-# chmod ______________________________________________________
-# long sys_chmod(const char __user * filename, mode_t mode)
-probe nd_syscall.chmod = kprobe.function("sys_chmod") ?
-{
- name = "chmod"
- asmlinkage()
- path = user_string_quoted(pointer_arg(1))
- mode = uint_arg(2)
- argstr = sprintf("%s, %#o", user_string_quoted(pointer_arg(1)), mode)
-}
-probe nd_syscall.chmod.return = kprobe.function("sys_chmod").return ?
-{
- name = "chmod"
- retstr = returnstr(1)
-}
-
# chown ______________________________________________________
# long sys_chown(const char __user * filename, uid_t user, gid_t group)
probe nd_syscall.chown = kprobe.function("sys_chown") ?
--- /dev/null
+# chmod ______________________________________________________
+# long sys_chmod(const char __user * filename, mode_t mode)
+
+@define _SYSCALL_CHMOD_NAME
+%(
+ name = "chmod"
+%)
+
+@define _SYSCALL_CHMOD_ARGSTR
+%(
+ argstr = sprintf("%s, %#o", path, mode)
+%)
+
+probe syscall.chmod = dw_syscall.chmod !, nd_syscall.chmod {}
+probe syscall.chmod.return = dw_syscall.chmod.return !, nd_syscall.chmod.return {}
+
+# dw_chmod _____________________________________________________
+
+probe dw_syscall.chmod = kernel.function("sys_chmod").call
+{
+ @_SYSCALL_CHMOD_NAME
+ path = user_string_quoted($filename)
+%( arch == "i386" %?
+ # Why @cast() here? Even though the user passes an unsigned
+ # int (32-bits), some kernels (2.6.32-431.el6.i686) get an
+ # unsigned short (16-bits).
+ mode = @cast(&$mode, "unsigned int")
+%:
+ mode = __uint32($mode)
+%)
+ @_SYSCALL_CHMOD_ARGSTR
+}
+probe dw_syscall.chmod.return = kernel.function("sys_chmod").return
+{
+ @_SYSCALL_CHMOD_NAME
+ retstr = return_str(1, $return)
+}
+
+# nd_chmod _____________________________________________________
+
+probe nd_syscall.chmod = kprobe.function("sys_chmod") ?
+{
+ @_SYSCALL_CHMOD_NAME
+ asmlinkage()
+ path = user_string_quoted(pointer_arg(1))
+ mode = uint_arg(2)
+ @_SYSCALL_CHMOD_ARGSTR
+}
+probe nd_syscall.chmod.return = kprobe.function("sys_chmod").return ?
+{
+ @_SYSCALL_CHMOD_NAME
+ retstr = returnstr(1)
+}
-# chmod ______________________________________________________
-# long sys_chmod(const char __user * filename, mode_t mode)
-probe syscall.chmod = kernel.function("sys_chmod").call
-{
- name = "chmod"
- path = user_string_quoted($filename)
-%( arch == "i386" %?
- # Why @cast() here? Even though the user passes an unsigned
- # int (32-bits), some kernels (2.6.32-431.el6.i686) get an
- # unsigned short (16-bits).
- mode = @cast(&$mode, "unsigned int")
-%:
- mode = __uint32($mode)
-%)
- argstr = sprintf("%s, %#o", user_string_quoted($filename), mode)
-}
-probe syscall.chmod.return = kernel.function("sys_chmod").return
-{
- name = "chmod"
- retstr = return_str(1, $return)
-}
-
# chown ______________________________________________________
# long sys_chown(const char __user * filename, uid_t user, gid_t group)
probe syscall.chown = kernel.function("sys_chown").call