'noio', + landlock_create_ruleset => 'noio', + landlock_restrict_self => 'noio', + lchown => 'noio', + lgetxattr => 'noio', + link => 'noio', + linkat => 'noio', + listen => 'noio', + listmount => 'noio', + listxattr => 'noio', + listxattrat => 'noio', + llistxattr => 'noio', + lremovexattr => 'noio', + lseek => 'noio', + lsetxattr => 'noio', + lsm_get_self_attr => 'noio', + lsm_list_modules => 'noio', + lsm_set_self_attr => 'noio', + madvise => 'noio', + map_shadow_stack => 'noio', + mbind => 'noio', + membarrier => 'noio', + memfd_create => 'noio', + memfd_secret => 'noio', + migrate_pages => 'noio', + mincore => 'noio', + mkdir => 'noio', + mkdirat => 'noio', + mknod => 'noio', + mknodat => 'noio', + mlock => 'noio', + mlock2 => 'noio', + mlockall => 'noio', + mmap => 'noio', + modify_ldt => 'noio', + mount => 'noio', + mount_setattr => 'noio', + move_mount => 'noio', + move_pages => 'noio', + mprotect => 'noio', + mq_getsetattr => 'noio', + mq_notify => 'noio', + mq_open => 'noio', + mq_timedreceive => 'noio', + mq_timedsend => 'noio', + mq_unlink => 'noio', + mremap => 'noio', + mseal => 'noio', + msgctl => 'noio', + msgget => 'noio', + msgrcv => 'noio', + msgsnd => 'noio', + msync => 'noio', + munlock => 'noio', + munlockall => 'noio', + munmap => 'noio', + name_to_handle_at => 'noio', + nanosleep => 'noio', + newfstat => 'noio', + newfstatat => 'noio', + newlstat => 'noio', + newstat => 'noio', + newuname => 'noio', + open => 'noio', + open_by_handle_at => 'noio', + open_tree => 'noio', + open_tree_attr => 'noio', + openat => 'noio', + openat2 => 'noio', + pause => 'noio', + perf_event_open => 'noio', + personality => 'noio', + pidfd_getfd => 'noio', + pidfd_open => 'noio', + pidfd_send_signal => 'noio', + pipe => 'noio', + pipe2 => 'noio', + pivot_root => 'noio', + pkey_alloc => 'noio', + pkey_free => 'noio', + pkey_mprotect => 'noio', + poll => 'noio', + ppoll => 'noio', + prctl => 'noio', + pread64 => 'read', + preadv => 'read', + preadv2 => 'read', + prlimit64 => 'noio', + process_madvise => 'noio', + process_mrelease => 'noio', + process_vm_readv => 'read', + process_vm_writev => 'write', + pselect6 => 'noio', + ptrace => 'noio', + pwrite64 => 'write', + pwritev => 'write', + pwritev2 => 'write', + quotactl => 'noio', + quotactl_fd => 'noio', + read => 'read', + readahead => 'noio', + readlink => 'read', + readlinkat => 'read', + readv => 'read', + reboot => 'noio', + recvfrom => 'read', + recvmmsg => 'read', + recvmsg => 'read', + remap_file_pages => 'noio', + removexattr => 'noio', + removexattrat => 'noio', + rename => 'noio', + renameat => 'noio', + renameat2 => 'noio', + request_key => 'noio', + restart_syscall => 'noio', + rmdir => 'noio', + rseq => 'noio', + rt_sigaction => 'noio', + rt_sigpending => 'noio', + rt_sigprocmask => 'noio', + rt_sigqueueinfo => 'noio', + rt_sigreturn => 'noio', + rt_sigsuspend => 'noio', + rt_sigtimedwait => 'noio', + rt_tgsigqueueinfo => 'noio', + sched_get_priority_max => 'noio', + sched_get_priority_min => 'noio', + sched_getaffinity => 'noio', + sched_getattr => 'noio', + sched_getparam => 'noio', + sched_getscheduler => 'noio', + sched_rr_get_interval => 'noio', + sched_setaffinity => 'noio', + sched_setattr => 'noio', + sched_setparam => 'noio', + sched_setscheduler => 'noio', + sched_yield => 'noio', + seccomp => 'noio', + select => 'noio', + semctl => 'noio', + semget => 'noio', + semop => 'noio', + semtimedop => 'noio', + sendfile64 => 'transfer', + sendmmsg => 'write', + sendmsg => 'write', + sendto => 'write', + set_mempolicy => 'noio', + set_mempolicy_home_node => 'noio', + set_robust_list => 'noio', + set_tid_address => 'noio', + setdomainname => 'noio', + setfsgid => 'noio', + setfsuid => 'noio', + setgid => 'noio', + setgroups => 'noio', + sethostname => 'noio', + setitimer => 'noio', + setns => 'noio', + setpgid => 'noio', + setpriority => 'noio', + setregid => 'noio', + setresgid => 'noio', + setresuid => 'noio', + setreuid => 'noio', + setrlimit => 'noio', + setsid => 'noio', + setsockopt => 'noio', + settimeofday => 'noio', + setuid => 'noio', + setxattr => 'noio', + setxattrat => 'noio', + shmat => 'noio', + shmctl => 'noio', + shmdt => 'noio', + shmget => 'noio', + shutdown => 'noio', + sigaltstack => 'noio', + signalfd => 'noio', + signalfd4 => 'noio', + socket => 'noio', + socketpair => 'noio', + splice => 'transfer', + statfs => 'noio', + statmount => 'noio', + statx => 'noio', + swapoff => 'noio', + swapon => 'noio', + symlink => 'noio', + symlinkat => 'noio', + sync => 'noio', + sync_file_range => 'noio', + syncfs => 'noio', + sysfs => 'noio', + sysinfo => 'noio', + syslog => 'noio', + tee => 'transfer', + tgkill => 'noio', + time => 'noio', + timer_create => 'noio', + timer_delete => 'noio', + timer_getoverrun => 'noio', + timer_gettime => 'noio', + timer_settime => 'noio', + timerfd_create => 'noio', + timerfd_gettime => 'noio', + timerfd_settime => 'noio', + times => 'noio', + tkill => 'noio', + truncate => 'noio', + umask => 'noio', + umount => 'noio', + unlink => 'noio', + unlinkat => 'noio', + unshare => 'noio', + uretprobe => 'noio', + userfaultfd => 'noio', + ustat => 'noio', + utime => 'noio', + utimensat => 'noio', + utimes => 'noio', + vfork => 'noio', + vhangup => 'noio', + vmsplice => 'transfer', + wait4 => 'noio', + waitid => 'noio', + write => 'write', + writev => 'write'; + + method classify-tracepoint(Str \name --> Str) { + my Str \syscall = name.subst(/^SYS_EXIT_/, '').lc; + die "Syscall '{syscall}' for tracepoint '{name}' not found in classification map" + unless %!map:exists; + given %!map{syscall} { + when 'read' { 'READ_CLASSIFIED' } + when 'write' { 'WRITE_CLASSIFIED' } + default { 'OTHER_CLASSIFIED' } + } + } +} + +class RetTracepoint does TracepointTemplate does TracepointClassification { method generate-bpf-c-tracepoint(%vals --> Str) { - my Str $extra = q:to/BPF_C_CODE/; - ev->ret = ctx->ret; + my Str $extra = qq:to/BPF_C_CODE/; + ev->ret = ctx->ret; + ev->ret_type = {self.classify-tracepoint: %vals}; BPF_C_CODE self.template: %vals.append( ( event-struct => 'ret_event', :$extra ).hash ); } diff --git a/internal/c/generated_tracepoints.c b/internal/c/generated_tracepoints.c index bf17d18..9a50b17 100644 --- a/internal/c/generated_tracepoints.c +++ b/internal/c/generated_tracepoints.c @@ -1,5287 +1,256 @@ // Code generated - don't change manually! -/// Ignoring sys_enter_pidfd_open sys_exit_pidfd_open as possibly not file I/O related -/// Ignoring sys_enter_move_pages sys_exit_move_pages as possibly not file I/O related +/// Ignoring sys_enter_memfd_create sys_exit_memfd_create as possibly not file I/O related +/// Ignoring sys_enter_epoll_pwait sys_exit_epoll_pwait as possibly not file I/O related +/// Ignoring sys_enter_pkey_mprotect sys_exit_pkey_mprotect as possibly not file I/O related +/// Ignoring sys_enter_sethostname sys_exit_sethostname as possibly not file I/O related +/// Ignoring sys_enter_rt_sigpending sys_exit_rt_sigpending as possibly not file I/O related +/// Ignoring sys_enter_mq_getsetattr sys_exit_mq_getsetattr as possibly not file I/O related +/// Ignoring sys_enter_timer_getoverrun sys_exit_timer_getoverrun as possibly not file I/O related +/// Ignoring sys_enter_sigaltstack sys_exit_sigaltstack as possibly not file I/O related +/// Ignoring sys_enter_gettid sys_exit_gettid as possibly not file I/O related +/// Ignoring sys_enter_sendmmsg sys_exit_sendmmsg as possibly not file I/O related /// Ignoring sys_enter_get_robust_list sys_exit_get_robust_list as possibly not file I/O related -/// Ignoring sys_enter_set_mempolicy_home_node sys_exit_set_mempolicy_home_node as possibly not file I/O related -/// Ignoring sys_enter_futex_wait sys_exit_futex_wait as possibly not file I/O related -/// Ignoring sys_enter_kcmp sys_exit_kcmp as possibly not file I/O related -/// Ignoring sys_enter_sched_setattr sys_exit_sched_setattr as possibly not file I/O related -/// Ignoring sys_enter_gettimeofday sys_exit_gettimeofday as possibly not file I/O related -/// Ignoring sys_enter_getsid sys_exit_getsid as possibly not file I/O related -/// Ignoring sys_enter_pkey_alloc sys_exit_pkey_alloc as possibly not file I/O related -/// Ignoring sys_enter_settimeofday sys_exit_settimeofday as possibly not file I/O related -/// Ignoring sys_enter_timer_delete sys_exit_timer_delete as possibly not file I/O related -/// Ignoring sys_enter_getpgrp sys_exit_getpgrp as possibly not file I/O related -/// Ignoring sys_enter_map_shadow_stack sys_exit_map_shadow_stack as possibly not file I/O related -/// Ignoring sys_enter_capset sys_exit_capset as possibly not file I/O related -/// Ignoring sys_enter_socket sys_exit_socket as possibly not file I/O related -/// Ignoring sys_enter_rt_sigsuspend sys_exit_rt_sigsuspend as possibly not file I/O related +/// Ignoring sys_enter_ioperm sys_exit_ioperm as possibly not file I/O related +/// Ignoring sys_enter_umount sys_exit_umount as possibly not file I/O related +/// Ignoring sys_enter_fanotify_init sys_exit_fanotify_init as possibly not file I/O related /// Ignoring sys_enter_ustat sys_exit_ustat as possibly not file I/O related -/// Ignoring sys_enter_poll sys_exit_poll as possibly not file I/O related -/// Ignoring sys_enter_getcpu sys_exit_getcpu as possibly not file I/O related -/// Ignoring sys_enter_adjtimex sys_exit_adjtimex as possibly not file I/O related -/// Ignoring sys_enter_getgid sys_exit_getgid as possibly not file I/O related +/// Ignoring sys_enter_capget sys_exit_capget as possibly not file I/O related +/// Ignoring sys_enter_arch_prctl sys_exit_arch_prctl as possibly not file I/O related +/// Ignoring sys_enter_listmount sys_exit_listmount as possibly not file I/O related +/// Ignoring sys_enter_statmount sys_exit_statmount as possibly not file I/O related +/// Ignoring sys_enter_futex_waitv sys_exit_futex_waitv as possibly not file I/O related +/// Ignoring sys_enter_iopl sys_exit_iopl as possibly not file I/O related +/// Ignoring sys_enter_shmget sys_exit_shmget as possibly not file I/O related +/// Ignoring sys_enter_prlimit64 sys_exit_prlimit64 as possibly not file I/O related +/// Ignoring sys_enter_getcwd sys_exit_getcwd as possibly not file I/O related +/// Ignoring sys_enter_msgrcv sys_exit_msgrcv as possibly not file I/O related +/// Ignoring sys_enter_userfaultfd sys_exit_userfaultfd as possibly not file I/O related +/// Ignoring sys_enter_signalfd4 sys_exit_signalfd4 as possibly not file I/O related +/// Ignoring sys_enter_madvise sys_exit_madvise as possibly not file I/O related +/// Ignoring sys_enter_rt_sigtimedwait sys_exit_rt_sigtimedwait as possibly not file I/O related +/// Ignoring sys_enter_mq_unlink sys_exit_mq_unlink as possibly not file I/O related /// Ignoring sys_enter_setrlimit sys_exit_setrlimit as possibly not file I/O related +/// Ignoring sys_enter_pivot_root sys_exit_pivot_root as possibly not file I/O related +/// Ignoring sys_enter_set_robust_list sys_exit_set_robust_list as possibly not file I/O related +/// Ignoring sys_enter_eventfd2 sys_exit_eventfd2 as possibly not file I/O related +/// Ignoring sys_enter_timerfd_settime sys_exit_timerfd_settime as possibly not file I/O related +/// Ignoring sys_enter_pidfd_open sys_exit_pidfd_open as possibly not file I/O related +/// Ignoring sys_enter_sysfs sys_exit_sysfs as possibly not file I/O related +/// Ignoring sys_enter_shmat sys_exit_shmat as possibly not file I/O related +/// Ignoring sys_enter_newuname sys_exit_newuname as possibly not file I/O related +/// Ignoring sys_enter_gettimeofday sys_exit_gettimeofday as possibly not file I/O related +/// Ignoring sys_enter_getcpu sys_exit_getcpu as possibly not file I/O related +/// Ignoring sys_enter_bpf sys_exit_bpf as possibly not file I/O related +/// Ignoring sys_enter_mq_open sys_exit_mq_open as possibly not file I/O related /// Ignoring sys_enter_swapon sys_exit_swapon as possibly not file I/O related -/// Ignoring sys_enter_futex_wake sys_exit_futex_wake as possibly not file I/O related -/// Ignoring sys_enter_setitimer sys_exit_setitimer as possibly not file I/O related -/// Ignoring sys_enter_semtimedop sys_exit_semtimedop as possibly not file I/O related -/// Ignoring sys_enter_acct sys_exit_acct as possibly not file I/O related +/// Ignoring sys_enter_lsm_get_self_attr sys_exit_lsm_get_self_attr as possibly not file I/O related +/// Ignoring sys_enter_getrlimit sys_exit_getrlimit as possibly not file I/O related +/// Ignoring sys_enter_futex sys_exit_futex as possibly not file I/O related +/// Ignoring sys_enter_clock_gettime sys_exit_clock_gettime as possibly not file I/O related +/// Ignoring sys_enter_sched_yield sys_exit_sched_yield as possibly not file I/O related +/// Ignoring sys_enter_timer_gettime sys_exit_timer_gettime as possibly not file I/O related +/// Ignoring sys_enter_rt_sigprocmask sys_exit_rt_sigprocmask as possibly not file I/O related +/// Ignoring sys_enter_utimes sys_exit_utimes as possibly not file I/O related +/// Ignoring sys_enter_timer_create sys_exit_timer_create as possibly not file I/O related +/// Ignoring sys_enter_pselect6 sys_exit_pselect6 as possibly not file I/O related +/// Ignoring sys_enter_fork sys_exit_fork as possibly not file I/O related +/// Ignoring sys_enter_setfsuid sys_exit_setfsuid as possibly not file I/O related +/// Ignoring sys_enter_utime sys_exit_utime as possibly not file I/O related +/// Ignoring sys_enter_sched_get_priority_min sys_exit_sched_get_priority_min as possibly not file I/O related +/// Ignoring sys_enter_msgsnd sys_exit_msgsnd as possibly not file I/O related /// Ignoring sys_enter_listen sys_exit_listen as possibly not file I/O related -/// Ignoring sys_enter_quotactl sys_exit_quotactl as possibly not file I/O related -/// Ignoring sys_enter_pause sys_exit_pause as possibly not file I/O related -/// Ignoring sys_enter_clone sys_exit_clone as possibly not file I/O related -/// Ignoring sys_enter_sched_getattr sys_exit_sched_getattr as possibly not file I/O related -/// Ignoring sys_enter_getresuid sys_exit_getresuid as possibly not file I/O related -/// Ignoring sys_enter_setgroups sys_exit_setgroups as possibly not file I/O related -/// Ignoring sys_enter_sysfs sys_exit_sysfs as possibly not file I/O related -/// Ignoring sys_enter_capget sys_exit_capget as possibly not file I/O related -/// Ignoring sys_enter_recvmmsg sys_exit_recvmmsg as possibly not file I/O related -/// Ignoring sys_enter_times sys_exit_times as possibly not file I/O related -/// Ignoring sys_enter_sched_setaffinity sys_exit_sched_setaffinity as possibly not file I/O related +/// Ignoring sys_enter_timer_settime sys_exit_timer_settime as possibly not file I/O related +/// Ignoring sys_enter_mount sys_exit_mount as possibly not file I/O related +/// Ignoring sys_enter_migrate_pages sys_exit_migrate_pages as possibly not file I/O related +/// Ignoring sys_enter_waitid sys_exit_waitid as possibly not file I/O related +/// Ignoring sys_enter_getuid sys_exit_getuid as possibly not file I/O related +/// Ignoring sys_enter_poll sys_exit_poll as possibly not file I/O related +/// Ignoring sys_enter_setresuid sys_exit_setresuid as possibly not file I/O related +/// Ignoring sys_enter_socket sys_exit_socket as possibly not file I/O related +/// Ignoring sys_enter_mbind sys_exit_mbind as possibly not file I/O related +/// Ignoring sys_enter_recvfrom sys_exit_recvfrom as possibly not file I/O related +/// Ignoring sys_enter_connect sys_exit_connect as possibly not file I/O related +/// Ignoring sys_enter_splice sys_exit_splice as possibly not file I/O related +/// Ignoring sys_enter_recvmsg sys_exit_recvmsg as possibly not file I/O related +/// Ignoring sys_enter_rt_sigqueueinfo sys_exit_rt_sigqueueinfo as possibly not file I/O related /// Ignoring sys_enter_landlock_add_rule sys_exit_landlock_add_rule as possibly not file I/O related -/// Ignoring sys_enter_set_robust_list sys_exit_set_robust_list as possibly not file I/O related -/// Ignoring sys_enter_clock_settime sys_exit_clock_settime as possibly not file I/O related -/// Ignoring sys_enter_sched_rr_get_interval sys_exit_sched_rr_get_interval as possibly not file I/O related -/// Ignoring sys_enter_rseq sys_exit_rseq as possibly not file I/O related -/// Ignoring sys_enter_execve sys_exit_execve as possibly not file I/O related -/// Ignoring sys_enter_inotify_init sys_exit_inotify_init as possibly not file I/O related +/// Ignoring sys_enter_inotify_rm_watch sys_exit_inotify_rm_watch as possibly not file I/O related +/// Ignoring sys_enter_inotify_add_watch sys_exit_inotify_add_watch as possibly not file I/O related +/// Ignoring sys_enter_rt_sigaction sys_exit_rt_sigaction as possibly not file I/O related /// Ignoring sys_enter_geteuid sys_exit_geteuid as possibly not file I/O related -/// Ignoring sys_enter_pidfd_getfd sys_exit_pidfd_getfd as possibly not file I/O related -/// Ignoring sys_enter_set_tid_address sys_exit_set_tid_address as possibly not file I/O related -/// Ignoring sys_enter_ioperm sys_exit_ioperm as possibly not file I/O related -/// Ignoring sys_enter_msgsnd sys_exit_msgsnd as possibly not file I/O related -/// Ignoring sys_enter_umount sys_exit_umount as possibly not file I/O related +/// Ignoring sys_enter_pidfd_send_signal sys_exit_pidfd_send_signal as possibly not file I/O related +/// Ignoring sys_enter_process_mrelease sys_exit_process_mrelease as possibly not file I/O related +/// Ignoring sys_enter_mknod sys_exit_mknod as possibly not file I/O related +/// Ignoring sys_enter_sched_rr_get_interval sys_exit_sched_rr_get_interval as possibly not file I/O related +/// Ignoring sys_enter_epoll_pwait2 sys_exit_epoll_pwait2 as possibly not file I/O related +/// Ignoring sys_enter_pipe2 sys_exit_pipe2 as possibly not file I/O related +/// Ignoring sys_enter_tkill sys_exit_tkill as possibly not file I/O related +/// Ignoring sys_enter_mlock sys_exit_mlock as possibly not file I/O related +/// Ignoring sys_enter_sched_setaffinity sys_exit_sched_setaffinity as possibly not file I/O related +/// Ignoring sys_enter_sched_setparam sys_exit_sched_setparam as possibly not file I/O related +/// Ignoring sys_enter_keyctl sys_exit_keyctl as possibly not file I/O related +/// Ignoring sys_enter_getitimer sys_exit_getitimer as possibly not file I/O related +/// Ignoring sys_enter_pkey_alloc sys_exit_pkey_alloc as possibly not file I/O related +/// Ignoring sys_enter_sendmsg sys_exit_sendmsg as possibly not file I/O related +/// Ignoring sys_enter_restart_syscall sys_exit_restart_syscall as possibly not file I/O related +/// Ignoring sys_enter_clone sys_exit_clone as possibly not file I/O related +/// Ignoring sys_enter_clone3 sys_exit_clone3 as possibly not file I/O related /// Ignoring sys_enter_setns sys_exit_setns as possibly not file I/O related -/// Ignoring sys_enter_getuid sys_exit_getuid as possibly not file I/O related -/// Ignoring sys_enter_getrlimit sys_exit_getrlimit as possibly not file I/O related +/// Ignoring sys_enter_shmctl sys_exit_shmctl as possibly not file I/O related +/// Ignoring sys_enter_getrusage sys_exit_getrusage as possibly not file I/O related +/// Ignoring sys_enter_bind sys_exit_bind as possibly not file I/O related +/// Ignoring sys_enter_msgget sys_exit_msgget as possibly not file I/O related +/// Ignoring sys_enter_landlock_restrict_self sys_exit_landlock_restrict_self as possibly not file I/O related +/// Ignoring sys_enter_execveat sys_exit_execveat as possibly not file I/O related +/// Ignoring sys_enter_time sys_exit_time as possibly not file I/O related +/// Ignoring sys_enter_getpeername sys_exit_getpeername as possibly not file I/O related +/// Ignoring sys_enter_clock_nanosleep sys_exit_clock_nanosleep as possibly not file I/O related +/// Ignoring sys_enter_quotactl sys_exit_quotactl as possibly not file I/O related +/// Ignoring sys_enter_pipe sys_exit_pipe as possibly not file I/O related +/// Ignoring sys_enter_mlockall sys_exit_mlockall as possibly not file I/O related +/// Ignoring sys_enter_epoll_ctl sys_exit_epoll_ctl as possibly not file I/O related +/// Ignoring sys_enter_modify_ldt sys_exit_modify_ldt as possibly not file I/O related +/// Ignoring sys_enter_tee sys_exit_tee as possibly not file I/O related +/// Ignoring sys_enter_rt_tgsigqueueinfo sys_exit_rt_tgsigqueueinfo as possibly not file I/O related +/// Ignoring sys_enter_exit sys_exit_exit as possibly not file I/O related +/// Ignoring sys_enter_vfork sys_exit_vfork as possibly not file I/O related +/// Ignoring sys_enter_munlockall sys_exit_munlockall as possibly not file I/O related +/// Ignoring sys_enter_unshare sys_exit_unshare as possibly not file I/O related +/// Ignoring sys_enter_clock_adjtime sys_exit_clock_adjtime as possibly not file I/O related +/// Ignoring sys_enter_brk sys_exit_brk as possibly not file I/O related +/// Ignoring sys_enter_init_module sys_exit_init_module as possibly not file I/O related +/// Ignoring sys_enter_pkey_free sys_exit_pkey_free as possibly not file I/O related +/// Ignoring sys_enter_epoll_create sys_exit_epoll_create as possibly not file I/O related +/// Ignoring sys_enter_getresgid sys_exit_getresgid as possibly not file I/O related +/// Ignoring sys_enter_getrandom sys_exit_getrandom as possibly not file I/O related +/// Ignoring sys_enter_settimeofday sys_exit_settimeofday as possibly not file I/O related +/// Ignoring sys_enter_mlock2 sys_exit_mlock2 as possibly not file I/O related /// Ignoring sys_enter_sched_getscheduler sys_exit_sched_getscheduler as possibly not file I/O related -/// Ignoring sys_enter_sched_yield sys_exit_sched_yield as possibly not file I/O related +/// Ignoring sys_enter_ptrace sys_exit_ptrace as possibly not file I/O related +/// Ignoring sys_enter_accept sys_exit_accept as possibly not file I/O related +/// Ignoring sys_enter_lsm_set_self_attr sys_exit_lsm_set_self_attr as possibly not file I/O related /// Ignoring sys_enter_semget sys_exit_semget as possibly not file I/O related -/// Ignoring sys_enter_epoll_create1 sys_exit_epoll_create1 as possibly not file I/O related -/// Ignoring sys_enter_tkill sys_exit_tkill as possibly not file I/O related -/// Ignoring sys_enter_process_madvise sys_exit_process_madvise as possibly not file I/O related -/// Ignoring sys_enter_setfsgid sys_exit_setfsgid as possibly not file I/O related -/// Ignoring sys_enter_rt_sigqueueinfo sys_exit_rt_sigqueueinfo as possibly not file I/O related -/// Ignoring sys_enter_modify_ldt sys_exit_modify_ldt as possibly not file I/O related +/// Ignoring sys_enter_setpgid sys_exit_setpgid as possibly not file I/O related /// Ignoring sys_enter_move_mount sys_exit_move_mount as possibly not file I/O related -/// Ignoring sys_enter_setgid sys_exit_setgid as possibly not file I/O related -/// Ignoring sys_enter_setuid sys_exit_setuid as possibly not file I/O related -/// Ignoring sys_enter_getitimer sys_exit_getitimer as possibly not file I/O related -/// Ignoring sys_enter_brk sys_exit_brk as possibly not file I/O related +/// Ignoring sys_enter_accept4 sys_exit_accept4 as possibly not file I/O related +/// Ignoring sys_enter_semtimedop sys_exit_semtimedop as possibly not file I/O related +/// Ignoring sys_enter_setdomainname sys_exit_setdomainname as possibly not file I/O related +/// Ignoring sys_enter_getgroups sys_exit_getgroups as possibly not file I/O related +/// Ignoring sys_enter_getpgrp sys_exit_getpgrp as possibly not file I/O related +/// Ignoring sys_enter_tgkill sys_exit_tgkill as possibly not file I/O related +/// Ignoring sys_enter_sched_getparam sys_exit_sched_getparam as possibly not file I/O related +/// Ignoring sys_enter_socketpair sys_exit_socketpair as possibly not file I/O related +/// Ignoring sys_enter_setsid sys_exit_setsid as possibly not file I/O related +/// Ignoring sys_enter_setfsgid sys_exit_setfsgid as possibly not file I/O related +/// Ignoring sys_enter_sched_setattr sys_exit_sched_setattr as possibly not file I/O related +/// Ignoring sys_enter_getgid sys_exit_getgid as possibly not file I/O related /// Ignoring sys_enter_futex_requeue sys_exit_futex_requeue as possibly not file I/O related -/// Ignoring sys_enter_getsockopt sys_exit_getsockopt as possibly not file I/O related -/// Ignoring sys_enter_getcwd sys_exit_getcwd as possibly not file I/O related -/// Ignoring sys_enter_pipe sys_exit_pipe as possibly not file I/O related -/// Ignoring sys_enter_swapoff sys_exit_swapoff as possibly not file I/O related -/// Ignoring sys_enter_wait4 sys_exit_wait4 as possibly not file I/O related -/// Ignoring sys_enter_ptrace sys_exit_ptrace as possibly not file I/O related -/// Ignoring sys_enter_process_vm_readv sys_exit_process_vm_readv as possibly not file I/O related -/// Ignoring sys_enter_membarrier sys_exit_membarrier as possibly not file I/O related +/// Ignoring sys_enter_add_key sys_exit_add_key as possibly not file I/O related +/// Ignoring sys_enter_memfd_secret sys_exit_memfd_secret as possibly not file I/O related /// Ignoring sys_enter_shmdt sys_exit_shmdt as possibly not file I/O related -/// Ignoring sys_enter_fork sys_exit_fork as possibly not file I/O related -/// Ignoring sys_enter_mlockall sys_exit_mlockall as possibly not file I/O related -/// Ignoring sys_enter_timerfd_gettime sys_exit_timerfd_gettime as possibly not file I/O related -/// Ignoring sys_enter_timer_getoverrun sys_exit_timer_getoverrun as possibly not file I/O related -/// Ignoring sys_enter_sched_setscheduler sys_exit_sched_setscheduler as possibly not file I/O related -/// Ignoring sys_enter_perf_event_open sys_exit_perf_event_open as possibly not file I/O related -/// Ignoring sys_enter_getppid sys_exit_getppid as possibly not file I/O related -/// Ignoring sys_enter_getsockname sys_exit_getsockname as possibly not file I/O related -/// Ignoring sys_enter_lsm_set_self_attr sys_exit_lsm_set_self_attr as possibly not file I/O related -/// Ignoring sys_enter_futex_waitv sys_exit_futex_waitv as possibly not file I/O related -/// Ignoring sys_enter_sigaltstack sys_exit_sigaltstack as possibly not file I/O related -/// Ignoring sys_enter_sethostname sys_exit_sethostname as possibly not file I/O related -/// Ignoring sys_enter_select sys_exit_select as possibly not file I/O related -/// Ignoring sys_enter_sched_getaffinity sys_exit_sched_getaffinity as possibly not file I/O related -/// Ignoring sys_enter_clock_nanosleep sys_exit_clock_nanosleep as possibly not file I/O related -/// Ignoring sys_enter_mq_getsetattr sys_exit_mq_getsetattr as possibly not file I/O related -/// Ignoring sys_enter_sched_setparam sys_exit_sched_setparam as possibly not file I/O related -/// Ignoring sys_enter_copy_file_range sys_exit_copy_file_range as possibly not file I/O related -/// Ignoring sys_enter_uretprobe sys_exit_uretprobe as possibly not file I/O related +/// Ignoring sys_enter_epoll_wait sys_exit_epoll_wait as possibly not file I/O related +/// Ignoring sys_enter_move_pages sys_exit_move_pages as possibly not file I/O related /// Ignoring sys_enter_timerfd_create sys_exit_timerfd_create as possibly not file I/O related -/// Ignoring sys_enter_process_vm_writev sys_exit_process_vm_writev as possibly not file I/O related -/// Ignoring sys_enter_umask sys_exit_umask as possibly not file I/O related -/// Ignoring sys_enter_lsm_list_modules sys_exit_lsm_list_modules as possibly not file I/O related -/// Ignoring sys_enter_munlock sys_exit_munlock as possibly not file I/O related -/// Ignoring sys_enter_getpid sys_exit_getpid as possibly not file I/O related -/// Ignoring sys_enter_rt_sigpending sys_exit_rt_sigpending as possibly not file I/O related -/// Ignoring sys_enter_eventfd sys_exit_eventfd as possibly not file I/O related -/// Ignoring sys_enter_inotify_init1 sys_exit_inotify_init1 as possibly not file I/O related -/// Ignoring sys_enter_ioprio_get sys_exit_ioprio_get as possibly not file I/O related -/// Ignoring sys_enter_munlockall sys_exit_munlockall as possibly not file I/O related -/// Ignoring sys_enter_request_key sys_exit_request_key as possibly not file I/O related -/// Ignoring sys_enter_madvise sys_exit_madvise as possibly not file I/O related -/// Ignoring sys_enter_mq_timedsend sys_exit_mq_timedsend as possibly not file I/O related -/// Ignoring sys_enter_splice sys_exit_splice as possibly not file I/O related +/// Ignoring sys_enter_kill sys_exit_kill as possibly not file I/O related +/// Ignoring sys_enter_getsid sys_exit_getsid as possibly not file I/O related /// Ignoring sys_enter_open_by_handle_at sys_exit_open_by_handle_at as possibly not file I/O related +/// Ignoring sys_enter_fsmount sys_exit_fsmount as possibly not file I/O related +/// Ignoring sys_enter_mq_notify sys_exit_mq_notify as possibly not file I/O related +/// Ignoring sys_enter_execve sys_exit_execve as possibly not file I/O related +/// Ignoring sys_enter_recvmmsg sys_exit_recvmmsg as possibly not file I/O related +/// Ignoring sys_enter_getresuid sys_exit_getresuid as possibly not file I/O related +/// Ignoring sys_enter_sysinfo sys_exit_sysinfo as possibly not file I/O related +/// Ignoring sys_enter_delete_module sys_exit_delete_module as possibly not file I/O related +/// Ignoring sys_enter_copy_file_range sys_exit_copy_file_range as possibly not file I/O related +/// Ignoring sys_enter_vhangup sys_exit_vhangup as possibly not file I/O related +/// Ignoring sys_enter_setgroups sys_exit_setgroups as possibly not file I/O related +/// Ignoring sys_enter_pause sys_exit_pause as possibly not file I/O related +/// Ignoring sys_enter_mincore sys_exit_mincore as possibly not file I/O related +/// Ignoring sys_enter_umask sys_exit_umask as possibly not file I/O related +/// Ignoring sys_enter_personality sys_exit_personality as possibly not file I/O related +/// Ignoring sys_enter_futex_wait sys_exit_futex_wait as possibly not file I/O related /// Ignoring sys_enter_kexec_load sys_exit_kexec_load as possibly not file I/O related -/// Ignoring sys_enter_mseal sys_exit_mseal as possibly not file I/O related -/// Ignoring sys_enter_lsm_get_self_attr sys_exit_lsm_get_self_attr as possibly not file I/O related -/// Ignoring sys_enter_seccomp sys_exit_seccomp as possibly not file I/O related -/// Ignoring sys_enter_nanosleep sys_exit_nanosleep as possibly not file I/O related -/// Ignoring sys_enter_eventfd2 sys_exit_eventfd2 as possibly not file I/O related -/// Ignoring sys_enter_inotify_add_watch sys_exit_inotify_add_watch as possibly not file I/O related +/// Ignoring sys_enter_epoll_create1 sys_exit_epoll_create1 as possibly not file I/O related +/// Ignoring sys_enter_getegid sys_exit_getegid as possibly not file I/O related /// Ignoring sys_enter_clock_getres sys_exit_clock_getres as possibly not file I/O related -/// Ignoring sys_enter_tgkill sys_exit_tgkill as possibly not file I/O related -/// Ignoring sys_enter_socketpair sys_exit_socketpair as possibly not file I/O related -/// Ignoring sys_enter_vfork sys_exit_vfork as possibly not file I/O related -/// Ignoring sys_enter_setpgid sys_exit_setpgid as possibly not file I/O related -/// Ignoring sys_enter_ioprio_set sys_exit_ioprio_set as possibly not file I/O related -/// Ignoring sys_enter_tee sys_exit_tee as possibly not file I/O related +/// Ignoring sys_enter_nanosleep sys_exit_nanosleep as possibly not file I/O related +/// Ignoring sys_enter_semop sys_exit_semop as possibly not file I/O related +/// Ignoring sys_enter_rt_sigreturn sys_exit_rt_sigreturn as possibly not file I/O related +/// Ignoring sys_enter_rseq sys_exit_rseq as possibly not file I/O related +/// Ignoring sys_enter_set_tid_address sys_exit_set_tid_address as possibly not file I/O related +/// Ignoring sys_enter_prctl sys_exit_prctl as possibly not file I/O related +/// Ignoring sys_enter_ioprio_get sys_exit_ioprio_get as possibly not file I/O related /// Ignoring sys_enter_getpriority sys_exit_getpriority as possibly not file I/O related -/// Ignoring sys_enter_mq_unlink sys_exit_mq_unlink as possibly not file I/O related -/// Ignoring sys_enter_inotify_rm_watch sys_exit_inotify_rm_watch as possibly not file I/O related +/// Ignoring sys_enter_getpgid sys_exit_getpgid as possibly not file I/O related +/// Ignoring sys_enter_semctl sys_exit_semctl as possibly not file I/O related +/// Ignoring sys_enter_futex_wake sys_exit_futex_wake as possibly not file I/O related +/// Ignoring sys_enter_setitimer sys_exit_setitimer as possibly not file I/O related +/// Ignoring sys_enter_munlock sys_exit_munlock as possibly not file I/O related +/// Ignoring sys_enter_lsm_list_modules sys_exit_lsm_list_modules as possibly not file I/O related /// Ignoring sys_enter_setreuid sys_exit_setreuid as possibly not file I/O related -/// Ignoring sys_enter_kexec_file_load sys_exit_kexec_file_load as possibly not file I/O related -/// Ignoring sys_enter_shmget sys_exit_shmget as possibly not file I/O related -/// Ignoring sys_enter_rt_tgsigqueueinfo sys_exit_rt_tgsigqueueinfo as possibly not file I/O related -/// Ignoring sys_enter_memfd_secret sys_exit_memfd_secret as possibly not file I/O related -/// Ignoring sys_enter_process_mrelease sys_exit_process_mrelease as possibly not file I/O related -/// Ignoring sys_enter_iopl sys_exit_iopl as possibly not file I/O related -/// Ignoring sys_enter_recvfrom sys_exit_recvfrom as possibly not file I/O related -/// Ignoring sys_enter_keyctl sys_exit_keyctl as possibly not file I/O related -/// Ignoring sys_enter_setsockopt sys_exit_setsockopt as possibly not file I/O related -/// Ignoring sys_enter_exit sys_exit_exit as possibly not file I/O related -/// Ignoring sys_enter_msync sys_exit_msync as possibly not file I/O related -/// Ignoring sys_enter_mprotect sys_exit_mprotect as possibly not file I/O related -/// Ignoring sys_enter_sendto sys_exit_sendto as possibly not file I/O related -/// Ignoring sys_enter_rt_sigprocmask sys_exit_rt_sigprocmask as possibly not file I/O related +/// Ignoring sys_enter_sched_setscheduler sys_exit_sched_setscheduler as possibly not file I/O related +/// Ignoring sys_enter_acct sys_exit_acct as possibly not file I/O related +/// Ignoring sys_enter_inotify_init1 sys_exit_inotify_init1 as possibly not file I/O related +/// Ignoring sys_enter_mremap sys_exit_mremap as possibly not file I/O related +/// Ignoring sys_enter_ppoll sys_exit_ppoll as possibly not file I/O related /// Ignoring sys_enter_sendfile64 sys_exit_sendfile64 as possibly not file I/O related -/// Ignoring sys_enter_setdomainname sys_exit_setdomainname as possibly not file I/O related -/// Ignoring sys_enter_migrate_pages sys_exit_migrate_pages as possibly not file I/O related -/// Ignoring sys_enter_accept4 sys_exit_accept4 as possibly not file I/O related -/// Ignoring sys_enter_shutdown sys_exit_shutdown as possibly not file I/O related -/// Ignoring sys_enter_gettid sys_exit_gettid as possibly not file I/O related -/// Ignoring sys_enter_alarm sys_exit_alarm as possibly not file I/O related -/// Ignoring sys_enter_getresgid sys_exit_getresgid as possibly not file I/O related -/// Ignoring sys_enter_restart_syscall sys_exit_restart_syscall as possibly not file I/O related -/// Ignoring sys_enter_timer_gettime sys_exit_timer_gettime as possibly not file I/O related -/// Ignoring sys_enter_getpeername sys_exit_getpeername as possibly not file I/O related +/// Ignoring sys_enter_select sys_exit_select as possibly not file I/O related +/// Ignoring sys_enter_perf_event_open sys_exit_perf_event_open as possibly not file I/O related /// Ignoring sys_enter_mknodat sys_exit_mknodat as possibly not file I/O related +/// Ignoring sys_enter_membarrier sys_exit_membarrier as possibly not file I/O related +/// Ignoring sys_enter_mprotect sys_exit_mprotect as possibly not file I/O related /// Ignoring sys_enter_fsopen sys_exit_fsopen as possibly not file I/O related -/// Ignoring sys_enter_recvmsg sys_exit_recvmsg as possibly not file I/O related -/// Ignoring sys_enter_timer_settime sys_exit_timer_settime as possibly not file I/O related -/// Ignoring sys_enter_epoll_pwait2 sys_exit_epoll_pwait2 as possibly not file I/O related -/// Ignoring sys_enter_timer_create sys_exit_timer_create as possibly not file I/O related -/// Ignoring sys_enter_shmctl sys_exit_shmctl as possibly not file I/O related +/// Ignoring sys_enter_uretprobe sys_exit_uretprobe as possibly not file I/O related +/// Ignoring sys_enter_times sys_exit_times as possibly not file I/O related +/// Ignoring sys_enter_getpid sys_exit_getpid as possibly not file I/O related +/// Ignoring sys_enter_mq_timedsend sys_exit_mq_timedsend as possibly not file I/O related +/// Ignoring sys_enter_set_mempolicy sys_exit_set_mempolicy as possibly not file I/O related +/// Ignoring sys_enter_setresgid sys_exit_setresgid as possibly not file I/O related +/// Ignoring sys_enter_getsockname sys_exit_getsockname as possibly not file I/O related +/// Ignoring sys_enter_reboot sys_exit_reboot as possibly not file I/O related +/// Ignoring sys_enter_wait4 sys_exit_wait4 as possibly not file I/O related +/// Ignoring sys_enter_sched_getaffinity sys_exit_sched_getaffinity as possibly not file I/O related +/// Ignoring sys_enter_setuid sys_exit_setuid as possibly not file I/O related +/// Ignoring sys_enter_msync sys_exit_msync as possibly not file I/O related +/// Ignoring sys_enter_kcmp sys_exit_kcmp as possibly not file I/O related +/// Ignoring sys_enter_rt_sigsuspend sys_exit_rt_sigsuspend as possibly not file I/O related +/// Ignoring sys_enter_timer_delete sys_exit_timer_delete as possibly not file I/O related +/// Ignoring sys_enter_mseal sys_exit_mseal as possibly not file I/O related /// Ignoring sys_enter_signalfd sys_exit_signalfd as possibly not file I/O related -/// Ignoring sys_enter_setsid sys_exit_setsid as possibly not file I/O related -/// Ignoring sys_enter_getgroups sys_exit_getgroups as possibly not file I/O related -/// Ignoring sys_enter_fanotify_init sys_exit_fanotify_init as possibly not file I/O related -/// Ignoring sys_enter_get_mempolicy sys_exit_get_mempolicy as possibly not file I/O related -/// Ignoring sys_enter_pkey_mprotect sys_exit_pkey_mprotect as possibly not file I/O related -/// Ignoring sys_enter_rt_sigaction sys_exit_rt_sigaction as possibly not file I/O related -/// Ignoring sys_enter_semctl sys_exit_semctl as possibly not file I/O related -/// Ignoring sys_enter_bpf sys_exit_bpf as possibly not file I/O related -/// Ignoring sys_enter_msgrcv sys_exit_msgrcv as possibly not file I/O related -/// Ignoring sys_enter_clock_adjtime sys_exit_clock_adjtime as possibly not file I/O related -/// Ignoring sys_enter_getrandom sys_exit_getrandom as possibly not file I/O related -/// Ignoring sys_enter_userfaultfd sys_exit_userfaultfd as possibly not file I/O related -/// Ignoring sys_enter_shmat sys_exit_shmat as possibly not file I/O related -/// Ignoring sys_enter_exit_group sys_exit_exit_group as possibly not file I/O related -/// Ignoring sys_enter_pkey_free sys_exit_pkey_free as possibly not file I/O related +/// Ignoring sys_enter_kexec_file_load sys_exit_kexec_file_load as possibly not file I/O related +/// Ignoring sys_enter_alarm sys_exit_alarm as possibly not file I/O related +/// Ignoring sys_enter_adjtimex sys_exit_adjtimex as possibly not file I/O related +/// Ignoring sys_enter_setsockopt sys_exit_setsockopt as possibly not file I/O related +/// Ignoring sys_enter_sched_getattr sys_exit_sched_getattr as possibly not file I/O related +/// Ignoring sys_enter_msgctl sys_exit_msgctl as possibly not file I/O related /// Ignoring sys_enter_setregid sys_exit_setregid as possibly not file I/O related +/// Ignoring sys_enter_set_mempolicy_home_node sys_exit_set_mempolicy_home_node as possibly not file I/O related +/// Ignoring sys_enter_inotify_init sys_exit_inotify_init as possibly not file I/O related +/// Ignoring sys_enter_shutdown sys_exit_shutdown as possibly not file I/O related +/// Ignoring sys_enter_sendto sys_exit_sendto as possibly not file I/O related +/// Ignoring sys_enter_getsockopt sys_exit_getsockopt as possibly not file I/O related +/// Ignoring sys_enter_name_to_handle_at sys_exit_name_to_handle_at as possibly not file I/O related +/// Ignoring sys_enter_pidfd_getfd sys_exit_pidfd_getfd as possibly not file I/O related +/// Ignoring sys_enter_ioprio_set sys_exit_ioprio_set as possibly not file I/O related +/// Ignoring sys_enter_sched_get_priority_max sys_exit_sched_get_priority_max as possibly not file I/O related +/// Ignoring sys_enter_swapoff sys_exit_swapoff as possibly not file I/O related +/// Ignoring sys_enter_setgid sys_exit_setgid as possibly not file I/O related +/// Ignoring sys_enter_process_vm_readv sys_exit_process_vm_readv as possibly not file I/O related /// Ignoring sys_enter_remap_file_pages sys_exit_remap_file_pages as possibly not file I/O related -/// Ignoring sys_enter_connect sys_exit_connect as possibly not file I/O related -/// Ignoring sys_enter_mbind sys_exit_mbind as possibly not file I/O related +/// Ignoring sys_enter_capset sys_exit_capset as possibly not file I/O related /// Ignoring sys_enter_munmap sys_exit_munmap as possibly not file I/O related -/// Ignoring sys_enter_setfsuid sys_exit_setfsuid as possibly not file I/O related -/// Ignoring sys_enter_epoll_create sys_exit_epoll_create as possibly not file I/O related -/// Ignoring sys_enter_sendmmsg sys_exit_sendmmsg as possibly not file I/O related -/// Ignoring sys_enter_mq_open sys_exit_mq_open as possibly not file I/O related -/// Ignoring sys_enter_getpgid sys_exit_getpgid as possibly not file I/O related -/// Ignoring sys_enter_vhangup sys_exit_vhangup as possibly not file I/O related -/// Ignoring sys_enter_sysinfo sys_exit_sysinfo as possibly not file I/O related -/// Ignoring sys_enter_set_mempolicy sys_exit_set_mempolicy as possibly not file I/O related -/// Ignoring sys_enter_epoll_wait sys_exit_epoll_wait as possibly not file I/O related -/// Ignoring sys_enter_getrusage sys_exit_getrusage as possibly not file I/O related -/// Ignoring sys_enter_execveat sys_exit_execveat as possibly not file I/O related -/// Ignoring sys_enter_name_to_handle_at sys_exit_name_to_handle_at as possibly not file I/O related -/// Ignoring sys_enter_msgget sys_exit_msgget as possibly not file I/O related -/// Ignoring sys_enter_accept sys_exit_accept as possibly not file I/O related -/// Ignoring sys_enter_mknod sys_exit_mknod as possibly not file I/O related -/// Ignoring sys_enter_timerfd_settime sys_exit_timerfd_settime as possibly not file I/O related +/// Ignoring sys_enter_process_vm_writev sys_exit_process_vm_writev as possibly not file I/O related +/// Ignoring sys_enter_get_mempolicy sys_exit_get_mempolicy as possibly not file I/O related /// Ignoring sys_enter_landlock_create_ruleset sys_exit_landlock_create_ruleset as possibly not file I/O related -/// Ignoring sys_enter_pselect6 sys_exit_pselect6 as possibly not file I/O related -/// Ignoring sys_enter_statmount sys_exit_statmount as possibly not file I/O related -/// Ignoring sys_enter_utime sys_exit_utime as possibly not file I/O related -/// Ignoring sys_enter_listmount sys_exit_listmount as possibly not file I/O related -/// Ignoring sys_enter_kill sys_exit_kill as possibly not file I/O related -/// Ignoring sys_enter_fsmount sys_exit_fsmount as possibly not file I/O related -/// Ignoring sys_enter_mincore sys_exit_mincore as possibly not file I/O related -/// Ignoring sys_enter_prlimit64 sys_exit_prlimit64 as possibly not file I/O related -/// Ignoring sys_enter_unshare sys_exit_unshare as possibly not file I/O related -/// Ignoring sys_enter_pipe2 sys_exit_pipe2 as possibly not file I/O related /// Ignoring sys_enter_setpriority sys_exit_setpriority as possibly not file I/O related -/// Ignoring sys_enter_add_key sys_exit_add_key as possibly not file I/O related -/// Ignoring sys_enter_memfd_create sys_exit_memfd_create as possibly not file I/O related -/// Ignoring sys_enter_mlock2 sys_exit_mlock2 as possibly not file I/O related +/// Ignoring sys_enter_seccomp sys_exit_seccomp as possibly not file I/O related +/// Ignoring sys_enter_eventfd sys_exit_eventfd as possibly not file I/O related +/// Ignoring sys_enter_process_madvise sys_exit_process_madvise as possibly not file I/O related +/// Ignoring sys_enter_map_shadow_stack sys_exit_map_shadow_stack as possibly not file I/O related /// Ignoring sys_enter_mq_timedreceive sys_exit_mq_timedreceive as possibly not file I/O related -/// Ignoring sys_enter_getegid sys_exit_getegid as possibly not file I/O related -/// Ignoring sys_enter_time sys_exit_time as possibly not file I/O related -/// Ignoring sys_enter_signalfd4 sys_exit_signalfd4 as possibly not file I/O related -/// Ignoring sys_enter_sendmsg sys_exit_sendmsg as possibly not file I/O related -/// Ignoring sys_enter_setresuid sys_exit_setresuid as possibly not file I/O related -/// Ignoring sys_enter_mount sys_exit_mount as possibly not file I/O related -/// Ignoring sys_enter_landlock_restrict_self sys_exit_landlock_restrict_self as possibly not file I/O related -/// Ignoring sys_enter_epoll_ctl sys_exit_epoll_ctl as possibly not file I/O related -/// Ignoring sys_enter_personality sys_exit_personality as possibly not file I/O related -/// Ignoring sys_enter_futex sys_exit_futex as possibly not file I/O related -/// Ignoring sys_enter_bind sys_exit_bind as possibly not file I/O related -/// Ignoring sys_enter_setresgid sys_exit_setresgid as possibly not file I/O related -/// Ignoring sys_enter_arch_prctl sys_exit_arch_prctl as possibly not file I/O related -/// Ignoring sys_enter_reboot sys_exit_reboot as possibly not file I/O related -/// Ignoring sys_enter_epoll_pwait sys_exit_epoll_pwait as possibly not file I/O related -/// Ignoring sys_enter_msgctl sys_exit_msgctl as possibly not file I/O related -/// Ignoring sys_enter_pidfd_send_signal sys_exit_pidfd_send_signal as possibly not file I/O related -/// Ignoring sys_enter_semop sys_exit_semop as possibly not file I/O related -/// Ignoring sys_enter_mq_notify sys_exit_mq_notify as possibly not file I/O related -/// Ignoring sys_enter_clock_gettime sys_exit_clock_gettime as possibly not file I/O related -/// Ignoring sys_enter_waitid sys_exit_waitid as possibly not file I/O related -/// Ignoring sys_enter_newuname sys_exit_newuname as possibly not file I/O related -/// Ignoring sys_enter_pivot_root sys_exit_pivot_root as possibly not file I/O related -/// Ignoring sys_enter_init_module sys_exit_init_module as possibly not file I/O related -/// Ignoring sys_enter_sched_getparam sys_exit_sched_getparam as possibly not file I/O related -/// Ignoring sys_enter_sched_get_priority_max sys_exit_sched_get_priority_max as possibly not file I/O related -/// Ignoring sys_enter_mlock sys_exit_mlock as possibly not file I/O related -/// Ignoring sys_enter_mremap sys_exit_mremap as possibly not file I/O related -/// Ignoring sys_enter_utimes sys_exit_utimes as possibly not file I/O related -/// Ignoring sys_enter_clone3 sys_exit_clone3 as possibly not file I/O related -/// Ignoring sys_enter_rt_sigreturn sys_exit_rt_sigreturn as possibly not file I/O related -/// Ignoring sys_enter_sched_get_priority_min sys_exit_sched_get_priority_min as possibly not file I/O related -/// Ignoring sys_enter_ppoll sys_exit_ppoll as possibly not file I/O related -/// Ignoring sys_enter_rt_sigtimedwait sys_exit_rt_sigtimedwait as possibly not file I/O related -/// Ignoring sys_enter_prctl sys_exit_prctl as possibly not file I/O related -/// Ignoring sys_enter_delete_module sys_exit_delete_module as possibly not file I/O related - -#define SYS_ENTER_IO_URING_REGISTER 1513 -#define SYS_EXIT_IO_URING_REGISTER 1512 -#define SYS_ENTER_IO_URING_ENTER 1494 -#define SYS_EXIT_IO_URING_ENTER 1493 -#define SYS_ENTER_IO_URING_SETUP 1492 -#define SYS_EXIT_IO_URING_SETUP 1491 -#define SYS_ENTER_QUOTACTL_FD 1151 -#define SYS_EXIT_QUOTACTL_FD 1150 -#define SYS_ENTER_FLOCK 1120 -#define SYS_EXIT_FLOCK 1119 -#define SYS_ENTER_IO_SETUP 1104 -#define SYS_EXIT_IO_SETUP 1103 -#define SYS_ENTER_IO_DESTROY 1102 -#define SYS_EXIT_IO_DESTROY 1101 -#define SYS_ENTER_IO_SUBMIT 1100 -#define SYS_EXIT_IO_SUBMIT 1099 -#define SYS_ENTER_IO_CANCEL 1098 -#define SYS_EXIT_IO_CANCEL 1097 -#define SYS_ENTER_IO_GETEVENTS 1096 -#define SYS_EXIT_IO_GETEVENTS 1095 -#define SYS_ENTER_IO_PGETEVENTS 1094 -#define SYS_EXIT_IO_PGETEVENTS 1093 -#define SYS_ENTER_FANOTIFY_MARK 1062 -#define SYS_EXIT_FANOTIFY_MARK 1061 -#define SYS_ENTER_FSPICK 1050 -#define SYS_EXIT_FSPICK 1049 -#define SYS_ENTER_FSCONFIG 1048 -#define SYS_EXIT_FSCONFIG 1047 -#define SYS_ENTER_STATFS 1046 -#define SYS_EXIT_STATFS 1045 -#define SYS_ENTER_FSTATFS 1044 -#define SYS_EXIT_FSTATFS 1043 -#define SYS_ENTER_UTIMENSAT 1038 -#define SYS_EXIT_UTIMENSAT 1037 -#define SYS_ENTER_FUTIMESAT 1036 -#define SYS_EXIT_FUTIMESAT 1035 -#define SYS_ENTER_SYNC 1030 -#define SYS_EXIT_SYNC 1029 -#define SYS_ENTER_SYNCFS 1028 -#define SYS_EXIT_SYNCFS 1027 -#define SYS_ENTER_FSYNC 1026 -#define SYS_EXIT_FSYNC 1025 -#define SYS_ENTER_FDATASYNC 1024 -#define SYS_EXIT_FDATASYNC 1023 -#define SYS_ENTER_SYNC_FILE_RANGE 1022 -#define SYS_EXIT_SYNC_FILE_RANGE 1021 -#define SYS_ENTER_VMSPLICE 1020 -#define SYS_EXIT_VMSPLICE 1019 -#define SYS_ENTER_SETXATTRAT 982 -#define SYS_EXIT_SETXATTRAT 981 -#define SYS_ENTER_SETXATTR 980 -#define SYS_EXIT_SETXATTR 979 -#define SYS_ENTER_LSETXATTR 978 -#define SYS_EXIT_LSETXATTR 977 -#define SYS_ENTER_FSETXATTR 976 -#define SYS_EXIT_FSETXATTR 975 -#define SYS_ENTER_GETXATTRAT 974 -#define SYS_EXIT_GETXATTRAT 973 -#define SYS_ENTER_GETXATTR 972 -#define SYS_EXIT_GETXATTR 971 -#define SYS_ENTER_LGETXATTR 970 -#define SYS_EXIT_LGETXATTR 969 -#define SYS_ENTER_FGETXATTR 968 -#define SYS_EXIT_FGETXATTR 967 -#define SYS_ENTER_LISTXATTRAT 966 -#define SYS_EXIT_LISTXATTRAT 965 -#define SYS_ENTER_LISTXATTR 964 -#define SYS_EXIT_LISTXATTR 963 -#define SYS_ENTER_LLISTXATTR 962 -#define SYS_EXIT_LLISTXATTR 961 -#define SYS_ENTER_FLISTXATTR 960 -#define SYS_EXIT_FLISTXATTR 959 -#define SYS_ENTER_REMOVEXATTRAT 958 -#define SYS_EXIT_REMOVEXATTRAT 957 -#define SYS_ENTER_REMOVEXATTR 956 -#define SYS_EXIT_REMOVEXATTR 955 -#define SYS_ENTER_LREMOVEXATTR 954 -#define SYS_EXIT_LREMOVEXATTR 953 -#define SYS_ENTER_FREMOVEXATTR 952 -#define SYS_EXIT_FREMOVEXATTR 951 -#define SYS_ENTER_OPEN_TREE 948 -#define SYS_EXIT_OPEN_TREE 947 -#define SYS_ENTER_MOUNT_SETATTR 938 -#define SYS_EXIT_MOUNT_SETATTR 937 -#define SYS_ENTER_CLOSE_RANGE 930 -#define SYS_EXIT_CLOSE_RANGE 929 -#define SYS_ENTER_DUP3 928 -#define SYS_EXIT_DUP3 927 -#define SYS_ENTER_DUP2 926 -#define SYS_EXIT_DUP2 925 -#define SYS_ENTER_DUP 924 -#define SYS_EXIT_DUP 923 -#define SYS_ENTER_GETDENTS 910 -#define SYS_EXIT_GETDENTS 909 -#define SYS_ENTER_GETDENTS64 908 -#define SYS_EXIT_GETDENTS64 907 -#define SYS_ENTER_IOCTL 906 -#define SYS_EXIT_IOCTL 905 -#define SYS_ENTER_FCNTL 904 -#define SYS_EXIT_FCNTL 903 -#define SYS_ENTER_MKDIRAT 898 -#define SYS_EXIT_MKDIRAT 897 -#define SYS_ENTER_MKDIR 896 -#define SYS_EXIT_MKDIR 895 -#define SYS_ENTER_RMDIR 894 -#define SYS_EXIT_RMDIR 893 -#define SYS_ENTER_UNLINKAT 892 -#define SYS_EXIT_UNLINKAT 891 -#define SYS_ENTER_UNLINK 890 -#define SYS_EXIT_UNLINK 889 -#define SYS_ENTER_SYMLINKAT 888 -#define SYS_EXIT_SYMLINKAT 887 -#define SYS_ENTER_SYMLINK 886 -#define SYS_EXIT_SYMLINK 885 -#define SYS_ENTER_LINKAT 884 -#define SYS_EXIT_LINKAT 883 -#define SYS_ENTER_LINK 882 -#define SYS_EXIT_LINK 881 -#define SYS_ENTER_RENAMEAT2 880 -#define SYS_EXIT_RENAMEAT2 879 -#define SYS_ENTER_RENAMEAT 878 -#define SYS_EXIT_RENAMEAT 877 -#define SYS_ENTER_RENAME 876 -#define SYS_EXIT_RENAME 875 -#define SYS_ENTER_NEWSTAT 866 -#define SYS_EXIT_NEWSTAT 865 -#define SYS_ENTER_NEWLSTAT 864 -#define SYS_EXIT_NEWLSTAT 863 -#define SYS_ENTER_NEWFSTATAT 862 -#define SYS_EXIT_NEWFSTATAT 861 -#define SYS_ENTER_NEWFSTAT 860 -#define SYS_EXIT_NEWFSTAT 859 -#define SYS_ENTER_READLINKAT 858 -#define SYS_EXIT_READLINKAT 857 -#define SYS_ENTER_READLINK 856 -#define SYS_EXIT_READLINK 855 -#define SYS_ENTER_STATX 854 -#define SYS_EXIT_STATX 853 -#define SYS_ENTER_LSEEK 852 -#define SYS_EXIT_LSEEK 851 -#define SYS_ENTER_READ 850 -#define SYS_EXIT_READ 849 -#define SYS_ENTER_WRITE 848 -#define SYS_EXIT_WRITE 847 -#define SYS_ENTER_PREAD64 846 -#define SYS_EXIT_PREAD64 845 -#define SYS_ENTER_PWRITE64 844 -#define SYS_EXIT_PWRITE64 843 -#define SYS_ENTER_READV 842 -#define SYS_EXIT_READV 841 -#define SYS_ENTER_WRITEV 840 -#define SYS_EXIT_WRITEV 839 -#define SYS_ENTER_PREADV 838 -#define SYS_EXIT_PREADV 837 -#define SYS_ENTER_PREADV2 836 -#define SYS_EXIT_PREADV2 835 -#define SYS_ENTER_PWRITEV 834 -#define SYS_EXIT_PWRITEV 833 -#define SYS_ENTER_PWRITEV2 832 -#define SYS_EXIT_PWRITEV2 831 -#define SYS_ENTER_TRUNCATE 826 -#define SYS_EXIT_TRUNCATE 825 -#define SYS_ENTER_FTRUNCATE 824 -#define SYS_EXIT_FTRUNCATE 823 -#define SYS_ENTER_FALLOCATE 822 -#define SYS_EXIT_FALLOCATE 821 -#define SYS_ENTER_FACCESSAT 820 -#define SYS_EXIT_FACCESSAT 819 -#define SYS_ENTER_FACCESSAT2 818 -#define SYS_EXIT_FACCESSAT2 817 -#define SYS_ENTER_ACCESS 816 -#define SYS_EXIT_ACCESS 815 -#define SYS_ENTER_CHDIR 814 -#define SYS_EXIT_CHDIR 813 -#define SYS_ENTER_FCHDIR 812 -#define SYS_EXIT_FCHDIR 811 -#define SYS_ENTER_CHROOT 810 -#define SYS_EXIT_CHROOT 809 -#define SYS_ENTER_FCHMOD 808 -#define SYS_EXIT_FCHMOD 807 -#define SYS_ENTER_FCHMODAT2 806 -#define SYS_EXIT_FCHMODAT2 805 -#define SYS_ENTER_FCHMODAT 804 -#define SYS_EXIT_FCHMODAT 803 -#define SYS_ENTER_CHMOD 802 -#define SYS_EXIT_CHMOD 801 -#define SYS_ENTER_FCHOWNAT 800 -#define SYS_EXIT_FCHOWNAT 799 -#define SYS_ENTER_CHOWN 798 -#define SYS_EXIT_CHOWN 797 -#define SYS_ENTER_LCHOWN 796 -#define SYS_EXIT_LCHOWN 795 -#define SYS_ENTER_FCHOWN 794 -#define SYS_EXIT_FCHOWN 793 -#define SYS_ENTER_OPEN 792 -#define SYS_EXIT_OPEN 791 -#define SYS_ENTER_OPENAT 790 -#define SYS_EXIT_OPENAT 789 -#define SYS_ENTER_OPENAT2 788 -#define SYS_EXIT_OPENAT2 787 -#define SYS_ENTER_CREAT 786 -#define SYS_EXIT_CREAT 785 -#define SYS_ENTER_CLOSE 784 -#define SYS_EXIT_CLOSE 783 -#define SYS_ENTER_READAHEAD 620 -#define SYS_EXIT_READAHEAD 619 -#define SYS_ENTER_FADVISE64 618 -#define SYS_EXIT_FADVISE64 617 -#define SYS_ENTER_CACHESTAT 599 -#define SYS_EXIT_CACHESTAT 598 -#define SYS_ENTER_FINIT_MODULE 409 -#define SYS_EXIT_FINIT_MODULE 408 -#define SYS_ENTER_SYSLOG 349 -#define SYS_EXIT_SYSLOG 348 -#define SYS_ENTER_MMAP 102 -#define SYS_EXIT_MMAP 101 - -/// sys_enter_io_uring_register is a struct null_event -SEC("tracepoint/syscalls/sys_enter_io_uring_register") -int handle_sys_enter_io_uring_register(struct trace_event_raw_sys_enter *ctx) { - __u32 pid, tid; - if (filter(&pid, &tid)) - return 0; - - struct null_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct null_event), 0); - if (!ev) - return 0; - - ev->event_type = ENTER_NULL_EVENT; - ev->trace_id = SYS_ENTER_IO_URING_REGISTER; - ev->pid = pid; - ev->tid = tid; - ev->time = bpf_ktime_get_boot_ns(); - - bpf_ringbuf_submit(ev, 0); - return 0; -} - -/// sys_exit_io_uring_register is a struct ret_event -SEC("tracepoint/syscalls/sys_exit_io_uring_register") -int handle_sys_exit_io_uring_register(struct trace_event_raw_sys_exit *ctx) { - __u32 pid, tid; - if (filter(&pid, &tid)) - return 0; - - struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); - if (!ev) - return 0; - - ev->event_type = EXIT_RET_EVENT; - ev->trace_id = SYS_EXIT_IO_URING_REGISTER; - ev->pid = pid; - ev->tid = tid; - ev->time = bpf_ktime_get_boot_ns(); - ev->ret = ctx->ret; - - bpf_ringbuf_submit(ev, 0); - return 0; -} - -/// sys_enter_io_uring_enter is a struct null_event -SEC("tracepoint/syscalls/sys_enter_io_uring_enter") -int handle_sys_enter_io_uring_enter(struct trace_event_raw_sys_enter *ctx) { - __u32 pid, tid; - if (filter(&pid, &tid)) - return 0; - - struct null_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct null_event), 0); - if (!ev) - return 0; - - ev->event_type = ENTER_NULL_EVENT; - ev->trace_id = SYS_ENTER_IO_URING_ENTER; - ev->pid = pid; - ev->tid = tid; - ev->time = bpf_ktime_get_boot_ns(); - - bpf_ringbuf_submit(ev, 0); - return 0; -} - -/// sys_exit_io_uring_enter is a struct ret_event -SEC("tracepoint/syscalls/sys_exit_io_uring_enter") -int handle_sys_exit_io_uring_enter(struct trace_event_raw_sys_exit *ctx) { - __u32 pid, tid; - if (filter(&pid, &tid)) - return 0; - - struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); - if (!ev) - return 0; - - ev->event_type = EXIT_RET_EVENT; - ev->trace_id = SYS_EXIT_IO_URING_ENTER; - ev->pid = pid; - ev->tid = tid; - ev->time = bpf_ktime_get_boot_ns(); - ev->ret = ctx->ret; - - bpf_ringbuf_submit(ev, 0); - return 0; -} - -/// sys_enter_io_uring_setup is a struct null_event -SEC("tracepoint/syscalls/sys_enter_io_uring_setup") -int handle_sys_enter_io_uring_setup(struct trace_event_raw_sys_enter *ctx) { - __u32 pid, tid; - if (filter(&pid, &tid)) - return 0; - - struct null_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct null_event), 0); - if (!ev) - return 0; - - ev->event_type = ENTER_NULL_EVENT; - ev->trace_id = SYS_ENTER_IO_URING_SETUP; - ev->pid = pid; - ev->tid = tid; - ev->time = bpf_ktime_get_boot_ns(); - - bpf_ringbuf_submit(ev, 0); - return 0; -} - -/// sys_exit_io_uring_setup is a struct ret_event -SEC("tracepoint/syscalls/sys_exit_io_uring_setup") -int handle_sys_exit_io_uring_setup(struct trace_event_raw_sys_exit *ctx) { - __u32 pid, tid; - if (filter(&pid, &tid)) - return 0; - - struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); - if (!ev) - return 0; - - ev->event_type = EXIT_RET_EVENT; - ev->trace_id = SYS_EXIT_IO_URING_SETUP; - ev->pid = pid; - ev->tid = tid; - ev->time = bpf_ktime_get_boot_ns(); - ev->ret = ctx->ret; - - bpf_ringbuf_submit(ev, 0); - return 0; -} - -/// sys_enter_quotactl_fd is a struct fd_event -SEC("tracepoint/syscalls/sys_enter_quotactl_fd") -int handle_sys_enter_quotactl_fd(struct trace_event_raw_sys_enter *ctx) { - __u32 pid, tid; - if (filter(&pid, &tid)) - return 0; - - struct fd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct fd_event), 0); - if (!ev) - return 0; - - ev->event_type =