Supported Events
Find out which events Falco supports
Here are the system call event types and args supported by the kernel module and eBPF probes via libscap included in the Falco libs. Note that, for performance reasons, by default Falco will only consider a subset of them indicated in the table below with "yes". However, it's possible to make Falco consider all events by using the -A command line switch.
Note that several event types exist:
- Syscall events correspond to Linux system calls. Most of them have parameters, documented below, while some are detected as generic and they only offer the syscall ID.
- Tracepoint events represent internal kernel events that may be significant but don't directly translate to any syscall.
- Metaevents are generated from supplementary data sources, for instance, during data enrichment procedures or when the need for asynchronous actions arises. This group also encompasses some of Falco's internally produced events (such as the
dropevent) that are unavailable for rules. - Plugin events act as an envelope for actual plugin event data. In order to write rules that use plugins use the fields documented in the individual plugin.
The events below are valid for Falco Schema Version: 4.0.1
Syscall events
| Default | Dir | Name | Params |
|---|---|---|---|
| Yes | > | open | FSPATH name, FLAGS32 flags: O_LARGEFILE, O_DIRECTORY, O_DIRECT, O_TRUNC, O_SYNC, O_NONBLOCK, O_EXCL, O_DSYNC, O_APPEND, O_CREAT, O_RDWR, O_WRONLY, O_RDONLY, O_CLOEXEC, O_NONE, O_TMPFILE, O_F_CREATED, FD_UPPER_LAYER, FD_LOWER_LAYER, UINT32 mode |
| Yes | < | open | FD fd, FSPATH name, FLAGS32 flags: O_LARGEFILE, O_DIRECTORY, O_DIRECT, O_TRUNC, O_SYNC, O_NONBLOCK, O_EXCL, O_DSYNC, O_APPEND, O_CREAT, O_RDWR, O_WRONLY, O_RDONLY, O_CLOEXEC, O_NONE, O_TMPFILE, O_F_CREATED, FD_UPPER_LAYER, FD_LOWER_LAYER, UINT32 mode, UINT32 dev, UINT64 ino |
| Yes | < | close | ERRNO res, FD fd |
| No | < | read | ERRNO res, BYTEBUF data, FD fd, UINT32 size |
| No | < | write | ERRNO res, BYTEBUF data, FD fd, UINT32 size |
| Yes | < | socket | FD fd, ENUMFLAGS32 domain: AF_NFC, AF_ALG, AF_CAIF, AF_IEEE802154, AF_PHONET, AF_ISDN, AF_RXRPC, AF_IUCV, AF_BLUETOOTH, AF_TIPC, AF_CAN, AF_LLC, AF_WANPIPE, AF_PPPOX, AF_IRDA, AF_SNA, AF_RDS, AF_ATMSVC, AF_ECONET, AF_ASH, AF_PACKET, AF_ROUTE, AF_NETLINK, AF_KEY, AF_SECURITY, AF_NETBEUI, AF_DECnet, AF_ROSE, AF_INET6, AF_X25, AF_ATMPVC, AF_BRIDGE, AF_NETROM, AF_APPLETALK, AF_IPX, AF_AX25, AF_INET, AF_LOCAL, AF_UNIX, AF_UNSPEC, UINT32 type, UINT32 proto |
| Yes | < | bind | ERRNO res, SOCKADDR addr, FD fd |
| Yes | > | connect | FD fd, SOCKADDR addr |
| Yes | < | connect | ERRNO res, SOCKTUPLE tuple, FD fd, SOCKADDR addr |
| Yes | < | listen | ERRNO res, FD fd, INT32 backlog |
| No | < | send | ERRNO res, BYTEBUF data, FD fd, UINT32 size, SOCKTUPLE tuple |
| Yes | < | sendto | ERRNO res, BYTEBUF data, FD fd, UINT32 size, SOCKTUPLE tuple |
| No | < | recv | ERRNO res, BYTEBUF data, FD fd, UINT32 size, SOCKTUPLE tuple |
| Yes | < | recvfrom | ERRNO res, BYTEBUF data, SOCKTUPLE tuple, FD fd, UINT32 size |
| Yes | < | shutdown | ERRNO res, FD fd, ENUMFLAGS8 how: SHUT_UNKNOWN, SHUT_RDWR, SHUT_WR, SHUT_RD |
| Yes | < | getsockname | |
| Yes | < | getpeername | |
| Yes | < | socketpair | ERRNO res, FD fd1, FD fd2, UINT64 source, UINT64 peer, ENUMFLAGS32 domain: AF_NFC, AF_ALG, AF_CAIF, AF_IEEE802154, AF_PHONET, AF_ISDN, AF_RXRPC, AF_IUCV, AF_BLUETOOTH, AF_TIPC, AF_CAN, AF_LLC, AF_WANPIPE, AF_PPPOX, AF_IRDA, AF_SNA, AF_RDS, AF_ATMSVC, AF_ECONET, AF_ASH, AF_PACKET, AF_ROUTE, AF_NETLINK, AF_KEY, AF_SECURITY, AF_NETBEUI, AF_DECnet, AF_ROSE, AF_INET6, AF_X25, AF_ATMPVC, AF_BRIDGE, AF_NETROM, AF_APPLETALK, AF_IPX, AF_AX25, AF_INET, AF_LOCAL, AF_UNIX, AF_UNSPEC, UINT32 type, UINT32 proto |
| Yes | < | setsockopt | ERRNO res, FD fd, ENUMFLAGS8 level: SOL_SOCKET, SOL_TCP, UNKNOWN, ENUMFLAGS8 optname: SO_COOKIE, SO_MEMINFO, SO_PEERGROUPS, SO_ATTACH_BPF, SO_INCOMING_CPU, SO_BPF_EXTENSIONS, SO_MAX_PACING_RATE, SO_BUSY_POLL, SO_SELECT_ERR_QUEUE, SO_LOCK_FILTER, SO_NOFCS, SO_PEEK_OFF, SO_WIFI_STATUS, SO_RXQ_OVFL, SO_DOMAIN, SO_PROTOCOL, SO_TIMESTAMPING, SO_MARK, SO_TIMESTAMPNS, SO_PASSSEC, SO_PEERSEC, SO_ACCEPTCONN, SO_TIMESTAMP, SO_PEERNAME, SO_DETACH_FILTER, SO_ATTACH_FILTER, SO_BINDTODEVICE, SO_SECURITY_ENCRYPTION_NETWORK, SO_SECURITY_ENCRYPTION_TRANSPORT, SO_SECURITY_AUTHENTICATION, SO_SNDTIMEO, SO_RCVTIMEO, SO_SNDLOWAT, SO_RCVLOWAT, SO_PEERCRED, SO_PASSCRED, SO_REUSEPORT, SO_BSDCOMPAT, SO_LINGER, SO_PRIORITY, SO_NO_CHECK, SO_OOBINLINE, SO_KEEPALIVE, SO_RCVBUFFORCE, SO_SNDBUFFORCE, SO_RCVBUF, SO_SNDBUF, SO_BROADCAST, SO_DONTROUTE, SO_ERROR, SO_TYPE, SO_REUSEADDR, SO_DEBUG, UNKNOWN, DYNAMIC val, UINT32 optlen |
| Yes | < | getsockopt | ERRNO res, FD fd, ENUMFLAGS8 level: SOL_SOCKET, SOL_TCP, UNKNOWN, ENUMFLAGS8 optname: SO_COOKIE, SO_MEMINFO, SO_PEERGROUPS, SO_ATTACH_BPF, SO_INCOMING_CPU, SO_BPF_EXTENSIONS, SO_MAX_PACING_RATE, SO_BUSY_POLL, SO_SELECT_ERR_QUEUE, SO_LOCK_FILTER, SO_NOFCS, SO_PEEK_OFF, SO_WIFI_STATUS, SO_RXQ_OVFL, SO_DOMAIN, SO_PROTOCOL, SO_TIMESTAMPING, SO_MARK, SO_TIMESTAMPNS, SO_PASSSEC, SO_PEERSEC, SO_ACCEPTCONN, SO_TIMESTAMP, SO_PEERNAME, SO_DETACH_FILTER, SO_ATTACH_FILTER, SO_BINDTODEVICE, SO_SECURITY_ENCRYPTION_NETWORK, SO_SECURITY_ENCRYPTION_TRANSPORT, SO_SECURITY_AUTHENTICATION, SO_SNDTIMEO, SO_RCVTIMEO, SO_SNDLOWAT, SO_RCVLOWAT, SO_PEERCRED, SO_PASSCRED, SO_REUSEPORT, SO_BSDCOMPAT, SO_LINGER, SO_PRIORITY, SO_NO_CHECK, SO_OOBINLINE, SO_KEEPALIVE, SO_RCVBUFFORCE, SO_SNDBUFFORCE, SO_RCVBUF, SO_SNDBUF, SO_BROADCAST, SO_DONTROUTE, SO_ERROR, SO_TYPE, SO_REUSEADDR, SO_DEBUG, UNKNOWN, DYNAMIC val, UINT32 optlen |
| Yes | < | sendmsg | ERRNO res, BYTEBUF data, FD fd, UINT32 size, SOCKTUPLE tuple |
| Yes | < | sendmmsg | ERRNO res, FD fd, UINT32 size, BYTEBUF data, SOCKTUPLE tuple |
| Yes | < | recvmsg | ERRNO res, UINT32 size, BYTEBUF data, SOCKTUPLE tuple, BYTEBUF msgcontrol, FD fd |
| Yes | < | recvmmsg | ERRNO res, FD fd, UINT32 size, BYTEBUF data, SOCKTUPLE tuple, BYTEBUF msgcontrol |
| Yes | > | creat | FSPATH name, UINT32 mode |
| Yes | < | creat | FD fd, FSPATH name, UINT32 mode, UINT32 dev, UINT64 ino, FLAGS16 creat_flags: FD_UPPER_LAYER_CREAT, FD_LOWER_LAYER_CREAT |
| Yes | < | pipe | ERRNO res, FD fd1, FD fd2, UINT64 ino |
| Yes | < | eventfd | FD res, UINT64 initval, UINT32 flags |
| Yes | < | futex | ERRNO res, UINT64 addr, FLAGS16 op: FUTEX_CLOCK_REALTIME, FUTEX_PRIVATE_FLAG, FUTEX_CMP_REQUEUE_PI, FUTEX_WAIT_REQUEUE_PI, FUTEX_WAKE_BITSET, FUTEX_WAIT_BITSET, FUTEX_TRYLOCK_PI, FUTEX_UNLOCK_PI, FUTEX_LOCK_PI, FUTEX_WAKE_OP, FUTEX_CMP_REQUEUE, FUTEX_REQUEUE, FUTEX_FD, FUTEX_WAKE, FUTEX_WAIT, UINT64 val |
| Yes | < | stat | ERRNO res, FSPATH path |
| Yes | < | lstat | ERRNO res, FSPATH path |
| Yes | < | fstat | ERRNO res, FD fd |
| Yes | < | stat64 | ERRNO res, FSPATH path |
| Yes | < | lstat64 | ERRNO res, FSPATH path |
| Yes | < | fstat64 | ERRNO res |
| Yes | < | epoll_wait | ERRNO res, ERRNO maxevents |
| Yes | < | poll | ERRNO res, FDLIST fds, INT64 timeout |
| Yes | < | select | ERRNO res |
| Yes | < | lseek | ERRNO res, FD fd, UINT64 offset, ENUMFLAGS8 whence: SEEK_END, SEEK_CUR, SEEK_SET |
| Yes | < | llseek | ERRNO res, FD fd, UINT64 offset, ENUMFLAGS8 whence: SEEK_END, SEEK_CUR, SEEK_SET |
| Yes | < | getcwd | ERRNO res, CHARBUF path |
| Yes | < | chdir | ERRNO res, CHARBUF path |
| Yes | < | fchdir | ERRNO res, FD fd |
| No | < | pread | ERRNO res, BYTEBUF data, FD fd, UINT32 size, UINT64 pos |
| No | < | pwrite | ERRNO res, BYTEBUF data, FD fd, UINT32 size, UINT64 pos |
| No | < | readv | ERRNO res, UINT32 size, BYTEBUF data, FD fd |
| No | < | writev | ERRNO res, BYTEBUF data, FD fd, UINT32 size |
| No | < | preadv | ERRNO res, UINT32 size, BYTEBUF data, FD fd, UINT64 pos |
| No | < | pwritev | ERRNO res, BYTEBUF data, FD fd, UINT32 size, UINT64 pos |
| Yes | < | signalfd | FD res, FD fd, UINT32 mask, UINT8 flags |
| Yes | < | kill | ERRNO res, PID pid, SIGTYPE sig |
| Yes | < | tkill | ERRNO res, PID tid, SIGTYPE sig |
| Yes | < | tgkill | ERRNO res, PID pid, PID tid, SIGTYPE sig |
| Yes | < | nanosleep | ERRNO res, RELTIME interval |
| Yes | < | timerfd_create | FD res, UINT8 clockid, UINT8 flags |
| Yes | < | inotify_init | FD res, UINT8 flags |
| Yes | < | getrlimit | ERRNO res, INT64 cur, INT64 max, ENUMFLAGS8 resource: RLIMIT_UNKNOWN, RLIMIT_RTTIME, RLIMIT_RTPRIO, RLIMIT_NICE, RLIMIT_MSGQUEUE, RLIMIT_SIGPENDING, RLIMIT_LOCKS, RLIMIT_AS, RLIMIT_MEMLOCK, RLIMIT_NOFILE, RLIMIT_NPROC, RLIMIT_RSS, RLIMIT_CORE, RLIMIT_STACK, RLIMIT_DATA, RLIMIT_FSIZE, RLIMIT_CPU |
| Yes | < | setrlimit | ERRNO res, INT64 cur, INT64 max, ENUMFLAGS8 resource: RLIMIT_UNKNOWN, RLIMIT_RTTIME, RLIMIT_RTPRIO, RLIMIT_NICE, RLIMIT_MSGQUEUE, RLIMIT_SIGPENDING, RLIMIT_LOCKS, RLIMIT_AS, RLIMIT_MEMLOCK, RLIMIT_NOFILE, RLIMIT_NPROC, RLIMIT_RSS, RLIMIT_CORE, RLIMIT_STACK, RLIMIT_DATA, RLIMIT_FSIZE, RLIMIT_CPU |
| Yes | < | prlimit | ERRNO res, INT64 newcur, INT64 newmax, INT64 oldcur, INT64 oldmax, INT64 pid, ENUMFLAGS8 resource: RLIMIT_UNKNOWN, RLIMIT_RTTIME, RLIMIT_RTPRIO, RLIMIT_NICE, RLIMIT_MSGQUEUE, RLIMIT_SIGPENDING, RLIMIT_LOCKS, RLIMIT_AS, RLIMIT_MEMLOCK, RLIMIT_NOFILE, RLIMIT_NPROC, RLIMIT_RSS, RLIMIT_CORE, RLIMIT_STACK, RLIMIT_DATA, RLIMIT_FSIZE, RLIMIT_CPU |
| Yes | < | fcntl | FD res, FD fd, ENUMFLAGS8 cmd: F_GETPIPE_SZ, F_SETPIPE_SZ, F_NOTIFY, F_DUPFD_CLOEXEC, F_CANCELLK, F_GETLEASE, F_SETLEASE, F_GETOWN_EX, F_SETOWN_EX, F_SETLKW64, F_SETLK64, F_GETLK64, F_GETSIG, F_SETSIG, F_GETOWN, F_SETOWN, F_SETLKW, F_SETLK, F_GETLK, F_SETFL, F_GETFL, F_SETFD, F_GETFD, F_DUPFD, F_OFD_GETLK, F_OFD_SETLK, F_OFD_SETLKW, UNKNOWN |
| Yes | < | brk | UINT64 res, UINT32 vm_size, UINT32 vm_rss, UINT32 vm_swap, UINT64 addr |
| Yes | < | mmap | ERRNO res, UINT32 vm_size, UINT32 vm_rss, UINT32 vm_swap, UINT64 addr, UINT64 length, FLAGS32 prot: PROT_READ, PROT_WRITE, PROT_EXEC, PROT_SEM, PROT_GROWSDOWN, PROT_GROWSUP, PROT_SAO, PROT_NONE, FLAGS32 flags: MAP_SHARED, MAP_PRIVATE, MAP_FIXED, MAP_ANONYMOUS, MAP_32BIT, MAP_RENAME, MAP_NORESERVE, MAP_POPULATE, MAP_NONBLOCK, MAP_GROWSDOWN, MAP_DENYWRITE, MAP_EXECUTABLE, MAP_INHERIT, MAP_FILE, MAP_LOCKED, FD fd, UINT64 offset |
| Yes | < | mmap2 | ERRNO res, UINT32 vm_size, UINT32 vm_rss, UINT32 vm_swap, UINT64 addr, UINT64 length, FLAGS32 prot: PROT_READ, PROT_WRITE, PROT_EXEC, PROT_SEM, PROT_GROWSDOWN, PROT_GROWSUP, PROT_SAO, PROT_NONE, FLAGS32 flags: MAP_SHARED, MAP_PRIVATE, MAP_FIXED, MAP_ANONYMOUS, MAP_32BIT, MAP_RENAME, MAP_NORESERVE, MAP_POPULATE, MAP_NONBLOCK, MAP_GROWSDOWN, MAP_DENYWRITE, MAP_EXECUTABLE, MAP_INHERIT, MAP_FILE, MAP_LOCKED, FD fd, UINT64 pgoffset |
| Yes | < | munmap | ERRNO res, UINT32 vm_size, UINT32 vm_rss, UINT32 vm_swap, UINT64 addr, UINT64 length |
| Yes | < | splice | ERRNO res, FD fd_in, FD fd_out, UINT64 size, FLAGS32 flags: SPLICE_F_MOVE, SPLICE_F_NONBLOCK, SPLICE_F_MORE, SPLICE_F_GIFT |
| Yes | < | ptrace | ERRNO res, DYNAMIC addr, DYNAMIC data, ENUMFLAGS16 request: PTRACE_SINGLEBLOCK, PTRACE_SYSEMU_SINGLESTEP, PTRACE_SYSEMU, PTRACE_ARCH_PRCTL, PTRACE_SET_THREAD_AREA, PTRACE_GET_THREAD_AREA, PTRACE_OLDSETOPTIONS, PTRACE_SETFPXREGS, PTRACE_GETFPXREGS, PTRACE_SETFPREGS, PTRACE_GETFPREGS, PTRACE_SETREGS, PTRACE_GETREGS, PTRACE_SETSIGMASK, PTRACE_GETSIGMASK, PTRACE_PEEKSIGINFO, PTRACE_LISTEN, PTRACE_INTERRUPT, PTRACE_SEIZE, PTRACE_SETREGSET, PTRACE_GETREGSET, PTRACE_SETSIGINFO, PTRACE_GETSIGINFO, PTRACE_GETEVENTMSG, PTRACE_SETOPTIONS, PTRACE_SYSCALL, PTRACE_DETACH, PTRACE_ATTACH, PTRACE_SINGLESTEP, PTRACE_KILL, PTRACE_CONT, PTRACE_POKEUSR, PTRACE_POKEDATA, PTRACE_POKETEXT, PTRACE_PEEKUSR, PTRACE_PEEKDATA, PTRACE_PEEKTEXT, PTRACE_TRACEME, PTRACE_UNKNOWN, PID pid |
| Yes | < | ioctl | ERRNO res, FD fd, UINT64 request, UINT64 argument |
| Yes | < | rename | ERRNO res, FSPATH oldpath, FSPATH newpath |
| Yes | < | renameat | ERRNO res, FD olddirfd, FSRELPATH oldpath, FD newdirfd, FSRELPATH newpath |
| Yes | < | symlink | ERRNO res, CHARBUF target, FSPATH linkpath |
| Yes | < | symlinkat | ERRNO res, CHARBUF target, FD linkdirfd, FSRELPATH linkpath |
| No | < | sendfile | ERRNO res, UINT64 offset, FD out_fd, FD in_fd, UINT64 size |
| Yes | < | quotactl | ERRNO res, CHARBUF special, CHARBUF quotafilepath, UINT64 dqb_bhardlimit, UINT64 dqb_bsoftlimit, UINT64 dqb_curspace, UINT64 dqb_ihardlimit, UINT64 dqb_isoftlimit, RELTIME dqb_btime, RELTIME dqb_itime, RELTIME dqi_bgrace, RELTIME dqi_igrace, FLAGS8 dqi_flags: DQF_NONE, V1_DQF_RSQUASH, FLAGS8 quota_fmt_out: QFMT_NOT_USED, QFMT_VFS_OLD, QFMT_VFS_V0, QFMT_VFS_V1, FLAGS16 cmd: Q_QUOTAON, Q_QUOTAOFF, Q_GETFMT, Q_GETINFO, Q_SETINFO, Q_GETQUOTA, Q_SETQUOTA, Q_SYNC, Q_XQUOTAON, Q_XQUOTAOFF, Q_XGETQUOTA, Q_XSETQLIM, Q_XGETQSTAT, Q_XQUOTARM, Q_XQUOTASYNC, FLAGS8 type: USRQUOTA, GRPQUOTA, UINT32 id, FLAGS8 quota_fmt: QFMT_NOT_USED, QFMT_VFS_OLD, QFMT_VFS_V0, QFMT_VFS_V1 |
| Yes | < | setresuid | ERRNO res, UID ruid, UID euid, UID suid |
| Yes | < | setresgid | ERRNO res, GID rgid, GID egid, GID sgid |
| Yes | < | setuid | ERRNO res, UID uid |
| Yes | < | setgid | ERRNO res, GID gid |
| Yes | < | getuid | UID uid |
| Yes | < | geteuid | UID euid |
| Yes | < | getgid | GID gid |
| Yes | < | getegid | GID egid |
| Yes | < | getresuid | ERRNO res, UID ruid, UID euid, UID suid |
| Yes | < | getresgid | ERRNO res, GID rgid, GID egid, GID sgid |
| Yes | < | clone | PID res, CHARBUF exe, BYTEBUF args, PID tid, PID pid, PID ptid, CHARBUF cwd, INT64 fdlimit, UINT64 pgft_maj, UINT64 pgft_min, UINT32 vm_size, UINT32 vm_rss, UINT32 vm_swap, CHARBUF comm, BYTEBUF cgroups, FLAGS32 flags: CLONE_FILES, CLONE_FS, CLONE_IO, CLONE_NEWIPC, CLONE_NEWNET, CLONE_NEWNS, CLONE_NEWPID, CLONE_NEWUTS, CLONE_PARENT, CLONE_PARENT_SETTID, CLONE_PTRACE, CLONE_SIGHAND, CLONE_SYSVSEM, CLONE_THREAD, CLONE_UNTRACED, CLONE_VM, CLONE_INVERTED, NAME_CHANGED, CLOSED, CLONE_NEWUSER, CLONE_CHILD_CLEARTID, CLONE_CHILD_SETTID, CLONE_SETTLS, CLONE_STOPPED, CLONE_VFORK, CLONE_NEWCGROUP, UINT32 uid, UINT32 gid, PID vtid, PID vpid, UINT64 pidns_init_start_ts |
| Yes | < | fork | PID res, CHARBUF exe, BYTEBUF args, PID tid, PID pid, PID ptid, CHARBUF cwd, INT64 fdlimit, UINT64 pgft_maj, UINT64 pgft_min, UINT32 vm_size, UINT32 vm_rss, UINT32 vm_swap, CHARBUF comm, BYTEBUF cgroups, FLAGS32 flags: CLONE_FILES, CLONE_FS, CLONE_IO, CLONE_NEWIPC, CLONE_NEWNET, CLONE_NEWNS, CLONE_NEWPID, CLONE_NEWUTS, CLONE_PARENT, CLONE_PARENT_SETTID, CLONE_PTRACE, CLONE_SIGHAND, CLONE_SYSVSEM, CLONE_THREAD, CLONE_UNTRACED, CLONE_VM, CLONE_INVERTED, NAME_CHANGED, CLOSED, CLONE_NEWUSER, CLONE_CHILD_CLEARTID, CLONE_CHILD_SETTID, CLONE_SETTLS, CLONE_STOPPED, CLONE_VFORK, CLONE_NEWCGROUP, UINT32 uid, UINT32 gid, PID vtid, PID vpid, UINT64 pidns_init_start_ts |
| Yes | < | vfork | PID res, CHARBUF exe, BYTEBUF args, PID tid, PID pid, PID ptid, CHARBUF cwd, INT64 fdlimit, UINT64 pgft_maj, UINT64 pgft_min, UINT32 vm_size, UINT32 vm_rss, UINT32 vm_swap, CHARBUF comm, BYTEBUF cgroups, FLAGS32 flags: CLONE_FILES, CLONE_FS, CLONE_IO, CLONE_NEWIPC, CLONE_NEWNET, CLONE_NEWNS, CLONE_NEWPID, CLONE_NEWUTS, CLONE_PARENT, CLONE_PARENT_SETTID, CLONE_PTRACE, CLONE_SIGHAND, CLONE_SYSVSEM, CLONE_THREAD, CLONE_UNTRACED, CLONE_VM, CLONE_INVERTED, NAME_CHANGED, CLOSED, CLONE_NEWUSER, CLONE_CHILD_CLEARTID, CLONE_CHILD_SETTID, CLONE_SETTLS, CLONE_STOPPED, CLONE_VFORK, CLONE_NEWCGROUP, UINT32 uid, UINT32 gid, PID vtid, PID vpid, UINT64 pidns_init_start_ts |
| Yes | < | getdents | ERRNO res, FD fd |
| Yes | < | getdents64 | ERRNO res, FD fd |
| Yes | < | setns | ERRNO res, FD fd, FLAGS32 nstype: CLONE_FILES, CLONE_FS, CLONE_IO, CLONE_NEWIPC, CLONE_NEWNET, CLONE_NEWNS, CLONE_NEWPID, CLONE_NEWUTS, CLONE_PARENT, CLONE_PARENT_SETTID, CLONE_PTRACE, CLONE_SIGHAND, CLONE_SYSVSEM, CLONE_THREAD, CLONE_UNTRACED, CLONE_VM, CLONE_INVERTED, NAME_CHANGED, CLOSED, CLONE_NEWUSER, CLONE_CHILD_CLEARTID, CLONE_CHILD_SETTID, CLONE_SETTLS, CLONE_STOPPED, CLONE_VFORK, CLONE_NEWCGROUP |
| Yes | < | flock | ERRNO res, FD fd, FLAGS32 operation: LOCK_SH, LOCK_EX, LOCK_NB, LOCK_UN, LOCK_NONE |
| Yes | < | accept | FD fd, SOCKTUPLE tuple, UINT8 queuepct, UINT32 queuelen, UINT32 queuemax |
| Yes | < | semop | ERRNO res, UINT32 nsops, UINT16 sem_num_0, INT16 sem_op_0, FLAGS16 sem_flg_0: IPC_NOWAIT, SEM_UNDO, UINT16 sem_num_1, INT16 sem_op_1, FLAGS16 sem_flg_1: IPC_NOWAIT, SEM_UNDO, INT32 semid |
| Yes | < | semctl | ERRNO res, INT32 semid, INT32 semnum, FLAGS16 cmd: IPC_STAT, IPC_SET, IPC_RMID, IPC_INFO, SEM_INFO, SEM_STAT, GETALL, GETNCNT, GETPID, GETVAL, GETZCNT, SETALL, SETVAL, INT32 val |
| Yes | < | ppoll | ERRNO res, FDLIST fds, RELTIME timeout, SIGSET sigmask |
| Yes | < | mount | ERRNO res, CHARBUF dev, FSPATH dir, CHARBUF type, FLAGS32 flags: RDONLY, NOSUID, NODEV, NOEXEC, SYNCHRONOUS, REMOUNT, MANDLOCK, DIRSYNC, NOATIME, NODIRATIME, BIND, MOVE, REC, SILENT, POSIXACL, UNBINDABLE, PRIVATE, SLAVE, SHARED, RELATIME, KERNMOUNT, I_VERSION, STRICTATIME, LAZYTIME, NOSEC, BORN, ACTIVE, NOUSER |
| Yes | < | semget | ERRNO res, INT32 key, INT32 nsems, FLAGS32 semflg: IPC_EXCL, IPC_CREAT |
| Yes | < | access | ERRNO res, FSPATH name, FLAGS32 mode: F_OK, R_OK, W_OK, X_OK |
| Yes | < | chroot | ERRNO res, FSPATH path |
| Yes | < | setsid | PID res |
| Yes | < | mkdir | ERRNO res, FSPATH path, UINT32 mode |
| Yes | < | rmdir | ERRNO res, FSPATH path |
| Yes | < | unshare | ERRNO res, FLAGS32 flags: CLONE_FILES, CLONE_FS, CLONE_IO, CLONE_NEWIPC, CLONE_NEWNET, CLONE_NEWNS, CLONE_NEWPID, CLONE_NEWUTS, CLONE_PARENT, CLONE_PARENT_SETTID, CLONE_PTRACE, CLONE_SIGHAND, CLONE_SYSVSEM, CLONE_THREAD, CLONE_UNTRACED, CLONE_VM, CLONE_INVERTED, NAME_CHANGED, CLOSED, CLONE_NEWUSER, CLONE_CHILD_CLEARTID, CLONE_CHILD_SETTID, CLONE_SETTLS, CLONE_STOPPED, CLONE_VFORK, CLONE_NEWCGROUP |
| Yes | < | execve | ERRNO res, CHARBUF exe, BYTEBUF args, PID tid, PID pid, PID ptid, CHARBUF cwd, UINT64 fdlimit, UINT64 pgft_maj, UINT64 pgft_min, UINT32 vm_size, UINT32 vm_rss, UINT32 vm_swap, CHARBUF comm, BYTEBUF cgroups, BYTEBUF env, UINT32 tty, PID vpgid, UID loginuid, FLAGS32 flags: EXE_WRITABLE, EXE_UPPER_LAYER, EXE_FROM_MEMFD, EXE_LOWER_LAYER, UINT64 cap_inheritable, UINT64 cap_permitted, UINT64 cap_effective, UINT64 exe_ino, ABSTIME exe_ino_ctime, ABSTIME exe_ino_mtime, UID uid, FSPATH trusted_exepath, PID pgid, GID gid |
| Yes | < | setpgid | ERRNO res, PID pid, PID pgid |
| Yes | < | seccomp | ERRNO res, UINT64 op, UINT64 flags |
| Yes | < | unlink | ERRNO res, FSPATH path |
| Yes | < | unlinkat | ERRNO res, FD dirfd, FSRELPATH name, FLAGS32 flags: AT_REMOVEDIR |
| Yes | < | mkdirat | ERRNO res, FD dirfd, FSRELPATH path, UINT32 mode |
| Yes | > | openat | FD dirfd, FSRELPATH name, FLAGS32 flags: O_LARGEFILE, O_DIRECTORY, O_DIRECT, O_TRUNC, O_SYNC, O_NONBLOCK, O_EXCL, O_DSYNC, O_APPEND, O_CREAT, O_RDWR, O_WRONLY, O_RDONLY, O_CLOEXEC, O_NONE, O_TMPFILE, O_F_CREATED, FD_UPPER_LAYER, FD_LOWER_LAYER, UINT32 mode |
| Yes | < | openat | FD fd, FD dirfd, FSRELPATH name, FLAGS32 flags: O_LARGEFILE, O_DIRECTORY, O_DIRECT, O_TRUNC, O_SYNC, O_NONBLOCK, O_EXCL, O_DSYNC, O_APPEND, O_CREAT, O_RDWR, O_WRONLY, O_RDONLY, O_CLOEXEC, O_NONE, O_TMPFILE, O_F_CREATED, FD_UPPER_LAYER, FD_LOWER_LAYER, UINT32 mode, UINT32 dev, UINT64 ino |
| Yes | < | link | ERRNO res, FSPATH oldpath, FSPATH newpath |
| Yes | < | linkat | ERRNO res, FD olddir, FSRELPATH oldpath, FD newdir, FSRELPATH newpath, FLAGS32 flags: AT_SYMLINK_FOLLOW, AT_EMPTY_PATH |
| Yes | < | fchmodat | ERRNO res, FD dirfd, FSRELPATH filename, MODE mode |
| Yes | < | chmod | ERRNO res, FSPATH filename, MODE mode |
| Yes | < | fchmod | ERRNO res, FD fd, MODE mode |
| Yes | < | renameat2 | ERRNO res, FD olddirfd, FSRELPATH oldpath, FD newdirfd, FSRELPATH newpath, FLAGS32 flags: RENAME_NOREPLACE, RENAME_EXCHANGE, RENAME_WHITEOUT |
| Yes | < | userfaultfd | ERRNO res, FLAGS32 flags: O_LARGEFILE, O_DIRECTORY, O_DIRECT, O_TRUNC, O_SYNC, O_NONBLOCK, O_EXCL, O_DSYNC, O_APPEND, O_CREAT, O_RDWR, O_WRONLY, O_RDONLY, O_CLOEXEC, O_NONE, O_TMPFILE, O_F_CREATED, FD_UPPER_LAYER, FD_LOWER_LAYER |
| Yes | > | openat2 | FD dirfd, FSRELPATH name, FLAGS32 flags: O_LARGEFILE, O_DIRECTORY, O_DIRECT, O_TRUNC, O_SYNC, O_NONBLOCK, O_EXCL, O_DSYNC, O_APPEND, O_CREAT, O_RDWR, O_WRONLY, O_RDONLY, O_CLOEXEC, O_NONE, O_TMPFILE, O_F_CREATED, FD_UPPER_LAYER, FD_LOWER_LAYER, UINT32 mode, FLAGS32 resolve: RESOLVE_BENEATH, RESOLVE_IN_ROOT, RESOLVE_NO_MAGICLINKS, RESOLVE_NO_SYMLINKS, RESOLVE_NO_XDEV, RESOLVE_CACHED |
| Yes | < | openat2 | FD fd, FD dirfd, FSRELPATH name, FLAGS32 flags: O_LARGEFILE, O_DIRECTORY, O_DIRECT, O_TRUNC, O_SYNC, O_NONBLOCK, O_EXCL, O_DSYNC, O_APPEND, O_CREAT, O_RDWR, O_WRONLY, O_RDONLY, O_CLOEXEC, O_NONE, O_TMPFILE, O_F_CREATED, FD_UPPER_LAYER, FD_LOWER_LAYER, UINT32 mode, FLAGS32 resolve: RESOLVE_BENEATH, RESOLVE_IN_ROOT, RESOLVE_NO_MAGICLINKS, RESOLVE_NO_SYMLINKS, RESOLVE_NO_XDEV, RESOLVE_CACHED, UINT32 dev, UINT64 ino |
| Yes | < | mprotect | ERRNO res, UINT64 addr, UINT64 length, FLAGS32 prot: PROT_READ, PROT_WRITE, PROT_EXEC, PROT_SEM, PROT_GROWSDOWN, PROT_GROWSUP, PROT_SAO, PROT_NONE |
| Yes | < | execveat | ERRNO res, CHARBUF exe, BYTEBUF args, PID tid, PID pid, PID ptid, CHARBUF cwd, UINT64 fdlimit, UINT64 pgft_maj, UINT64 pgft_min, UINT32 vm_size, UINT32 vm_rss, UINT32 vm_swap, CHARBUF comm, BYTEBUF cgroups, BYTEBUF env, UINT32 tty, PID vpgid, UID loginuid, FLAGS32 flags: EXE_WRITABLE, EXE_UPPER_LAYER, EXE_FROM_MEMFD, EXE_LOWER_LAYER, UINT64 cap_inheritable, UINT64 cap_permitted, UINT64 cap_effective, UINT64 exe_ino, ABSTIME exe_ino_ctime, ABSTIME exe_ino_mtime, UID uid, FSPATH trusted_exepath, PID pgid, GID gid |
| Yes | < | copy_file_range | ERRNO res, FD fdout, UINT64 offout, FD fdin, UINT64 offin, UINT64 len |
| Yes | < | clone3 | PID res, CHARBUF exe, BYTEBUF args, PID tid, PID pid, PID ptid, CHARBUF cwd, INT64 fdlimit, UINT64 pgft_maj, UINT64 pgft_min, UINT32 vm_size, UINT32 vm_rss, UINT32 vm_swap, CHARBUF comm, BYTEBUF cgroups, FLAGS32 flags: CLONE_FILES, CLONE_FS, CLONE_IO, CLONE_NEWIPC, CLONE_NEWNET, CLONE_NEWNS, CLONE_NEWPID, CLONE_NEWUTS, CLONE_PARENT, CLONE_PARENT_SETTID, CLONE_PTRACE, CLONE_SIGHAND, CLONE_SYSVSEM, CLONE_THREAD, CLONE_UNTRACED, CLONE_VM, CLONE_INVERTED, NAME_CHANGED, CLOSED, CLONE_NEWUSER, CLONE_CHILD_CLEARTID, CLONE_CHILD_SETTID, CLONE_SETTLS, CLONE_STOPPED, CLONE_VFORK, CLONE_NEWCGROUP, UINT32 uid, UINT32 gid, PID vtid, PID vpid, UINT64 pidns_init_start_ts |
| Yes | < | open_by_handle_at | FD fd, FD mountfd, FLAGS32 flags: O_LARGEFILE, O_DIRECTORY, O_DIRECT, O_TRUNC, O_SYNC, O_NONBLOCK, O_EXCL, O_DSYNC, O_APPEND, O_CREAT, O_RDWR, O_WRONLY, O_RDONLY, O_CLOEXEC, O_NONE, O_TMPFILE, O_F_CREATED, FD_UPPER_LAYER, FD_LOWER_LAYER, FSPATH path, UINT32 dev, UINT64 ino |
| Yes | < | io_uring_setup | ERRNO res, UINT32 entries, UINT32 sq_entries, UINT32 cq_entries, FLAGS32 flags: IORING_SETUP_IOPOLL, IORING_SETUP_SQPOLL, IORING_SQ_NEED_WAKEUP, IORING_SETUP_SQ_AFF, IORING_SETUP_CQSIZE, IORING_SETUP_CLAMP, IORING_SETUP_ATTACH_RW, IORING_SETUP_R_DISABLED, UINT32 sq_thread_cpu, UINT32 sq_thread_idle, FLAGS32 features: IORING_FEAT_SINGLE_MMAP, IORING_FEAT_NODROP, IORING_FEAT_SUBMIT_STABLE, IORING_FEAT_RW_CUR_POS, IORING_FEAT_CUR_PERSONALITY, IORING_FEAT_FAST_POLL, IORING_FEAT_POLL_32BITS, IORING_FEAT_SQPOLL_NONFIXED, IORING_FEAT_ENTER_EXT_ARG, IORING_FEAT_NATIVE_WORKERS, IORING_FEAT_RSRC_TAGS |
| Yes | < | io_uring_enter | ERRNO res, FD fd, UINT32 to_submit, UINT32 min_complete, FLAGS32 flags: IORING_ENTER_GETEVENTS, IORING_ENTER_SQ_WAKEUP, IORING_ENTER_SQ_WAIT, IORING_ENTER_EXT_ARG, SIGSET sig |
| Yes | < | io_uring_register | ERRNO res, FD fd, ENUMFLAGS16 opcode: IORING_REGISTER_BUFFERS, IORING_UNREGISTER_BUFFERS, IORING_REGISTER_FILES, IORING_UNREGISTER_FILES, IORING_REGISTER_EVENTFD, IORING_UNREGISTER_EVENTFD, IORING_REGISTER_FILES_UPDATE, IORING_REGISTER_EVENTFD_ASYNC, IORING_REGISTER_PROBE, IORING_REGISTER_PERSONALITY, IORING_UNREGISTER_PERSONALITY, IORING_REGISTER_RESTRICTIONS, IORING_REGISTER_ENABLE_RINGS, IORING_REGISTER_FILES2, IORING_REGISTER_FILES_UPDATE2, IORING_REGISTER_BUFFERS2, IORING_REGISTER_BUFFERS_UPDATE, IORING_REGISTER_IOWQ_AFF, IORING_UNREGISTER_IOWQ_AFF, IORING_REGISTER_IOWQ_MAX_WORKERS, IORING_REGISTER_RING_FDS, IORING_UNREGISTER_RING_FDS, UINT64 arg, UINT32 nr_args |
| Yes | < | mlock | ERRNO res, UINT64 addr, UINT64 len |
| Yes | < | munlock | ERRNO res, UINT64 addr, UINT64 len |
| Yes | < | mlockall | ERRNO res, FLAGS32 flags: MCL_CURRENT, MCL_FUTURE, MCL_ONFAULT |
| Yes | < | munlockall | ERRNO res |
| Yes | < | capset | ERRNO res, UINT64 cap_inheritable, UINT64 cap_permitted, UINT64 cap_effective |
| Yes | < | dup2 | FD res, FD oldfd, FD newfd |
| Yes | < | dup3 | FD res, FD oldfd, FD newfd, FLAGS32 flags: O_LARGEFILE, O_DIRECTORY, O_DIRECT, O_TRUNC, O_SYNC, O_NONBLOCK, O_EXCL, O_DSYNC, O_APPEND, O_CREAT, O_RDWR, O_WRONLY, O_RDONLY, O_CLOEXEC, O_NONE, O_TMPFILE, O_F_CREATED, FD_UPPER_LAYER, FD_LOWER_LAYER |
| Yes | < | dup | FD res, FD oldfd |
| Yes | < | bpf | FD fd, ENUMFLAGS32 cmd: BPF_MAP_CREATE, BPF_MAP_LOOKUP_ELEM, BPF_MAP_UPDATE_ELEM, BPF_MAP_DELETE_ELEM, BPF_MAP_GET_NEXT_KEY, BPF_PROG_LOAD, BPF_OBJ_PIN, BPF_OBJ_GET, BPF_PROG_ATTACH, BPF_PROG_DETACH, BPF_PROG_TEST_RUN, BPF_PROG_RUN, BPF_PROG_GET_NEXT_ID, BPF_MAP_GET_NEXT_ID, BPF_PROG_GET_FD_BY_ID, BPF_MAP_GET_FD_BY_ID, BPF_OBJ_GET_INFO_BY_FD, BPF_PROG_QUERY, BPF_RAW_TRACEPOINT_OPEN, BPF_BTF_LOAD, BPF_BTF_GET_FD_BY_ID, BPF_TASK_FD_QUERY, BPF_MAP_LOOKUP_AND_DELETE_ELEM, BPF_MAP_FREEZE, BPF_BTF_GET_NEXT_ID, BPF_MAP_LOOKUP_BATCH, BPF_MAP_LOOKUP_AND_DELETE_BATCH, BPF_MAP_UPDATE_BATCH, BPF_MAP_DELETE_BATCH, BPF_LINK_CREATE, BPF_LINK_UPDATE, BPF_LINK_GET_FD_BY_ID, BPF_LINK_GET_NEXT_ID, BPF_ENABLE_STATS, BPF_ITER_CREATE, BPF_LINK_DETACH, BPF_PROG_BIND_MAP |
| Yes | < | mlock2 | ERRNO res, UINT64 addr, UINT64 len, FLAGS32 flags: MLOCK_ONFAULT |
| Yes | < | fsconfig | ERRNO res, FD fd, ENUMFLAGS32 cmd: FSCONFIG_SET_FLAG, FSCONFIG_SET_STRING, FSCONFIG_SET_BINARY, FSCONFIG_SET_PATH, FSCONFIG_SET_PATH_EMPTY, FSCONFIG_SET_FD, FSCONFIG_CMD_CREATE, FSCONFIG_CMD_RECONFIGURE, CHARBUF key, BYTEBUF value_bytebuf, CHARBUF value_charbuf, INT32 aux |
| Yes | < | epoll_create | ERRNO res, INT32 size |
| Yes | < | epoll_create1 | ERRNO res, FLAGS32 flags: EPOLL_CLOEXEC |
| Yes | < | chown | ERRNO res, FSPATH path, UINT32 uid, UINT32 gid |
| Yes | < | lchown | ERRNO res, FSPATH path, UINT32 uid, UINT32 gid |
| Yes | < | fchown | ERRNO res, FD fd, UINT32 uid, UINT32 gid |
| Yes | < | fchownat | ERRNO res, FD dirfd, FSRELPATH pathname, UINT32 uid, UINT32 gid, FLAGS32 flags: AT_SYMLINK_NOFOLLOW, AT_EMPTY_PATH |
| Yes | < | umount | ERRNO res, FSPATH name |
| Yes | < | accept4 | FD fd, SOCKTUPLE tuple, UINT8 queuepct, UINT32 queuelen, UINT32 queuemax, INT32 flags |
| Yes | < | umount2 | ERRNO res, FSPATH name, FLAGS32 flags: FORCE, DETACH, EXPIRE, NOFOLLOW |
| Yes | < | pipe2 | ERRNO res, FD fd1, FD fd2, UINT64 ino, FLAGS32 flags: O_LARGEFILE, O_DIRECTORY, O_DIRECT, O_TRUNC, O_SYNC, O_NONBLOCK, O_EXCL, O_DSYNC, O_APPEND, O_CREAT, O_RDWR, O_WRONLY, O_RDONLY, O_CLOEXEC, O_NONE, O_TMPFILE, O_F_CREATED, FD_UPPER_LAYER, FD_LOWER_LAYER |
| Yes | < | inotify_init1 | FD res, FLAGS16 flags: O_LARGEFILE, O_DIRECTORY, O_DIRECT, O_TRUNC, O_SYNC, O_NONBLOCK, O_EXCL, O_DSYNC, O_APPEND, O_CREAT, O_RDWR, O_WRONLY, O_RDONLY, O_CLOEXEC, O_NONE, O_TMPFILE, O_F_CREATED, FD_UPPER_LAYER, FD_LOWER_LAYER |
| Yes | < | eventfd2 | FD res, FLAGS16 flags: O_LARGEFILE, O_DIRECTORY, O_DIRECT, O_TRUNC, O_SYNC, O_NONBLOCK, O_EXCL, O_DSYNC, O_APPEND, O_CREAT, O_RDWR, O_WRONLY, O_RDONLY, O_CLOEXEC, O_NONE, O_TMPFILE, O_F_CREATED, FD_UPPER_LAYER, FD_LOWER_LAYER, UINT64 initval |
| Yes | < | signalfd4 | FD res, FLAGS16 flags: O_LARGEFILE, O_DIRECTORY, O_DIRECT, O_TRUNC, O_SYNC, O_NONBLOCK, O_EXCL, O_DSYNC, O_APPEND, O_CREAT, O_RDWR, O_WRONLY, O_RDONLY, O_CLOEXEC, O_NONE, O_TMPFILE, O_F_CREATED, FD_UPPER_LAYER, FD_LOWER_LAYER, FD fd, UINT32 mask |
| Yes | < | prctl | ERRNO res, ENUMFLAGS32 option: PR_GET_DUMPABLE, PR_SET_DUMPABLE, PR_GET_KEEPCAPS, PR_SET_KEEPCAPS, PR_SET_NAME, PR_GET_NAME, PR_GET_SECCOMP, PR_SET_SECCOMP, PR_CAPBSET_READ, PR_CAPBSET_DROP, PR_GET_SECUREBITS, PR_SET_SECUREBITS, PR_MCE_KILL, PR_MCE_KILL, PR_SET_MM, PR_SET_CHILD_SUBREAPER, PR_GET_CHILD_SUBREAPER, PR_SET_NO_NEW_PRIVS, PR_GET_NO_NEW_PRIVS, PR_GET_TID_ADDRESS, PR_SET_THP_DISABLE, PR_GET_THP_DISABLE, PR_CAP_AMBIENT, CHARBUF arg2_str, INT64 arg2_int |
| Yes | < | memfd_create | FD fd, CHARBUF name, FLAGS32 flags: MFD_CLOEXEC, MFD_ALLOW_SEALING, MFD_HUGETLB |
| Yes | < | pidfd_getfd | FD fd, FD pid_fd, FD target_fd, UINT32 flags |
| Yes | < | pidfd_open | FD fd, PID pid, FLAGS32 flags: PIDFD_NONBLOCK |
| Yes | < | init_module | ERRNO res, BYTEBUF img, UINT64 length, CHARBUF uargs |
| Yes | < | finit_module | ERRNO res, FD fd, CHARBUF uargs, FLAGS32 flags: MODULE_INIT_IGNORE_MODVERSIONS, MODULE_INIT_IGNORE_VERMAGIC, MODULE_INIT_COMPRESSED_FILE |
| Yes | < | mknod | ERRNO res, FSPATH path, MODE mode, UINT32 dev |
| Yes | < | mknodat | ERRNO res, FD dirfd, FSRELPATH path, MODE mode, UINT32 dev |
| Yes | < | newfstatat | ERRNO res, FD dirfd, FSRELPATH path, FLAGS32 flags: AT_EMPTY_PATH, AT_NO_AUTOMOUNT, AT_SYMLINK_NOFOLLOW |
| Yes | < | process_vm_readv | INT64 res, PID pid, BYTEBUF data |
| Yes | < | process_vm_writev | INT64 res, PID pid, BYTEBUF data |
| Yes | < | delete_module | ERRNO res, CHARBUF name, FLAGS32 flags: O_NONBLOCK, O_TRUNC |
| Yes | < | setreuid | ERRNO res, UID ruid, UID euid |
| Yes | < | setregid | ERRNO res, UID rgid, UID egid |
| Yes | > | adjtimex | SYSCALLID ID, UINT16 nativeID |
| Yes | < | adjtimex | SYSCALLID ID, UINT16 nativeID |
| Yes | > | exit | SYSCALLID ID, UINT16 nativeID |
| Yes | < | exit | SYSCALLID ID, UINT16 nativeID |
| Yes | > | sethostname | SYSCALLID ID, UINT16 nativeID |
| Yes | < | sethostname | SYSCALLID ID, UINT16 nativeID |
| Yes | > | getsid | SYSCALLID ID, UINT16 nativeID |
| Yes | < | getsid | SYSCALLID ID, UINT16 nativeID |
| Yes | > | fstatfs | SYSCALLID ID, UINT16 nativeID |
| Yes | < | fstatfs | SYSCALLID ID, UINT16 nativeID |
| Yes | > | pivot_root | SYSCALLID ID, UINT16 nativeID |
| Yes | < | pivot_root | SYSCALLID ID, UINT16 nativeID |
| Yes | > | oldstat | SYSCALLID ID, UINT16 nativeID |
| Yes | < | oldstat | SYSCALLID ID, UINT16 nativeID |
| Yes | > | umask | SYSCALLID ID, UINT16 nativeID |
| Yes | < | umask | SYSCALLID ID, UINT16 nativeID |
| Yes | > | madvise | SYSCALLID ID, UINT16 nativeID |
| Yes | < | madvise | SYSCALLID ID, UINT16 nativeID |
| Yes | > | statfs64 | SYSCALLID ID, UINT16 nativeID |
| Yes | < | statfs64 | SYSCALLID ID, UINT16 nativeID |
| Yes | > | iopl | SYSCALLID ID, UINT16 nativeID |
| Yes | < | iopl | SYSCALLID ID, UINT16 nativeID |
| Yes | > | swapon | SYSCALLID ID, UINT16 nativeID |
| Yes | < | swapon | SYSCALLID ID, UINT16 nativeID |
| Yes | > | utime | SYSCALLID ID, UINT16 nativeID |
| Yes | < | utime | SYSCALLID ID, UINT16 nativeID |
| Yes | > | getpid | SYSCALLID ID, UINT16 nativeID |
| Yes | < | getpid | SYSCALLID ID, UINT16 nativeID |
| Yes | > | setdomainname | SYSCALLID ID, UINT16 nativeID |
| Yes | < | setdomainname | SYSCALLID ID, UINT16 nativeID |
| Yes | > | semtimedop | SYSCALLID ID, UINT16 nativeID |
| Yes | < | semtimedop | SYSCALLID ID, UINT16 nativeID |
| Yes | > | mq_notify | SYSCALLID ID, UINT16 nativeID |
| Yes | < | mq_notify | SYSCALLID ID, UINT16 nativeID |
| Yes | > | nfsservctl | SYSCALLID ID, UINT16 nativeID |
| Yes | < | nfsservctl | SYSCALLID ID, UINT16 nativeID |
| Yes | > | pkey_mprotect | SYSCALLID ID, UINT16 nativeID |
| Yes | < | pkey_mprotect | SYSCALLID ID, UINT16 nativeID |
| Yes | > | fgetxattr | SYSCALLID ID, UINT16 nativeID |
| Yes | < | fgetxattr | SYSCALLID ID, UINT16 nativeID |
| Yes | > | sysinfo | SYSCALLID ID, UINT16 nativeID |
| Yes | < | sysinfo | SYSCALLID ID, UINT16 nativeID |
| Yes | > | uselib | SYSCALLID ID, UINT16 nativeID |
| Yes | < | uselib | SYSCALLID ID, UINT16 nativeID |
| Yes | > | olduname | SYSCALLID ID, UINT16 nativeID |
| Yes | < | olduname | SYSCALLID ID, UINT16 nativeID |
| Yes | > | set_mempolicy | SYSCALLID ID, UINT16 nativeID |
| Yes | < | set_mempolicy | SYSCALLID ID, UINT16 nativeID |
| Yes | > | getppid | SYSCALLID ID, UINT16 nativeID |
| Yes | < | getppid | SYSCALLID ID, UINT16 nativeID |
| Yes | > | sched_yield | SYSCALLID ID, UINT16 nativeID |
| Yes | < | sched_yield | SYSCALLID ID, UINT16 nativeID |
| Yes | > | getrusage | SYSCALLID ID, UINT16 nativeID |
| Yes | < | getrusage | SYSCALLID ID, UINT16 nativeID |
| Yes | > | sigsuspend | SYSCALLID ID, UINT16 nativeID |
| Yes | < | sigsuspend | SYSCALLID ID, UINT16 nativeID |
| Yes | > | riscv_hwprobe | SYSCALLID ID, UINT16 nativeID |
| Yes | < | riscv_hwprobe | SYSCALLID ID, UINT16 nativeID |
| Yes | > | bdflush | SYSCALLID ID, UINT16 nativeID |
| Yes | < | bdflush | SYSCALLID ID, UINT16 nativeID |
| Yes | > | get_kernel_syms | SYSCALLID ID, UINT16 nativeID |
| Yes | < | get_kernel_syms | SYSCALLID ID, UINT16 nativeID |
| Yes | > | pause | SYSCALLID ID, UINT16 nativeID |
| Yes | < | pause | SYSCALLID ID, UINT16 nativeID |
| Yes | > | getpmsg | SYSCALLID ID, UINT16 nativeID |
| Yes | < | getpmsg | SYSCALLID ID, UINT16 nativeID |
| Yes | > | clock_gettime | SYSCALLID ID, UINT16 nativeID |
| Yes | < | clock_gettime | SYSCALLID ID, UINT16 nativeID |
| Yes | > | mq_getsetattr | SYSCALLID ID, UINT16 nativeID |
| Yes | < | mq_getsetattr | SYSCALLID ID, UINT16 nativeID |
| Yes | > | spu_run | SYSCALLID ID, UINT16 nativeID |
| Yes | < | spu_run | SYSCALLID ID, UINT16 nativeID |
| Yes | > | personality | SYSCALLID ID, UINT16 nativeID |
| Yes | < | personality | SYSCALLID ID, UINT16 nativeID |
| Yes | > | request_key | SYSCALLID ID, UINT16 nativeID |
| Yes | < | request_key | SYSCALLID ID, UINT16 nativeID |
| Yes | > | readlink | SYSCALLID ID, UINT16 nativeID |
| Yes | < | readlink | SYSCALLID ID, UINT16 nativeID |
| Yes | > | times | SYSCALLID ID, UINT16 nativeID |
| Yes | < | times | SYSCALLID ID, UINT16 nativeID |
| Yes | > | reboot | SYSCALLID ID, UINT16 nativeID |
| Yes | < | reboot | SYSCALLID ID, UINT16 nativeID |
| Yes | > | syslog | SYSCALLID ID, UINT16 nativeID |
| Yes | < | syslog | SYSCALLID ID, UINT16 nativeID |
| Yes | > | ipc | SYSCALLID ID, UINT16 nativeID |
| Yes | < | ipc | SYSCALLID ID, UINT16 nativeID |
| Yes | > | create_module | SYSCALLID ID, UINT16 nativeID |
| Yes | < | create_module | SYSCALLID ID, UINT16 nativeID |
| Yes | > | listxattr | SYSCALLID ID, UINT16 nativeID |
| Yes | < | listxattr | SYSCALLID ID, UINT16 nativeID |
| Yes | > | setxattr | SYSCALLID ID, UINT16 nativeID |
| Yes | < | setxattr | SYSCALLID ID, UINT16 nativeID |
| Yes | > | setpriority | SYSCALLID ID, UINT16 nativeID |
| Yes | < | setpriority | SYSCALLID ID, UINT16 nativeID |
| Yes | > | sigreturn | SYSCALLID ID, UINT16 nativeID |
| Yes | < | sigreturn | SYSCALLID ID, UINT16 nativeID |
| Yes | > | setgroups | SYSCALLID ID, UINT16 nativeID |
| Yes | < | setgroups | SYSCALLID ID, UINT16 nativeID |
| Yes | > | preadv2 | SYSCALLID ID, UINT16 nativeID |
| Yes | < | preadv2 | SYSCALLID ID, UINT16 nativeID |
| Yes | > | setitimer | SYSCALLID ID, UINT16 nativeID |
| Yes | < | setitimer | SYSCALLID ID, UINT16 nativeID |
| Yes | > | shmat | SYSCALLID ID, UINT16 nativeID |
| Yes | < | shmat | SYSCALLID ID, UINT16 nativeID |
| Yes | > | getitimer | SYSCALLID ID, UINT16 nativeID |
| Yes | < | getitimer | SYSCALLID ID, UINT16 nativeID |
| Yes | > | removexattr | SYSCALLID ID, UINT16 nativeID |
| Yes | < | removexattr | SYSCALLID ID, UINT16 nativeID |
| Yes | > | msgget | SYSCALLID ID, UINT16 nativeID |
| Yes | < | msgget | SYSCALLID ID, UINT16 nativeID |
| Yes | > | spu_create | SYSCALLID ID, UINT16 nativeID |
| Yes | < | spu_create | SYSCALLID ID, UINT16 nativeID |
| Yes | > | capget | SYSCALLID ID, UINT16 nativeID |
| Yes | < | capget | SYSCALLID ID, UINT16 nativeID |
| Yes | > | rt_sigsuspend | SYSCALLID ID, UINT16 nativeID |
| Yes | < | rt_sigsuspend | SYSCALLID ID, UINT16 nativeID |
| Yes | > | mseal | SYSCALLID ID, UINT16 nativeID |
| Yes | < | mseal | SYSCALLID ID, UINT16 nativeID |
| Yes | > | fanotify_init | SYSCALLID ID, UINT16 nativeID |
| Yes | < | fanotify_init | SYSCALLID ID, UINT16 nativeID |
| Yes | > | readdir | SYSCALLID ID, UINT16 nativeID |
| Yes | < | readdir | SYSCALLID ID, UINT16 nativeID |
| Yes | > | getxattr | SYSCALLID ID, UINT16 nativeID |
| Yes | < | getxattr | SYSCALLID ID, UINT16 nativeID |
| Yes | > | mq_timedreceive | SYSCALLID ID, UINT16 nativeID |
| Yes | < | mq_timedreceive | SYSCALLID ID, UINT16 nativeID |
| Yes | > | nice | SYSCALLID ID, UINT16 nativeID |
| Yes | < | nice | SYSCALLID ID, UINT16 nativeID |
| Yes | > | fsopen | SYSCALLID ID, UINT16 nativeID |
| Yes | < | fsopen | SYSCALLID ID, UINT16 nativeID |
| Yes | > | rt_sigpending | SYSCALLID ID, UINT16 nativeID |
| Yes | < | rt_sigpending | SYSCALLID ID, UINT16 nativeID |
| Yes | > | sysfs | SYSCALLID ID, UINT16 nativeID |
| Yes | < | sysfs | SYSCALLID ID, UINT16 nativeID |
| Yes | > | acct | SYSCALLID ID, UINT16 nativeID |
| Yes | < | acct | SYSCALLID ID, UINT16 nativeID |
| Yes | > | setfsgid | SYSCALLID ID, UINT16 nativeID |
| Yes | < | setfsgid | SYSCALLID ID, UINT16 nativeID |
| Yes | > | sync | SYSCALLID ID, UINT16 nativeID |
| Yes | < | sync | SYSCALLID ID, UINT16 nativeID |
| Yes | > | clock_adjtime | SYSCALLID ID, UINT16 nativeID |
| Yes | < | clock_adjtime | SYSCALLID ID, UINT16 nativeID |
| Yes | > | io_getevents | SYSCALLID ID, UINT16 nativeID |
| Yes | < | io_getevents | SYSCALLID ID, UINT16 nativeID |
| Yes | > | query_module | SYSCALLID ID, UINT16 nativeID |
| Yes | < | query_module | SYSCALLID ID, UINT16 nativeID |
| Yes | > | remap_file_pages | SYSCALLID ID, UINT16 nativeID |
| Yes | < | remap_file_pages | SYSCALLID ID, UINT16 nativeID |
| Yes | > | rt_sigprocmask | SYSCALLID ID, UINT16 nativeID |
| Yes | < | rt_sigprocmask | SYSCALLID ID, UINT16 nativeID |
| Yes | > | mincore | SYSCALLID ID, UINT16 nativeID |
| Yes | < | mincore | SYSCALLID ID, UINT16 nativeID |
| Yes | > | getpgid | SYSCALLID ID, UINT16 nativeID |
| Yes | < | getpgid | SYSCALLID ID, UINT16 nativeID |
| Yes | > | msgsnd | SYSCALLID ID, UINT16 nativeID |
| Yes | < | msgsnd | SYSCALLID ID, UINT16 nativeID |
| Yes | > | sched_getparam | SYSCALLID ID, UINT16 nativeID |
| Yes | < | sched_getparam | SYSCALLID ID, UINT16 nativeID |
| Yes | > | getgroups | SYSCALLID ID, UINT16 nativeID |
| Yes | < | getgroups | SYSCALLID ID, UINT16 nativeID |
| Yes | > | ustat | SYSCALLID ID, UINT16 nativeID |
| Yes | < | ustat | SYSCALLID ID, UINT16 nativeID |
| Yes | > | uname | SYSCALLID ID, UINT16 nativeID |
| Yes | < | uname | SYSCALLID ID, UINT16 nativeID |
| Yes | > | epoll_ctl | SYSCALLID ID, UINT16 nativeID |
| Yes | < | epoll_ctl | SYSCALLID ID, UINT16 nativeID |
| Yes | > | lgetxattr | SYSCALLID ID, UINT16 nativeID |
| Yes | < | lgetxattr | SYSCALLID ID, UINT16 nativeID |
| Yes | > | _sysctl | SYSCALLID ID, UINT16 nativeID |
| Yes | < | _sysctl | SYSCALLID ID, UINT16 nativeID |
| Yes | > | rt_sigtimedwait | SYSCALLID ID, UINT16 nativeID |
| Yes | < | rt_sigtimedwait | SYSCALLID ID, UINT16 nativeID |
| Yes | > | flistxattr | SYSCALLID ID, UINT16 nativeID |
| Yes | < | flistxattr | SYSCALLID ID, UINT16 nativeID |
| Yes | > | pkey_alloc | SYSCALLID ID, UINT16 nativeID |
| Yes | < | pkey_alloc | SYSCALLID ID, UINT16 nativeID |
| Yes | > | time | SYSCALLID ID, UINT16 nativeID |
| Yes | < | time | SYSCALLID ID, UINT16 nativeID |
| Yes | > | kcmp | SYSCALLID ID, UINT16 nativeID |
| Yes | < | kcmp | SYSCALLID ID, UINT16 nativeID |
| Yes | > | epoll_pwait | SYSCALLID ID, UINT16 nativeID |
| Yes | < | epoll_pwait | SYSCALLID ID, UINT16 nativeID |
| Yes | > | oldlstat | SYSCALLID ID, UINT16 nativeID |
| Yes | < | oldlstat | SYSCALLID ID, UINT16 nativeID |
| Yes | > | sched_setscheduler | SYSCALLID ID, UINT16 nativeID |
| Yes | < | sched_setscheduler | SYSCALLID ID, UINT16 nativeID |
| Yes | > | statfs | SYSCALLID ID, UINT16 nativeID |
| Yes | < | statfs | SYSCALLID ID, UINT16 nativeID |
| Yes | > | fdatasync | SYSCALLID ID, UINT16 nativeID |
| Yes | < | fdatasync | SYSCALLID ID, UINT16 nativeID |
| Yes | > | set_robust_list | SYSCALLID ID, UINT16 nativeID |
| Yes | < | set_robust_list | SYSCALLID ID, UINT16 nativeID |
| Yes | > | swapoff | SYSCALLID ID, UINT16 nativeID |
| Yes | < | swapoff | SYSCALLID ID, UINT16 nativeID |
| Yes | > | quotactl_fd | SYSCALLID ID, UINT16 nativeID |
| Yes | < | quotactl_fd | SYSCALLID ID, UINT16 nativeID |
| Yes | > | exit_group | SYSCALLID ID, UINT16 nativeID |
| Yes | < | exit_group | SYSCALLID ID, UINT16 nativeID |
| Yes | > | listmount | SYSCALLID ID, UINT16 nativeID |
| Yes | < | listmount | SYSCALLID ID, UINT16 nativeID |
| Yes | > | timerfd_settime | SYSCALLID ID, UINT16 nativeID |
| Yes | < | timerfd_settime | SYSCALLID ID, UINT16 nativeID |
| Yes | > | sched_getscheduler | SYSCALLID ID, UINT16 nativeID |
| Yes | < | sched_getscheduler | SYSCALLID ID, UINT16 nativeID |
| Yes | > | sched_get_priority_min | SYSCALLID ID, UINT16 nativeID |
| Yes | < | sched_get_priority_min | SYSCALLID ID, UINT16 nativeID |
| Yes | > | ftruncate | SYSCALLID ID, UINT16 nativeID |
| Yes | < | ftruncate | SYSCALLID ID, UINT16 nativeID |
| Yes | > | pkey_free | SYSCALLID ID, UINT16 nativeID |
| Yes | < | pkey_free | SYSCALLID ID, UINT16 nativeID |
| Yes | > | sched_rr_get_interval | SYSCALLID ID, UINT16 nativeID |
| Yes | < | sched_rr_get_interval | SYSCALLID ID, UINT16 nativeID |
| Yes | > | open_tree | SYSCALLID ID, UINT16 nativeID |
| Yes | < | open_tree | SYSCALLID ID, UINT16 nativeID |
| Yes | > | idle | SYSCALLID ID, UINT16 nativeID |
| Yes | < | idle | SYSCALLID ID, UINT16 nativeID |
| Yes | > | mremap | SYSCALLID ID, UINT16 nativeID |
| Yes | < | mremap | SYSCALLID ID, UINT16 nativeID |
| Yes | > | rt_sigaction | SYSCALLID ID, UINT16 nativeID |
| Yes | < | rt_sigaction | SYSCALLID ID, UINT16 nativeID |
| Yes | > | stime | SYSCALLID ID, UINT16 nativeID |
| Yes | < | stime | SYSCALLID ID, UINT16 nativeID |
| Yes | > | sched_getattr | SYSCALLID ID, UINT16 nativeID |
| Yes | < | sched_getattr | SYSCALLID ID, UINT16 nativeID |
| Yes | > | rt_sigqueueinfo | SYSCALLID ID, UINT16 nativeID |
| Yes | < | rt_sigqueueinfo | SYSCALLID ID, UINT16 nativeID |
| Yes | > | sync_file_range | SYSCALLID ID, UINT16 nativeID |
| Yes | < | sync_file_range | SYSCALLID ID, UINT16 nativeID |
| Yes | > | mq_unlink | SYSCALLID ID, UINT16 nativeID |
| Yes | < | mq_unlink | SYSCALLID ID, UINT16 nativeID |
| Yes | > | alarm | SYSCALLID ID, UINT16 nativeID |
| Yes | < | alarm | SYSCALLID ID, UINT16 nativeID |
| Yes | > | inotify_rm_watch | SYSCALLID ID, UINT16 nativeID |
| Yes | < | inotify_rm_watch | SYSCALLID ID, UINT16 nativeID |
| Yes | > | lsetxattr | SYSCALLID ID, UINT16 nativeID |
| Yes | < | lsetxattr | SYSCALLID ID, UINT16 nativeID |
| Yes | > | timer_delete | SYSCALLID ID, UINT16 nativeID |
| Yes | < | timer_delete | SYSCALLID ID, UINT16 nativeID |
| Yes | > | msync | SYSCALLID ID, UINT16 nativeID |
| Yes | < | msync | SYSCALLID ID, UINT16 nativeID |
| Yes | > | timer_settime | SYSCALLID ID, UINT16 nativeID |
| Yes | < | timer_settime | SYSCALLID ID, UINT16 nativeID |
| Yes | > | sigprocmask | SYSCALLID ID, UINT16 nativeID |
| Yes | < | sigprocmask | SYSCALLID ID, UINT16 nativeID |
| Yes | > | lremovexattr | SYSCALLID ID, UINT16 nativeID |
| Yes | < | lremovexattr | SYSCALLID ID, UINT16 nativeID |
| Yes | > | fremovexattr | SYSCALLID ID, UINT16 nativeID |
| Yes | < | fremovexattr | SYSCALLID ID, UINT16 nativeID |
| Yes | > | sched_setaffinity | SYSCALLID ID, UINT16 nativeID |
| Yes | < | sched_setaffinity | SYSCALLID ID, UINT16 nativeID |
| Yes | > | fsetxattr | SYSCALLID ID, UINT16 nativeID |
| Yes | < | fsetxattr | SYSCALLID ID, UINT16 nativeID |
| Yes | > | settimeofday | SYSCALLID ID, UINT16 nativeID |
| Yes | < | settimeofday | SYSCALLID ID, UINT16 nativeID |
| Yes | > | gettimeofday | SYSCALLID ID, UINT16 nativeID |
| Yes | < | gettimeofday | SYSCALLID ID, UINT16 nativeID |
| Yes | > | io_setup | SYSCALLID ID, UINT16 nativeID |
| Yes | < | io_setup | SYSCALLID ID, UINT16 nativeID |
| Yes | > | llistxattr | SYSCALLID ID, UINT16 nativeID |
| Yes | < | llistxattr | SYSCALLID ID, UINT16 nativeID |
| Yes | > | fsync | SYSCALLID ID, UINT16 nativeID |
| Yes | < | fsync | SYSCALLID ID, UINT16 nativeID |
| Yes | > | pidfd_send_signal | SYSCALLID ID, UINT16 nativeID |
| Yes | < | pidfd_send_signal | SYSCALLID ID, UINT16 nativeID |
| Yes | > | getrandom | SYSCALLID ID, UINT16 nativeID |
| Yes | < | getrandom | SYSCALLID ID, UINT16 nativeID |
| Yes | > | s390_sthyi | SYSCALLID ID, UINT16 nativeID |
| Yes | < | s390_sthyi | SYSCALLID ID, UINT16 nativeID |
| Yes | > | io_destroy | SYSCALLID ID, UINT16 nativeID |
| Yes | < | io_destroy | SYSCALLID ID, UINT16 nativeID |
| Yes | > | sigaltstack | SYSCALLID ID, UINT16 nativeID |
| Yes | < | sigaltstack | SYSCALLID ID, UINT16 nativeID |
| Yes | > | riscv_flush_icache | SYSCALLID ID, UINT16 nativeID |
| Yes | < | riscv_flush_icache | SYSCALLID ID, UINT16 nativeID |
| Yes | > | mount_setattr | SYSCALLID ID, UINT16 nativeID |
| Yes | < | mount_setattr | SYSCALLID ID, UINT16 nativeID |
| Yes | > | getpgrp | SYSCALLID ID, UINT16 nativeID |
| Yes | < | getpgrp | SYSCALLID ID, UINT16 nativeID |
| Yes | > | vhangup | SYSCALLID ID, UINT16 nativeID |
| Yes | < | vhangup | SYSCALLID ID, UINT16 nativeID |
| Yes | > | set_tid_address | SYSCALLID ID, UINT16 nativeID |
| Yes | < | set_tid_address | SYSCALLID ID, UINT16 nativeID |
| Yes | > | timer_create | SYSCALLID ID, UINT16 nativeID |
| Yes | < | timer_create | SYSCALLID ID, UINT16 nativeID |
| Yes | > | timer_gettime | SYSCALLID ID, UINT16 nativeID |
| Yes | < | timer_gettime | SYSCALLID ID, UINT16 nativeID |
| Yes | > | timer_getoverrun | SYSCALLID ID, UINT16 nativeID |
| Yes | < | timer_getoverrun | SYSCALLID ID, UINT16 nativeID |
| Yes | > | clock_settime | SYSCALLID ID, UINT16 nativeID |
| Yes | < | clock_settime | SYSCALLID ID, UINT16 nativeID |
| Yes | > | clock_getres | SYSCALLID ID, UINT16 nativeID |
| Yes | < | clock_getres | SYSCALLID ID, UINT16 nativeID |
| Yes | > | utimes | SYSCALLID ID, UINT16 nativeID |
| Yes | < | utimes | SYSCALLID ID, UINT16 nativeID |
| Yes | > | vm86 | SYSCALLID ID, UINT16 nativeID |
| Yes | < | vm86 | SYSCALLID ID, UINT16 nativeID |
| Yes | > | lsm_set_self_attr | SYSCALLID ID, UINT16 nativeID |
| Yes | < | lsm_set_self_attr | SYSCALLID ID, UINT16 nativeID |
| Yes | > | clock_nanosleep | SYSCALLID ID, UINT16 nativeID |
| Yes | < | clock_nanosleep | SYSCALLID ID, UINT16 nativeID |
| Yes | > | futimesat | SYSCALLID ID, UINT16 nativeID |
| Yes | < | futimesat | SYSCALLID ID, UINT16 nativeID |
| Yes | > | signal | SYSCALLID ID, UINT16 nativeID |
| Yes | < | signal | SYSCALLID ID, UINT16 nativeID |
| Yes | > | mq_open | SYSCALLID ID, UINT16 nativeID |
| Yes | < | mq_open | SYSCALLID ID, UINT16 nativeID |
| Yes | > | keyctl | SYSCALLID ID, UINT16 nativeID |
| Yes | < | keyctl | SYSCALLID ID, UINT16 nativeID |
| Yes | > | ioprio_set | SYSCALLID ID, UINT16 nativeID |
| Yes | < | ioprio_set | SYSCALLID ID, UINT16 nativeID |
| Yes | > | landlock_add_rule | SYSCALLID ID, UINT16 nativeID |
| Yes | < | landlock_add_rule | SYSCALLID ID, UINT16 nativeID |
| Yes | > | add_key | SYSCALLID ID, UINT16 nativeID |
| Yes | < | add_key | SYSCALLID ID, UINT16 nativeID |
| Yes | > | set_thread_area | SYSCALLID ID, UINT16 nativeID |
| Yes | < | set_thread_area | SYSCALLID ID, UINT16 nativeID |
| Yes | > | ioprio_get | SYSCALLID ID, UINT16 nativeID |
| Yes | < | ioprio_get | SYSCALLID ID, UINT16 nativeID |
| Yes | > | sync_file_range2 | SYSCALLID ID, UINT16 nativeID |
| Yes | < | sync_file_range2 | SYSCALLID ID, UINT16 nativeID |
| Yes | > | ioperm | SYSCALLID ID, UINT16 nativeID |
| Yes | < | ioperm | SYSCALLID ID, UINT16 nativeID |
| Yes | > | sigaction | SYSCALLID ID, UINT16 nativeID |
| Yes | < | sigaction | SYSCALLID ID, UINT16 nativeID |
| Yes | > | inotify_add_watch | SYSCALLID ID, UINT16 nativeID |
| Yes | < | inotify_add_watch | SYSCALLID ID, UINT16 nativeID |
| Yes | > | fallocate | SYSCALLID ID, UINT16 nativeID |
| Yes | < | fallocate | SYSCALLID ID, UINT16 nativeID |
| Yes | > | get_thread_area | SYSCALLID ID, UINT16 nativeID |
| Yes | < | get_thread_area | SYSCALLID ID, UINT16 nativeID |
| Yes | > | readlinkat | SYSCALLID ID, UINT16 nativeID |
| Yes | < | readlinkat | SYSCALLID ID, UINT16 nativeID |
| Yes | > | name_to_handle_at | SYSCALLID ID, UINT16 nativeID |
| Yes | < | name_to_handle_at | SYSCALLID ID, UINT16 nativeID |
| Yes | > | perf_event_open | SYSCALLID ID, UINT16 nativeID |
| Yes | < | perf_event_open | SYSCALLID ID, UINT16 nativeID |
| Yes | > | kexec_load | SYSCALLID ID, UINT16 nativeID |
| Yes | < | kexec_load | SYSCALLID ID, UINT16 nativeID |
| Yes | > | truncate | SYSCALLID ID, UINT16 nativeID |
| Yes | < | truncate | SYSCALLID ID, UINT16 nativeID |
| Yes | > | faccessat | SYSCALLID ID, UINT16 nativeID |
| Yes | < | faccessat | SYSCALLID ID, UINT16 nativeID |
| Yes | > | mq_timedsend | SYSCALLID ID, UINT16 nativeID |
| Yes | < | mq_timedsend | SYSCALLID ID, UINT16 nativeID |
| Yes | > | restart_syscall | SYSCALLID ID, UINT16 nativeID |
| Yes | < | restart_syscall | SYSCALLID ID, UINT16 nativeID |
| Yes | > | map_shadow_stack | SYSCALLID ID, UINT16 nativeID |
| Yes | < | map_shadow_stack | SYSCALLID ID, UINT16 nativeID |
| Yes | > | pselect6 | SYSCALLID ID, UINT16 nativeID |
| Yes | < | pselect6 | SYSCALLID ID, UINT16 nativeID |
| Yes | > | epoll_ctl_old | SYSCALLID ID, UINT16 nativeID |
| Yes | < | epoll_ctl_old | SYSCALLID ID, UINT16 nativeID |
| Yes | > | get_robust_list | SYSCALLID ID, UINT16 nativeID |
| Yes | < | get_robust_list | SYSCALLID ID, UINT16 nativeID |
| Yes | > | tee | SYSCALLID ID, UINT16 nativeID |
| Yes | < | tee | SYSCALLID ID, UINT16 nativeID |
| Yes | > | vmsplice | SYSCALLID ID, UINT16 nativeID |
| Yes | < | vmsplice | SYSCALLID ID, UINT16 nativeID |
| Yes | > | getcpu | SYSCALLID ID, UINT16 nativeID |
| Yes | < | getcpu | SYSCALLID ID, UINT16 nativeID |
| Yes | > | utimensat | SYSCALLID ID, UINT16 nativeID |
| Yes | < | utimensat | SYSCALLID ID, UINT16 nativeID |
| Yes | > | rseq | SYSCALLID ID, UINT16 nativeID |
| Yes | < | rseq | SYSCALLID ID, UINT16 nativeID |
| Yes | > | timerfd_gettime | SYSCALLID ID, UINT16 nativeID |
| Yes | < | timerfd_gettime | SYSCALLID ID, UINT16 nativeID |
| Yes | > | syncfs | SYSCALLID ID, UINT16 nativeID |
| Yes | < | syncfs | SYSCALLID ID, UINT16 nativeID |
| Yes | > | msgctl | SYSCALLID ID, UINT16 nativeID |
| Yes | < | msgctl | SYSCALLID ID, UINT16 nativeID |
| Yes | > | io_submit | SYSCALLID ID, UINT16 nativeID |
| Yes | < | io_submit | SYSCALLID ID, UINT16 nativeID |
| Yes | > | oldolduname | SYSCALLID ID, UINT16 nativeID |
| Yes | < | oldolduname | SYSCALLID ID, UINT16 nativeID |
| Yes | > | shmdt | SYSCALLID ID, UINT16 nativeID |
| Yes | < | shmdt | SYSCALLID ID, UINT16 nativeID |
| Yes | > | sched_getaffinity | SYSCALLID ID, UINT16 nativeID |
| Yes | < | sched_getaffinity | SYSCALLID ID, UINT16 nativeID |
| Yes | > | fstatat64 | SYSCALLID ID, UINT16 nativeID |
| Yes | < | fstatat64 | SYSCALLID ID, UINT16 nativeID |
| Yes | > | socketcall | SYSCALLID ID, UINT16 nativeID |
| Yes | < | socketcall | SYSCALLID ID, UINT16 nativeID |
| Yes | > | waitid | SYSCALLID ID, UINT16 nativeID |
| Yes | < | waitid | SYSCALLID ID, UINT16 nativeID |
| Yes | > | sgetmask | SYSCALLID ID, UINT16 nativeID |
| Yes | < | sgetmask | SYSCALLID ID, UINT16 nativeID |
| Yes | > | io_cancel | SYSCALLID ID, UINT16 nativeID |
| Yes | < | io_cancel | SYSCALLID ID, UINT16 nativeID |
| Yes | > | sched_setparam | SYSCALLID ID, UINT16 nativeID |
| Yes | < | sched_setparam | SYSCALLID ID, UINT16 nativeID |
| Yes | > | cachestat | SYSCALLID ID, UINT16 nativeID |
| Yes | < | cachestat | SYSCALLID ID, UINT16 nativeID |
| Yes | > | sched_setattr | SYSCALLID ID, UINT16 nativeID |
| Yes | < | sched_setattr | SYSCALLID ID, UINT16 nativeID |
| Yes | > | ssetmask | SYSCALLID ID, UINT16 nativeID |
| Yes | < | ssetmask | SYSCALLID ID, UINT16 nativeID |
| Yes | > | _newselect | SYSCALLID ID, UINT16 nativeID |
| Yes | < | _newselect | SYSCALLID ID, UINT16 nativeID |
| Yes | > | setfsuid | SYSCALLID ID, UINT16 nativeID |
| Yes | < | setfsuid | SYSCALLID ID, UINT16 nativeID |
| Yes | > | sigpending | SYSCALLID ID, UINT16 nativeID |
| Yes | < | sigpending | SYSCALLID ID, UINT16 nativeID |
| Yes | > | wait4 | SYSCALLID ID, UINT16 nativeID |
| Yes | < | wait4 | SYSCALLID ID, UINT16 nativeID |
| Yes | > | process_mrelease | SYSCALLID ID, UINT16 nativeID |
| Yes | < | process_mrelease | SYSCALLID ID, UINT16 nativeID |
| Yes | > | waitpid | SYSCALLID ID, UINT16 nativeID |
| Yes | < | waitpid | SYSCALLID ID, UINT16 nativeID |
| Yes | > | arch_prctl | SYSCALLID ID, UINT16 nativeID |
| Yes | < | arch_prctl | SYSCALLID ID, UINT16 nativeID |
| Yes | > | rt_sigreturn | SYSCALLID ID, UINT16 nativeID |
| Yes | < | rt_sigreturn | SYSCALLID ID, UINT16 nativeID |
| Yes | > | fadvise64 | SYSCALLID ID, UINT16 nativeID |
| Yes | < | fadvise64 | SYSCALLID ID, UINT16 nativeID |
| Yes | > | msgrcv | SYSCALLID ID, UINT16 nativeID |
| Yes | < | msgrcv | SYSCALLID ID, UINT16 nativeID |
| Yes | > | move_mount | SYSCALLID ID, UINT16 nativeID |
| Yes | < | move_mount | SYSCALLID ID, UINT16 nativeID |
| Yes | > | lookup_dcookie | SYSCALLID ID, UINT16 nativeID |
| Yes | < | lookup_dcookie | SYSCALLID ID, UINT16 nativeID |
| Yes | > | fspick | SYSCALLID ID, UINT16 nativeID |
| Yes | < | fspick | SYSCALLID ID, UINT16 nativeID |
| Yes | > | shmget | SYSCALLID ID, UINT16 nativeID |
| Yes | < | shmget | SYSCALLID ID, UINT16 nativeID |
| Yes | > | fsmount | SYSCALLID ID, UINT16 nativeID |
| Yes | < | fsmount | SYSCALLID ID, UINT16 nativeID |
| Yes | > | epoll_pwait2 | SYSCALLID ID, UINT16 nativeID |
| Yes | < | epoll_pwait2 | SYSCALLID ID, UINT16 nativeID |
| Yes | > | move_pages | SYSCALLID ID, UINT16 nativeID |
| Yes | < | move_pages | SYSCALLID ID, UINT16 nativeID |
| Yes | > | shmctl | SYSCALLID ID, UINT16 nativeID |
| Yes | < | shmctl | SYSCALLID ID, UINT16 nativeID |
| Yes | > | memfd_secret | SYSCALLID ID, UINT16 nativeID |
| Yes | < | memfd_secret | SYSCALLID ID, UINT16 nativeID |
| Yes | > | landlock_restrict_self | SYSCALLID ID, UINT16 nativeID |
| Yes | < | landlock_restrict_self | SYSCALLID ID, UINT16 nativeID |
| Yes | > | sched_get_priority_max | SYSCALLID ID, UINT16 nativeID |
| Yes | < | sched_get_priority_max | SYSCALLID ID, UINT16 nativeID |
| Yes | > | sys_debug_setcontext | SYSCALLID ID, UINT16 nativeID |
| Yes | < | sys_debug_setcontext | SYSCALLID ID, UINT16 nativeID |
| Yes | > | kexec_file_load | SYSCALLID ID, UINT16 nativeID |
| Yes | < | kexec_file_load | SYSCALLID ID, UINT16 nativeID |
| Yes | > | process_madvise | SYSCALLID ID, UINT16 nativeID |
| Yes | < | process_madvise | SYSCALLID ID, UINT16 nativeID |
| Yes | > | landlock_create_ruleset | SYSCALLID ID, UINT16 nativeID |
| Yes | < | landlock_create_ruleset | SYSCALLID ID, UINT16 nativeID |
| Yes | > | rt_tgsigqueueinfo | SYSCALLID ID, UINT16 nativeID |
| Yes | < | rt_tgsigqueueinfo | SYSCALLID ID, UINT16 nativeID |
| Yes | > | migrate_pages | SYSCALLID ID, UINT16 nativeID |
| Yes | < | migrate_pages | SYSCALLID ID, UINT16 nativeID |
| Yes | > | fstatfs64 | SYSCALLID ID, UINT16 nativeID |
| Yes | < | fstatfs64 | SYSCALLID ID, UINT16 nativeID |
| Yes | > | pwritev2 | SYSCALLID ID, UINT16 nativeID |
| Yes | < | pwritev2 | SYSCALLID ID, UINT16 nativeID |
| Yes | > | mbind | SYSCALLID ID, UINT16 nativeID |
| Yes | < | mbind | SYSCALLID ID, UINT16 nativeID |
| Yes | > | modify_ldt | SYSCALLID ID, UINT16 nativeID |
| Yes | < | modify_ldt | SYSCALLID ID, UINT16 nativeID |
| Yes | > | gettid | SYSCALLID ID, UINT16 nativeID |
| Yes | < | gettid | SYSCALLID ID, UINT16 nativeID |
| Yes | > | statx | SYSCALLID ID, UINT16 nativeID |
| Yes | < | statx | SYSCALLID ID, UINT16 nativeID |
| Yes | > | getpriority | SYSCALLID ID, UINT16 nativeID |
| Yes | < | getpriority | SYSCALLID ID, UINT16 nativeID |
| Yes | > | io_pgetevents | SYSCALLID ID, UINT16 nativeID |
| Yes | < | io_pgetevents | SYSCALLID ID, UINT16 nativeID |
| Yes | > | listxattrat | SYSCALLID ID, UINT16 nativeID |
| Yes | < | listxattrat | SYSCALLID ID, UINT16 nativeID |
| Yes | > | set_mempolicy_home_node | SYSCALLID ID, UINT16 nativeID |
| Yes | < | set_mempolicy_home_node | SYSCALLID ID, UINT16 nativeID |
| Yes | > | readahead | SYSCALLID ID, UINT16 nativeID |
| Yes | < | readahead | SYSCALLID ID, UINT16 nativeID |
| Yes | > | futex_waitv | SYSCALLID ID, UINT16 nativeID |
| Yes | < | futex_waitv | SYSCALLID ID, UINT16 nativeID |
| Yes | > | epoll_wait_old | SYSCALLID ID, UINT16 nativeID |
| Yes | < | epoll_wait_old | SYSCALLID ID, UINT16 nativeID |
| Yes | > | faccessat2 | SYSCALLID ID, UINT16 nativeID |
| Yes | < | faccessat2 | SYSCALLID ID, UINT16 nativeID |
| Yes | > | get_mempolicy | SYSCALLID ID, UINT16 nativeID |
| Yes | < | get_mempolicy | SYSCALLID ID, UINT16 nativeID |
| Yes | > | membarrier | SYSCALLID ID, UINT16 nativeID |
| Yes | < | membarrier | SYSCALLID ID, UINT16 nativeID |
| Yes | > | pciconfig_iobase | SYSCALLID ID, UINT16 nativeID |
| Yes | < | pciconfig_iobase | SYSCALLID ID, UINT16 nativeID |
| Yes | > | close_range | SYSCALLID ID, UINT16 nativeID |
| Yes | < | close_range | SYSCALLID ID, UINT16 nativeID |
| Yes | > | fanotify_mark | SYSCALLID ID, UINT16 nativeID |
| Yes | < | fanotify_mark | SYSCALLID ID, UINT16 nativeID |
| Yes | > | open_tree_attr | SYSCALLID ID, UINT16 nativeID |
| Yes | < | open_tree_attr | SYSCALLID ID, UINT16 nativeID |
| Yes | > | timerfd | SYSCALLID ID, UINT16 nativeID |
| Yes | < | timerfd | SYSCALLID ID, UINT16 nativeID |
| Yes | > | s390_pci_mmio_read | SYSCALLID ID, UINT16 nativeID |
| Yes | < | s390_pci_mmio_read | SYSCALLID ID, UINT16 nativeID |
| Yes | > | s390_pci_mmio_write | SYSCALLID ID, UINT16 nativeID |
| Yes | < | s390_pci_mmio_write | SYSCALLID ID, UINT16 nativeID |
| Yes | > | s390_runtime_instr | SYSCALLID ID, UINT16 nativeID |
| Yes | < | s390_runtime_instr | SYSCALLID ID, UINT16 nativeID |
| Yes | > | s390_guarded_storage | SYSCALLID ID, UINT16 nativeID |
| Yes | < | s390_guarded_storage | SYSCALLID ID, UINT16 nativeID |
| Yes | > | fchmodat2 | SYSCALLID ID, UINT16 nativeID |
| Yes | < | fchmodat2 | SYSCALLID ID, UINT16 nativeID |
| Yes | > | futex_wake | SYSCALLID ID, UINT16 nativeID |
| Yes | < | futex_wake | SYSCALLID ID, UINT16 nativeID |
| Yes | > | futex_requeue | SYSCALLID ID, UINT16 nativeID |
| Yes | < | futex_requeue | SYSCALLID ID, UINT16 nativeID |
| Yes | > | futex_wait | SYSCALLID ID, UINT16 nativeID |
| Yes | < | futex_wait | SYSCALLID ID, UINT16 nativeID |
| Yes | > | switch_endian | SYSCALLID ID, UINT16 nativeID |
| Yes | < | switch_endian | SYSCALLID ID, UINT16 nativeID |
| Yes | > | multiplexer | SYSCALLID ID, UINT16 nativeID |
| Yes | < | multiplexer | SYSCALLID ID, UINT16 nativeID |
| Yes | > | oldfstat | SYSCALLID ID, UINT16 nativeID |
| Yes | < | oldfstat | SYSCALLID ID, UINT16 nativeID |
| Yes | > | lsm_get_self_attr | SYSCALLID ID, UINT16 nativeID |
| Yes | < | lsm_get_self_attr | SYSCALLID ID, UINT16 nativeID |
| Yes | > | swapcontext | SYSCALLID ID, UINT16 nativeID |
| Yes | < | swapcontext | SYSCALLID ID, UINT16 nativeID |
| Yes | > | pciconfig_write | SYSCALLID ID, UINT16 nativeID |
| Yes | < | pciconfig_write | SYSCALLID ID, UINT16 nativeID |
| Yes | > | rtas | SYSCALLID ID, UINT16 nativeID |
| Yes | < | rtas | SYSCALLID ID, UINT16 nativeID |
| Yes | > | pciconfig_read | SYSCALLID ID, UINT16 nativeID |
| Yes | < | pciconfig_read | SYSCALLID ID, UINT16 nativeID |
| Yes | > | subpage_prot | SYSCALLID ID, UINT16 nativeID |
| Yes | < | subpage_prot | SYSCALLID ID, UINT16 nativeID |
| Yes | > | statmount | SYSCALLID ID, UINT16 nativeID |
| Yes | < | statmount | SYSCALLID ID, UINT16 nativeID |
| Yes | > | lsm_list_modules | SYSCALLID ID, UINT16 nativeID |
| Yes | < | lsm_list_modules | SYSCALLID ID, UINT16 nativeID |
| Yes | > | uretprobe | SYSCALLID ID, UINT16 nativeID |
| Yes | < | uretprobe | SYSCALLID ID, UINT16 nativeID |
| Yes | > | removexattrat | SYSCALLID ID, UINT16 nativeID |
| Yes | < | removexattrat | SYSCALLID ID, UINT16 nativeID |
| Yes | > | getxattrat | SYSCALLID ID, UINT16 nativeID |
| Yes | < | getxattrat | SYSCALLID ID, UINT16 nativeID |
| Yes | > | setxattrat | SYSCALLID ID, UINT16 nativeID |
| Yes | < | setxattrat | SYSCALLID ID, UINT16 nativeID |
| Yes | > | file_getattr | SYSCALLID ID, UINT16 nativeID |
| Yes | < | file_getattr | SYSCALLID ID, UINT16 nativeID |
| Yes | > | file_setattr | SYSCALLID ID, UINT16 nativeID |
| Yes | < | file_setattr | SYSCALLID ID, UINT16 nativeID |
Tracepoint events
| Default | Dir | Name | Params |
|---|---|---|---|
| Yes | > | switch | PID next, UINT64 pgft_maj, UINT64 pgft_min, UINT32 vm_size, UINT32 vm_rss, UINT32 vm_swap |
| Yes | > | procexit | ERRNO status, ERRNO ret, SIGTYPE sig, UINT8 core, PID reaper_tid |
| Yes | > | signaldeliver | PID spid, PID dpid, SIGTYPE sig |
| Yes | > | page_fault | UINT64 addr, UINT64 ip, FLAGS32 error: PROTECTION_VIOLATION, PAGE_NOT_PRESENT, WRITE_ACCESS, READ_ACCESS, USER_FAULT, SUPERVISOR_FAULT, RESERVED_PAGE, INSTRUCTION_FETCH |
Plugin events
| Default | Dir | Name | Params |
|---|---|---|---|
| Yes | > | pluginevent | UINT32 plugin_id, BYTEBUF event_data |
Metaevents
| Default | Dir | Name | Params |
|---|---|---|---|
| Yes | > | drop | UINT32 ratio |
| Yes | < | drop | UINT32 ratio |
| Yes | > | scapevent | UINT32 event_type, UINT64 event_data |
| Yes | > | procinfo | UINT64 cpu_usr, UINT64 cpu_sys |
| Yes | > | cpu_hotplug | UINT32 cpu, UINT32 action |
| Yes | > | notification | CHARBUF id, CHARBUF desc |
| Yes | > | infra | CHARBUF source, CHARBUF name, CHARBUF description, CHARBUF scope |
| Yes | > | container | CHARBUF json |
| Yes | > | useradded | UINT32 uid, UINT32 gid, CHARBUF name, CHARBUF home, CHARBUF shell, CHARBUF container_id |
| Yes | > | userdeleted | UINT32 uid, UINT32 gid, CHARBUF name, CHARBUF home, CHARBUF shell, CHARBUF container_id |
| Yes | > | groupadded | UINT32 gid, CHARBUF name, CHARBUF container_id |
| Yes | > | groupdeleted | UINT32 gid, CHARBUF name, CHARBUF container_id |
| Yes | > | asyncevent | UINT32 plugin_id, CHARBUF name, BYTEBUF data |
Was this page helpful?
Let us know! You feedback will help us to improve the content and to stay in touch with our users.
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.
