Supported Events
Find out which events Falco supports
Here are the system call event types and args supported by the kernel module and BPF probe via libscap included in the Falco libs. Note that, for performance reasons, by default Falco will only consider a subset of them indicated in the table below with "yes". However, it's possible to make Falco consider all events by using the -A command line switch.
Note that several event types exist:
- Syscall events correspond to Linux system calls. Most of them have parameters, documented below, while some are detected as generic and they only offer the syscall ID.
- Tracepoint events represent internal kernel events that may be significant but don't directly translate to any syscall.
- Metaevents are generated from supplementary data sources, for instance, during data enrichment procedures or when the need for asynchronous actions arises. This group also encompasses some of Falco's internally produced events (such as the
dropevent) that are unavailable for rules. - Plugin events act as an envelope for actual plugin event data. In order to write rules that use plugins use the fields documented in the individual plugin.
The events below are valid for Falco Schema Version: 2.0.0
Syscall events
| Default | Dir | Name | Params |
|---|---|---|---|
| Yes | > | open | FSPATH name, FLAGS32 flags: O_LARGEFILE, O_DIRECTORY, O_DIRECT, O_TRUNC, O_SYNC, O_NONBLOCK, O_EXCL, O_DSYNC, O_APPEND, O_CREAT, O_RDWR, O_WRONLY, O_RDONLY, O_CLOEXEC, O_NONE, O_TMPFILE, O_F_CREATED, UINT32 mode |
| Yes | < | open | FD fd, FSPATH name, FLAGS32 flags: O_LARGEFILE, O_DIRECTORY, O_DIRECT, O_TRUNC, O_SYNC, O_NONBLOCK, O_EXCL, O_DSYNC, O_APPEND, O_CREAT, O_RDWR, O_WRONLY, O_RDONLY, O_CLOEXEC, O_NONE, O_TMPFILE, O_F_CREATED, UINT32 mode, UINT32 dev, UINT64 ino |
| Yes | > | close | FD fd |
| Yes | < | close | ERRNO res |
| No | > | read | FD fd, UINT32 size |
| No | < | read | ERRNO res, BYTEBUF data |
| No | > | write | FD fd, UINT32 size |
| No | < | write | ERRNO res, BYTEBUF data |
| Yes | > | socket | ENUMFLAGS32 domain: AF_NFC, AF_ALG, AF_CAIF, AF_IEEE802154, AF_PHONET, AF_ISDN, AF_RXRPC, AF_IUCV, AF_BLUETOOTH, AF_TIPC, AF_CAN, AF_LLC, AF_WANPIPE, AF_PPPOX, AF_IRDA, AF_SNA, AF_RDS, AF_ATMSVC, AF_ECONET, AF_ASH, AF_PACKET, AF_ROUTE, AF_NETLINK, AF_KEY, AF_SECURITY, AF_NETBEUI, AF_DECnet, AF_ROSE, AF_INET6, AF_X25, AF_ATMPVC, AF_BRIDGE, AF_NETROM, AF_APPLETALK, AF_IPX, AF_AX25, AF_INET, AF_LOCAL, AF_UNIX, AF_UNSPEC, UINT32 type, UINT32 proto |
| Yes | < | socket | FD fd |
| Yes | > | bind | FD fd |
| Yes | < | bind | ERRNO res, SOCKADDR addr |
| Yes | > | connect | FD fd, SOCKADDR addr |
| Yes | < | connect | ERRNO res, SOCKTUPLE tuple, FD fd |
| Yes | > | listen | FD fd, INT32 backlog |
| Yes | < | listen | ERRNO res |
| No | > | send | FD fd, UINT32 size |
| No | < | send | ERRNO res, BYTEBUF data |
| Yes | > | sendto | FD fd, UINT32 size, SOCKTUPLE tuple |
| Yes | < | sendto | ERRNO res, BYTEBUF data |
| No | > | recv | FD fd, UINT32 size |
| No | < | recv | ERRNO res, BYTEBUF data |
| Yes | > | recvfrom | FD fd, UINT32 size |
| Yes | < | recvfrom | ERRNO res, BYTEBUF data, SOCKTUPLE tuple |
| Yes | > | shutdown | FD fd, ENUMFLAGS8 how: SHUT_RDWR, SHUT_WR, SHUT_RD |
| Yes | < | shutdown | ERRNO res |
| Yes | > | getsockname | |
| Yes | < | getsockname | |
| Yes | > | getpeername | |
| Yes | < | getpeername | |
| Yes | > | socketpair | ENUMFLAGS32 domain: AF_NFC, AF_ALG, AF_CAIF, AF_IEEE802154, AF_PHONET, AF_ISDN, AF_RXRPC, AF_IUCV, AF_BLUETOOTH, AF_TIPC, AF_CAN, AF_LLC, AF_WANPIPE, AF_PPPOX, AF_IRDA, AF_SNA, AF_RDS, AF_ATMSVC, AF_ECONET, AF_ASH, AF_PACKET, AF_ROUTE, AF_NETLINK, AF_KEY, AF_SECURITY, AF_NETBEUI, AF_DECnet, AF_ROSE, AF_INET6, AF_X25, AF_ATMPVC, AF_BRIDGE, AF_NETROM, AF_APPLETALK, AF_IPX, AF_AX25, AF_INET, AF_LOCAL, AF_UNIX, AF_UNSPEC, UINT32 type, UINT32 proto |
| Yes | < | socketpair | ERRNO res, FD fd1, FD fd2, UINT64 source, UINT64 peer |
| Yes | > | setsockopt | |
| Yes | < | setsockopt | ERRNO res, FD fd, ENUMFLAGS8 level: SOL_SOCKET, SOL_TCP, UNKNOWN, ENUMFLAGS8 optname: SO_COOKIE, SO_MEMINFO, SO_PEERGROUPS, SO_ATTACH_BPF, SO_INCOMING_CPU, SO_BPF_EXTENSIONS, SO_MAX_PACING_RATE, SO_BUSY_POLL, SO_SELECT_ERR_QUEUE, SO_LOCK_FILTER, SO_NOFCS, SO_PEEK_OFF, SO_WIFI_STATUS, SO_RXQ_OVFL, SO_DOMAIN, SO_PROTOCOL, SO_TIMESTAMPING, SO_MARK, SO_TIMESTAMPNS, SO_PASSSEC, SO_PEERSEC, SO_ACCEPTCONN, SO_TIMESTAMP, SO_PEERNAME, SO_DETACH_FILTER, SO_ATTACH_FILTER, SO_BINDTODEVICE, SO_SECURITY_ENCRYPTION_NETWORK, SO_SECURITY_ENCRYPTION_TRANSPORT, SO_SECURITY_AUTHENTICATION, SO_SNDTIMEO, SO_RCVTIMEO, SO_SNDLOWAT, SO_RCVLOWAT, SO_PEERCRED, SO_PASSCRED, SO_REUSEPORT, SO_BSDCOMPAT, SO_LINGER, SO_PRIORITY, SO_NO_CHECK, SO_OOBINLINE, SO_KEEPALIVE, SO_RCVBUFFORCE, SO_SNDBUFFORCE, SO_RCVBUF, SO_SNDBUF, SO_BROADCAST, SO_DONTROUTE, SO_ERROR, SO_TYPE, SO_REUSEADDR, SO_DEBUG, UNKNOWN, DYNAMIC val, UINT32 optlen |
| Yes | > | getsockopt | |
| Yes | < | getsockopt | ERRNO res, FD fd, ENUMFLAGS8 level: SOL_SOCKET, SOL_TCP, UNKNOWN, ENUMFLAGS8 optname: SO_COOKIE, SO_MEMINFO, SO_PEERGROUPS, SO_ATTACH_BPF, SO_INCOMING_CPU, SO_BPF_EXTENSIONS, SO_MAX_PACING_RATE, SO_BUSY_POLL, SO_SELECT_ERR_QUEUE, SO_LOCK_FILTER, SO_NOFCS, SO_PEEK_OFF, SO_WIFI_STATUS, SO_RXQ_OVFL, SO_DOMAIN, SO_PROTOCOL, SO_TIMESTAMPING, SO_MARK, SO_TIMESTAMPNS, SO_PASSSEC, SO_PEERSEC, SO_ACCEPTCONN, SO_TIMESTAMP, SO_PEERNAME, SO_DETACH_FILTER, SO_ATTACH_FILTER, SO_BINDTODEVICE, SO_SECURITY_ENCRYPTION_NETWORK, SO_SECURITY_ENCRYPTION_TRANSPORT, SO_SECURITY_AUTHENTICATION, SO_SNDTIMEO, SO_RCVTIMEO, SO_SNDLOWAT, SO_RCVLOWAT, SO_PEERCRED, SO_PASSCRED, SO_REUSEPORT, SO_BSDCOMPAT, SO_LINGER, SO_PRIORITY, SO_NO_CHECK, SO_OOBINLINE, SO_KEEPALIVE, SO_RCVBUFFORCE, SO_SNDBUFFORCE, SO_RCVBUF, SO_SNDBUF, SO_BROADCAST, SO_DONTROUTE, SO_ERROR, SO_TYPE, SO_REUSEADDR, SO_DEBUG, UNKNOWN, DYNAMIC val, UINT32 optlen |
| Yes | > | sendmsg | FD fd, UINT32 size, SOCKTUPLE tuple |
| Yes | < | sendmsg | ERRNO res, BYTEBUF data |
| No | > | sendmmsg | |
| No | < | sendmmsg | |
| Yes | > | recvmsg | FD fd |
| Yes | < | recvmsg | ERRNO res, UINT32 size, BYTEBUF data, SOCKTUPLE tuple |
| No | > | recvmmsg | |
| No | < | recvmmsg | |
| Yes | > | creat | FSPATH name, UINT32 mode |
| Yes | < | creat | FD fd, FSPATH name, UINT32 mode, UINT32 dev, UINT64 ino |
| Yes | > | pipe | |
| Yes | < | pipe | ERRNO res, FD fd1, FD fd2, UINT64 ino |
| Yes | > | eventfd | UINT64 initval, FLAGS32 flags |
| Yes | < | eventfd | FD res |
| Yes | > | futex | UINT64 addr, ENUMFLAGS16 op: FUTEX_CLOCK_REALTIME, FUTEX_PRIVATE_FLAG, FUTEX_CMP_REQUEUE_PI, FUTEX_WAIT_REQUEUE_PI, FUTEX_WAKE_BITSET, FUTEX_WAIT_BITSET, FUTEX_TRYLOCK_PI, FUTEX_UNLOCK_PI, FUTEX_LOCK_PI, FUTEX_WAKE_OP, FUTEX_CMP_REQUEUE, FUTEX_REQUEUE, FUTEX_FD, FUTEX_WAKE, FUTEX_WAIT, UINT64 val |
| Yes | < | futex | ERRNO res |
| Yes | > | stat | |
| Yes | < | stat | ERRNO res, FSPATH path |
| Yes | > | lstat | |
| Yes | < | lstat | ERRNO res, FSPATH path |
| Yes | > | fstat | FD fd |
| Yes | < | fstat | ERRNO res |
| Yes | > | stat64 | |
| Yes | < | stat64 | ERRNO res, FSPATH path |
| Yes | > | lstat64 | |
| Yes | < | lstat64 | ERRNO res, FSPATH path |
| Yes | > | fstat64 | FD fd |
| Yes | < | fstat64 | ERRNO res |
| Yes | > | epoll_wait | ERRNO maxevents |
| Yes | < | epoll_wait | ERRNO res |
| Yes | > | poll | FDLIST fds, INT64 timeout |
| Yes | < | poll | ERRNO res, FDLIST fds |
| Yes | > | select | |
| Yes | < | select | ERRNO res |
| Yes | > | lseek | FD fd, UINT64 offset, ENUMFLAGS8 whence: SEEK_END, SEEK_CUR, SEEK_SET |
| Yes | < | lseek | ERRNO res |
| Yes | > | llseek | FD fd, UINT64 offset, ENUMFLAGS8 whence: SEEK_END, SEEK_CUR, SEEK_SET |
| Yes | < | llseek | ERRNO res |
| Yes | > | getcwd | |
| Yes | < | getcwd | ERRNO res, CHARBUF path |
| Yes | > | chdir | |
| Yes | < | chdir | ERRNO res, CHARBUF path |
| Yes | > | fchdir | FD fd |
| Yes | < | fchdir | ERRNO res |
| No | > | pread | FD fd, UINT32 size, UINT64 pos |
| No | < | pread | ERRNO res, BYTEBUF data |
| No | > | pwrite | FD fd, UINT32 size, UINT64 pos |
| No | < | pwrite | ERRNO res, BYTEBUF data |
| No | > | readv | FD fd |
| No | < | readv | ERRNO res, UINT32 size, BYTEBUF data |
| No | > | writev | FD fd, UINT32 size |
| No | < | writev | ERRNO res, BYTEBUF data |
| No | > | preadv | FD fd, UINT64 pos |
| No | < | preadv | ERRNO res, UINT32 size, BYTEBUF data |
| No | > | pwritev | FD fd, UINT32 size, UINT64 pos |
| No | < | pwritev | ERRNO res, BYTEBUF data |
| Yes | > | signalfd | FD fd, UINT32 mask, FLAGS8 flags |
| Yes | < | signalfd | FD res |
| Yes | > | kill | PID pid, SIGTYPE sig |
| Yes | < | kill | ERRNO res |
| Yes | > | tkill | PID tid, SIGTYPE sig |
| Yes | < | tkill | ERRNO res |
| Yes | > | tgkill | PID pid, PID tid, SIGTYPE sig |
| Yes | < | tgkill | ERRNO res |
| Yes | > | nanosleep | RELTIME interval |
| Yes | < | nanosleep | ERRNO res |
| Yes | > | timerfd_create | UINT8 clockid, FLAGS8 flags |
| Yes | < | timerfd_create | FD res |
| Yes | > | inotify_init | FLAGS8 flags |
| Yes | < | inotify_init | FD res |
| Yes | > | getrlimit | ENUMFLAGS8 resource: RLIMIT_UNKNOWN, RLIMIT_RTTIME, RLIMIT_RTPRIO, RLIMIT_NICE, RLIMIT_MSGQUEUE, RLIMIT_SIGPENDING, RLIMIT_LOCKS, RLIMIT_AS, RLIMIT_MEMLOCK, RLIMIT_NOFILE, RLIMIT_NPROC, RLIMIT_RSS, RLIMIT_CORE, RLIMIT_STACK, RLIMIT_DATA, RLIMIT_FSIZE, RLIMIT_CPU |
| Yes | < | getrlimit | ERRNO res, INT64 cur, INT64 max |
| Yes | > | setrlimit | ENUMFLAGS8 resource: RLIMIT_UNKNOWN, RLIMIT_RTTIME, RLIMIT_RTPRIO, RLIMIT_NICE, RLIMIT_MSGQUEUE, RLIMIT_SIGPENDING, RLIMIT_LOCKS, RLIMIT_AS, RLIMIT_MEMLOCK, RLIMIT_NOFILE, RLIMIT_NPROC, RLIMIT_RSS, RLIMIT_CORE, RLIMIT_STACK, RLIMIT_DATA, RLIMIT_FSIZE, RLIMIT_CPU |
| Yes | < | setrlimit | ERRNO res, INT64 cur, INT64 max |
| Yes | > | prlimit | PID pid, ENUMFLAGS8 resource: RLIMIT_UNKNOWN, RLIMIT_RTTIME, RLIMIT_RTPRIO, RLIMIT_NICE, RLIMIT_MSGQUEUE, RLIMIT_SIGPENDING, RLIMIT_LOCKS, RLIMIT_AS, RLIMIT_MEMLOCK, RLIMIT_NOFILE, RLIMIT_NPROC, RLIMIT_RSS, RLIMIT_CORE, RLIMIT_STACK, RLIMIT_DATA, RLIMIT_FSIZE, RLIMIT_CPU |
| Yes | < | prlimit | ERRNO res, INT64 newcur, INT64 newmax, INT64 oldcur, INT64 oldmax |
| Yes | > | fcntl | FD fd, ENUMFLAGS8 cmd: F_GETPIPE_SZ, F_SETPIPE_SZ, F_NOTIFY, F_DUPFD_CLOEXEC, F_CANCELLK, F_GETLEASE, F_SETLEASE, F_GETOWN_EX, F_SETOWN_EX, F_SETLKW64, F_SETLK64, F_GETLK64, F_GETSIG, F_SETSIG, F_GETOWN, F_SETOWN, F_SETLKW, F_SETLK, F_GETLK, F_SETFL, F_GETFL, F_SETFD, F_GETFD, F_DUPFD, F_OFD_GETLK, F_OFD_SETLK, F_OFD_SETLKW, UNKNOWN |
| Yes | < | fcntl | FD res, FD fd, ENUMFLAGS8 cmd: F_GETPIPE_SZ, F_SETPIPE_SZ, F_NOTIFY, F_DUPFD_CLOEXEC, F_CANCELLK, F_GETLEASE, F_SETLEASE, F_GETOWN_EX, F_SETOWN_EX, F_SETLKW64, F_SETLK64, F_GETLK64, F_GETSIG, F_SETSIG, F_GETOWN, F_SETOWN, F_SETLKW, F_SETLK, F_GETLK, F_SETFL, F_GETFL, F_SETFD, F_GETFD, F_DUPFD, F_OFD_GETLK, F_OFD_SETLK, F_OFD_SETLKW, UNKNOWN |
| Yes | > | brk | UINT64 addr |
| Yes | < | brk | UINT64 res, UINT32 vm_size, UINT32 vm_rss, UINT32 vm_swap |
| Yes | > | mmap | UINT64 addr, UINT64 length, FLAGS32 prot: PROT_READ, PROT_WRITE, PROT_EXEC, PROT_SEM, PROT_GROWSDOWN, PROT_GROWSUP, PROT_SAO, PROT_NONE, FLAGS32 flags: MAP_SHARED, MAP_PRIVATE, MAP_FIXED, MAP_ANONYMOUS, MAP_32BIT, MAP_RENAME, MAP_NORESERVE, MAP_POPULATE, MAP_NONBLOCK, MAP_GROWSDOWN, MAP_DENYWRITE, MAP_EXECUTABLE, MAP_INHERIT, MAP_FILE, MAP_LOCKED, FD fd, UINT64 offset |
| Yes | < | mmap | ERRNO res, UINT32 vm_size, UINT32 vm_rss, UINT32 vm_swap |
| Yes | > | mmap2 | UINT64 addr, UINT64 length, FLAGS32 prot: PROT_READ, PROT_WRITE, PROT_EXEC, PROT_SEM, PROT_GROWSDOWN, PROT_GROWSUP, PROT_SAO, PROT_NONE, FLAGS32 flags: MAP_SHARED, MAP_PRIVATE, MAP_FIXED, MAP_ANONYMOUS, MAP_32BIT, MAP_RENAME, MAP_NORESERVE, MAP_POPULATE, MAP_NONBLOCK, MAP_GROWSDOWN, MAP_DENYWRITE, MAP_EXECUTABLE, MAP_INHERIT, MAP_FILE, MAP_LOCKED, FD fd, UINT64 pgoffset |
| Yes | < | mmap2 | ERRNO res, UINT32 vm_size, UINT32 vm_rss, UINT32 vm_swap |
| Yes | > | munmap | UINT64 addr, UINT64 length |
| Yes | < | munmap | ERRNO res, UINT32 vm_size, UINT32 vm_rss, UINT32 vm_swap |
| Yes | > | splice | FD fd_in, FD fd_out, UINT64 size, FLAGS32 flags: SPLICE_F_MOVE, SPLICE_F_NONBLOCK, SPLICE_F_MORE, SPLICE_F_GIFT |
| Yes | < | splice | ERRNO res |
| Yes | > | ptrace | ENUMFLAGS16 request: PTRACE_SINGLEBLOCK, PTRACE_SYSEMU_SINGLESTEP, PTRACE_SYSEMU, PTRACE_ARCH_PRCTL, PTRACE_SET_THREAD_AREA, PTRACE_GET_THREAD_AREA, PTRACE_OLDSETOPTIONS, PTRACE_SETFPXREGS, PTRACE_GETFPXREGS, PTRACE_SETFPREGS, PTRACE_GETFPREGS, PTRACE_SETREGS, PTRACE_GETREGS, PTRACE_SETSIGMASK, PTRACE_GETSIGMASK, PTRACE_PEEKSIGINFO, PTRACE_LISTEN, PTRACE_INTERRUPT, PTRACE_SEIZE, PTRACE_SETREGSET, PTRACE_GETREGSET, PTRACE_SETSIGINFO, PTRACE_GETSIGINFO, PTRACE_GETEVENTMSG, PTRACE_SETOPTIONS, PTRACE_SYSCALL, PTRACE_DETACH, PTRACE_ATTACH, PTRACE_SINGLESTEP, PTRACE_KILL, PTRACE_CONT, PTRACE_POKEUSR, PTRACE_POKEDATA, PTRACE_POKETEXT, PTRACE_PEEKUSR, PTRACE_PEEKDATA, PTRACE_PEEKTEXT, PTRACE_TRACEME, PTRACE_UNKNOWN, PID pid |
| Yes | < | ptrace | ERRNO res, DYNAMIC addr, DYNAMIC data |
| Yes | > | ioctl | FD fd, UINT64 request, UINT64 argument |
| Yes | < | ioctl | ERRNO res |
| Yes | > | rename | |
| Yes | < | rename | ERRNO res, FSPATH oldpath, FSPATH newpath |
| Yes | > | renameat | |
| Yes | < | renameat | ERRNO res, FD olddirfd, FSRELPATH oldpath, FD newdirfd, FSRELPATH newpath |
| Yes | > | symlink | |
| Yes | < | symlink | ERRNO res, CHARBUF target, FSPATH linkpath |
| Yes | > | symlinkat | |
| Yes | < | symlinkat | ERRNO res, CHARBUF target, FD linkdirfd, FSRELPATH linkpath |
| No | > | sendfile | FD out_fd, FD in_fd, UINT64 offset, UINT64 size |
| No | < | sendfile | ERRNO res, UINT64 offset |
| Yes | > | quotactl | FLAGS16 cmd: Q_QUOTAON, Q_QUOTAOFF, Q_GETFMT, Q_GETINFO, Q_SETINFO, Q_GETQUOTA, Q_SETQUOTA, Q_SYNC, Q_XQUOTAON, Q_XQUOTAOFF, Q_XGETQUOTA, Q_XSETQLIM, Q_XGETQSTAT, Q_XQUOTARM, Q_XQUOTASYNC, FLAGS8 type: USRQUOTA, GRPQUOTA, UINT32 id, FLAGS8 quota_fmt: QFMT_NOT_USED, QFMT_VFS_OLD, QFMT_VFS_V0, QFMT_VFS_V1 |
| Yes | < | quotactl | ERRNO res, CHARBUF special, CHARBUF quotafilepath, UINT64 dqb_bhardlimit, UINT64 dqb_bsoftlimit, UINT64 dqb_curspace, UINT64 dqb_ihardlimit, UINT64 dqb_isoftlimit, RELTIME dqb_btime, RELTIME dqb_itime, RELTIME dqi_bgrace, RELTIME dqi_igrace, FLAGS8 dqi_flags: DQF_NONE, V1_DQF_RSQUASH, FLAGS8 quota_fmt_out: QFMT_NOT_USED, QFMT_VFS_OLD, QFMT_VFS_V0, QFMT_VFS_V1 |
| Yes | > | setresuid | UID ruid, UID euid, UID suid |
| Yes | < | setresuid | ERRNO res |
| Yes | > | setresgid | GID rgid, GID egid, GID sgid |
| Yes | < | setresgid | ERRNO res |
| Yes | > | setuid | UID uid |
| Yes | < | setuid | ERRNO res |
| Yes | > | setgid | GID gid |
| Yes | < | setgid | ERRNO res |
| Yes | > | getuid | |
| Yes | < | getuid | UID uid |
| Yes | > | geteuid | |
| Yes | < | geteuid | UID euid |
| Yes | > | getgid | |
| Yes | < | getgid | GID gid |
| Yes | > | getegid | |
| Yes | < | getegid | GID egid |
| Yes | > | getresuid | |
| Yes | < | getresuid | ERRNO res, UID ruid, UID euid, UID suid |
| Yes | > | getresgid | |
| Yes | < | getresgid | ERRNO res, GID rgid, GID egid, GID sgid |
| Yes | > | clone | |
| Yes | < | clone | PID res, CHARBUF exe, BYTEBUF args, PID tid, PID pid, PID ptid, CHARBUF cwd, INT64 fdlimit, UINT64 pgft_maj, UINT64 pgft_min, UINT32 vm_size, UINT32 vm_rss, UINT32 vm_swap, CHARBUF comm, BYTEBUF cgroups, FLAGS32 flags: CLONE_FILES, CLONE_FS, CLONE_IO, CLONE_NEWIPC, CLONE_NEWNET, CLONE_NEWNS, CLONE_NEWPID, CLONE_NEWUTS, CLONE_PARENT, CLONE_PARENT_SETTID, CLONE_PTRACE, CLONE_SIGHAND, CLONE_SYSVSEM, CLONE_THREAD, CLONE_UNTRACED, CLONE_VM, CLONE_INVERTED, NAME_CHANGED, CLOSED, CLONE_NEWUSER, CLONE_CHILD_CLEARTID, CLONE_CHILD_SETTID, CLONE_SETTLS, CLONE_STOPPED, CLONE_VFORK, CLONE_NEWCGROUP, UINT32 uid, UINT32 gid, PID vtid, PID vpid, UINT64 pidns_init_start_ts |
| Yes | > | fork | |
| Yes | < | fork | PID res, CHARBUF exe, BYTEBUF args, PID tid, PID pid, PID ptid, CHARBUF cwd, INT64 fdlimit, UINT64 pgft_maj, UINT64 pgft_min, UINT32 vm_size, UINT32 vm_rss, UINT32 vm_swap, CHARBUF comm, BYTEBUF cgroups, FLAGS32 flags: CLONE_FILES, CLONE_FS, CLONE_IO, CLONE_NEWIPC, CLONE_NEWNET, CLONE_NEWNS, CLONE_NEWPID, CLONE_NEWUTS, CLONE_PARENT, CLONE_PARENT_SETTID, CLONE_PTRACE, CLONE_SIGHAND, CLONE_SYSVSEM, CLONE_THREAD, CLONE_UNTRACED, CLONE_VM, CLONE_INVERTED, NAME_CHANGED, CLOSED, CLONE_NEWUSER, CLONE_CHILD_CLEARTID, CLONE_CHILD_SETTID, CLONE_SETTLS, CLONE_STOPPED, CLONE_VFORK, CLONE_NEWCGROUP, UINT32 uid, UINT32 gid, PID vtid, PID vpid, UINT64 pidns_init_start_ts |
| Yes | > | vfork | |
| Yes | < | vfork | PID res, CHARBUF exe, BYTEBUF args, PID tid, PID pid, PID ptid, CHARBUF cwd, INT64 fdlimit, UINT64 pgft_maj, UINT64 pgft_min, UINT32 vm_size, UINT32 vm_rss, UINT32 vm_swap, CHARBUF comm, BYTEBUF cgroups, FLAGS32 flags: CLONE_FILES, CLONE_FS, CLONE_IO, CLONE_NEWIPC, CLONE_NEWNET, CLONE_NEWNS, CLONE_NEWPID, CLONE_NEWUTS, CLONE_PARENT, CLONE_PARENT_SETTID, CLONE_PTRACE, CLONE_SIGHAND, CLONE_SYSVSEM, CLONE_THREAD, CLONE_UNTRACED, CLONE_VM, CLONE_INVERTED, NAME_CHANGED, CLOSED, CLONE_NEWUSER, CLONE_CHILD_CLEARTID, CLONE_CHILD_SETTID, CLONE_SETTLS, CLONE_STOPPED, CLONE_VFORK, CLONE_NEWCGROUP, UINT32 uid, UINT32 gid, PID vtid, PID vpid, UINT64 pidns_init_start_ts |
| Yes | > | getdents | FD fd |
| Yes | < | getdents | ERRNO res |
| Yes | > | getdents64 | FD fd |
| Yes | < | getdents64 | ERRNO res |
| Yes | > | setns | FD fd, FLAGS32 nstype: CLONE_FILES, CLONE_FS, CLONE_IO, CLONE_NEWIPC, CLONE_NEWNET, CLONE_NEWNS, CLONE_NEWPID, CLONE_NEWUTS, CLONE_PARENT, CLONE_PARENT_SETTID, CLONE_PTRACE, CLONE_SIGHAND, CLONE_SYSVSEM, CLONE_THREAD, CLONE_UNTRACED, CLONE_VM, CLONE_INVERTED, NAME_CHANGED, CLOSED, CLONE_NEWUSER, CLONE_CHILD_CLEARTID, CLONE_CHILD_SETTID, CLONE_SETTLS, CLONE_STOPPED, CLONE_VFORK, CLONE_NEWCGROUP |
| Yes | < | setns | ERRNO res |
| Yes | > | flock | FD fd, FLAGS32 operation: LOCK_SH, LOCK_EX, LOCK_NB, LOCK_UN, LOCK_NONE |
| Yes | < | flock | ERRNO res |
| Yes | > | accept | |
| Yes | < | accept | FD fd, SOCKTUPLE tuple, UINT8 queuepct, UINT32 queuelen, UINT32 queuemax |
| Yes | > | semop | INT32 semid |
| Yes | < | semop | ERRNO res, UINT32 nsops, UINT16 sem_num_0, INT16 sem_op_0, FLAGS16 sem_flg_0: IPC_NOWAIT, SEM_UNDO, UINT16 sem_num_1, INT16 sem_op_1, FLAGS16 sem_flg_1: IPC_NOWAIT, SEM_UNDO |
| Yes | > | semctl | INT32 semid, INT32 semnum, FLAGS16 cmd: IPC_STAT, IPC_SET, IPC_RMID, IPC_INFO, SEM_INFO, SEM_STAT, GETALL, GETNCNT, GETPID, GETVAL, GETZCNT, SETALL, SETVAL, INT32 val |
| Yes | < | semctl | ERRNO res |
| Yes | > | ppoll | FDLIST fds, RELTIME timeout, SIGSET sigmask |
| Yes | < | ppoll | ERRNO res, FDLIST fds |
| Yes | > | mount | FLAGS32 flags: RDONLY, NOSUID, NODEV, NOEXEC, SYNCHRONOUS, REMOUNT, MANDLOCK, DIRSYNC, NOATIME, NODIRATIME, BIND, MOVE, REC, SILENT, POSIXACL, UNBINDABLE, PRIVATE, SLAVE, SHARED, RELATIME, KERNMOUNT, I_VERSION, STRICTATIME, LAZYTIME, NOSEC, BORN, ACTIVE, NOUSER |
| Yes | < | mount | ERRNO res, CHARBUF dev, FSPATH dir, CHARBUF type |
| Yes | > | semget | INT32 key, INT32 nsems, FLAGS32 semflg: IPC_EXCL, IPC_CREAT |
| Yes | < | semget | ERRNO res |
| Yes | > | access | FLAGS32 mode: F_OK, R_OK, W_OK, X_OK |
| Yes | < | access | ERRNO res, FSPATH name |
| Yes | > | chroot | |
| Yes | < | chroot | ERRNO res, FSPATH path |
| Yes | > | setsid | |
| Yes | < | setsid | PID res |
| Yes | > | mkdir | UINT32 mode |
| Yes | < | mkdir | ERRNO res, FSPATH path |
| Yes | > | rmdir | |
| Yes | < | rmdir | ERRNO res, FSPATH path |
| Yes | > | unshare | FLAGS32 flags: CLONE_FILES, CLONE_FS, CLONE_IO, CLONE_NEWIPC, CLONE_NEWNET, CLONE_NEWNS, CLONE_NEWPID, CLONE_NEWUTS, CLONE_PARENT, CLONE_PARENT_SETTID, CLONE_PTRACE, CLONE_SIGHAND, CLONE_SYSVSEM, CLONE_THREAD, CLONE_UNTRACED, CLONE_VM, CLONE_INVERTED, NAME_CHANGED, CLOSED, CLONE_NEWUSER, CLONE_CHILD_CLEARTID, CLONE_CHILD_SETTID, CLONE_SETTLS, CLONE_STOPPED, CLONE_VFORK, CLONE_NEWCGROUP |
| Yes | < | unshare | ERRNO res |
| Yes | > | execve | FSPATH filename |
| Yes | < | execve | ERRNO res, CHARBUF exe, BYTEBUF args, PID tid, PID pid, PID ptid, CHARBUF cwd, UINT64 fdlimit, UINT64 pgft_maj, UINT64 pgft_min, UINT32 vm_size, UINT32 vm_rss, UINT32 vm_swap, CHARBUF comm, BYTEBUF cgroups, BYTEBUF env, UINT32 tty, PID pgid, UID loginuid, FLAGS32 flags: EXE_WRITABLE, EXE_UPPER_LAYER, EXE_FROM_MEMFD, UINT64 cap_inheritable, UINT64 cap_permitted, UINT64 cap_effective, UINT64 exe_ino, ABSTIME exe_ino_ctime, ABSTIME exe_ino_mtime, UID uid, FSPATH trusted_exepath |
| Yes | > | setpgid | PID pid, PID pgid |
| Yes | < | setpgid | PID res |
| Yes | > | seccomp | UINT64 op |
| Yes | < | seccomp | ERRNO res |
| Yes | > | unlink | |
| Yes | < | unlink | ERRNO res, FSPATH path |
| Yes | > | unlinkat | |
| Yes | < | unlinkat | ERRNO res, FD dirfd, FSRELPATH name, FLAGS32 flags: AT_REMOVEDIR |
| Yes | > | mkdirat | |
| Yes | < | mkdirat | ERRNO res, FD dirfd, FSRELPATH path, UINT32 mode |
| Yes | > | openat | FD dirfd, FSRELPATH name, FLAGS32 flags: O_LARGEFILE, O_DIRECTORY, O_DIRECT, O_TRUNC, O_SYNC, O_NONBLOCK, O_EXCL, O_DSYNC, O_APPEND, O_CREAT, O_RDWR, O_WRONLY, O_RDONLY, O_CLOEXEC, O_NONE, O_TMPFILE, O_F_CREATED, UINT32 mode |
| Yes | < | openat | FD fd, FD dirfd, FSRELPATH name, FLAGS32 flags: O_LARGEFILE, O_DIRECTORY, O_DIRECT, O_TRUNC, O_SYNC, O_NONBLOCK, O_EXCL, O_DSYNC, O_APPEND, O_CREAT, O_RDWR, O_WRONLY, O_RDONLY, O_CLOEXEC, O_NONE, O_TMPFILE, O_F_CREATED, UINT32 mode, UINT32 dev, UINT64 ino |
| Yes | > | link | |
| Yes | < | link | ERRNO res, FSPATH oldpath, FSPATH newpath |
| Yes | > | linkat | |
| Yes | < | linkat | ERRNO res, FD olddir, FSRELPATH oldpath, FD newdir, FSRELPATH newpath, FLAGS32 flags: AT_SYMLINK_FOLLOW, AT_EMPTY_PATH |
| Yes | > | fchmodat | |
| Yes | < | fchmodat | ERRNO res, FD dirfd, FSRELPATH filename, MODE mode |
| Yes | > | chmod | |
| Yes | < | chmod | ERRNO res, FSPATH filename, MODE mode |
| Yes | > | fchmod | |
| Yes | < | fchmod | ERRNO res, FD fd, MODE mode |
| Yes | > | renameat2 | |
| Yes | < | renameat2 | ERRNO res, FD olddirfd, FSRELPATH oldpath, FD newdirfd, FSRELPATH newpath, FLAGS32 flags: RENAME_NOREPLACE, RENAME_EXCHANGE, RENAME_WHITEOUT |
| Yes | > | userfaultfd | |
| Yes | < | userfaultfd | ERRNO res, FLAGS32 flags: O_LARGEFILE, O_DIRECTORY, O_DIRECT, O_TRUNC, O_SYNC, O_NONBLOCK, O_EXCL, O_DSYNC, O_APPEND, O_CREAT, O_RDWR, O_WRONLY, O_RDONLY, O_CLOEXEC, O_NONE, O_TMPFILE, O_F_CREATED |
| Yes | > | openat2 | FD dirfd, FSRELPATH name, FLAGS32 flags: O_LARGEFILE, O_DIRECTORY, O_DIRECT, O_TRUNC, O_SYNC, O_NONBLOCK, O_EXCL, O_DSYNC, O_APPEND, O_CREAT, O_RDWR, O_WRONLY, O_RDONLY, O_CLOEXEC, O_NONE, O_TMPFILE, O_F_CREATED, UINT32 mode, FLAGS32 resolve: RESOLVE_BENEATH, RESOLVE_IN_ROOT, RESOLVE_NO_MAGICLINKS, RESOLVE_NO_SYMLINKS, RESOLVE_NO_XDEV, RESOLVE_CACHED |
| Yes | < | openat2 | FD fd, FD dirfd, FSRELPATH name, FLAGS32 flags: O_LARGEFILE, O_DIRECTORY, O_DIRECT, O_TRUNC, O_SYNC, O_NONBLOCK, O_EXCL, O_DSYNC, O_APPEND, O_CREAT, O_RDWR, O_WRONLY, O_RDONLY, O_CLOEXEC, O_NONE, O_TMPFILE, O_F_CREATED, UINT32 mode, FLAGS32 resolve: RESOLVE_BENEATH, RESOLVE_IN_ROOT, RESOLVE_NO_MAGICLINKS, RESOLVE_NO_SYMLINKS, RESOLVE_NO_XDEV, RESOLVE_CACHED |
| Yes | > | mprotect | UINT64 addr, UINT64 length, FLAGS32 prot: PROT_READ, PROT_WRITE, PROT_EXEC, PROT_SEM, PROT_GROWSDOWN, PROT_GROWSUP, PROT_SAO, PROT_NONE |
| Yes | < | mprotect | ERRNO res |
| Yes | > | execveat | FD dirfd, FSRELPATH pathname, FLAGS32 flags: AT_EMPTY_PATH, AT_SYMLINK_NOFOLLOW |
| Yes | < | execveat | ERRNO res, CHARBUF exe, BYTEBUF args, PID tid, PID pid, PID ptid, CHARBUF cwd, UINT64 fdlimit, UINT64 pgft_maj, UINT64 pgft_min, UINT32 vm_size, UINT32 vm_rss, UINT32 vm_swap, CHARBUF comm, BYTEBUF cgroups, BYTEBUF env, UINT32 tty, PID pgid, UID loginuid, FLAGS32 flags: EXE_WRITABLE, EXE_UPPER_LAYER, EXE_FROM_MEMFD, UINT64 cap_inheritable, UINT64 cap_permitted, UINT64 cap_effective, UINT64 exe_ino, ABSTIME exe_ino_ctime, ABSTIME exe_ino_mtime, UID uid, FSPATH trusted_exepath |
| Yes | > | copy_file_range | FD fdin, UINT64 offin, UINT64 len |
| Yes | < | copy_file_range | ERRNO res, FD fdout, UINT64 offout |
| Yes | > | clone3 | |
| Yes | < | clone3 | PID res, CHARBUF exe, BYTEBUF args, PID tid, PID pid, PID ptid, CHARBUF cwd, INT64 fdlimit, UINT64 pgft_maj, UINT64 pgft_min, UINT32 vm_size, UINT32 vm_rss, UINT32 vm_swap, CHARBUF comm, BYTEBUF cgroups, FLAGS32 flags: CLONE_FILES, CLONE_FS, CLONE_IO, CLONE_NEWIPC, CLONE_NEWNET, CLONE_NEWNS, CLONE_NEWPID, CLONE_NEWUTS, CLONE_PARENT, CLONE_PARENT_SETTID, CLONE_PTRACE, CLONE_SIGHAND, CLONE_SYSVSEM, CLONE_THREAD, CLONE_UNTRACED, CLONE_VM, CLONE_INVERTED, NAME_CHANGED, CLOSED, CLONE_NEWUSER, CLONE_CHILD_CLEARTID, CLONE_CHILD_SETTID, CLONE_SETTLS, CLONE_STOPPED, CLONE_VFORK, CLONE_NEWCGROUP, UINT32 uid, UINT32 gid, PID vtid, PID vpid, UINT64 pidns_init_start_ts |
| Yes | > | open_by_handle_at | |
| Yes | < | open_by_handle_at | FD fd, FD mountfd, FLAGS32 flags: O_LARGEFILE, O_DIRECTORY, O_DIRECT, O_TRUNC, O_SYNC, O_NONBLOCK, O_EXCL, O_DSYNC, O_APPEND, O_CREAT, O_RDWR, O_WRONLY, O_RDONLY, O_CLOEXEC, O_NONE, O_TMPFILE, O_F_CREATED, FSPATH path |
| Yes | > | io_uring_setup | |
| Yes | < | io_uring_setup | ERRNO res, UINT32 entries, UINT32 sq_entries, UINT32 cq_entries, FLAGS32 flags: IORING_SETUP_IOPOLL, IORING_SETUP_SQPOLL, IORING_SQ_NEED_WAKEUP, IORING_SETUP_SQ_AFF, IORING_SETUP_CQSIZE, IORING_SETUP_CLAMP, IORING_SETUP_ATTACH_RW, IORING_SETUP_R_DISABLED, UINT32 sq_thread_cpu, UINT32 sq_thread_idle, FLAGS32 features: IORING_FEAT_SINGLE_MMAP, IORING_FEAT_NODROP, IORING_FEAT_SUBMIT_STABLE, IORING_FEAT_RW_CUR_POS, IORING_FEAT_CUR_PERSONALITY, IORING_FEAT_FAST_POLL, IORING_FEAT_POLL_32BITS, IORING_FEAT_SQPOLL_NONFIXED, IORING_FEAT_ENTER_EXT_ARG, IORING_FEAT_NATIVE_WORKERS, IORING_FEAT_RSRC_TAGS |
| Yes | > | io_uring_enter | |
| Yes | < | io_uring_enter | ERRNO res, FD fd, UINT32 to_submit, UINT32 min_complete, FLAGS32 flags: IORING_ENTER_GETEVENTS, IORING_ENTER_SQ_WAKEUP, IORING_ENTER_SQ_WAIT, IORING_ENTER_EXT_ARG, SIGSET sig |
| Yes | > | io_uring_register | |
| Yes | < | io_uring_register | ERRNO res, FD fd, ENUMFLAGS16 opcode: IORING_REGISTER_BUFFERS, IORING_UNREGISTER_BUFFERS, IORING_REGISTER_FILES, IORING_UNREGISTER_FILES, IORING_REGISTER_EVENTFD, IORING_UNREGISTER_EVENTFD, IORING_REGISTER_FILES_UPDATE, IORING_REGISTER_EVENTFD_ASYNC, IORING_REGISTER_PROBE, IORING_REGISTER_PERSONALITY, IORING_UNREGISTER_PERSONALITY, IORING_REGISTER_RESTRICTIONS, IORING_REGISTER_ENABLE_RINGS, IORING_REGISTER_FILES2, IORING_REGISTER_FILES_UPDATE2, IORING_REGISTER_BUFFERS2, IORING_REGISTER_BUFFERS_UPDATE, IORING_REGISTER_IOWQ_AFF, IORING_UNREGISTER_IOWQ_AFF, IORING_REGISTER_IOWQ_MAX_WORKERS, IORING_REGISTER_RING_FDS, IORING_UNREGISTER_RING_FDS, UINT64 arg, UINT32 nr_args |
| Yes | > | mlock | |
| Yes | < | mlock | ERRNO res, UINT64 addr, UINT64 len |
| Yes | > | munlock | |
| Yes | < | munlock | ERRNO res, UINT64 addr, UINT64 len |
| Yes | > | mlockall | |
| Yes | < | mlockall | ERRNO res, FLAGS32 flags: MCL_CURRENT, MCL_FUTURE, MCL_ONFAULT |
| Yes | > | munlockall | |
| Yes | < | munlockall | ERRNO res |
| Yes | > | capset | |
| Yes | < | capset | ERRNO res, UINT64 cap_inheritable, UINT64 cap_permitted, UINT64 cap_effective |
| Yes | > | dup2 | FD fd |
| Yes | < | dup2 | FD res, FD oldfd, FD newfd |
| Yes | > | dup3 | FD fd |
| Yes | < | dup3 | FD res, FD oldfd, FD newfd, FLAGS32 flags: O_LARGEFILE, O_DIRECTORY, O_DIRECT, O_TRUNC, O_SYNC, O_NONBLOCK, O_EXCL, O_DSYNC, O_APPEND, O_CREAT, O_RDWR, O_WRONLY, O_RDONLY, O_CLOEXEC, O_NONE, O_TMPFILE, O_F_CREATED |
| Yes | > | dup | FD fd |
| Yes | < | dup | FD res, FD oldfd |
| Yes | > | bpf | INT64 cmd |
| Yes | < | bpf | FD fd |
| Yes | > | mlock2 | |
| Yes | < | mlock2 | ERRNO res, UINT64 addr, UINT64 len, UINT32 flags |
| Yes | > | fsconfig | |
| Yes | < | fsconfig | ERRNO res, FD fd, ENUMFLAGS32 cmd: FSCONFIG_SET_FLAG, FSCONFIG_SET_STRING, FSCONFIG_SET_BINARY, FSCONFIG_SET_PATH, FSCONFIG_SET_PATH_EMPTY, FSCONFIG_SET_FD, FSCONFIG_CMD_CREATE, FSCONFIG_CMD_RECONFIGURE, CHARBUF key, BYTEBUF value_bytebuf, CHARBUF value_charbuf, INT32 aux |
| Yes | > | epoll_create | INT32 size |
| Yes | < | epoll_create | ERRNO res |
| Yes | > | epoll_create1 | FLAGS32 flags: EPOLL_CLOEXEC |
| Yes | < | epoll_create1 | ERRNO res |
| Yes | > | chown | |
| Yes | < | chown | ERRNO res, FSPATH path, UINT32 uid, UINT32 gid |
| Yes | > | lchown | |
| Yes | < | lchown | ERRNO res, FSPATH path, UINT32 uid, UINT32 gid |
| Yes | > | fchown | |
| Yes | < | fchown | ERRNO res, FD fd, UINT32 uid, UINT32 gid |
| Yes | > | fchownat | |
| Yes | < | fchownat | ERRNO res, FD dirfd, FSRELPATH pathname, UINT32 uid, UINT32 gid, FLAGS32 flags: AT_SYMLINK_NOFOLLOW, AT_EMPTY_PATH |
| Yes | > | umount | |
| Yes | < | umount | ERRNO res, FSPATH name |
| Yes | > | accept4 | INT32 flags |
| Yes | < | accept4 | FD fd, SOCKTUPLE tuple, UINT8 queuepct, UINT32 queuelen, UINT32 queuemax |
| Yes | > | umount2 | FLAGS32 flags: FORCE, DETACH, EXPIRE, NOFOLLOW |
| Yes | < | umount2 | ERRNO res, FSPATH name |
| Yes | > | pipe2 | |
| Yes | < | pipe2 | ERRNO res, FD fd1, FD fd2, UINT64 ino, FLAGS32 flags: O_LARGEFILE, O_DIRECTORY, O_DIRECT, O_TRUNC, O_SYNC, O_NONBLOCK, O_EXCL, O_DSYNC, O_APPEND, O_CREAT, O_RDWR, O_WRONLY, O_RDONLY, O_CLOEXEC, O_NONE, O_TMPFILE, O_F_CREATED |
| Yes | > | inotify_init1 | |
| Yes | < | inotify_init1 | FD res, FLAGS16 flags: O_LARGEFILE, O_DIRECTORY, O_DIRECT, O_TRUNC, O_SYNC, O_NONBLOCK, O_EXCL, O_DSYNC, O_APPEND, O_CREAT, O_RDWR, O_WRONLY, O_RDONLY, O_CLOEXEC, O_NONE, O_TMPFILE, O_F_CREATED |
| Yes | > | eventfd2 | UINT64 initval |
| Yes | < | eventfd2 | FD res, FLAGS16 flags: O_LARGEFILE, O_DIRECTORY, O_DIRECT, O_TRUNC, O_SYNC, O_NONBLOCK, O_EXCL, O_DSYNC, O_APPEND, O_CREAT, O_RDWR, O_WRONLY, O_RDONLY, O_CLOEXEC, O_NONE, O_TMPFILE, O_F_CREATED |
| Yes | > | signalfd4 | FD fd, UINT32 mask |
| Yes | < | signalfd4 | FD res, FLAGS16 flags |
| Yes | > | prctl | |
| Yes | < | prctl | ERRNO res, ENUMFLAGS32 option: PR_GET_DUMPABLE, PR_SET_DUMPABLE, PR_GET_KEEPCAPS, PR_SET_KEEPCAPS, PR_SET_NAME, PR_GET_NAME, PR_GET_SECCOMP, PR_SET_SECCOMP, PR_CAPBSET_READ, PR_CAPBSET_DROP, PR_GET_SECUREBITS, PR_SET_SECUREBITS, PR_MCE_KILL, PR_MCE_KILL, PR_SET_MM, PR_SET_CHILD_SUBREAPER, PR_GET_CHILD_SUBREAPER, PR_SET_NO_NEW_PRIVS, PR_GET_NO_NEW_PRIVS, PR_GET_TID_ADDRESS, PR_SET_THP_DISABLE, PR_GET_THP_DISABLE, PR_CAP_AMBIENT, CHARBUF arg2_str, INT64 arg2_int |
| Yes | > | memfd_create | |
| Yes | < | memfd_create | FD fd, CHARBUF name, FLAGS32 flags: MFD_CLOEXEC, MFD_ALLOW_SEALING, MFD_HUGETLB |
| Yes | > | pidfd_getfd | |
| Yes | < | pidfd_getfd | FD fd, FD pid_fd, FD target_fd, FLAGS32 flags |
| Yes | > | pidfd_open | |
| Yes | < | pidfd_open | FD fd, PID pid, FLAGS32 flags |
| Yes | > | init_module | |
| Yes | < | init_module | ERRNO res, BYTEBUF img, UINT64 length, CHARBUF uargs |
| Yes | > | finit_module | |
| Yes | < | finit_module | ERRNO res, FD fd, CHARBUF uargs, FLAGS32 flags |
| Yes | > | mknod | |
| Yes | < | mknod | ERRNO res, FSPATH path, MODE mode, UINT32 dev |
| Yes | > | mknodat | |
| Yes | < | mknodat | ERRNO res, FD dirfd, FSRELPATH path, MODE mode, UINT32 dev |
| Yes | > | sigreturn | SYSCALLID ID, UINT16 nativeID |
| Yes | < | sigreturn | SYSCALLID ID |
| Yes | > | s390_runtime_instr | SYSCALLID ID, UINT16 nativeID |
| Yes | < | s390_runtime_instr | SYSCALLID ID |
| Yes | > | s390_sthyi | SYSCALLID ID, UINT16 nativeID |
| Yes | < | s390_sthyi | SYSCALLID ID |
| Yes | > | readdir | SYSCALLID ID, UINT16 nativeID |
| Yes | < | readdir | SYSCALLID ID |
| Yes | > | sync_file_range | SYSCALLID ID, UINT16 nativeID |
| Yes | < | sync_file_range | SYSCALLID ID |
| Yes | > | faccessat2 | SYSCALLID ID, UINT16 nativeID |
| Yes | < | faccessat2 | SYSCALLID ID |
| Yes | > | sched_getattr | SYSCALLID ID, UINT16 nativeID |
| Yes | < | sched_getattr | SYSCALLID ID |
| Yes | > | rseq | SYSCALLID ID, UINT16 nativeID |
| Yes | < | rseq | SYSCALLID ID |
| Yes | > | nfsservctl | SYSCALLID ID, UINT16 nativeID |
| Yes | < | nfsservctl | SYSCALLID ID |
| Yes | > | sigsuspend | SYSCALLID ID, UINT16 nativeID |
| Yes | < | sigsuspend | SYSCALLID ID |
| Yes | > | getpmsg | SYSCALLID ID, UINT16 nativeID |
| Yes | < | getpmsg | SYSCALLID ID |
| Yes | > | set_mempolicy_home_node | SYSCALLID ID, UINT16 nativeID |
| Yes | < | set_mempolicy_home_node | SYSCALLID ID |
| Yes | > | io_pgetevents | SYSCALLID ID, UINT16 nativeID |
| Yes | < | io_pgetevents | SYSCALLID ID |
| Yes | > | statx | SYSCALLID ID, UINT16 nativeID |
| Yes | < | statx | SYSCALLID ID |
| Yes | > | epoll_ctl_old | SYSCALLID ID, UINT16 nativeID |
| Yes | < | epoll_ctl_old | SYSCALLID ID |
| Yes | > | mbind | SYSCALLID ID, UINT16 nativeID |
| Yes | < | mbind | SYSCALLID ID |
| Yes | > | move_pages | SYSCALLID ID, UINT16 nativeID |
| Yes | < | move_pages | SYSCALLID ID |
| Yes | > | migrate_pages | SYSCALLID ID, UINT16 nativeID |
| Yes | < | migrate_pages | SYSCALLID ID |
| Yes | > | landlock_add_rule | SYSCALLID ID, UINT16 nativeID |
| Yes | < | landlock_add_rule | SYSCALLID ID |
| Yes | > | landlock_restrict_self | SYSCALLID ID, UINT16 nativeID |
| Yes | < | landlock_restrict_self | SYSCALLID ID |
| Yes | > | pkey_alloc | SYSCALLID ID, UINT16 nativeID |
| Yes | < | pkey_alloc | SYSCALLID ID |
| Yes | > | close_range | SYSCALLID ID, UINT16 nativeID |
| Yes | < | close_range | SYSCALLID ID |
| Yes | > | kexec_file_load | SYSCALLID ID, UINT16 nativeID |
| Yes | < | kexec_file_load | SYSCALLID ID |
| Yes | > | memfd_secret | SYSCALLID ID, UINT16 nativeID |
| Yes | < | memfd_secret | SYSCALLID ID |
| Yes | > | fadvise64 | SYSCALLID ID, UINT16 nativeID |
| Yes | < | fadvise64 | SYSCALLID ID |
| Yes | > | getrandom | SYSCALLID ID, UINT16 nativeID |
| Yes | < | getrandom | SYSCALLID ID |
| Yes | > | sigaltstack | SYSCALLID ID, UINT16 nativeID |
| Yes | < | sigaltstack | SYSCALLID ID |
| Yes | > | process_vm_writev | SYSCALLID ID, UINT16 nativeID |
| Yes | < | process_vm_writev | SYSCALLID ID |
| Yes | > | fallocate | SYSCALLID ID, UINT16 nativeID |
| Yes | < | fallocate | SYSCALLID ID |
| Yes | > | waitpid | SYSCALLID ID, UINT16 nativeID |
| Yes | < | waitpid | SYSCALLID ID |
| Yes | > | nice | SYSCALLID ID, UINT16 nativeID |
| Yes | < | nice | SYSCALLID ID |
| Yes | > | olduname | SYSCALLID ID, UINT16 nativeID |
| Yes | < | olduname | SYSCALLID ID |
| Yes | > | sgetmask | SYSCALLID ID, UINT16 nativeID |
| Yes | < | sgetmask | SYSCALLID ID |
| Yes | > | _newselect | SYSCALLID ID, UINT16 nativeID |
| Yes | < | _newselect | SYSCALLID ID |
| Yes | > | socketcall | SYSCALLID ID, UINT16 nativeID |
| Yes | < | socketcall | SYSCALLID ID |
| Yes | > | sigprocmask | SYSCALLID ID, UINT16 nativeID |
| Yes | < | sigprocmask | SYSCALLID ID |
| Yes | > | fstatat64 | SYSCALLID ID, UINT16 nativeID |
| Yes | < | fstatat64 | SYSCALLID ID |
| Yes | > | process_vm_readv | SYSCALLID ID, UINT16 nativeID |
| Yes | < | process_vm_readv | SYSCALLID ID |
| Yes | > | fstatfs64 | SYSCALLID ID, UINT16 nativeID |
| Yes | < | fstatfs64 | SYSCALLID ID |
| Yes | > | statfs64 | SYSCALLID ID, UINT16 nativeID |
| Yes | < | statfs64 | SYSCALLID ID |
| Yes | > | msgctl | SYSCALLID ID, UINT16 nativeID |
| Yes | < | msgctl | SYSCALLID ID |
| Yes | > | msgget | SYSCALLID ID, UINT16 nativeID |
| Yes | < | msgget | SYSCALLID ID |
| Yes | > | process_mrelease | SYSCALLID ID, UINT16 nativeID |
| Yes | < | process_mrelease | SYSCALLID ID |
| Yes | > | msgrcv | SYSCALLID ID, UINT16 nativeID |
| Yes | < | msgrcv | SYSCALLID ID |
| Yes | > | perf_event_open | SYSCALLID ID, UINT16 nativeID |
| Yes | < | perf_event_open | SYSCALLID ID |
| Yes | > | getcpu | SYSCALLID ID, UINT16 nativeID |
| Yes | < | getcpu | SYSCALLID ID |
| Yes | > | create_module | SYSCALLID ID, UINT16 nativeID |
| Yes | < | create_module | SYSCALLID ID |
| Yes | > | preadv2 | SYSCALLID ID, UINT16 nativeID |
| Yes | < | preadv2 | SYSCALLID ID |
| Yes | > | vmsplice | SYSCALLID ID, UINT16 nativeID |
| Yes | < | vmsplice | SYSCALLID ID |
| Yes | > | rt_sigtimedwait | SYSCALLID ID, UINT16 nativeID |
| Yes | < | rt_sigtimedwait | SYSCALLID ID |
| Yes | > | mq_open | SYSCALLID ID, UINT16 nativeID |
| Yes | < | mq_open | SYSCALLID ID |
| Yes | > | modify_ldt | SYSCALLID ID, UINT16 nativeID |
| Yes | < | modify_ldt | SYSCALLID ID |
| Yes | > | timerfd_settime | SYSCALLID ID, UINT16 nativeID |
| Yes | < | timerfd_settime | SYSCALLID ID |
| Yes | > | getitimer | SYSCALLID ID, UINT16 nativeID |
| Yes | < | getitimer | SYSCALLID ID |
| Yes | > | semtimedop | SYSCALLID ID, UINT16 nativeID |
| Yes | < | semtimedop | SYSCALLID ID |
| Yes | > | rt_sigreturn | SYSCALLID ID, UINT16 nativeID |
| Yes | < | rt_sigreturn | SYSCALLID ID |
| Yes | > | rt_sigpending | SYSCALLID ID, UINT16 nativeID |
| Yes | < | rt_sigpending | SYSCALLID ID |
| Yes | > | sched_get_priority_min | SYSCALLID ID, UINT16 nativeID |
| Yes | < | sched_get_priority_min | SYSCALLID ID |
| Yes | > | sched_getscheduler | SYSCALLID ID, UINT16 nativeID |
| Yes | < | sched_getscheduler | SYSCALLID ID |
| Yes | > | kcmp | SYSCALLID ID, UINT16 nativeID |
| Yes | < | kcmp | SYSCALLID ID |
| Yes | > | open_tree | SYSCALLID ID, UINT16 nativeID |
| Yes | < | open_tree | SYSCALLID ID |
| Yes | > | setpriority | SYSCALLID ID, UINT16 nativeID |
| Yes | < | setpriority | SYSCALLID ID |
| Yes | > | sched_setscheduler | SYSCALLID ID, UINT16 nativeID |
| Yes | < | sched_setscheduler | SYSCALLID ID |
| Yes | > | sched_getparam | SYSCALLID ID, UINT16 nativeID |
| Yes | < | sched_getparam | SYSCALLID ID |
| Yes | > | fdatasync | SYSCALLID ID, UINT16 nativeID |
| Yes | < | fdatasync | SYSCALLID ID |
| Yes | > | pkey_mprotect | SYSCALLID ID, UINT16 nativeID |
| Yes | < | pkey_mprotect | SYSCALLID ID |
| Yes | > | clock_nanosleep | SYSCALLID ID, UINT16 nativeID |
| Yes | < | clock_nanosleep | SYSCALLID ID |
| Yes | > | getsid | SYSCALLID ID, UINT16 nativeID |
| Yes | < | getsid | SYSCALLID ID |
| Yes | > | signal | SYSCALLID ID, UINT16 nativeID |
| Yes | < | signal | SYSCALLID ID |
| Yes | > | sched_yield | SYSCALLID ID, UINT16 nativeID |
| Yes | < | sched_yield | SYSCALLID ID |
| Yes | > | get_robust_list | SYSCALLID ID, UINT16 nativeID |
| Yes | < | get_robust_list | SYSCALLID ID |
| Yes | > | set_tid_address | SYSCALLID ID, UINT16 nativeID |
| Yes | < | set_tid_address | SYSCALLID ID |
| Yes | > | getpgid | SYSCALLID ID, UINT16 nativeID |
| Yes | < | getpgid | SYSCALLID ID |
| Yes | > | wait4 | SYSCALLID ID, UINT16 nativeID |
| Yes | < | wait4 | SYSCALLID ID |
| Yes | > | rt_sigaction | SYSCALLID ID, UINT16 nativeID |
| Yes | < | rt_sigaction | SYSCALLID ID |
| Yes | > | mq_timedreceive | SYSCALLID ID, UINT16 nativeID |
| Yes | < | mq_timedreceive | SYSCALLID ID |
| Yes | > | rt_tgsigqueueinfo | SYSCALLID ID, UINT16 nativeID |
| Yes | < | rt_tgsigqueueinfo | SYSCALLID ID |
| Yes | > | rt_sigprocmask | SYSCALLID ID, UINT16 nativeID |
| Yes | < | rt_sigprocmask | SYSCALLID ID |
| Yes | > | _sysctl | SYSCALLID ID, UINT16 nativeID |
| Yes | < | _sysctl | SYSCALLID ID |
| Yes | > | epoll_wait_old | SYSCALLID ID, UINT16 nativeID |
| Yes | < | epoll_wait_old | SYSCALLID ID |
| Yes | > | vhangup | SYSCALLID ID, UINT16 nativeID |
| Yes | < | vhangup | SYSCALLID ID |
| Yes | > | io_destroy | SYSCALLID ID, UINT16 nativeID |
| Yes | < | io_destroy | SYSCALLID ID |
| Yes | > | getppid | SYSCALLID ID, UINT16 nativeID |
| Yes | < | getppid | SYSCALLID ID |
| Yes | > | exit | SYSCALLID ID, UINT16 nativeID |
| Yes | < | exit | SYSCALLID ID |
| Yes | > | pivot_root | SYSCALLID ID, UINT16 nativeID |
| Yes | < | pivot_root | SYSCALLID ID |
| Yes | > | cachestat | SYSCALLID ID, UINT16 nativeID |
| Yes | < | cachestat | SYSCALLID ID |
| Yes | > | mincore | SYSCALLID ID, UINT16 nativeID |
| Yes | < | mincore | SYSCALLID ID |
| Yes | > | msgsnd | SYSCALLID ID, UINT16 nativeID |
| Yes | < | msgsnd | SYSCALLID ID |
| Yes | > | sysinfo | SYSCALLID ID, UINT16 nativeID |
| Yes | < | sysinfo | SYSCALLID ID |
| Yes | > | acct | SYSCALLID ID, UINT16 nativeID |
| Yes | < | acct | SYSCALLID ID |
| Yes | > | epoll_pwait | SYSCALLID ID, UINT16 nativeID |
| Yes | < | epoll_pwait | SYSCALLID ID |
| Yes | > | sysfs | SYSCALLID ID, UINT16 nativeID |
| Yes | < | sysfs | SYSCALLID ID |
| Yes | > | restart_syscall | SYSCALLID ID, UINT16 nativeID |
| Yes | < | restart_syscall | SYSCALLID ID |
| Yes | > | clock_adjtime | SYSCALLID ID, UINT16 nativeID |
| Yes | < | clock_adjtime | SYSCALLID ID |
| Yes | > | sync | SYSCALLID ID, UINT16 nativeID |
| Yes | < | sync | SYSCALLID ID |
| Yes | > | getpid | SYSCALLID ID, UINT16 nativeID |
| Yes | < | getpid | SYSCALLID ID |
| Yes | > | utime | SYSCALLID ID, UINT16 nativeID |
| Yes | < | utime | SYSCALLID ID |
| Yes | > | name_to_handle_at | SYSCALLID ID, UINT16 nativeID |
| Yes | < | name_to_handle_at | SYSCALLID ID |
| Yes | > | sched_setparam | SYSCALLID ID, UINT16 nativeID |
| Yes | < | sched_setparam | SYSCALLID ID |
| Yes | > | stime | SYSCALLID ID, UINT16 nativeID |
| Yes | < | stime | SYSCALLID ID |
| Yes | > | pause | SYSCALLID ID, UINT16 nativeID |
| Yes | < | pause | SYSCALLID ID |
| Yes | > | timerfd | SYSCALLID ID, UINT16 nativeID |
| Yes | < | timerfd | SYSCALLID ID |
| Yes | > | msync | SYSCALLID ID, UINT16 nativeID |
| Yes | < | msync | SYSCALLID ID |
| Yes | > | rt_sigsuspend | SYSCALLID ID, UINT16 nativeID |
| Yes | < | rt_sigsuspend | SYSCALLID ID |
| Yes | > | landlock_create_ruleset | SYSCALLID ID, UINT16 nativeID |
| Yes | < | landlock_create_ruleset | SYSCALLID ID |
| Yes | > | lremovexattr | SYSCALLID ID, UINT16 nativeID |
| Yes | < | lremovexattr | SYSCALLID ID |
| Yes | > | remap_file_pages | SYSCALLID ID, UINT16 nativeID |
| Yes | < | remap_file_pages | SYSCALLID ID |
| Yes | > | times | SYSCALLID ID, UINT16 nativeID |
| Yes | < | times | SYSCALLID ID |
| Yes | > | sched_get_priority_max | SYSCALLID ID, UINT16 nativeID |
| Yes | < | sched_get_priority_max | SYSCALLID ID |
| Yes | > | fanotify_mark | SYSCALLID ID, UINT16 nativeID |
| Yes | < | fanotify_mark | SYSCALLID ID |
| Yes | > | statfs | SYSCALLID ID, UINT16 nativeID |
| Yes | < | statfs | SYSCALLID ID |
| Yes | > | readahead | SYSCALLID ID, UINT16 nativeID |
| Yes | < | readahead | SYSCALLID ID |
| Yes | > | pkey_free | SYSCALLID ID, UINT16 nativeID |
| Yes | < | pkey_free | SYSCALLID ID |
| Yes | > | time | SYSCALLID ID, UINT16 nativeID |
| Yes | < | time | SYSCALLID ID |
| Yes | > | uname | SYSCALLID ID, UINT16 nativeID |
| Yes | < | uname | SYSCALLID ID |
| Yes | > | process_madvise | SYSCALLID ID, UINT16 nativeID |
| Yes | < | process_madvise | SYSCALLID ID |
| Yes | > | ioprio_get | SYSCALLID ID, UINT16 nativeID |
| Yes | < | ioprio_get | SYSCALLID ID |
| Yes | > | pselect6 | SYSCALLID ID, UINT16 nativeID |
| Yes | < | pselect6 | SYSCALLID ID |
| Yes | > | swapon | SYSCALLID ID, UINT16 nativeID |
| Yes | < | swapon | SYSCALLID ID |
| Yes | > | settimeofday | SYSCALLID ID, UINT16 nativeID |
| Yes | < | settimeofday | SYSCALLID ID |
| Yes | > | iopl | SYSCALLID ID, UINT16 nativeID |
| Yes | < | iopl | SYSCALLID ID |
| Yes | > | set_mempolicy | SYSCALLID ID, UINT16 nativeID |
| Yes | < | set_mempolicy | SYSCALLID ID |
| Yes | > | ftruncate | SYSCALLID ID, UINT16 nativeID |
| Yes | < | ftruncate | SYSCALLID ID |
| Yes | > | syncfs | SYSCALLID ID, UINT16 nativeID |
| Yes | < | syncfs | SYSCALLID ID |
| Yes | > | readlink | SYSCALLID ID, UINT16 nativeID |
| Yes | < | readlink | SYSCALLID ID |
| Yes | > | gettimeofday | SYSCALLID ID, UINT16 nativeID |
| Yes | < | gettimeofday | SYSCALLID ID |
| Yes | > | s390_guarded_storage | SYSCALLID ID, UINT16 nativeID |
| Yes | < | s390_guarded_storage | SYSCALLID ID |
| Yes | > | sched_rr_get_interval | SYSCALLID ID, UINT16 nativeID |
| Yes | < | sched_rr_get_interval | SYSCALLID ID |
| Yes | > | setgroups | SYSCALLID ID, UINT16 nativeID |
| Yes | < | setgroups | SYSCALLID ID |
| Yes | > | timer_gettime | SYSCALLID ID, UINT16 nativeID |
| Yes | < | timer_gettime | SYSCALLID ID |
| Yes | > | ioprio_set | SYSCALLID ID, UINT16 nativeID |
| Yes | < | ioprio_set | SYSCALLID ID |
| Yes | > | futimesat | SYSCALLID ID, UINT16 nativeID |
| Yes | < | futimesat | SYSCALLID ID |
| Yes | > | reboot | SYSCALLID ID, UINT16 nativeID |
| Yes | < | reboot | SYSCALLID ID |
| Yes | > | get_kernel_syms | SYSCALLID ID, UINT16 nativeID |
| Yes | < | get_kernel_syms | SYSCALLID ID |
| Yes | > | uselib | SYSCALLID ID, UINT16 nativeID |
| Yes | < | uselib | SYSCALLID ID |
| Yes | > | ioperm | SYSCALLID ID, UINT16 nativeID |
| Yes | < | ioperm | SYSCALLID ID |
| Yes | > | syslog | SYSCALLID ID, UINT16 nativeID |
| Yes | < | syslog | SYSCALLID ID |
| Yes | > | mremap | SYSCALLID ID, UINT16 nativeID |
| Yes | < | mremap | SYSCALLID ID |
| Yes | > | truncate | SYSCALLID ID, UINT16 nativeID |
| Yes | < | truncate | SYSCALLID ID |
| Yes | > | ustat | SYSCALLID ID, UINT16 nativeID |
| Yes | < | ustat | SYSCALLID ID |
| Yes | > | timer_settime | SYSCALLID ID, UINT16 nativeID |
| Yes | < | timer_settime | SYSCALLID ID |
| Yes | > | quotactl_fd | SYSCALLID ID, UINT16 nativeID |
| Yes | < | quotactl_fd | SYSCALLID ID |
| Yes | > | umask | SYSCALLID ID, UINT16 nativeID |
| Yes | < | umask | SYSCALLID ID |
| Yes | > | clock_settime | SYSCALLID ID, UINT16 nativeID |
| Yes | < | clock_settime | SYSCALLID ID |
| Yes | > | mount_setattr | SYSCALLID ID, UINT16 nativeID |
| Yes | < | mount_setattr | SYSCALLID ID |
| Yes | > | getpriority | SYSCALLID ID, UINT16 nativeID |
| Yes | < | getpriority | SYSCALLID ID |
| Yes | > | get_mempolicy | SYSCALLID ID, UINT16 nativeID |
| Yes | < | get_mempolicy | SYSCALLID ID |
| Yes | > | move_mount | SYSCALLID ID, UINT16 nativeID |
| Yes | < | move_mount | SYSCALLID ID |
| Yes | > | alarm | SYSCALLID ID, UINT16 nativeID |
| Yes | < | alarm | SYSCALLID ID |
| Yes | > | getxattr | SYSCALLID ID, UINT16 nativeID |
| Yes | < | getxattr | SYSCALLID ID |
| Yes | > | personality | SYSCALLID ID, UINT16 nativeID |
| Yes | < | personality | SYSCALLID ID |
| Yes | > | getpgrp | SYSCALLID ID, UINT16 nativeID |
| Yes | < | getpgrp | SYSCALLID ID |
| Yes | > | fstatfs | SYSCALLID ID, UINT16 nativeID |
| Yes | < | fstatfs | SYSCALLID ID |
| Yes | > | mq_getsetattr | SYSCALLID ID, UINT16 nativeID |
| Yes | < | mq_getsetattr | SYSCALLID ID |
| Yes | > | setreuid | SYSCALLID ID, UINT16 nativeID |
| Yes | < | setreuid | SYSCALLID ID |
| Yes | > | setregid | SYSCALLID ID, UINT16 nativeID |
| Yes | < | setregid | SYSCALLID ID |
| Yes | > | setfsuid | SYSCALLID ID, UINT16 nativeID |
| Yes | < | setfsuid | SYSCALLID ID |
| Yes | > | setfsgid | SYSCALLID ID, UINT16 nativeID |
| Yes | < | setfsgid | SYSCALLID ID |
| Yes | > | s390_pci_mmio_read | SYSCALLID ID, UINT16 nativeID |
| Yes | < | s390_pci_mmio_read | SYSCALLID ID |
| Yes | > | ssetmask | SYSCALLID ID, UINT16 nativeID |
| Yes | < | ssetmask | SYSCALLID ID |
| Yes | > | madvise | SYSCALLID ID, UINT16 nativeID |
| Yes | < | madvise | SYSCALLID ID |
| Yes | > | swapoff | SYSCALLID ID, UINT16 nativeID |
| Yes | < | swapoff | SYSCALLID ID |
| Yes | > | add_key | SYSCALLID ID, UINT16 nativeID |
| Yes | < | add_key | SYSCALLID ID |
| Yes | > | membarrier | SYSCALLID ID, UINT16 nativeID |
| Yes | < | membarrier | SYSCALLID ID |
| Yes | > | gettid | SYSCALLID ID, UINT16 nativeID |
| Yes | < | gettid | SYSCALLID ID |
| Yes | > | query_module | SYSCALLID ID, UINT16 nativeID |
| Yes | < | query_module | SYSCALLID ID |
| Yes | > | shmat | SYSCALLID ID, UINT16 nativeID |
| Yes | < | shmat | SYSCALLID ID |
| Yes | > | lsetxattr | SYSCALLID ID, UINT16 nativeID |
| Yes | < | lsetxattr | SYSCALLID ID |
| Yes | > | lookup_dcookie | SYSCALLID ID, UINT16 nativeID |
| Yes | < | lookup_dcookie | SYSCALLID ID |
| Yes | > | fsetxattr | SYSCALLID ID, UINT16 nativeID |
| Yes | < | fsetxattr | SYSCALLID ID |
| Yes | > | ipc | SYSCALLID ID, UINT16 nativeID |
| Yes | < | ipc | SYSCALLID ID |
| Yes | > | fsync | SYSCALLID ID, UINT16 nativeID |
| Yes | < | fsync | SYSCALLID ID |
| Yes | > | lgetxattr | SYSCALLID ID, UINT16 nativeID |
| Yes | < | lgetxattr | SYSCALLID ID |
| Yes | > | futex_waitv | SYSCALLID ID, UINT16 nativeID |
| Yes | < | futex_waitv | SYSCALLID ID |
| Yes | > | fgetxattr | SYSCALLID ID, UINT16 nativeID |
| Yes | < | fgetxattr | SYSCALLID ID |
| Yes | > | sigpending | SYSCALLID ID, UINT16 nativeID |
| Yes | < | sigpending | SYSCALLID ID |
| Yes | > | shmdt | SYSCALLID ID, UINT16 nativeID |
| Yes | < | shmdt | SYSCALLID ID |
| Yes | > | listxattr | SYSCALLID ID, UINT16 nativeID |
| Yes | < | listxattr | SYSCALLID ID |
| Yes | > | setxattr | SYSCALLID ID, UINT16 nativeID |
| Yes | < | setxattr | SYSCALLID ID |
| Yes | > | mq_timedsend | SYSCALLID ID, UINT16 nativeID |
| Yes | < | mq_timedsend | SYSCALLID ID |
| Yes | > | sigaction | SYSCALLID ID, UINT16 nativeID |
| Yes | < | sigaction | SYSCALLID ID |
| Yes | > | arch_prctl | SYSCALLID ID, UINT16 nativeID |
| Yes | < | arch_prctl | SYSCALLID ID |
| Yes | > | waitid | SYSCALLID ID, UINT16 nativeID |
| Yes | < | waitid | SYSCALLID ID |
| Yes | > | llistxattr | SYSCALLID ID, UINT16 nativeID |
| Yes | < | llistxattr | SYSCALLID ID |
| Yes | > | flistxattr | SYSCALLID ID, UINT16 nativeID |
| Yes | < | flistxattr | SYSCALLID ID |
| Yes | > | timer_create | SYSCALLID ID, UINT16 nativeID |
| Yes | < | timer_create | SYSCALLID ID |
| Yes | > | removexattr | SYSCALLID ID, UINT16 nativeID |
| Yes | < | removexattr | SYSCALLID ID |
| Yes | > | delete_module | SYSCALLID ID, UINT16 nativeID |
| Yes | < | delete_module | SYSCALLID ID |
| Yes | > | fremovexattr | SYSCALLID ID, UINT16 nativeID |
| Yes | < | fremovexattr | SYSCALLID ID |
| Yes | > | utimensat | SYSCALLID ID, UINT16 nativeID |
| Yes | < | utimensat | SYSCALLID ID |
| Yes | > | rt_sigqueueinfo | SYSCALLID ID, UINT16 nativeID |
| Yes | < | rt_sigqueueinfo | SYSCALLID ID |
| Yes | > | sched_getaffinity | SYSCALLID ID, UINT16 nativeID |
| Yes | < | sched_getaffinity | SYSCALLID ID |
| Yes | > | sched_setattr | SYSCALLID ID, UINT16 nativeID |
| Yes | < | sched_setattr | SYSCALLID ID |
| Yes | > | epoll_pwait2 | SYSCALLID ID, UINT16 nativeID |
| Yes | < | epoll_pwait2 | SYSCALLID ID |
| Yes | > | fsopen | SYSCALLID ID, UINT16 nativeID |
| Yes | < | fsopen | SYSCALLID ID |
| Yes | > | fanotify_init | SYSCALLID ID, UINT16 nativeID |
| Yes | < | fanotify_init | SYSCALLID ID |
| Yes | > | request_key | SYSCALLID ID, UINT16 nativeID |
| Yes | < | request_key | SYSCALLID ID |
| Yes | > | sched_setaffinity | SYSCALLID ID, UINT16 nativeID |
| Yes | < | sched_setaffinity | SYSCALLID ID |
| Yes | > | io_submit | SYSCALLID ID, UINT16 nativeID |
| Yes | < | io_submit | SYSCALLID ID |
| Yes | > | set_thread_area | SYSCALLID ID, UINT16 nativeID |
| Yes | < | set_thread_area | SYSCALLID ID |
| Yes | > | get_thread_area | SYSCALLID ID, UINT16 nativeID |
| Yes | < | get_thread_area | SYSCALLID ID |
| Yes | > | epoll_ctl | SYSCALLID ID, UINT16 nativeID |
| Yes | < | epoll_ctl | SYSCALLID ID |
| Yes | > | pidfd_send_signal | SYSCALLID ID, UINT16 nativeID |
| Yes | < | pidfd_send_signal | SYSCALLID ID |
| Yes | > | inotify_add_watch | SYSCALLID ID, UINT16 nativeID |
| Yes | < | inotify_add_watch | SYSCALLID ID |
| Yes | > | setdomainname | SYSCALLID ID, UINT16 nativeID |
| Yes | < | setdomainname | SYSCALLID ID |
| Yes | > | io_setup | SYSCALLID ID, UINT16 nativeID |
| Yes | < | io_setup | SYSCALLID ID |
| Yes | > | s390_pci_mmio_write | SYSCALLID ID, UINT16 nativeID |
| Yes | < | s390_pci_mmio_write | SYSCALLID ID |
| Yes | > | io_getevents | SYSCALLID ID, UINT16 nativeID |
| Yes | < | io_getevents | SYSCALLID ID |
| Yes | > | io_cancel | SYSCALLID ID, UINT16 nativeID |
| Yes | < | io_cancel | SYSCALLID ID |
| Yes | > | timer_getoverrun | SYSCALLID ID, UINT16 nativeID |
| Yes | < | timer_getoverrun | SYSCALLID ID |
| Yes | > | timerfd_gettime | SYSCALLID ID, UINT16 nativeID |
| Yes | < | timerfd_gettime | SYSCALLID ID |
| Yes | > | setitimer | SYSCALLID ID, UINT16 nativeID |
| Yes | < | setitimer | SYSCALLID ID |
| Yes | > | clock_gettime | SYSCALLID ID, UINT16 nativeID |
| Yes | < | clock_gettime | SYSCALLID ID |
| Yes | > | fsmount | SYSCALLID ID, UINT16 nativeID |
| Yes | < | fsmount | SYSCALLID ID |
| Yes | > | exit_group | SYSCALLID ID, UINT16 nativeID |
| Yes | < | exit_group | SYSCALLID ID |
| Yes | > | getrusage | SYSCALLID ID, UINT16 nativeID |
| Yes | < | getrusage | SYSCALLID ID |
| Yes | > | sethostname | SYSCALLID ID, UINT16 nativeID |
| Yes | < | sethostname | SYSCALLID ID |
| Yes | > | timer_delete | SYSCALLID ID, UINT16 nativeID |
| Yes | < | timer_delete | SYSCALLID ID |
| Yes | > | idle | SYSCALLID ID, UINT16 nativeID |
| Yes | < | idle | SYSCALLID ID |
| Yes | > | shmget | SYSCALLID ID, UINT16 nativeID |
| Yes | < | shmget | SYSCALLID ID |
| Yes | > | readlinkat | SYSCALLID ID, UINT16 nativeID |
| Yes | < | readlinkat | SYSCALLID ID |
| Yes | > | shmctl | SYSCALLID ID, UINT16 nativeID |
| Yes | < | shmctl | SYSCALLID ID |
| Yes | > | set_robust_list | SYSCALLID ID, UINT16 nativeID |
| Yes | < | set_robust_list | SYSCALLID ID |
| Yes | > | utimes | SYSCALLID ID, UINT16 nativeID |
| Yes | < | utimes | SYSCALLID ID |
| Yes | > | adjtimex | SYSCALLID ID, UINT16 nativeID |
| Yes | < | adjtimex | SYSCALLID ID |
| Yes | > | mq_unlink | SYSCALLID ID, UINT16 nativeID |
| Yes | < | mq_unlink | SYSCALLID ID |
| Yes | > | pwritev2 | SYSCALLID ID, UINT16 nativeID |
| Yes | < | pwritev2 | SYSCALLID ID |
| Yes | > | mq_notify | SYSCALLID ID, UINT16 nativeID |
| Yes | < | mq_notify | SYSCALLID ID |
| Yes | > | kexec_load | SYSCALLID ID, UINT16 nativeID |
| Yes | < | kexec_load | SYSCALLID ID |
| Yes | > | clock_getres | SYSCALLID ID, UINT16 nativeID |
| Yes | < | clock_getres | SYSCALLID ID |
| Yes | > | keyctl | SYSCALLID ID, UINT16 nativeID |
| Yes | < | keyctl | SYSCALLID ID |
| Yes | > | bdflush | SYSCALLID ID, UINT16 nativeID |
| Yes | < | bdflush | SYSCALLID ID |
| Yes | > | tee | SYSCALLID ID, UINT16 nativeID |
| Yes | < | tee | SYSCALLID ID |
| Yes | > | getgroups | SYSCALLID ID, UINT16 nativeID |
| Yes | < | getgroups | SYSCALLID ID |
| Yes | > | inotify_rm_watch | SYSCALLID ID, UINT16 nativeID |
| Yes | < | inotify_rm_watch | SYSCALLID ID |
| Yes | > | fspick | SYSCALLID ID, UINT16 nativeID |
| Yes | < | fspick | SYSCALLID ID |
| Yes | > | newfstatat | SYSCALLID ID, UINT16 nativeID |
| Yes | < | newfstatat | SYSCALLID ID |
| Yes | > | capget | SYSCALLID ID, UINT16 nativeID |
| Yes | < | capget | SYSCALLID ID |
| Yes | > | faccessat | SYSCALLID ID, UINT16 nativeID |
| Yes | < | faccessat | SYSCALLID ID |
Tracepoint events
| Default | Dir | Name | Params |
|---|---|---|---|
| Yes | > | switch | PID next, UINT64 pgft_maj, UINT64 pgft_min, UINT32 vm_size, UINT32 vm_rss, UINT32 vm_swap |
| Yes | > | procexit | ERRNO status, ERRNO ret, SIGTYPE sig, UINT8 core, PID reaper_tid |
| Yes | > | signaldeliver | PID spid, PID dpid, SIGTYPE sig |
| Yes | > | page_fault | UINT64 addr, UINT64 ip, FLAGS32 error: PROTECTION_VIOLATION, PAGE_NOT_PRESENT, WRITE_ACCESS, READ_ACCESS, USER_FAULT, SUPERVISOR_FAULT, RESERVED_PAGE, INSTRUCTION_FETCH |
Plugin events
| Default | Dir | Name | Params |
|---|---|---|---|
| Yes | > | pluginevent | UINT32 plugin_id, BYTEBUF event_data |
Metaevents
| Default | Dir | Name | Params |
|---|---|---|---|
| Yes | > | drop | UINT32 ratio |
| Yes | < | drop | UINT32 ratio |
| Yes | > | scapevent | UINT32 event_type, UINT64 event_data |
| Yes | > | procinfo | UINT64 cpu_usr, UINT64 cpu_sys |
| Yes | > | cpu_hotplug | UINT32 cpu, UINT32 action |
| Yes | > | k8s | CHARBUF json |
| Yes | > | tracer | INT64 id, CHARBUFARRAY tags, CHARBUF_PAIR_ARRAY args |
| Yes | < | tracer | INT64 id, CHARBUFARRAY tags, CHARBUF_PAIR_ARRAY args |
| Yes | > | mesos | CHARBUF json |
| Yes | > | notification | CHARBUF id, CHARBUF desc |
| Yes | > | infra | CHARBUF source, CHARBUF name, CHARBUF description, CHARBUF scope |
| Yes | > | container | CHARBUF json |
| Yes | > | useradded | UINT32 uid, UINT32 gid, CHARBUF name, CHARBUF home, CHARBUF shell, CHARBUF container_id |
| Yes | > | userdeleted | UINT32 uid, UINT32 gid, CHARBUF name, CHARBUF home, CHARBUF shell, CHARBUF container_id |
| Yes | > | groupadded | UINT32 gid, CHARBUF name, CHARBUF container_id |
| Yes | > | groupdeleted | UINT32 gid, CHARBUF name, CHARBUF container_id |
| Yes | > | asyncevent | UINT32 plugin_id, CHARBUF name, BYTEBUF data |
Was this page helpful?
Let us know! You feedback will help us to improve the content and to stay in touch with our users.
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.
