From e462a4d9963a2949f0670a00a013dd362b5219d1 Mon Sep 17 00:00:00 2001 From: Paul Buetow Date: Sat, 30 May 2026 17:12:25 +0300 Subject: kexec_load: classify into Security family with its sibling kexec_load(2) and kexec_file_load are documented together on the same man page and both load a new kernel for later execution by reboot(2). kexec_file_load was already FamilySecurity, but kexec_load fell through to FamilyMisc. Move kexec_load to FamilySecurity so the siblings share a family. Kind classification was already correct: kexec_load takes raw user pointers (KindNull, no fd/path) while kexec_file_load takes fds (KindFd); the return value (long 0/-1, no byte count) stays UNCLASSIFIED. Update docs/syscall-tracing-plan.md to match, regenerate artifacts, and add lock-in tests for the family and UNCLASSIFIED return of both kexec syscalls plus reboot. Co-Authored-By: Claude Opus 4.8 --- internal/generate/retclassify_test.go | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'internal/generate/retclassify_test.go') diff --git a/internal/generate/retclassify_test.go b/internal/generate/retclassify_test.go index f26d803..ad548b2 100644 --- a/internal/generate/retclassify_test.go +++ b/internal/generate/retclassify_test.go @@ -109,6 +109,14 @@ func TestClassifyRetUnclassified(t *testing.T) { "listen", "getsockname", "getpeername", + // kexec_load(2) loads a new kernel for later execution by reboot(2) and + // returns long 0 on success or -1 on error — a status code, NOT a + // transferred byte count. Its exit must stay UNCLASSIFIED (plain + // ret_event), exactly like its sibling kexec_file_load and the + // system/admin syscall reboot below. + "kexec_load", + "kexec_file_load", + "reboot", } for _, name := range unclassified { if got := ClassifyRet("sys_exit_" + name); got != Unclassified { -- cgit v1.2.3