From aeced89f46253e0b4813bbbd89362a0c4466f2d7 Mon Sep 17 00:00:00 2001 From: Paul Buetow Date: Sat, 30 May 2026 21:34:13 +0300 Subject: test(rmdir): lock in FS family, args[0] pathname capture, UNCLASSIFIED exit Audit of the rmdir(2) syscall found the tracing implementation already correct and fully consistent with its siblings: rmdir is in the FS family, classified KindPathname with the pathname captured from args[0] (its generated BPF C handler is byte-identical to unlink's), and its exit is a ret_event with UNCLASSIFIED ret_type (rmdir returns int 0/-1, not a byte count). The docs and drift tests, integration tests (unlink-rmdir success and unlink-rmdir-notempty ENOTEMPTY failure), and retclassify coverage all already match. To guard against future drift, add a dedicated rmdir lock-in: - FormatRmdir tracepoint fixture (single const char * pathname at args[0], mirroring the real sys_enter_rmdir format and unlink's shape). - TestGenerateRmdirHandlerCapturesPathFromArgs0: asserts the generated handler reads the path from args[0] (with a negative guard against args[1], since rmdir has no dirfd) and that the exit stays UNCLASSIFIED. - TestRmdirFamilyAndKindMatchSiblings: asserts rmdir shares FamilyFS and KindPathname/pathname with unlink/unlinkat/mkdir. Co-Authored-By: Claude Opus 4.8 --- internal/generate/testdata.go | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) (limited to 'internal/generate/testdata.go') diff --git a/internal/generate/testdata.go b/internal/generate/testdata.go index c2d47ba..7631d61 100644 --- a/internal/generate/testdata.go +++ b/internal/generate/testdata.go @@ -411,6 +411,27 @@ format: print fmt: "pathname: 0x%08lx", ((unsigned long)(REC->pathname)) ` +// FormatRmdir mirrors the real sys_enter_rmdir tracepoint format. rmdir(2) is +// "int rmdir(const char *pathname)": it deletes an empty directory and takes a +// single argument, a genuine const char * filesystem path at args[0]. It is the +// directory-removal sibling of unlink(2) (same single-pathname shape) and the +// inverse of mkdir(2), so it classifies as KindPathname with PathnameField +// "pathname" and the path is captured from args[0]. Its exit returns int 0/-1 +// (no byte count), so the exit stays UNCLASSIFIED. +const FormatRmdir = `name: sys_enter_rmdir +ID: 882 +format: + field:unsigned short common_type; offset:0; size:2; signed:0; + field:unsigned char common_flags; offset:2; size:1; signed:0; + field:unsigned char common_preempt_count; offset:3; size:1; signed:0; + field:int common_pid; offset:4; size:4; signed:1; + + field:int __syscall_nr; offset:8; size:4; signed:1; + field:const char * pathname; offset:16; size:8; signed:0; + +print fmt: "pathname: 0x%08lx", ((unsigned long)(REC->pathname)) +` + // FormatUtime mirrors the real sys_enter_utime tracepoint format: its first // argument "filename" is a genuine const char * filesystem path (args[0]), // so utime classifies as KindPathname with PathnameField "filename" — the -- cgit v1.2.3