fix(schema): fix FUTEX_E flags parameter

The correct type is PT_FLAGS, not PT_ENUMFLAGS, as FUTEX_PRIVATE_FLAG and FUTEX_CLOCK_REALTIME are bitwise-or'ed with the other values. Signed-off-by: Grzegorz Nosek <[email protected]>
falcosecurity · Sep 5, 2024 · eba3e31 · eba3e31
1 parent 9d2d151
commit eba3e31
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/driver/SCHEMA_VERSION b/driver/SCHEMA_VERSION
@@ -1 +1 @@
-2.22.0
+2.22.1
diff --git a/driver/event_table.c b/driver/event_table.c
@@ -114,7 +114,7 @@ const struct ppm_event_info g_event_info[] = {
 	[PPME_SYSCALL_PIPE_X] = {"pipe", EC_IPC | EC_SYSCALL, EF_CREATES_FD | EF_MODIFIES_STATE, 4, {{"res", PT_ERRNO, PF_DEC}, {"fd1", PT_FD, PF_DEC}, {"fd2", PT_FD, PF_DEC}, {"ino", PT_UINT64, PF_DEC} } },
 	[PPME_SYSCALL_EVENTFD_E] = {"eventfd", EC_IPC | EC_SYSCALL, EF_CREATES_FD | EF_MODIFIES_STATE, 2, {{"initval", PT_UINT64, PF_DEC}, {"flags", PT_UINT32, PF_HEX} } },
 	[PPME_SYSCALL_EVENTFD_X] = {"eventfd", EC_IPC | EC_SYSCALL, EF_CREATES_FD | EF_MODIFIES_STATE, 1, {{"res", PT_FD, PF_DEC} } },
-	[PPME_SYSCALL_FUTEX_E] = {"futex", EC_IPC | EC_SYSCALL, EF_NONE, 3, {{"addr", PT_UINT64, PF_HEX}, {"op", PT_ENUMFLAGS16, PF_HEX, futex_operations}, {"val", PT_UINT64, PF_DEC} } },
+	[PPME_SYSCALL_FUTEX_E] = {"futex", EC_IPC | EC_SYSCALL, EF_NONE, 3, {{"addr", PT_UINT64, PF_HEX}, {"op", PT_FLAGS16, PF_HEX, futex_operations}, {"val", PT_UINT64, PF_DEC} } },
 	[PPME_SYSCALL_FUTEX_X] = {"futex", EC_IPC | EC_SYSCALL, EF_NONE, 1, {{"res", PT_ERRNO, PF_DEC} } },
 	[PPME_SYSCALL_STAT_E] = {"stat", EC_FILE | EC_SYSCALL, EF_NONE, 0},
 	[PPME_SYSCALL_STAT_X] = {"stat", EC_FILE | EC_SYSCALL, EF_NONE, 2, {{"res", PT_ERRNO, PF_DEC}, {"path", PT_FSPATH, PF_NA} } },