retstr = returnstr(1)
}
# fstat64 ____________________________________________________
-/*
- * asmlinkage long
- * sys_fstat64(unsigned long fd,
- * struct stat64 __user * statbuf)
- */
+# long sys_fstat64(unsigned long fd,
+# struct stat64 __user * statbuf)
probe syscall.fstat64 = kernel.function("sys_fstat64") {
name = "fstat64"
fd = $fd
buf_uaddr = $statbuf
- argstr = sprintf("%d, [%p]", $fd, buf_uaddr)
+ argstr = sprintf("%d, [%p]", $fd, $statbuf)
}
probe syscall.fstat64.return = kernel.function("sys_fstat64").return {
name = "fstat64"
retstr = returnstr(1)
}
# lstat64 ____________________________________________________
-/*
- * asmlinkage long
- * sys_lstat64(char __user * filename,
- * struct stat64 __user * statbuf)
- */
+# long sys_lstat64(char __user * filename,
+# struct stat64 __user * statbuf)
probe syscall.lstat64 = kernel.function("sys_lstat64") {
name = "lstat64"
- filename_uaddr = $filename
filename = user_string($filename)
buf_uaddr = $statbuf
- argstr = sprintf("%s, [%p]", filename, buf_uaddr)
+ argstr = sprintf("\"%s\", [%p]", filename, $statbuf)
}
-probe syscall.lstat64.return =
- kernel.function("sys_lstat64").return {
+probe syscall.lstat64.return = kernel.function("sys_lstat64").return {
name = "lstat64"
retstr = returnstr(1)
}
retstr = returnstr(1)
}
# stat64 _____________________________________________________
-/*
- * asmlinkage long
- * sys_stat64(char __user * filename,
- * struct stat64 __user * statbuf)
- */
+# long sys_stat64(char __user * filename,
+# struct stat64 __user * statbuf)
probe syscall.stat64 = kernel.function("sys_stat64") {
name = "stat64"
- filename_uaddr = $filename
filename = user_string($filename)
buf_uaddr = $statbuf
- argstr = sprintf("%s, [%p]", filename, buf_uaddr)
+ argstr = sprintf("\"%s\", [%p]", filename, $statbuf)
}
probe syscall.stat64.return = kernel.function("sys_stat64").return {
name = "stat64"
name = "lgetxattr.return"
}
# link _______________________________________________________
-/*
- * asmlinkage long
- * sys_link(const char __user * oldname,
- * const char __user * newname)
- */
-probe kernel.syscall.link =
- kernel.function("sys_link") {
- name = "link"
- oldpath_uaddr = $oldname
- newpath_uaddr = $newname
- }
-probe kernel.syscall.link.return =
- kernel.function("sys_link").return {
- name = "link.return"
- }
+# long sys_link(const char __user * oldname,
+# const char __user * newname)
+probe syscall.link = kernel.function("sys_link") {
+ name = "link"
+ oldpath = user_string($oldname)
+ newpath = user_string($newname)
+ argstr = sprintf("\"%s\", \"%s\"", oldpath, newpath)
+}
+probe syscall.link.return = kernel.function("sys_link").return {
+ name = "link"
+ retstr = returnstr(1)
+}
# listen _____________________________________________________
# long sys_listen(int fd, int backlog)
}
# readlink ___________________________________________________
#
-# asmlinkage long
-# sys_readlink(const char __user * path,
+# long sys_readlink(const char __user * path,
# char __user * buf,
# int bufsiz)
#
probe syscall.readlink = kernel.function("sys_readlink") {
name = "readlink"
- path_uaddr = $path
- path_str = user_string(path_uaddr)
+ path = user_string($path)
buf_uaddr = $buf
bufsiz = $bufsiz
- argstr = sprintf("%s, [%p], %p", path_str, buf_uaddr, bufsiz)
+ argstr = sprintf("\"%s\", [%p], %d", path, buf_uaddr, bufsiz)
}
probe syscall.readlink.return = kernel.function("sys_readlink").return {
name = "readlink"
# statfs _____________________________________________________
#
-# asmlinkage long
-# sys_statfs(const char __user * path,
+# long sys_statfs(const char __user * path,
# struct statfs __user * buf)
#
probe syscall.statfs = kernel.function("sys_statfs") {
name = "statfs"
- path_uaddr = $path
path = user_string($path)
buf_uaddr = $buf
- argstr = sprintf("%s, [%p]", path, buf_uaddr)
+ argstr = sprintf("%s, [%p]", path, $buf)
}
probe syscall.statfs.return = kernel.function("sys_statfs").return {
name = "statfs"
}
# statfs64 ___________________________________________________
#
-# asmlinkage long
-# sys_statfs64(const char __user *path,
+# long sys_statfs64(const char __user *path,
# size_t sz,
# struct statfs64 __user *buf)
#
probe syscall.statfs64 = kernel.function("sys_statfs64") {
name = "statfs64"
- path_uaddr = $path
path = user_string($path)
sz = $sz
buf_uaddr = $buf
- argstr = sprintf("%s, %d, [%p]", path, $sz, buf_uaddr)
+ argstr = sprintf("%s, %d, [%p]", path, $sz, $buf)
}
probe syscall.statfs64.return = kernel.function("sys_statfs64").return {
name = "statfs64"
retstr = returnstr(1)
}
# symlink ____________________________________________________
-#
-# asmlinkage long
-# sys_symlink(const char __user * oldname,
+# long sys_symlink(const char __user * oldname,
# const char __user * newname)
-#
probe syscall.symlink = kernel.function("sys_symlink") {
name = "symlink"
oldpath = user_string($oldname)
newpath = user_string($newname)
- argstr = sprintf("%s, %s", oldpath, newpath)
+ argstr = sprintf("\"%s\", \"%s\"", oldpath, newpath)
}
probe syscall.symlink.return = kernel.function("sys_symlink").return {
name = "symlink"