From 3cd431e7aac28fa7bacc37a7e751a9082287251d Mon Sep 17 00:00:00 2001 From: Paul Buetow Date: Fri, 29 May 2026 22:56:49 +0300 Subject: test(mknod): lock in mknod/mknodat path-arg classification Audit of mknod(2) found the tracing implementation already correct: sys_enter_mknod captures the real pathname from args[0] (no dirfd), while the sibling sys_enter_mknodat captures it from args[1] (after dirfd). Both are FamilyFS path_events; both exits are ret_event UNCLASSIFIED (int 0/-1). No code or doc changes were needed. Add lock-in tests guarding this behavior against regressions: - TestGenerateMknodMknodatHandlers asserts the generated BPF C reads the path from args[0] for mknod and args[1] for mknodat. - FormatMknodat/FormatExitMknodat testdata mirroring the real tracepoint layout (dfd pushes filename to args[1]). - mknodat rows added to the classify kind (KindPathname) and family (FamilyFS) test tables, matching the existing mknod coverage. Co-Authored-By: Claude Opus 4.8 --- internal/generate/classify_test.go | 2 ++ 1 file changed, 2 insertions(+) (limited to 'internal/generate/classify_test.go') diff --git a/internal/generate/classify_test.go b/internal/generate/classify_test.go index 25c7068..5b233c2 100644 --- a/internal/generate/classify_test.go +++ b/internal/generate/classify_test.go @@ -1692,6 +1692,7 @@ func TestClassifySyscallPairAccepted(t *testing.T) { {"pread64", FormatPread64, FormatExitPread64, KindFd}, {"symlink", FormatSymlink, FormatExitSymlink, KindName}, {"mknod", FormatMknod, FormatExitMknod, KindPathname}, + {"mknodat", FormatMknodat, FormatExitMknodat, KindPathname}, {"execve", FormatExecve, FormatExitExecve, KindExec}, {"execveat", FormatExecveat, FormatExitExecveat, KindExec}, {"accept", FormatAccept, FormatExitAccept, KindAccept}, @@ -1806,6 +1807,7 @@ func TestClassifySyscallPairEmitsAllFamilies(t *testing.T) { family SyscallFamily }{ {"mknod", FormatMknod, FormatExitMknod, FamilyFS}, + {"mknodat", FormatMknodat, FormatExitMknodat, FamilyFS}, {"execve", FormatExecve, FormatExitExecve, FamilyProcess}, {"execveat", FormatExecveat, FormatExitExecveat, FamilyProcess}, {"accept", FormatAccept, FormatExitAccept, FamilyNetwork}, -- cgit v1.2.3