ptrace-syscalls 0.0.0-experimental.3

Analyze syscalls via ptrace
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29

# Architecture

## Syscalls

### syscall-enter

Copy raw syscall arguments into SyscallRawArgs struct.

Optionally, the tracer decodes the SyscallRawArgs struct into an Args struct by inspecting the tracee(using SyscallEnterInspect trait).

### syscall-exit

The tracer provides the RawArgs struct to decode it into SyscallResult by inspecting the tracee(using SyscallExitInspect trait).

The SyscallResult contains the syscall result(for non-exec syscalls) and modified syscall args.

### Seccomp

A bitflags enum is provided for syscalls. The user can generate a seccomp filter for usage in a follow-fork(or recursive)
tracer based on the syscalls of interest.


### Syscall Groups

The syscall groups are defined by strace: https://unix.stackexchange.com/questions/293090/strace-syscall-classes
It is also a bitflags enum.