-%)
-
-%( kernel_v < "3.7" %?
-# execve _____________________________________________________
-#
-# asmlinkage long sys32_execve(struct pt_regs regs)
-# asmlinkage long sys32_execve(char __user *name, compat_uptr_t __user *argv,
-# compat_uptr_t __user *envp)
-probe nd_syscall.compat_execve = kprobe.function("sys32_execve") ?
-{
- asmlinkage()
- name = "execve"
-%( kernel_v < "2.6.32" %?
- __regs = &@cast(ulong_arg(1), "pt_regs", "kernel<asm/ptrace.h>")
- filename = user_string_quoted(__regs->orig_gpr2 & 0x7fffffff)
- args = __get_compat_argv(__regs->gprs[3] & 0x7fffffff, 0)
- env_str = __count_compat_envp(__regs->gprs[4] & 0x7fffffff)
-%:
- filename = user_string_quoted(pointer_arg(1))
- args = __get_compat_argv(pointer_arg(2), 0)
- env_str = __count_compat_envp(pointer_arg(3))
-%)
- argstr = sprintf("%s, %s, %s", filename, args, env_str)
-}
-probe nd_syscall.compat_execve.return =
- kprobe.function("sys32_execve").return ?
-{
- name = "execve"
- retstr = returnstr(1)
-}
-%)
# lookup_dcookie _____________________________________________
# rhel7: COMPAT_SYSCALL_DEFINE4(lookup_dcookie, u32, w0, u32, w1, char __user *,
--- /dev/null
+%( kernel_v < "3.7" %?
+# execve _____________________________________________________
+#
+# asmlinkage long sys32_execve(struct pt_regs regs)
+# asmlinkage long sys32_execve(char __user *name, compat_uptr_t __user *argv,
+# compat_uptr_t __user *envp)
+
+@define _SYSCALL_COMPAT_EXECVE_NAME
+%(
+ name = "execve"
+%)
+
+@define _SYSCALL_COMPAT_EXECVE_ARGSTR
+%(
+ argstr = sprintf("%s, %s, %s", filename, args, env_str)
+%)
+
+probe syscall.compat_execve = dw_syscall.compat_execve !, nd_syscall.compat_execve {}
+probe syscall.compat_execve.return = dw_syscall.compat_execve.return !,
+ nd_syscall.compat_execve.return {}
+
+# dw_compat_execve _____________________________________________________
+
+probe dw_syscall.compat_execve = kernel.function("sys32_execve").call ?
+{
+ @_SYSCALL_COMPAT_EXECVE_NAME
+%( kernel_v < "2.6.32" %?
+ # The fact that the struct is passed in instead of a pointer
+ # confuses things.
+ __regs = &@cast(ulong_arg(1), "pt_regs", "kernel<asm/ptrace.h>")
+ filename = user_string_quoted(__regs->orig_gpr2 & 0x7fffffff)
+ args = __get_compat_argv(__regs->gprs[3] & 0x7fffffff, 0)
+ env_str = __count_compat_envp(__regs->gprs[4] & 0x7fffffff)
+%:
+ filename = user_string_quoted(@choose_defined($name, $filename))
+ args = __get_compat_argv($argv, 0)
+ env_str = __count_compat_envp($envp)
+%)
+ @_SYSCALL_COMPAT_EXECVE_ARGSTR
+}
+probe dw_syscall.compat_execve.return = kernel.function("sys32_execve").return ?
+{
+ @_SYSCALL_COMPAT_EXECVE_NAME
+ retstr = return_str(1, $return)
+}
+
+# nd_compat_execve _____________________________________________________
+
+probe nd_syscall.compat_execve = kprobe.function("sys32_execve") ?
+{
+ asmlinkage()
+ @_SYSCALL_COMPAT_EXECVE_NAME
+%( kernel_v < "2.6.32" %?
+ __regs = &@cast(ulong_arg(1), "pt_regs", "kernel<asm/ptrace.h>")
+ filename = user_string_quoted(__regs->orig_gpr2 & 0x7fffffff)
+ args = __get_compat_argv(__regs->gprs[3] & 0x7fffffff, 0)
+ env_str = __count_compat_envp(__regs->gprs[4] & 0x7fffffff)
+%:
+ filename = user_string_quoted(pointer_arg(1))
+ args = __get_compat_argv(pointer_arg(2), 0)
+ env_str = __count_compat_envp(pointer_arg(3))
+%)
+ @_SYSCALL_COMPAT_EXECVE_ARGSTR
+}
+probe nd_syscall.compat_execve.return =
+ kprobe.function("sys32_execve").return ?
+{
+ @_SYSCALL_COMPAT_EXECVE_NAME
+ retstr = returnstr(1)
+}
+%)
-%( kernel_v < "3.7" %?
-# execve _____________________________________________________
-#
-# asmlinkage long sys32_execve(struct pt_regs regs)
-# asmlinkage long sys32_execve(char __user *name, compat_uptr_t __user *argv,
-# compat_uptr_t __user *envp)
-probe syscall.compat_execve = kernel.function("sys32_execve").call ?
-{
- name = "execve"
-%( kernel_v < "2.6.32" %?
- # The fact that the struct is passed in instead of a pointer
- # confuses things.
- __regs = &@cast(ulong_arg(1), "pt_regs", "kernel<asm/ptrace.h>")
- filename = user_string_quoted(__regs->orig_gpr2 & 0x7fffffff)
- args = __get_compat_argv(__regs->gprs[3] & 0x7fffffff, 0)
- env_str = __count_compat_envp(__regs->gprs[4] & 0x7fffffff)
-%:
- filename = user_string_quoted(@choose_defined($name, $filename))
- args = __get_compat_argv($argv, 0)
- env_str = __count_compat_envp($envp)
-%)
- argstr = sprintf("%s, %s, %s", filename, args, env_str)
-}
-probe syscall.compat_execve.return = kernel.function("sys32_execve").return ?
-{
- name = "execve"
- retstr = return_str(1, $return)
-}
-%)
-
# lookup_dcookie _____________________________________________
# long sys_lookup_dcookie(u64 cookie64, char __user * buf, size_t len)
# there is compat_SyS_lookup_dcookie on thel7, but not on older distros,