update(driver): update syscalls tables and driver report.

Signed-off-by: GitHub <noreply@github.com>
falcosecurity · Feb 1, 2024 · c9aa2b9 · c9aa2b9
1 parent fa62e25
commit c9aa2b9
Show file tree

Hide file tree

Showing 11 changed files with 469 additions and 364 deletions.
diff --git a/docs/report.md b/docs/report.md
diff --git a/driver/SCHEMA_VERSION b/driver/SCHEMA_VERSION
@@ -1 +1 @@
-2.15.0
+2.15.1
diff --git a/driver/ppm_events_public.h b/driver/ppm_events_public.h
@@ -1901,7 +1901,12 @@ enum extra_event_prog_code
 	PPM_SC_X(VM86, 433) \
 	PPM_SC_X(OLDOLDUNAME, 434) \
 	PPM_SC_X(SUBPAGE_PROT, 435) \
-	PPM_SC_X(PCICONFIG_IOBASE, 436)
+	PPM_SC_X(PCICONFIG_IOBASE, 436) \
+	PPM_SC_X(LISTMOUNT, 437) \
+	PPM_SC_X(STATMOUNT, 438) \
+	PPM_SC_X(LSM_GET_SELF_ATTR, 439) \
+	PPM_SC_X(LSM_SET_SELF_ATTR, 440) \
+	PPM_SC_X(LSM_LIST_MODULES, 441)
 
 typedef enum {
 #define PPM_SC_X(name, value) PPM_SC_##name = (value),

diff --git a/driver/syscall_compat_aarch64.h b/driver/syscall_compat_aarch64.h
@@ -947,3 +947,18 @@ or GPL2.txt for full copies of the license.
 #ifndef __NR_futex_requeue
 #define __NR_futex_requeue 456
 #endif
+#ifndef __NR_statmount
+#define __NR_statmount 457
+#endif
+#ifndef __NR_listmount
+#define __NR_listmount 458
+#endif
+#ifndef __NR_lsm_get_self_attr
+#define __NR_lsm_get_self_attr 459
+#endif
+#ifndef __NR_lsm_set_self_attr
+#define __NR_lsm_set_self_attr 460
+#endif
+#ifndef __NR_lsm_list_modules
+#define __NR_lsm_list_modules 461
+#endif
diff --git a/driver/syscall_compat_ppc64le.h b/driver/syscall_compat_ppc64le.h
@@ -1178,3 +1178,18 @@ or GPL2.txt for full copies of the license.
 #ifndef __NR_futex_requeue
 #define __NR_futex_requeue 456
 #endif
+#ifndef __NR_statmount
+#define __NR_statmount 457
+#endif
+#ifndef __NR_listmount
+#define __NR_listmount 458
+#endif
+#ifndef __NR_lsm_get_self_attr
+#define __NR_lsm_get_self_attr 459
+#endif
+#ifndef __NR_lsm_set_self_attr
+#define __NR_lsm_set_self_attr 460
+#endif
+#ifndef __NR_lsm_list_modules
+#define __NR_lsm_list_modules 461
+#endif
diff --git a/driver/syscall_compat_riscv64.h b/driver/syscall_compat_riscv64.h
@@ -950,3 +950,18 @@ or GPL2.txt for full copies of the license.
 #ifndef __NR_futex_requeue
 #define __NR_futex_requeue 456
 #endif
+#ifndef __NR_statmount
+#define __NR_statmount 457
+#endif
+#ifndef __NR_listmount
+#define __NR_listmount 458
+#endif
+#ifndef __NR_lsm_get_self_attr
+#define __NR_lsm_get_self_attr 459
+#endif
+#ifndef __NR_lsm_set_self_attr
+#define __NR_lsm_set_self_attr 460
+#endif
+#ifndef __NR_lsm_list_modules
+#define __NR_lsm_list_modules 461
+#endif
diff --git a/driver/syscall_compat_s390x.h b/driver/syscall_compat_s390x.h
@@ -1106,3 +1106,18 @@ or GPL2.txt for full copies of the license.
 #ifndef __NR_futex_requeue
 #define __NR_futex_requeue 456
 #endif
+#ifndef __NR_statmount
+#define __NR_statmount 457
+#endif
+#ifndef __NR_listmount
+#define __NR_listmount 458
+#endif
+#ifndef __NR_lsm_get_self_attr
+#define __NR_lsm_get_self_attr 459
+#endif
+#ifndef __NR_lsm_set_self_attr
+#define __NR_lsm_set_self_attr 460
+#endif
+#ifndef __NR_lsm_list_modules
+#define __NR_lsm_list_modules 461
+#endif
diff --git a/driver/syscall_compat_x86_64.h b/driver/syscall_compat_x86_64.h
@@ -1082,3 +1082,18 @@ or GPL2.txt for full copies of the license.
 #ifndef __NR_futex_requeue
 #define __NR_futex_requeue 456
 #endif
+#ifndef __NR_statmount
+#define __NR_statmount 457
+#endif
+#ifndef __NR_listmount
+#define __NR_listmount 458
+#endif
+#ifndef __NR_lsm_get_self_attr
+#define __NR_lsm_get_self_attr 459
+#endif
+#ifndef __NR_lsm_set_self_attr
+#define __NR_lsm_set_self_attr 460
+#endif
+#ifndef __NR_lsm_list_modules
+#define __NR_lsm_list_modules 461
+#endif
diff --git a/driver/syscall_ia32_64_map.c b/driver/syscall_ia32_64_map.c
@@ -448,4 +448,9 @@ const int g_ia32_64_map[SYSCALL_TABLE_SIZE] = {
 	[454] = 454,
 	[455] = 455,
 	[456] = 456,
+	[457] = 457,
+	[458] = 458,
+	[459] = 459,
+	[460] = 460,
+	[461] = 461,
 };
diff --git a/driver/syscall_table.c b/driver/syscall_table.c
@@ -988,4 +988,19 @@ const struct syscall_evt_pair g_syscall_table[SYSCALL_TABLE_SIZE] = {
 #ifdef __NR_pciconfig_write
 	[__NR_pciconfig_write - SYSCALL_TABLE_ID0] = {.ppm_sc = PPM_SC_PCICONFIG_WRITE},
 #endif
+#ifdef __NR_statmount
+	[__NR_statmount - SYSCALL_TABLE_ID0] = {.ppm_sc = PPM_SC_STATMOUNT},
+#endif
+#ifdef __NR_lsm_get_self_attr
+	[__NR_lsm_get_self_attr - SYSCALL_TABLE_ID0] = {.ppm_sc = PPM_SC_LSM_GET_SELF_ATTR},
+#endif
+#ifdef __NR_lsm_set_self_attr
+	[__NR_lsm_set_self_attr - SYSCALL_TABLE_ID0] = {.ppm_sc = PPM_SC_LSM_SET_SELF_ATTR},
+#endif
+#ifdef __NR_lsm_list_modules
+	[__NR_lsm_list_modules - SYSCALL_TABLE_ID0] = {.ppm_sc = PPM_SC_LSM_LIST_MODULES},
+#endif
+#ifdef __NR_listmount
+	[__NR_listmount - SYSCALL_TABLE_ID0] = {.ppm_sc = PPM_SC_LISTMOUNT},
+#endif
 };
diff --git a/userspace/libscap/linux/scap_ppm_sc.c b/userspace/libscap/linux/scap_ppm_sc.c