Chapter 38. syscalls
Prev |  |

# Chapter 38. syscalls

Following is an overview of available syscall probes and convenience variables they offer. By default, each syscall probe has name and argstr convenience variables, which are not included in the overview in order to keep it short. Non dwarf-based nd_syscall probes are supposed to have the same convenience variables.

Table 38.1. Syscalls list

syscall | params
--- | ---
accept | addr_uaddr, addrlen_uaddr, sockfd
accept4 | addr_uaddr, addrlen_uaddr, flags, flags_str, sockfd
access | mode, mode_str, pathname, pathname_unquoted
acct | filename, filename_unquoted
add_key | description_uaddr, payload_uaddr, plen, ringid, type_uaddr
adjtimex | buf_str, buf_uaddr
alarm | seconds
arch_prctl | addr, code, code_str
bind | addrlen, my_addr_uaddr, sockfd, uaddr_af, uaddr_ip, uaddr_ip_port, uaddr_ipv6_flowinfo, uaddr_ipv6_scope_id
bpf | attr_uaddr, cmd, cmd_str, size
brk | brk
capget | data_uaddr, header_uaddr
capset | data_uaddr, header_uaddr
chdir | path, path_unquoted
chmod | mode, path, path_unquoted
chown | group, owner, path, path_unquoted
chown16 | group, owner, path, path_unquoted
chroot | path, path_unquoted
clock_adjtime | clk_id, clk_id_str, tx_uaddr, tx_uaddr_str
clock_getres | clk_id, clk_id_str, res_uaddr
clock_gettime | clk_id, clk_id_str, tp_uaddr
clock_nanosleep | clk_id, clk_id_str, flags, flags_str, rem_uaddr, req_str, req_uaddr
clock_settime | clk_id, clk_id_str, tp_uaddr, tp_uaddr_str
close | fd
compat_execve | args, env_str, filename
compat_execveat | args, dirfd, dirfd_str, env_str, filename, flags, flags_str
compat_getitimer | value_uaddr, which
compat_select | exceptfds_uaddr, n, readfds_uaddr, timeout_str, timeout_uaddr, writefds_uaddr
compat_setitimer | ovalue_uaddr, value_str, value_uaddr, which, which_str
compat_signalfd | flags
compat_sys_msgctl | buf_uaddr, cmd, cmd_str, msqid
compat_sys_msgrcv | msgflg, msgflg_str, msgp_uaddr, msgsz, msgtyp, msqid
compat_sys_msgsnd | msgflg, msgflg_str, msgp_uaddr, msgsz, msqid
compat_sys_recvmsg | flags, flags_str, msg_uaddr, s
compat_sys_semctl | arg, cmd, cmdstr, semid, semnum
compat_sys_semtimedop | nsops, semid, sops_uaddr, timeout_str, timeout_uaddr
compat_sys_sendmsg | flags, flags_str, msg_uaddr, s
compat_sys_shmat | shmaddr_uaddr, shmflg, shmflg_str, shmid
compat_sys_shmctl | buf_uaddr, cmd, cmd_str, shmid
connect | addrlen, serv_addr_uaddr, sockfd, uaddr_af, uaddr_ip, uaddr_ip_port, uaddr_ipv6_flowinfo, uaddr_ipv6_scope_id
copy_file_range | fd_in, fd_out, flags, len, off_in, off_out
creat | mode, pathname, pathname_unquoted
delete_module | flags, flags_str, name_user, name_user_unquoted
dup | oldfd
dup2 | flags, flags_str, newfd, oldfd
dup3 | flags, flags_str, newfd, oldfd
epoll_create | flags, size
epoll_ctl | epfd, event_uaddr, fd, op, op_str
epoll_pwait | epfd, events_uaddr, maxevents, sigmask_uaddr, sigsetsize, timeout
epoll_wait | epfd, events_uaddr, maxevents, timeout
eventfd | count, flags, flags_str
execve | args, env_str, filename
execveat | args, dirfd, dirfd_str, env_str, filename, flags, flags_str
exit | status
exit_group | status
faccessat | dirfd, dirfd_str, mode, mode_str, pathname, pathname_unquoted
faccessat2 | dirfd, dirfd_str, flags, flags_str, mode, mode_str, pathname, pathname_unquoted
fadvise64 | advice, advice_str, fd, len, offset
fallocate | fd, len, mode, mode_str, offset
fanotify_init | event_f_flags, event_f_flags_str, flags, flags_str
fanotify_mark | dirfd, dirfd_str, fanotify_fd, flags, flags_str, mask, mask_str, pathname, pathname_unquoted
fchdir | fd
fchmod | fildes, mode
fchmodat | dirfd, dirfd_str, mode, pathname, pathname_unquoted
fchown | fd, group, owner
fchown16 | fd, group, owner
fchownat | dirfd, dirfd_str, flags, flags_str, group, owner, pathname, pathname_unquoted
fcntl | arg, cmd, cmd_str, fd
fdatasync | fd
fgetxattr | filedes, name_str, name_str_unquoted, size, value_uaddr
finit_module | fd, flags, flags_str, uargs, uargs_unquoted
flistxattr | filedes, list_uaddr, size
flock | fd, operation
fork |
fremovexattr | filedes, name_str, name_str_unquoted, name_uaddr
fsetxattr | filedes, flags, flags_str, name_str, name_str_unquoted, name_uaddr, size, value_str, value_uaddr
fstat | buf_uaddr, filedes
fstatat | buf_uaddr, dirfd, dirfd_str, flags, flags_str, path, path_unquoted
fstatfs | buf_uaddr, fd
fstatfs64 | buf_uaddr, fd, sz
fsync | fd
ftruncate | fd, length
futex | futex_uaddr, op, uaddr2_uaddr, utime_uaddr, val3, val
futimesat | dirfd, dirfd_str, filename, filename_uaddr, filename_unquoted, tvp_str, tvp_uaddr
get_mempolicy | addr, flags, flags_str, maxnode, nmask_uaddr, policy_uaddr
get_robust_list | len_uaddr, list_head_uaddr, pid
get_thread_area | u_info_str, u_info_uaddr
getcpu | cpu_uaddr, node_uaddr, tcache_uaddr
getcwd | buf_uaddr, size
getdents | count, dirp_uaddr, fd
getegid |
geteuid |
getgid |
getgroups | list_uaddr, size
getitimer | value_uaddr, which
getpeername | name_uaddr, namelen_uaddr, s
getpgid | pid
getpgrp |
getpid |
getppid |
getpriority | which, who
getrandom | buf, buf_unquoted, count, flags, flags_str
getresgid | egid_uaddr, rgid_uaddr, sgid_uaddr
getresuid | euid_uaddr, ruid_uaddr, suid_uaddr
getrlimit | resource, rlim_uaddr
getrusage | usage_uaddr, who, who_str
getsid | pid
getsockname | name_uaddr, namelen_uaddr, s
getsockopt | fd, level, level_str, optlen_uaddr, optname, optname_str, optval_uaddr
gettid |
gettimeofday | tv_uaddr, tz_uaddr
getuid |
getxattr | name_str, name_str_unquoted, path, path_unquoted, size, value_uaddr
init_module | len, uargs, uargs_unquoted, umod_uaddr
inotify_add_watch | fd, mask, mask_str, path, path_uaddr, path_unquoted
inotify_init | flags
inotify_rm_watch | fd, wd
io_cancel | ctx_id, iocb_uaddr, result_uaddr
io_destroy | ctx
io_getevents | ctx_id, events_uaddr, min_nr, nr, timeout_uaddr, timestr
io_setup | ctxp_uaddr, maxevents
io_submit | ctx_id, iocbpp_uaddr, nr
ioctl | argp, fd, request
ioperm | from, num, turn_on
iopl | level
ioprio_get | which, which_str, who
ioprio_set | ioprio, ioprio_str, which, which_str, who
kcmp | idx1, idx2, pid1, pid2, type, type_str
kexec_file_load | cmdline, cmdline_len, cmdline_unquoted, flags, flags_str, initrd_fd, kernel_fd
kexec_load | entry, flags, flags_str, nr_segments, segments_uaddr
keyctl | arg2, arg3, arg4, arg5, option
kill | pid, sig, sig_name
lchown | group, owner, path, path_unquoted
lchown16 | group, owner, path, path_unquoted
lgetxattr | name_str, name_str_unquoted, path, path_unquoted, size, value_uaddr
link | newpath, newpath_unquoted, oldpath, oldpath_unquoted
linkat | flags, flags_str, newdirfd, newdirfd_str, newpath, newpath_unquoted, olddirfd, olddirfd_str, oldpath, oldpath_unquoted
listen | backlog, sockfd
listxattr | list_uaddr, path, path_uaddr, path_unquoted, size
llistxattr | list_uaddr, path, path_uaddr, path_unquoted, size
llseek | fd, offset_high, offset_low, result_uaddr, whence, whence_str
lremovexattr | name_str, name_str_unquoted, name_uaddr, path, path_uaddr, path_unquoted
lseek | fildes, offset, whence, whence_str
lsetxattr | flags, flags_str, name_str, name_str_unquoted, name_uaddr, path, path_uaddr, path_unquoted, size, value_str, value_uaddr
lstat | buf_uaddr, path, path_unquoted
madvise | advice, advice_str, length, start
mbind | flags, flags_str, len, maxnode, mode, mode_str, nmask_uaddr, start
membarrier | cmd, cmd_str, flags
memfd_create | flags, flags_str, uname, uname_unquoted
memfd_secret | flags, flags_str
migrate_pages | maxnode, new_nodes, old_nodes, pid
mincore | length, start, vec_uaddr
mkdir | mode, pathname, pathname_uaddr, pathname_unquoted
mkdirat | dirfd, dirfd_str, mode, pahtname_unquoted, pathname
mknod | dev, mode, mode_str, pathname, pathname_unquoted
mknodat | dev, dirfd, dirfd_str, mode, mode_str, pathname, pathname_unquoted
mlock | addr, len
mlock2 | addr, flags, flags_str, len
mlockall | flags, flags_str
mmap2 | fd, flags, flags_str, length, pgoffset, prot, prot_str, start
modify_ldt | bytecount, func, ptr_uaddr
mount | data, data_unquoted, filesystemtype, filesystemtype_unquoted, mountflags, mountflags_str, source, source_unquoted, target, target_unquoted
move_pages | flags, flags_str, nodes, nr_pages, pages, pid, status
mprotect | addr, len, prot, prot_str
mq_getsetattr | mqdes, u_mqstat_uaddr, u_omqstat_uaddr
mq_notify | mqdes, notification_uaddr
mq_open | filename, filename_unquoted, mode, name_uaddr, oflag, oflag_str, u_attr_uaddr
mq_timedreceive | abs_timeout_uaddr, mqdes, msg_len, msg_prio_uaddr, msg_ptr_uaddr
mq_timedsend | abs_timeout_uaddr, mqdes, msg_len, msg_prio, msg_ptr_uaddr
mq_unlink | u_name, u_name_uaddr, u_name_unquoted
mremap | flags, flags_str, new_address, new_size, old_address, old_size
msgctl | buf_uaddr, cmd, cmd_str, msqid
msgget | key, key_str, msgflg, msgflg_str
msgrcv | msgflg, msgflg_str, msgp_uaddr, msgsz, msgtyp, msqid
msgsnd | msgflg, msgflg_str, msgp_uaddr, msgsz, msqid
msync | flags, flags_str, length, start
munlock | addr, len
munlockall |
munmap | length, start
name_to_handle_at | dfd, dfd_str, flags, flags_str, handle_uaddr, mnt_id_uaddr, pathname, pathname_unquoted
nanosleep | rem_uaddr, req_str, req_uaddr
ni_syscall |
nice | inc
open | filename, filename_unquoted, flags, flags_str, mode
open_by_handle_at | flags, flags_str, handle_uaddr, mount_dfd, mount_dfd_str
openat | dfd, dfd_str, filename, filename_unquoted, flags, flags_str, mode
pause |
perf_event_open | attr_uaddr, cpu, flags, flags_str, group_fd, pid
personality | persona
pipe | fildes_uaddr, flag_str, flags, pipe0, pipe1
pivot_root | new_root_str, new_root_str_unquoted, old_root_str, old_root_str_unquoted
pkey_alloc | flags, init_val, init_val_str
pkey_free | pkey
pkey_mprotect | addr, len, pkey, prot, prot_str
poll | nfds, timeout, ufds_uaddr
ppoll | fds_uaddr, nfds, sigmask, sigsetsize, tsp, tsp_str
prctl | arg2, arg3, arg4, arg5, option
pread | buf_uaddr, count, fd, offset
preadv | count, fd, offset, vector_uaddr
preadv2 | count, fd, flags, flags_str, offset, vector_uaddr
prlimit64 | new_rlim_str, new_rlim_uaddr, old_rlim_uaddr, pid, resource, resource_str
process_vm_readv | flags, liovcnt, local_iov_uaddr, pid, remote_iov_uaddr, riovcnt
process_vm_writev | flags, liovcnt, local_iov_uaddr, pid, remote_iov_uaddr, riovcnt
pselect6 | exceptfds, nfds, readfds, sigmask, timeout, timeout_str, writefds
ptrace | addr, data, pid, request
pwrite | buf_str, buf_uaddr, count, fd, offset
pwritev | count, fd, offset, vector_uaddr
pwritev2 | count, fd, flags, flags_str, offset, vector_uaddr
quotactl | addr_uaddr, cmd, cmd_str, id, special, special_str, special_str_unquoted
read | buf_uaddr, count, fd
readahead | count, fd, offset
readdir | count, dirent, fd
readlink | buf_uaddr, bufsiz, path, path_unquoted
readlinkat | buf_uaddr, bufsiz, dfd, dfd_str, path, path_unquoted
readv | count, fd, vector_uaddr
reboot | arg_uaddr, flag, flag_str, magic2, magic2_str, magic, magic_str
recv | buf_uaddr, flags, flags_str, len, s
recvfrom | addr_uaddr, addrlen_uaddr, buf_uaddr, flags, flags_str, len, s
recvmmsg | flags, flags_str, mmsg_uaddr, s, timeout_str, timeout_uaddr, vlen
recvmsg | flags, flags_str, msg_uaddr, s
remap_file_pages | flags, flags_str, pgoff, prot, prot_str, size, start
removexattr | name_str, name_str_unquoted, path, path_unquoted
rename | newpath, newpath_unquoted, oldpath, oldpath_unquoted
renameat | newdfd, newdfd_str, newname, newname_str, newname_str_unquoted, olddfd, olddfd_str, oldname, oldname_str, oldname_str_unquoted
renameat2 | flags, flags_str, newdfd, newdfd_str, newname, newname_str, newname_str_unquoted, olddfd, olddfd_str, oldname, oldname_str, oldname_str_unquoted
request_key | callout_info_uaddr, description_str, description_str_unquoted, description_uaddr, destringid, type_str, type_str_unquoted, type_uaddr
restart_syscall |
rmdir | pathname, pathname_unquoted
rt_sigaction | act_str, act_uaddr, oact_uaddr, sig, sig_str, sigsetsize
rt_sigaction32 | act_str, act_uaddr, oact_uaddr, sig, sig_str, sigsetsize
rt_sigpending | set_uaddr, sigsetsize
rt_sigprocmask | how, how_str, oldset_uaddr, set_str, set_uaddr, sigsetsize
rt_sigqueueinfo | pid, sig, sig_name, siginfo_str, uinfo_uaddr
rt_sigsuspend | set_str, set_uaddr, sigsetsize
rt_sigtimedwait | sigsetsize, uinfo_str, uinfo_uaddr, uthese_str, uthese_uaddr, uts_str, uts_uaddr
rt_tgsigqueueinfo | sig, sig_str, tgid, tid, uinfo_str, uinfo_uaddr
sched_get_priority_max | policy, policy_str
sched_get_priority_min | policy, policy_str
sched_getaffinity | len, mask_uaddr, pid
sched_getattr | flags, pid, sched_attr_str, sched_attr_uaddr, size
sched_getparam | p_uaddr, pid
sched_getscheduler | pid
sched_rr_get_interval | pid, tp_uaddr
sched_setaffinity | len, mask_uaddr, pid
sched_setattr | flags, pid, sched_attr_str, sched_attr_uaddr
sched_setparam | p_uaddr, pid
sched_setscheduler | p_uaddr, pid, policy, policy_str
sched_yield |
seccomp | flags, flags_str, op, op_str, uargs_uaddr
select | exceptfds_uaddr, n, readfds_uaddr, timeout_str, timeout_uaddr, writefds_uaddr
semctl | arg, cmd, cmdstr, semid, semnum
semget | key, key_str, nsems, semflg, semflg_str
semop | nsops, semid, sops_uaddr
semtimedop | nsops, semid, sops_uaddr, timeout_str, timeout_uaddr
send | buf, buf_uaddr, flags, flags_str, len, s
sendfile | count, in_fd, offset_uaddr, out_fd
sendmmsg | flags, flags_str, mmsg_uaddr, s, vlen
sendmsg | flags, flags_str, msg_uaddr, s
sendto | buf, buf_uaddr, flags, flags_str, len, s, to_str, to_uaddr, tolen
set_mempolicy | maxnode, mode, mode_str, nmask_uaddr
set_robust_list | len, list_head_uaddr
set_thread_area | u_info_str, u_info_uaddr
set_tid_address | tidptr_uaddr
setdomainname | domainname_str, domainname_str_unquoted, domainname_uaddr, len
setfsgid | fsgid
setfsuid | fsuid
setgid | gid
setgroups | list_uaddr, size
sethostname | hostname_uaddr, len, name_str, name_str_unquoted
setitimer | ovalue_uaddr, value_str, value_uaddr, which, which_str
setns | fd, nstype, nstype_str
setpgid | pgid, pid
setpriority | prio, which, which_str, who
setregid | egid, rgid
setregid16 | egid, rgid
setresgid | egid, rgid, sgid
setresgid16 | egid, rgid, sgid
setresuid | euid, ruid, suid
setresuid16 | euid, ruid, suid
setreuid | euid, ruid
setreuid16 | euid, ruid
setrlimit | resource, resource_str, rlim_str, rlim_uaddr
setsid |
setsockopt | fd, level, level_str, optlen, optname, optname_str, optval_uaddr
settimeofday | tv_str, tv_uaddr, tz_str, tz_uaddr
settimeofday32 | tv_str, tv_uaddr, tz_str, tz_uaddr
setuid | uid
setxattr | flags, flags_str, name_str, name_str_unquoted, name_uaddr, path, path_uaddr, path_unquoted, size, value_str, value_uaddr
sgetmask |
shmat | shmaddr_uaddr, shmflg, shmflg_str, shmid
shmctl | buf_uaddr, cmd, cmd_str, shmid
shmdt | shmaddr_uaddr
shmget | key, shmflg, shmflg_str, size
shutdown | how, how_str, s
sigaction32 | act_str, act_uaddr, oact_uaddr, sig, sig_str
sigaltstack | uoss_uaddr, uss_str, uss_uaddr
signal | handler, handler_str, sig, sig_str
signalfd | flags
sigpending | set
sigprocmask | how, how_str, oldset_uaddr, set_uaddr
sigsuspend | mask, mask_str
socket | family, family_str, protocol, protocol_str, type, type_str
socketpair | family, family_str, protocol, protocol_str, sv_uaddr, type, type_str
splice | fd_in, fd_out, flags, flags_str, len, off_in, off_out
ssetmask | newmask, newmask_str
stat | buf_uaddr, filename, filename_uaddr, filename_unquoted
statfs | buf_uaddr, path, path_unquoted
statfs64 | buf_uaddr, path, path_unquoted, sz
statx | buf_uaddr, dfd, dfd_str, filename, filename_uaddr, filename_unquoted, flags, flags_str, mask, mask_str
stime | t_uaddr
swapoff | path, path_uaddr, path_unquoted
swapon | path, path_uaddr, path_unquoted, swapflags, swapflags_str
symlink | newpath, oldpath, oldpath_unquoted
symlinkat | newdfd, newdfd_str, newname, newname_str, newname_str_unquoted, oldname, oldname_str, oldname_str_unquoted
sync |
sync_file_range | fd, flags, flags_str, nbytes, offset
syncfs | fd
sysfs | arg1, arg2, option
sysinfo | info_str, info_uaddr
syslog | bufp_uaddr, len, type
tee | fdin, fdout, flags, len
tgkill | pid, sig, sig_str, tgid
time | t_uaddr
timer_create | clockid, clockid_str, evp_uaddr, timerid_uaddr
timer_delete | timerid
timer_getoverrun | timerid
timer_gettime | timerid, value_uaddr
timer_settime | flags, ovalue_uaddr, timerid, value_str, value_uaddr
timerfd_create | clockid, clockid_str, flags, flags_str
timerfd_gettime | fd, value_uaddr
timerfd_settime | fd, flags, flags_str, ovalue_uaddr, value_str, value_uaddr
times | buf_str, buf_uaddr
tkill | pid, sig, sig_str
truncate | length, path, path_uaddr, path_unquoted
umask | mask
umount | flags, flags_str, target, target_unquoted
uname | name_uaddr
unlink | pathname, pathname_uaddr, pathname_unquoted
unlinkat | dfd, dfd_str, flag, flag_str, pathname, pathname_str, pathname_str_unquoted
unshare | unshare_flags, unshare_flags_str
userfaultfd | flags, flags_str
ustat | dev, ubuf_uaddr
ustat32 | dev, ubuf_uaddr
utime | actime, buf_uaddr, filename, filename_uaddr, filename_unquoted, modtime
utimensat | dfd, dfd_str, filename, filename_uaddr, filename_unquoted, flags, flags_str, tsp_str, tsp_uaddr
utimes | filename, filename_uaddr, filename_unquoted, tvp_uaddr, tvp_uaddr_str
vfork |
vhangup |
vmsplice | fd, flags, flags_str, iov, nr_segs
wait4 | options, options_str, pid, rusage_uaddr, status_uaddr
waitid | infop_uaddr, options, options_str, pid, rusage_uaddr, which, which_str
waitpid | options, options_str, pid, status_uaddr
write | buf_str, buf_uaddr, count, fd
writev | count, fd, vector_uaddr

Prev |  |
function::cve_tmpdisable | Home |