package generate // kindMeta holds static metadata for a TracepointKind. Adding a new kind // only requires registering an entry here — no switch statements need to be // updated elsewhere (Open/Closed Principle). type kindMeta struct { // structName is the C struct name used in generated BPF handlers, e.g. "fd_event". structName string // enterAccepted reports whether this kind is valid for a syscall-enter tracepoint. // Kinds that are exit-only (e.g. KindRet) must not appear on enter. enterAccepted bool } // kindRegistry maps every known TracepointKind to its static metadata. // To add a new syscall classification, add a single entry here; the rest of // the code (isEnterRejected, eventStructName, eventTypeConstant) picks it up // automatically via lookupKind. var kindRegistry = map[TracepointKind]kindMeta{ KindFd: {structName: "fd_event", enterAccepted: true}, KindOpen: {structName: "open_event", enterAccepted: true}, KindMqOpen: {structName: "open_event", enterAccepted: true}, KindExec: {structName: "exec_event", enterAccepted: true}, KindPathname: {structName: "path_event", enterAccepted: true}, KindName: {structName: "name_event", enterAccepted: true}, KindRet: {structName: "ret_event", enterAccepted: false}, KindFcntl: {structName: "fcntl_event", enterAccepted: true}, KindNull: {structName: "null_event", enterAccepted: true}, KindDup3: {structName: "dup3_event", enterAccepted: true}, KindOpenByHandleAt: {structName: "open_by_handle_at_event", enterAccepted: true}, KindSocket: {structName: "socket_event", enterAccepted: true}, KindSocketpair: {structName: "socketpair_event", enterAccepted: true}, KindAccept: {structName: "accept_event", enterAccepted: true}, KindPipe: {structName: "pipe_event", enterAccepted: true}, KindEventfd: {structName: "eventfd_event", enterAccepted: true}, KindPidfd: {structName: "eventfd_event", enterAccepted: true}, KindEpollCtl: {structName: "epoll_ctl_event", enterAccepted: true}, KindTwoFd: {structName: "two_fd_event", enterAccepted: true}, KindPoll: {structName: "poll_event", enterAccepted: true}, KindMem: {structName: "mem_event", enterAccepted: true}, KindSleep: {structName: "sleep_event", enterAccepted: true}, KindKeyctl: {structName: "keyctl_event", enterAccepted: true}, KindPtrace: {structName: "ptrace_event", enterAccepted: true}, KindPerfOpen: {structName: "perf_open_event", enterAccepted: true}, KindSeccomp: {structName: "null_event", enterAccepted: true}, KindModule: {structName: "null_event", enterAccepted: true}, KindSysVId: {structName: "null_event", enterAccepted: true}, KindSysVOp: {structName: "null_event", enterAccepted: true}, KindProc: {structName: "null_event", enterAccepted: true}, KindBpf: {structName: "null_event", enterAccepted: true}, KindFutex: {structName: "null_event", enterAccepted: true}, KindPrctl: {structName: "null_event", enterAccepted: true}, KindTimerObj: {structName: "null_event", enterAccepted: true}, // KindNone is intentionally absent: it represents "unclassified" and is // never enter-accepted. lookupKind returns the zero kindMeta (enterAccepted=false) // for any unregistered kind, so KindNone is implicitly rejected. } // lookupKind returns the metadata for kind. If kind is not registered (e.g. // KindNone or an unknown value), it returns a zero kindMeta whose structName // is "unknown_event" and enterAccepted is false. func lookupKind(kind TracepointKind) kindMeta { if m, ok := kindRegistry[kind]; ok { return m } return kindMeta{structName: "unknown_event", enterAccepted: false} }