# asmlinkage long
# sys_setgid16(old_gid_t gid)
#
-probe syscall.setgid16 = kernel.function("sys_setgid16") {
+probe syscall.setgid16 = kernel.function("sys_setgid16") ? {
name = "setgid"
gid = $gid
argstr = sprint($gid)
}
-probe syscall.setgid16.return = kernel.function("sys_setgid16").return {
+probe syscall.setgid16.return = kernel.function("sys_setgid16").return ? {
name = "setgid"
retstr = returnstr(1)
}
# old_gid_t egid,
# old_gid_t sgid)
#
-probe syscall.setresgid16 = kernel.function("sys_setresgid16") {
+probe syscall.setresgid16 = kernel.function("sys_setresgid16") ? {
name = "setresgid"
rgid = $rgid
egid = $egid
sgid = $sgid
argstr = sprintf("%d, %d, %d", $rgid, $egid, $sgid)
}
-probe syscall.setresgid16.return = kernel.function("sys_setresgid16").return {
+probe syscall.setresgid16.return = kernel.function("sys_setresgid16").return ? {
name = "setresgid"
retstr = returnstr(1)
}
# old_uid_t euid,
# old_uid_t suid)
#
-probe syscall.setresuid16 = kernel.function("sys_setresuid16") {
+probe syscall.setresuid16 = kernel.function("sys_setresuid16") ? {
name = "setresuid"
ruid = $ruid
euid = $euid
suid = $suid
argstr = sprintf("%d, %d, %d", $ruid, $euid, $suid)
}
-probe syscall.setresuid16.return = kernel.function("sys_setresuid16").return {
+probe syscall.setresuid16.return = kernel.function("sys_setresuid16").return ? {
name = "setresuid"
retstr = returnstr(1)
}
# asmlinkage long
# sys_setuid16(old_uid_t uid)
#
-probe syscall.setuid16 = kernel.function("sys_setuid16") {
+probe syscall.setuid16 = kernel.function("sys_setuid16") ? {
name = "setuid"
uid = $uid
argstr = sprint($uid)
}
-probe syscall.setuid16.return = kernel.function("sys_setuid16").return {
+probe syscall.setuid16.return = kernel.function("sys_setuid16").return ? {
name = "setuid"
retstr = returnstr(1)
}
length = $length
argstr = sprintf("\"%s\", %d", path, $length)
}
-probe syscall.truncate.return = kernel.function("sys_truncate").return ?, kernel.function("sys_truncate64") ? {
+probe syscall.truncate.return = kernel.function("sys_truncate").return ?, kernel.function("sys_truncate64").return ? {
name = "truncate"
retstr = returnstr(1)
}