From bf433c995a6991607a8583bb613a404ce9bb1d6d Mon Sep 17 00:00:00 2001 From: Paul Buetow Date: Tue, 2 Jun 2026 21:51:06 +0300 Subject: fix(classify): assign fanotify_mark to FamilyIPC, not Misc fanotify_mark(2) adds, removes, or modifies a mark on an fanotify notification group. Its arg0 is the fanotify group fd returned by fanotify_init(2); it carries a dirfd@arg3 and an optional pathname@arg4 and returns 0/-1 (not a byte count). It is the operation counterpart of fanotify_init and the direct analog of inotify_add_watch (both register a watch/mark on a filesystem object via the notification-group fd). inotify_add_watch is FamilyIPC, and fanotify_init was just moved Misc->IPC to sit with the fd-based event-notification primitives (eventfd, signalfd, timerfd, userfaultfd, inotify_*). fanotify_mark, however, was still falling through to FamilyMisc by omission from the explicit family table -- the same alarm/adjtimex-style misclassification fixed for fanotify_init in 88769d4, and flagged there as still-outstanding for fanotify_mark. Add it to the IPC family map for sibling consistency and regenerate. KIND is unchanged and correct: KindPathname capturing the optional pathname at args[4]. This matches the *at() cohort convention (fchmodat, fchownat, unlinkat, mkdirat, newfstatat, utimensat, name_to_handle_at all carry a dirfd at arg0 yet capture the pathname), since fanotify_mark has a dirfd@arg3 + pathname@arg4 pair. RET stays UNCLASSIFIED (returns 0/-1). Docs plan updated to keep the docs-drift tests in sync. Co-Authored-By: Claude Opus 4.8 --- internal/tracepoints/generated_tracepoints.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'internal/tracepoints') diff --git a/internal/tracepoints/generated_tracepoints.go b/internal/tracepoints/generated_tracepoints.go index 1ca5f85..6b5ef6e 100644 --- a/internal/tracepoints/generated_tracepoints.go +++ b/internal/tracepoints/generated_tracepoints.go @@ -787,7 +787,7 @@ var syscallFamilies = map[string]string{ "fadvise64": "FS", "fallocate": "FS", "fanotify_init": "IPC", - "fanotify_mark": "Misc", + "fanotify_mark": "IPC", "fchdir": "FS", "fchmod": "FS", "fchmodat": "FS", -- cgit v1.2.3