update(driver): update syscalls tables and driver report.

Signed-off-by: GitHub <[email protected]>
falcosecurity · Oct 1, 2023 · b4b2501 · b4b2501
1 parent 5333d0b
commit b4b2501
Show file tree

Hide file tree

Showing 7 changed files with 25 additions and 3 deletions.
diff --git a/docs/report.md b/docs/report.md
@@ -60,6 +60,7 @@
 | fchdir                  | 🟢        |
 | fchmod                  | 🟢        |
 | fchmodat                | 🟢        |
+| fchmodat2               | 🟡        |
 | fchown                  | 🟢        |
 | fchownat                | 🟢        |
 | fcntl                   | 🟢        |
@@ -157,6 +158,7 @@
 | lsetxattr               | 🟡        |
 | lstat                   | 🟢        |
 | madvise                 | 🟡        |
+| map_shadow_stack        | 🟡        |
 | mbind                   | 🟡        |
 | membarrier              | 🟡        |
 | memfd_create            | 🟢        |

diff --git a/driver/ppm_events_public.h b/driver/ppm_events_public.h
@@ -1867,7 +1867,9 @@ enum extra_event_prog_code
 	PPM_SC_X(S390_RUNTIME_INSTR, 409) \
 	PPM_SC_X(SIGRETURN, 410) \
 	PPM_SC_X(S390_GUARDED_STORAGE, 411) \
-	PPM_SC_X(CACHESTAT, 412)
+	PPM_SC_X(CACHESTAT, 412) \
+	PPM_SC_X(FCHMODAT2, 413) \
+	PPM_SC_X(MAP_SHADOW_STACK, 414)
 
 typedef enum {
 #define PPM_SC_X(name, value) PPM_SC_##name = (value),

diff --git a/driver/syscall_compat_aarch64.h b/driver/syscall_compat_aarch64.h
@@ -920,3 +920,6 @@
 #ifndef __NR_cachestat
 #define __NR_cachestat 451
 #endif
+#ifndef __NR_fchmodat2
+#define __NR_fchmodat2 452
+#endif
diff --git a/driver/syscall_compat_s390x.h b/driver/syscall_compat_s390x.h
@@ -1103,3 +1103,6 @@
 #ifndef __NR_cachestat
 #define __NR_cachestat 451
 #endif
+#ifndef __NR_fchmodat2
+#define __NR_fchmodat2 452
+#endif
diff --git a/driver/syscall_compat_x86_64.h b/driver/syscall_compat_x86_64.h
@@ -1073,3 +1073,9 @@
 #ifndef __NR_cachestat
 #define __NR_cachestat 451
 #endif
+#ifndef __NR_fchmodat2
+#define __NR_fchmodat2 452
+#endif
+#ifndef __NR_map_shadow_stack
+#define __NR_map_shadow_stack 453
+#endif
diff --git a/driver/syscall_table.c b/driver/syscall_table.c
@@ -915,4 +915,10 @@ const struct syscall_evt_pair g_syscall_table[SYSCALL_TABLE_SIZE] = {
 #ifdef __NR_cachestat
 	[__NR_cachestat - SYSCALL_TABLE_ID0] = {.ppm_sc = PPM_SC_CACHESTAT},
 #endif
+#ifdef __NR_fchmodat2
+	[__NR_fchmodat2 - SYSCALL_TABLE_ID0] = {.ppm_sc = PPM_SC_FCHMODAT2},
+#endif
+#ifdef __NR_map_shadow_stack
+	[__NR_map_shadow_stack - SYSCALL_TABLE_ID0] = {.ppm_sc = PPM_SC_MAP_SHADOW_STACK},
+#endif
 };
diff --git a/userspace/libscap/linux/scap_ppm_sc.c b/userspace/libscap/linux/scap_ppm_sc.c