From 8bd5f17ae2cd662b21fcd45a849c4b701a3aa40f Mon Sep 17 00:00:00 2001 From: Paul Buetow Date: Thu, 21 May 2026 11:45:09 +0300 Subject: g7 classify fd-from-air eventfd users --- internal/generate/bpfhandler.go | 10 ++++++++++ 1 file changed, 10 insertions(+) (limited to 'internal/generate/bpfhandler.go') diff --git a/internal/generate/bpfhandler.go b/internal/generate/bpfhandler.go index 85377f1..fb4a4e3 100644 --- a/internal/generate/bpfhandler.go +++ b/internal/generate/bpfhandler.go @@ -262,6 +262,16 @@ func generateExtraEventfd(f *Format, isEnter bool) string { if isEnter { flagsExpr := "0" switch f.Name { + case "sys_enter_epoll_create": + flagsExpr = "(__s32)ctx->args[0]" + case "sys_enter_epoll_create1": + flagsExpr = "(__s32)ctx->args[0]" + case "sys_enter_inotify_init1": + flagsExpr = "(__s32)ctx->args[0]" + case "sys_enter_fanotify_init": + flagsExpr = "(__s32)ctx->args[0]" + case "sys_enter_landlock_create_ruleset": + flagsExpr = "(__s32)ctx->args[2]" case "sys_enter_eventfd2": flagsExpr = "(__s32)ctx->args[1]" case "sys_enter_memfd_create": -- cgit v1.2.3