Add Points to some syscalls

Added a raw syscall points to all syscalls. Added schematized syscall
points to the following syscalls:

  - chroot
  - dup, dup2, dup3
  - prlimit64
  - eventfd, eventfd2
  - signalfd, signalfd4
  - bind
  - accept, accept4
  - fcntl
  - pipe, pipe2

Updates #4805

PiperOrigin-RevId: 457139504

examples/seccheck/server.cc

@@ -95,6 +95,16 @@ std::vector<Callback> dispatchers = {
     unpackSyscall<::gvisor::syscall::Chdir>,
     unpackSyscall<::gvisor::syscall::Setid>,
     unpackSyscall<::gvisor::syscall::Setresid>,
+    unpackSyscall<::gvisor::syscall::Dup>,
+    unpackSyscall<::gvisor::syscall::Prlimit>,
+    unpackSyscall<::gvisor::syscall::Pipe>,
+    unpackSyscall<::gvisor::syscall::Fcntl>,
+    unpackSyscall<::gvisor::syscall::Signalfd>,
+    unpackSyscall<::gvisor::syscall::Eventfd>,
+    unpackSyscall<::gvisor::syscall::Chroot>,
+    unpackSyscall<::gvisor::syscall::Clone>,
+    unpackSyscall<::gvisor::syscall::Bind>,
+    unpackSyscall<::gvisor::syscall::Accept>,
 };
 
 void unpack(absl::string_view buf) {

pkg/sentry/seccheck/metadata_amd64.go

@@ -73,12 +73,72 @@ func init() {
 			Name: "fd_path",
 		},
 	})
-
+	addSyscallPoint(22, "pipe", nil)
+	addSyscallPoint(293, "pipe2", nil)
+	addSyscallPoint(72, "fcntl", []FieldDesc{
+		{
+			ID:   FieldSyscallPath,
+			Name: "fd_path",
+		},
+	})
 	addSyscallPoint(105, "setuid", nil)
 	addSyscallPoint(106, "setgid", nil)
 	addSyscallPoint(112, "setsid", nil)
 	addSyscallPoint(117, "setresuid", nil)
 	addSyscallPoint(119, "setresgid", nil)
+	addSyscallPoint(161, "chroot", nil)
+	addSyscallPoint(302, "prlimit64", nil)
+	addSyscallPoint(284, "eventfd", nil)
+	addSyscallPoint(290, "eventfd2", nil)
+	addSyscallPoint(282, "signalfd", []FieldDesc{
+		{
+			ID:   FieldSyscallPath,
+			Name: "fd_path",
+		},
+	})
+	addSyscallPoint(289, "signalfd4", []FieldDesc{
+		{
+			ID:   FieldSyscallPath,
+			Name: "fd_path",
+		},
+	})
+	addSyscallPoint(32, "dup", []FieldDesc{
+		{
+			ID:   FieldSyscallPath,
+			Name: "fd_path",
+		},
+	})
+	addSyscallPoint(33, "dup2", []FieldDesc{
+		{
+			ID:   FieldSyscallPath,
+			Name: "fd_path",
+		},
+	})
+	addSyscallPoint(292, "dup3", []FieldDesc{
+		{
+			ID:   FieldSyscallPath,
+			Name: "fd_path",
+		},
+	})
+	addSyscallPoint(56, "clone", nil)
+	addSyscallPoint(49, "bind", []FieldDesc{
+		{
+			ID:   FieldSyscallPath,
+			Name: "fd_path",
+		},
+	})
+	addSyscallPoint(43, "accept", []FieldDesc{
+		{
+			ID:   FieldSyscallPath,
+			Name: "fd_path",
+		},
+	})
+	addSyscallPoint(288, "accept4", []FieldDesc{
+		{
+			ID:   FieldSyscallPath,
+			Name: "fd_path",
+		},
+	})
 
 	const lastSyscallInTable = 441
 	for i := 0; i <= lastSyscallInTable; i++ {

pkg/sentry/seccheck/metadata_arm64.go

@@ -71,7 +71,53 @@ func init() {
 	addSyscallPoint(157, "setsid", nil)
 	addSyscallPoint(147, "setresuid", nil)
 	addSyscallPoint(149, "setresgid", nil)
-
+	addSyscallPoint(261, "prlimit64", nil)
+	addSyscallPoint(51, "chroot", nil)
+	addSyscallPoint(23, "dup", []FieldDesc{
+		{
+			ID:   FieldSyscallPath,
+			Name: "fd_path",
+		},
+	})
+	addSyscallPoint(24, "dup3", []FieldDesc{
+		{
+			ID:   FieldSyscallPath,
+			Name: "fd_path",
+		},
+	})
+	addSyscallPoint(59, "pipe2", nil)
+	addSyscallPoint(74, "signalfd4", []FieldDesc{
+		{
+			ID:   FieldSyscallPath,
+			Name: "fd_path",
+		},
+	})
+	addSyscallPoint(25, "fcntl", []FieldDesc{
+		{
+			ID:   FieldSyscallPath,
+			Name: "fd_path",
+		},
+	})
+	addSyscallPoint(19, "eventfd2", nil)
+	addSyscallPoint(220, "clone", nil)
+	addSyscallPoint(200, "bind", []FieldDesc{
+		{
+			ID:   FieldSyscallPath,
+			Name: "fd_path",
+		},
+	})
+	addSyscallPoint(202, "accept", []FieldDesc{
+		{
+			ID:   FieldSyscallPath,
+			Name: "fd_path",
+		},
+	})
+	addSyscallPoint(242, "accept4", []FieldDesc{
+		{
+			ID:   FieldSyscallPath,
+			Name: "fd_path",
+		},
+	})
 	const lastSyscallInTable = 441
 	for i := 0; i <= lastSyscallInTable; i++ {
 		addRawSyscallPoint(uintptr(i))

pkg/sentry/seccheck/points/common.proto

@@ -113,5 +113,15 @@ enum MessageType {
   MESSAGE_SYSCALL_CHDIR = 13;
   MESSAGE_SYSCALL_SETID = 14;
   MESSAGE_SYSCALL_SETRESID = 15;
+  MESSAGE_SYSCALL_PRLIMIT64 = 16;
+  MESSAGE_SYSCALL_PIPE = 17;
+  MESSAGE_SYSCALL_FCNTL = 18;
+  MESSAGE_SYSCALL_DUP = 19;
+  MESSAGE_SYSCALL_SIGNALFD = 20;
+  MESSAGE_SYSCALL_CHROOT = 21;
+  MESSAGE_SYSCALL_EVENTFD = 22;
+  MESSAGE_SYSCALL_CLONE = 23;
+  MESSAGE_SYSCALL_BIND = 24;
+  MESSAGE_SYSCALL_ACCEPT = 25;
 }
 // LINT.ThenChange(../../../../examples/seccheck/server.cc)

pkg/sentry/seccheck/points/syscall.proto

@@ -117,3 +117,100 @@ message Setid {
   uint64 sysno = 3;
   uint32 id = 4;
 }
+
+message StructRlimit {
+  uint64 cur = 1;
+  uint64 max = 2;
+}
+
+message Prlimit {
+  gvisor.common.ContextData context_data = 1;
+  Exit exit = 2;
+  uint64 sysno = 3;
+  int32 pid = 4;
+  int64 resource = 5;
+  StructRlimit new_limit = 6;
+  StructRlimit old_limit = 7;
+}
+
+message Pipe {
+  gvisor.common.ContextData context_data = 1;
+  Exit exit = 2;
+  uint64 sysno = 3;
+  uint32 flags = 4;
+  int32 reader = 5;
+  int32 writer = 6;
+}
+
+message Fcntl {
+  gvisor.common.ContextData context_data = 1;
+  Exit exit = 2;
+  uint64 sysno = 3;
+  int32 fd = 4;
+  string fd_path = 5;
+  int32 cmd = 6;
+  int64 args = 7;
+}
+
+message Dup {
+  gvisor.common.ContextData context_data = 1;
+  Exit exit = 2;
+  uint64 sysno = 3;
+  int32 old_fd = 4;
+  int32 new_fd = 5;
+  string fd_path = 6;
+  uint32 flags = 7;
+}
+
+message Signalfd {
+  gvisor.common.ContextData context_data = 1;
+  Exit exit = 2;
+  uint64 sysno = 3;
+  int32 fd = 4;
+  string fd_path = 5;
+  uint64 sigset = 6;
+  int32 flags = 7;
+}
+
+message Chroot {
+  gvisor.common.ContextData context_data = 1;
+  Exit exit = 2;
+  uint64 sysno = 3;
+  string pathname = 4;
+}
+message Eventfd {
+  gvisor.common.ContextData context_data = 1;
+  Exit exit = 2;
+  uint64 sysno = 3;
+  int32 val = 4;
+  uint32 flags = 5;
+}
+
+message Clone {
+  gvisor.common.ContextData context_data = 1;
+  Exit exit = 2;
+  uint64 sysno = 3;
+  uint64 flags = 4;
+  uint64 stack = 5;
+  uint64 new_tid = 6;
+  uint64 tls = 7;
+}
+
+message Bind {
+  gvisor.common.ContextData context_data = 1;
+  Exit exit = 2;
+  uint64 sysno = 3;
+  int32 fd = 4;
+  string fd_path = 5;
+  bytes address = 6;
+}
+
+message Accept {
+  gvisor.common.ContextData context_data = 1;
+  Exit exit = 2;
+  uint64 sysno = 3;
+  int32 fd = 4;
+  string fd_path = 5;
+  bytes address = 6;
+  int32 flags = 7;
+}

pkg/sentry/syscalls/linux/linux64.go

@@ -74,7 +74,7 @@ var AMD64 = &kernel.SyscallTable{
 		19:  syscalls.Supported("readv", Readv),
 		20:  syscalls.Supported("writev", Writev),
 		21:  syscalls.Supported("access", Access),
-		22:  syscalls.Supported("pipe", Pipe),
+		22:  syscalls.SupportedPoint("pipe", Pipe, PointPipe),
 		23:  syscalls.Supported("select", Select),
 		24:  syscalls.Supported("sched_yield", SchedYield),
 		25:  syscalls.Supported("mremap", Mremap),
@@ -84,8 +84,8 @@ var AMD64 = &kernel.SyscallTable{
 		29:  syscalls.PartiallySupported("shmget", Shmget, "Option SHM_HUGETLB is not supported.", nil),
 		30:  syscalls.PartiallySupported("shmat", Shmat, "Option SHM_RND is not supported.", nil),
 		31:  syscalls.PartiallySupported("shmctl", Shmctl, "Options SHM_LOCK, SHM_UNLOCK are not supported.", nil),
-		32:  syscalls.Supported("dup", Dup),
-		33:  syscalls.Supported("dup2", Dup2),
+		32:  syscalls.SupportedPoint("dup", Dup, PointDup),
+		33:  syscalls.SupportedPoint("dup2", Dup2, PointDup2),
 		34:  syscalls.Supported("pause", Pause),
 		35:  syscalls.Supported("nanosleep", Nanosleep),
 		36:  syscalls.Supported("getitimer", Getitimer),
@@ -95,20 +95,20 @@ var AMD64 = &kernel.SyscallTable{
 		40:  syscalls.Supported("sendfile", Sendfile),
 		41:  syscalls.PartiallySupported("socket", Socket, "Limited support for AF_NETLINK, NETLINK_ROUTE sockets. Limited support for SOCK_RAW.", nil),
 		42:  syscalls.SupportedPoint("connect", Connect, PointConnect),
-		43:  syscalls.Supported("accept", Accept),
+		43:  syscalls.SupportedPoint("accept", Accept, PointAccept),
 		44:  syscalls.Supported("sendto", SendTo),
 		45:  syscalls.Supported("recvfrom", RecvFrom),
 		46:  syscalls.Supported("sendmsg", SendMsg),
 		47:  syscalls.PartiallySupported("recvmsg", RecvMsg, "Not all flags and control messages are supported.", nil),
 		48:  syscalls.PartiallySupported("shutdown", Shutdown, "Not all flags and control messages are supported.", nil),
-		49:  syscalls.PartiallySupported("bind", Bind, "Autobind for abstract Unix sockets is not supported.", nil),
+		49:  syscalls.PartiallySupportedPoint("bind", Bind, PointBind, "Autobind for abstract Unix sockets is not supported.", nil),
 		50:  syscalls.Supported("listen", Listen),
 		51:  syscalls.Supported("getsockname", GetSockName),
 		52:  syscalls.Supported("getpeername", GetPeerName),
 		53:  syscalls.Supported("socketpair", SocketPair),
 		54:  syscalls.PartiallySupported("setsockopt", SetSockOpt, "Not all socket options are supported.", nil),
 		55:  syscalls.PartiallySupported("getsockopt", GetSockOpt, "Not all socket options are supported.", nil),
-		56:  syscalls.PartiallySupported("clone", Clone, "Mount namespace (CLONE_NEWNS) not supported. Options CLONE_PARENT, CLONE_SYSVSEM not supported.", nil),
+		56:  syscalls.PartiallySupportedPoint("clone", Clone, PointClone, "Mount namespace (CLONE_NEWNS) not supported. Options CLONE_PARENT, CLONE_SYSVSEM not supported.", nil),
 		57:  syscalls.Supported("fork", Fork),
 		58:  syscalls.Supported("vfork", Vfork),
 		59:  syscalls.SupportedPoint("execve", Execve, PointExecve),
@@ -124,7 +124,7 @@ var AMD64 = &kernel.SyscallTable{
 		69:  syscalls.Supported("msgsnd", Msgsnd),
 		70:  syscalls.Supported("msgrcv", Msgrcv),
 		71:  syscalls.Supported("msgctl", Msgctl),
-		72:  syscalls.PartiallySupported("fcntl", Fcntl, "Not all options are supported.", nil),
+		72:  syscalls.PartiallySupportedPoint("fcntl", Fcntl, PointFcntl, "Not all options are supported.", nil),
 		73:  syscalls.PartiallySupported("flock", Flock, "Locks are held within the sandbox only.", nil),
 		74:  syscalls.PartiallySupported("fsync", Fsync, "Full data flush is not guaranteed at this time.", nil),
 		75:  syscalls.PartiallySupported("fdatasync", Fdatasync, "Full data flush is not guaranteed at this time.", nil),
@@ -213,7 +213,7 @@ var AMD64 = &kernel.SyscallTable{
 		158: syscalls.PartiallySupported("arch_prctl", ArchPrctl, "Options ARCH_GET_GS, ARCH_SET_GS not supported.", nil),
 		159: syscalls.CapError("adjtimex", linux.CAP_SYS_TIME, "", nil),
 		160: syscalls.PartiallySupported("setrlimit", Setrlimit, "Not all rlimits are enforced.", nil),
-		161: syscalls.Supported("chroot", Chroot),
+		161: syscalls.SupportedPoint("chroot", Chroot, PointChroot),
 		162: syscalls.PartiallySupported("sync", Sync, "Full data flush is not guaranteed at this time.", nil),
 		163: syscalls.CapError("acct", linux.CAP_SYS_PACCT, "", nil),
 		164: syscalls.CapError("settimeofday", linux.CAP_SYS_TIME, "", nil),
@@ -334,18 +334,18 @@ var AMD64 = &kernel.SyscallTable{
 		279: syscalls.CapError("move_pages", linux.CAP_SYS_NICE, "", nil),                               // requires cap_sys_nice (mostly)
 		280: syscalls.Supported("utimensat", Utimensat),
 		281: syscalls.Supported("epoll_pwait", EpollPwait),
-		282: syscalls.PartiallySupported("signalfd", Signalfd, "Semantics are slightly different.", []string{"gvisor.dev/issue/139"}),
+		282: syscalls.PartiallySupportedPoint("signalfd", Signalfd, PointSignalfd, "Semantics are slightly different.", []string{"gvisor.dev/issue/139"}),
 		283: syscalls.Supported("timerfd_create", TimerfdCreate),
-		284: syscalls.Supported("eventfd", Eventfd),
+		284: syscalls.SupportedPoint("eventfd", Eventfd, PointEventfd),
 		285: syscalls.PartiallySupported("fallocate", Fallocate, "Not all options are supported.", nil),
 		286: syscalls.Supported("timerfd_settime", TimerfdSettime),
 		287: syscalls.Supported("timerfd_gettime", TimerfdGettime),
-		288: syscalls.Supported("accept4", Accept4),
-		289: syscalls.PartiallySupported("signalfd4", Signalfd4, "Semantics are slightly different.", []string{"gvisor.dev/issue/139"}),
-		290: syscalls.Supported("eventfd2", Eventfd2),
+		288: syscalls.SupportedPoint("accept4", Accept4, PointAccept4),
+		289: syscalls.PartiallySupportedPoint("signalfd4", Signalfd4, PointSignalfd4, "Semantics are slightly different.", []string{"gvisor.dev/issue/139"}),
+		290: syscalls.SupportedPoint("eventfd2", Eventfd2, PointEventfd2),
 		291: syscalls.Supported("epoll_create1", EpollCreate1),
-		292: syscalls.Supported("dup3", Dup3),
-		293: syscalls.Supported("pipe2", Pipe2),
+		292: syscalls.SupportedPoint("dup3", Dup3, PointDup3),
+		293: syscalls.SupportedPoint("pipe2", Pipe2, PointPipe2),
 		294: syscalls.PartiallySupported("inotify_init1", InotifyInit1, "Inotify events are only available inside the sandbox. Hard links are treated as different watch targets in gofer fs.", nil),
 		295: syscalls.Supported("preadv", Preadv),
 		296: syscalls.Supported("pwritev", Pwritev),
@@ -354,7 +354,7 @@ var AMD64 = &kernel.SyscallTable{
 		299: syscalls.PartiallySupported("recvmmsg", RecvMMsg, "Not all flags and control messages are supported.", nil),
 		300: syscalls.ErrorWithEvent("fanotify_init", linuxerr.ENOSYS, "Needs CONFIG_FANOTIFY", nil),
 		301: syscalls.ErrorWithEvent("fanotify_mark", linuxerr.ENOSYS, "Needs CONFIG_FANOTIFY", nil),
-		302: syscalls.Supported("prlimit64", Prlimit64),
+		302: syscalls.SupportedPoint("prlimit64", Prlimit64, PointPrlimit64),
 		303: syscalls.Error("name_to_handle_at", linuxerr.EOPNOTSUPP, "Not supported by gVisor filesystems", nil),
 		304: syscalls.Error("open_by_handle_at", linuxerr.EOPNOTSUPP, "Not supported by gVisor filesystems", nil),
 		305: syscalls.CapError("clock_adjtime", linux.CAP_SYS_TIME, "", nil),
@@ -449,13 +449,13 @@ var ARM64 = &kernel.SyscallTable{
 		16:  syscalls.PartiallySupported("fremovexattr", FRemoveXattr, "Only supported for tmpfs", nil),
 		17:  syscalls.Supported("getcwd", Getcwd),
 		18:  syscalls.CapError("lookup_dcookie", linux.CAP_SYS_ADMIN, "", nil),
-		19:  syscalls.Supported("eventfd2", Eventfd2),
+		19:  syscalls.SupportedPoint("eventfd2", Eventfd2, PointEventfd2),
 		20:  syscalls.Supported("epoll_create1", EpollCreate1),
 		21:  syscalls.Supported("epoll_ctl", EpollCtl),
 		22:  syscalls.Supported("epoll_pwait", EpollPwait),
-		23:  syscalls.Supported("dup", Dup),
-		24:  syscalls.Supported("dup3", Dup3),
-		25:  syscalls.PartiallySupported("fcntl", Fcntl, "Not all options are supported.", nil),
+		23:  syscalls.SupportedPoint("dup", Dup, PointDup),
+		24:  syscalls.SupportedPoint("dup3", Dup3, PointDup3),
+		25:  syscalls.PartiallySupportedPoint("fcntl", Fcntl, PointFcntl, "Not all options are supported.", nil),
 		26:  syscalls.PartiallySupported("inotify_init1", InotifyInit1, "Inotify events are only available inside the sandbox. Hard links are treated as different watch targets in gofer fs.", nil),
 		27:  syscalls.PartiallySupported("inotify_add_watch", InotifyAddWatch, "Inotify events are only available inside the sandbox. Hard links are treated as different watch targets in gofer fs.", nil),
 		28:  syscalls.PartiallySupported("inotify_rm_watch", InotifyRmWatch, "Inotify events are only available inside the sandbox. Hard links are treated as different watch targets in gofer fs.", nil),
@@ -481,7 +481,7 @@ var ARM64 = &kernel.SyscallTable{
 		48:  syscalls.Supported("faccessat", Faccessat),
 		49:  syscalls.SupportedPoint("chdir", Chdir, PointChdir),
 		50:  syscalls.SupportedPoint("fchdir", Fchdir, PointFchdir),
-		51:  syscalls.Supported("chroot", Chroot),
+		51:  syscalls.SupportedPoint("chroot", Chroot, PointChroot),
 		52:  syscalls.PartiallySupported("fchmod", Fchmod, "Options S_ISUID and S_ISGID not supported.", nil),
 		53:  syscalls.Supported("fchmodat", Fchmodat),
 		54:  syscalls.Supported("fchownat", Fchownat),
@@ -489,7 +489,7 @@ var ARM64 = &kernel.SyscallTable{
 		56:  syscalls.SupportedPoint("openat", Openat, PointOpenat),
 		57:  syscalls.Supported("close", Close),
 		58:  syscalls.CapError("vhangup", linux.CAP_SYS_TTY_CONFIG, "", nil),
-		59:  syscalls.Supported("pipe2", Pipe2),
+		59:  syscalls.SupportedPoint("pipe2", Pipe2, PointPipe2),
 		60:  syscalls.CapError("quotactl", linux.CAP_SYS_ADMIN, "", nil), // requires cap_sys_admin for most operations
 		61:  syscalls.Supported("getdents64", Getdents64),
 		62:  syscalls.Supported("lseek", Lseek),
@@ -504,7 +504,7 @@ var ARM64 = &kernel.SyscallTable{
 		71:  syscalls.Supported("sendfile", Sendfile),
 		72:  syscalls.Supported("pselect", Pselect),
 		73:  syscalls.Supported("ppoll", Ppoll),
-		74:  syscalls.PartiallySupported("signalfd4", Signalfd4, "Semantics are slightly different.", []string{"gvisor.dev/issue/139"}),
+		74:  syscalls.PartiallySupportedPoint("signalfd4", Signalfd4, PointSignalfd4, "Semantics are slightly different.", []string{"gvisor.dev/issue/139"}),
 		75:  syscalls.ErrorWithEvent("vmsplice", linuxerr.ENOSYS, "", []string{"gvisor.dev/issue/138"}), // TODO(b/29354098)
 		76:  syscalls.Supported("splice", Splice),
 		77:  syscalls.Supported("tee", Tee),
@@ -630,9 +630,9 @@ var ARM64 = &kernel.SyscallTable{
 		197: syscalls.Supported("shmdt", Shmdt),
 		198: syscalls.PartiallySupported("socket", Socket, "Limited support for AF_NETLINK, NETLINK_ROUTE sockets. Limited support for SOCK_RAW.", nil),
 		199: syscalls.Supported("socketpair", SocketPair),
-		200: syscalls.PartiallySupported("bind", Bind, "Autobind for abstract Unix sockets is not supported.", nil),
+		200: syscalls.PartiallySupportedPoint("bind", Bind, PointBind, "Autobind for abstract Unix sockets is not supported.", nil),
 		201: syscalls.Supported("listen", Listen),
-		202: syscalls.Supported("accept", Accept),
+		202: syscalls.SupportedPoint("accept", Accept, PointAccept),
 		203: syscalls.SupportedPoint("connect", Connect, PointConnect),
 		204: syscalls.Supported("getsockname", GetSockName),
 		205: syscalls.Supported("getpeername", GetPeerName),
@@ -650,7 +650,7 @@ var ARM64 = &kernel.SyscallTable{
 		217: syscalls.Error("add_key", linuxerr.EACCES, "Not available to user.", nil),
 		218: syscalls.Error("request_key", linuxerr.EACCES, "Not available to user.", nil),
 		219: syscalls.Error("keyctl", linuxerr.EACCES, "Not available to user.", nil),
-		220: syscalls.PartiallySupported("clone", Clone, "Mount namespace (CLONE_NEWNS) not supported. Options CLONE_PARENT, CLONE_SYSVSEM not supported.", nil),
+		220: syscalls.PartiallySupportedPoint("clone", Clone, PointClone, "Mount namespace (CLONE_NEWNS) not supported. Options CLONE_PARENT, CLONE_SYSVSEM not supported.", nil),
 		221: syscalls.SupportedPoint("execve", Execve, PointExecve),
 		222: syscalls.PartiallySupported("mmap", Mmap, "Generally supported with exceptions. Options MAP_FIXED_NOREPLACE, MAP_SHARED_VALIDATE, MAP_SYNC MAP_GROWSDOWN, MAP_HUGETLB are not supported.", nil),
 		223: syscalls.PartiallySupported("fadvise64", Fadvise64, "Not all options are supported.", nil),
@@ -672,10 +672,10 @@ var ARM64 = &kernel.SyscallTable{
 		239: syscalls.CapError("move_pages", linux.CAP_SYS_NICE, "", nil), // requires cap_sys_nice (mostly)
 		240: syscalls.Supported("rt_tgsigqueueinfo", RtTgsigqueueinfo),
 		241: syscalls.ErrorWithEvent("perf_event_open", linuxerr.ENODEV, "No support for perf counters", nil),
-		242: syscalls.Supported("accept4", Accept4),
+		242: syscalls.SupportedPoint("accept4", Accept4, PointAccept4),
 		243: syscalls.PartiallySupported("recvmmsg", RecvMMsg, "Not all flags and control messages are supported.", nil),
 		260: syscalls.Supported("wait4", Wait4),
-		261: syscalls.Supported("prlimit64", Prlimit64),
+		261: syscalls.SupportedPoint("prlimit64", Prlimit64, PointPrlimit64),
 		262: syscalls.ErrorWithEvent("fanotify_init", linuxerr.ENOSYS, "Needs CONFIG_FANOTIFY", nil),
 		263: syscalls.ErrorWithEvent("fanotify_mark", linuxerr.ENOSYS, "Needs CONFIG_FANOTIFY", nil),
 		264: syscalls.Error("name_to_handle_at", linuxerr.EOPNOTSUPP, "Not supported by gVisor filesystems", nil),

pkg/sentry/syscalls/linux/points.go

@@ -20,6 +20,7 @@ import (
 	"google.golang.org/protobuf/proto"
 	"gvisor.dev/gvisor/pkg/abi/linux"
 	"gvisor.dev/gvisor/pkg/hostarch"
+	"gvisor.dev/gvisor/pkg/marshal/primitive"
 	"gvisor.dev/gvisor/pkg/sentry/kernel"
 	"gvisor.dev/gvisor/pkg/sentry/seccheck"
 	pb "gvisor.dev/gvisor/pkg/sentry/seccheck/points/points_go_proto"
@@ -69,7 +70,7 @@ func PointOpen(t *kernel.Task, _ seccheck.FieldSet, cxtData *pb.ContextData, inf
 	addr := info.Args[0].Pointer()
 	if addr > 0 {
 		path, err := t.CopyInString(addr, linux.PATH_MAX)
-		if err == nil {
+		if err == nil { // if NO error
 			p.Pathname = path
 		}
 	}
@@ -89,7 +90,7 @@ func PointOpenat(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextDa
 	addr := info.Args[1].Pointer()
 	if addr > 0 {
 		path, err := t.CopyInString(addr, linux.PATH_MAX)
-		if err == nil {
+		if err == nil { // if NO error
 			p.Pathname = path
 		}
 	}
@@ -119,7 +120,7 @@ func PointCreat(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextDat
 	addr := info.Args[0].Pointer()
 	if addr > 0 {
 		path, err := t.CopyInString(addr, linux.PATH_MAX)
-		if err == nil {
+		if err == nil { // if NO error
 			p.Pathname = path
 		}
 	}
@@ -208,18 +209,18 @@ func PointExecve(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextDa
 		ContextData: cxtData,
 		Sysno:       uint64(info.Sysno),
 	}
-	if pathname, err := t.CopyInString(info.Args[0].Pointer(), linux.PATH_MAX); err == nil {
+	if pathname, err := t.CopyInString(info.Args[0].Pointer(), linux.PATH_MAX); err == nil { // if NO error
 		p.Pathname = pathname
 	}
 	if argvAddr := info.Args[1].Pointer(); argvAddr != 0 {
-		if argv, err := t.CopyInVector(argvAddr, ExecMaxElemSize, ExecMaxTotalSize); err == nil {
+		if argv, err := t.CopyInVector(argvAddr, ExecMaxElemSize, ExecMaxTotalSize); err == nil { // if NO error
 			p.Argv = argv
 		}
 	}
 
 	if fields.Local.Contains(seccheck.FieldSyscallExecveEnvv) {
 		if envvAddr := info.Args[2].Pointer(); envvAddr != 0 {
-			if envv, err := t.CopyInVector(envvAddr, ExecMaxElemSize, ExecMaxTotalSize); err == nil {
+			if envv, err := t.CopyInVector(envvAddr, ExecMaxElemSize, ExecMaxTotalSize); err == nil { // if NO error
 				p.Envv = envv
 			}
 		}
@@ -238,18 +239,18 @@ func PointExecveat(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.Context
 		Fd:          int64(info.Args[0].Int()),
 		Flags:       info.Args[4].Uint(),
 	}
-	if pathname, err := t.CopyInString(info.Args[1].Pointer(), linux.PATH_MAX); err == nil {
+	if pathname, err := t.CopyInString(info.Args[1].Pointer(), linux.PATH_MAX); err == nil { // if NO error
 		p.Pathname = pathname
 	}
 	if argvAddr := info.Args[2].Pointer(); argvAddr != 0 {
-		if argv, err := t.CopyInVector(argvAddr, ExecMaxElemSize, ExecMaxTotalSize); err == nil {
+		if argv, err := t.CopyInVector(argvAddr, ExecMaxElemSize, ExecMaxTotalSize); err == nil { // if NO error
 			p.Argv = argv
 		}
 	}
 
 	if fields.Local.Contains(seccheck.FieldSyscallExecveEnvv) {
 		if envvAddr := info.Args[3].Pointer(); envvAddr != 0 {
-			if envv, err := t.CopyInVector(envvAddr, ExecMaxElemSize, ExecMaxTotalSize); err == nil {
+			if envv, err := t.CopyInVector(envvAddr, ExecMaxElemSize, ExecMaxTotalSize); err == nil { // if NO error
 				p.Envv = envv
 			}
 		}
@@ -273,7 +274,7 @@ func pointChdirHelper(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.Cont
 
 	if path > 0 {
 		pathname, err := t.CopyInString(path, linux.PATH_MAX)
-		if err == nil {
+		if err == nil { // if NO error
 			p.Pathname = pathname
 		}
 	}
@@ -315,13 +316,13 @@ func pointSetidHelper(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.Cont
 
 // PointSetuid calls pointSetidHelper to convert setuid(2) syscall to proto.
 func PointSetuid(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) {
-	id := uint32(info.Args[0].Uint())
+	id := info.Args[0].Uint()
 	return pointSetidHelper(t, fields, cxtData, info, id)
 }
 
 // PointSetgid calls pointSetidHelper to convert setgid(2) syscall to proto.
 func PointSetgid(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) {
-	id := uint32(info.Args[0].Uint())
+	id := info.Args[0].Uint()
 	return pointSetidHelper(t, fields, cxtData, info, id)
 }
 
@@ -335,9 +336,9 @@ func pointSetresidHelper(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.C
 	p := &pb.Setresid{
 		ContextData: cxtData,
 		Sysno:       uint64(info.Sysno),
-		Rgid:        uint32(info.Args[0].Uint()),
-		Egid:        uint32(info.Args[1].Uint()),
-		Sgid:        uint32(info.Args[2].Uint()),
+		Rgid:        info.Args[0].Uint(),
+		Egid:        info.Args[1].Uint(),
+		Sgid:        info.Args[2].Uint(),
 	}
 
 	p.Exit = newExitMaybe(info)
@@ -354,3 +355,273 @@ func PointSetresuid(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.Contex
 func PointSetresgid(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) {
 	return pointSetresidHelper(t, fields, cxtData, info)
 }
+
+func rlimits(rlimit rlimit64) *pb.StructRlimit {
+	limit := rlimit.toLimit()
+	return &pb.StructRlimit{
+		Cur: limit.Cur,
+		Max: limit.Max,
+	}
+}
+
+// PointPrlimit64 call converts prlimit64(2) syscall to proto.
+func PointPrlimit64(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) {
+	p := &pb.Prlimit{
+		ContextData: cxtData,
+		Sysno:       uint64(info.Sysno),
+		Pid:         int32(info.Args[0].Int()),
+		Resource:    info.Args[1].Int64(),
+	}
+
+	if newRlimitAddr := info.Args[2].Pointer(); newRlimitAddr != 0 {
+		var nrl rlimit64
+		if err := nrl.copyIn(t, newRlimitAddr); err == nil { // if NO error
+			p.NewLimit = rlimits(nrl)
+		}
+	}
+
+	if oldRlimitAddr := info.Args[3].Pointer(); oldRlimitAddr != 0 {
+		var orl rlimit64
+		if err := orl.copyIn(t, oldRlimitAddr); err == nil { // if NO error
+			p.OldLimit = rlimits(orl)
+		}
+	}
+
+	p.Exit = newExitMaybe(info)
+
+	return p, pb.MessageType_MESSAGE_SYSCALL_PRLIMIT64
+}
+
+// pipeHelper converts pipe(2) and pipe2(2) syscall to proto.
+func pipeHelper(t *kernel.Task, cxtData *pb.ContextData, info kernel.SyscallInfo, flags uint32) (proto.Message, pb.MessageType) {
+	p := &pb.Pipe{
+		ContextData: cxtData,
+		Sysno:       uint64(info.Sysno),
+		Flags:       flags,
+	}
+	if info.Exit {
+		if pipeFDAddr := info.Args[0].Pointer(); pipeFDAddr != 0 {
+			var pipeFDs [2]int32
+			if _, err := primitive.CopyInt32SliceOut(t, pipeFDAddr, pipeFDs[2:2]); err == nil { // if NO error
+				p.Reader = pipeFDs[0]
+				p.Writer = pipeFDs[1]
+			}
+		}
+	}
+
+	p.Exit = newExitMaybe(info)
+	return p, pb.MessageType_MESSAGE_SYSCALL_PIPE
+}
+
+// PointPipe calls pipeHelper to convert pipe(2) syscall to proto.
+func PointPipe(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) {
+	return pipeHelper(t, cxtData, info, 0)
+}
+
+// PointPipe2 calls pipeHelper to convert pipe2(2) syscall to proto.
+func PointPipe2(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) {
+	flags := info.Args[1].Uint()
+	return pipeHelper(t, cxtData, info, flags)
+}
+
+// eventfdHelper converts eventfd(2) and eventfd2(2) syscall to proto.
+func eventfdHelper(cxtData *pb.ContextData, info kernel.SyscallInfo, flags uint32) (proto.Message, pb.MessageType) {
+	p := &pb.Eventfd{
+		ContextData: cxtData,
+		Sysno:       uint64(info.Sysno),
+		Val:         int32(info.Args[0].Int()),
+		Flags:       flags,
+	}
+
+	p.Exit = newExitMaybe(info)
+	return p, pb.MessageType_MESSAGE_SYSCALL_EVENTFD
+}
+
+// PointEventfd calls pipeHelper to convert eventfd(2) syscall to proto.
+func PointEventfd(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) {
+	return eventfdHelper(cxtData, info, 0)
+}
+
+// PointEventfd2 calls pipeHelper to convert eventfd2(2) syscall to proto.
+func PointEventfd2(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) {
+	flags := info.Args[1].Uint()
+	return eventfdHelper(cxtData, info, flags)
+}
+
+// PointFcntl converts fcntl(2) syscall to proto.
+func PointFcntl(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) {
+	p := &pb.Fcntl{
+		ContextData: cxtData,
+		Sysno:       uint64(info.Sysno),
+		Fd:          info.Args[0].Int(),
+		Cmd:         info.Args[1].Int(),
+		Args:        info.Args[2].Int64(),
+	}
+
+	if fields.Local.Contains(seccheck.FieldSyscallPath) {
+		p.FdPath = getFilePath(t, int32(p.Fd))
+	}
+
+	p.Exit = newExitMaybe(info)
+	return p, pb.MessageType_MESSAGE_SYSCALL_FCNTL
+}
+
+// pointDupHelper converts dup(2), dup2(2), and dup3(2) syscall to proto.
+func pointDupHelper(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo, oldFD, newFD int32, flags uint32) (proto.Message, pb.MessageType) {
+	p := &pb.Dup{
+		ContextData: cxtData,
+		Sysno:       uint64(info.Sysno),
+		OldFd:       oldFD,
+		NewFd:       newFD,
+		Flags:       flags,
+	}
+
+	if fields.Local.Contains(seccheck.FieldSyscallPath) {
+		p.FdPath = getFilePath(t, int32(p.OldFd))
+	}
+
+	p.Exit = newExitMaybe(info)
+	return p, pb.MessageType_MESSAGE_SYSCALL_DUP
+}
+
+// PointDup calls pointDupHelper to convert dup(2) syscall to proto.
+func PointDup(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) {
+	oldFD := info.Args[0].Int()
+	return pointDupHelper(t, fields, cxtData, info, oldFD, 0, 0)
+}
+
+// PointDup2 calls pointDupHelper to convert dup2(2) syscall to proto.
+func PointDup2(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) {
+	oldFD := info.Args[0].Int()
+	newFD := info.Args[1].Int()
+	return pointDupHelper(t, fields, cxtData, info, oldFD, newFD, 0)
+}
+
+// PointDup3 calls pointDupHelper to convert dup3(2) syscall to proto.
+func PointDup3(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) {
+	oldFD := info.Args[0].Int()
+	newFD := info.Args[1].Int()
+	flags := info.Args[2].Uint()
+	return pointDupHelper(t, fields, cxtData, info, oldFD, newFD, flags)
+}
+
+// signalfdHelper converts signalfd(2) and signalfd4(2) syscall to proto.
+func signalfdHelper(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo, flags int32) (proto.Message, pb.MessageType) {
+	p := &pb.Signalfd{
+		ContextData: cxtData,
+		Sysno:       uint64(info.Sysno),
+		Fd:          info.Args[0].Int(),
+		Flags:       flags,
+	}
+	sigset := info.Args[1].Pointer()
+	sigsetsize := info.Args[2].SizeT()
+	mask, err := CopyInSigSet(t, sigset, sigsetsize)
+	if err == nil { // if NO error
+		p.Sigset = uint64(mask)
+		p.Sigset = uint64(mask)
+	}
+
+	if fields.Local.Contains(seccheck.FieldSyscallPath) {
+		p.FdPath = getFilePath(t, int32(p.Fd))
+	}
+
+	p.Exit = newExitMaybe(info)
+	return p, pb.MessageType_MESSAGE_SYSCALL_SIGNALFD
+}
+
+// PointSignalfd calls signalfdHelper to convert signalfd(2) syscall to proto.
+func PointSignalfd(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) {
+	return signalfdHelper(t, fields, cxtData, info, 0)
+}
+
+// PointSignalfd4 calls signalfdHelper to convert signalfd4(2) syscall to proto.
+func PointSignalfd4(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) {
+	flags := info.Args[3].Int()
+	return signalfdHelper(t, fields, cxtData, info, flags)
+}
+
+// PointChroot converts chroot(2) syscall to proto.
+func PointChroot(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) {
+	p := &pb.Chroot{
+		ContextData: cxtData,
+		Sysno:       uint64(info.Sysno),
+	}
+	if pathname, err := t.CopyInString(info.Args[0].Pointer(), linux.PATH_MAX); err == nil { // if NO error
+		p.Pathname = pathname
+	}
+	p.Exit = newExitMaybe(info)
+	return p, pb.MessageType_MESSAGE_SYSCALL_CHROOT
+}
+
+// PointClone converts clone(2) syscall to proto.
+func PointClone(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) {
+	p := &pb.Clone{
+		ContextData: cxtData,
+		Sysno:       uint64(info.Sysno),
+		Flags:       info.Args[0].Uint64(),
+		Stack:       uint64(info.Args[1].Pointer()),
+		Tls:         uint64(info.Args[4].Pointer()),
+	}
+	var parTid kernel.ThreadID
+
+	parentTidAddr := info.Args[2].Pointer()
+	if _, err := parTid.CopyIn(t, parentTidAddr); err == nil { // if NO error
+		p.NewTid = uint64(parTid)
+	}
+
+	p.Exit = newExitMaybe(info)
+	return p, pb.MessageType_MESSAGE_SYSCALL_CLONE
+}
+
+// PointBind converts bind(2) syscall to proto.
+func PointBind(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) {
+	p := &pb.Bind{
+		ContextData: cxtData,
+		Sysno:       uint64(info.Sysno),
+		Fd:          info.Args[0].Int(),
+	}
+	addr := info.Args[1].Pointer()
+	addrLen := info.Args[2].Uint()
+	if address, err := CaptureAddress(t, addr, addrLen); err == nil { // if NO error
+		p.Address = address
+	}
+
+	if fields.Local.Contains(seccheck.FieldSyscallPath) {
+		p.FdPath = getFilePath(t, int32(p.Fd))
+	}
+
+	p.Exit = newExitMaybe(info)
+	return p, pb.MessageType_MESSAGE_SYSCALL_BIND
+}
+
+func acceptHelper(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo, flags int32) (proto.Message, pb.MessageType) {
+	p := &pb.Accept{
+		ContextData: cxtData,
+		Sysno:       uint64(info.Sysno),
+		Fd:          info.Args[0].Int(),
+		Flags:       flags,
+	}
+	addr := info.Args[1].Pointer()
+	addrLen := info.Args[2].Uint()
+	if address, err := CaptureAddress(t, addr, addrLen); err == nil { // if NO error
+		p.Address = address
+	}
+
+	if fields.Local.Contains(seccheck.FieldSyscallPath) {
+		p.FdPath = getFilePath(t, int32(p.Fd))
+	}
+
+	p.Exit = newExitMaybe(info)
+	return p, pb.MessageType_MESSAGE_SYSCALL_ACCEPT
+}
+
+// PointAccept converts accept(2) syscall to proto.
+func PointAccept(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) {
+	return acceptHelper(t, fields, cxtData, info, 0)
+}
+
+// PointAccept4 converts accept4(2) syscall to proto.
+func PointAccept4(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) {
+	flags := info.Args[3].Int()
+	return acceptHelper(t, fields, cxtData, info, flags)
+}

pkg/sentry/syscalls/linux/vfs2/vfs2.go

@@ -40,20 +40,20 @@ func Override() {
 	s.Table[19] = syscalls.Supported("readv", Readv)
 	s.Table[20] = syscalls.Supported("writev", Writev)
 	s.Table[21] = syscalls.Supported("access", Access)
-	s.Table[22] = syscalls.Supported("pipe", Pipe)
+	s.Table[22] = syscalls.SupportedPoint("pipe", Pipe, linux.PointPipe)
 	s.Table[23] = syscalls.Supported("select", Select)
-	s.Table[32] = syscalls.Supported("dup", Dup)
-	s.Table[33] = syscalls.Supported("dup2", Dup2)
+	s.Table[32] = syscalls.SupportedPoint("dup", Dup, linux.PointDup)
+	s.Table[33] = syscalls.SupportedPoint("dup2", Dup2, linux.PointDup2)
 	s.Table[40] = syscalls.Supported("sendfile", Sendfile)
 	s.Table[41] = syscalls.SupportedPoint("socket", Socket, linux.PointSocket)
 	s.Table[42] = syscalls.SupportedPoint("connect", Connect, linux.PointConnect)
-	s.Table[43] = syscalls.Supported("accept", Accept)
+	s.Table[43] = syscalls.SupportedPoint("accept", Accept, linux.PointAccept)
 	s.Table[44] = syscalls.Supported("sendto", SendTo)
 	s.Table[45] = syscalls.Supported("recvfrom", RecvFrom)
 	s.Table[46] = syscalls.Supported("sendmsg", SendMsg)
 	s.Table[47] = syscalls.Supported("recvmsg", RecvMsg)
 	s.Table[48] = syscalls.Supported("shutdown", Shutdown)
-	s.Table[49] = syscalls.Supported("bind", Bind)
+	s.Table[49] = syscalls.SupportedPoint("bind", Bind, linux.PointBind)
 	s.Table[50] = syscalls.Supported("listen", Listen)
 	s.Table[51] = syscalls.Supported("getsockname", GetSockName)
 	s.Table[52] = syscalls.Supported("getpeername", GetPeerName)
@@ -61,7 +61,7 @@ func Override() {
 	s.Table[54] = syscalls.Supported("setsockopt", SetSockOpt)
 	s.Table[55] = syscalls.Supported("getsockopt", GetSockOpt)
 	s.Table[59] = syscalls.SupportedPoint("execve", Execve, linux.PointExecve)
-	s.Table[72] = syscalls.Supported("fcntl", Fcntl)
+	s.Table[72] = syscalls.SupportedPoint("fcntl", Fcntl, linux.PointFcntl)
 	s.Table[73] = syscalls.Supported("flock", Flock)
 	s.Table[74] = syscalls.Supported("fsync", Fsync)
 	s.Table[75] = syscalls.Supported("fdatasync", Fdatasync)
@@ -89,7 +89,7 @@ func Override() {
 	s.Table[137] = syscalls.Supported("statfs", Statfs)
 	s.Table[138] = syscalls.Supported("fstatfs", Fstatfs)
 	s.Table[155] = syscalls.Supported("pivot_root", PivotRoot)
-	s.Table[161] = syscalls.Supported("chroot", Chroot)
+	s.Table[161] = syscalls.SupportedPoint("chroot", Chroot, linux.PointChroot)
 	s.Table[162] = syscalls.Supported("sync", Sync)
 	s.Table[165] = syscalls.Supported("mount", Mount)
 	s.Table[166] = syscalls.Supported("umount2", Umount2)
@@ -138,18 +138,18 @@ func Override() {
 	s.Table[277] = syscalls.Supported("sync_file_range", SyncFileRange)
 	s.Table[280] = syscalls.Supported("utimensat", Utimensat)
 	s.Table[281] = syscalls.Supported("epoll_pwait", EpollPwait)
-	s.Table[282] = syscalls.Supported("signalfd", Signalfd)
+	s.Table[282] = syscalls.SupportedPoint("signalfd", Signalfd, linux.PointSignalfd)
 	s.Table[283] = syscalls.Supported("timerfd_create", TimerfdCreate)
-	s.Table[284] = syscalls.Supported("eventfd", Eventfd)
+	s.Table[284] = syscalls.SupportedPoint("eventfd", Eventfd, linux.PointEventfd)
 	s.Table[285] = syscalls.PartiallySupported("fallocate", Fallocate, "Not all options are supported.", nil)
 	s.Table[286] = syscalls.Supported("timerfd_settime", TimerfdSettime)
 	s.Table[287] = syscalls.Supported("timerfd_gettime", TimerfdGettime)
-	s.Table[288] = syscalls.Supported("accept4", Accept4)
-	s.Table[289] = syscalls.Supported("signalfd4", Signalfd4)
-	s.Table[290] = syscalls.Supported("eventfd2", Eventfd2)
+	s.Table[288] = syscalls.SupportedPoint("accept4", Accept4, linux.PointAccept4)
+	s.Table[289] = syscalls.SupportedPoint("signalfd4", Signalfd4, linux.PointSignalfd4)
+	s.Table[290] = syscalls.SupportedPoint("eventfd2", Eventfd2, linux.PointEventfd2)
 	s.Table[291] = syscalls.Supported("epoll_create1", EpollCreate1)
-	s.Table[292] = syscalls.Supported("dup3", Dup3)
-	s.Table[293] = syscalls.Supported("pipe2", Pipe2)
+	s.Table[292] = syscalls.SupportedPoint("dup3", Dup3, linux.PointDup3)
+	s.Table[293] = syscalls.SupportedPoint("pipe2", Pipe2, linux.PointPipe2)
 	s.Table[294] = syscalls.PartiallySupported("inotify_init1", InotifyInit1, "inotify events are only available inside the sandbox.", nil)
 	s.Table[295] = syscalls.Supported("preadv", Preadv)
 	s.Table[296] = syscalls.Supported("pwritev", Pwritev)
@@ -183,13 +183,13 @@ func Override() {
 	s.Table[15] = syscalls.Supported("lremovexattr", Lremovexattr)
 	s.Table[16] = syscalls.Supported("fremovexattr", Fremovexattr)
 	s.Table[17] = syscalls.Supported("getcwd", Getcwd)
-	s.Table[19] = syscalls.Supported("eventfd2", Eventfd2)
+	s.Table[19] = syscalls.SupportedPoint("eventfd2", Eventfd2, linux.PointEventfd2)
 	s.Table[20] = syscalls.Supported("epoll_create1", EpollCreate1)
 	s.Table[21] = syscalls.Supported("epoll_ctl", EpollCtl)
 	s.Table[22] = syscalls.Supported("epoll_pwait", EpollPwait)
-	s.Table[23] = syscalls.Supported("dup", Dup)
-	s.Table[24] = syscalls.Supported("dup3", Dup3)
-	s.Table[25] = syscalls.Supported("fcntl", Fcntl)
+	s.Table[23] = syscalls.SupportedPoint("dup", Dup, linux.PointDup)
+	s.Table[24] = syscalls.SupportedPoint("dup3", Dup3, linux.PointDup3)
+	s.Table[25] = syscalls.SupportedPoint("fcntl", Fcntl, linux.PointFcntl)
 	s.Table[26] = syscalls.PartiallySupported("inotify_init1", InotifyInit1, "inotify events are only available inside the sandbox.", nil)
 	s.Table[27] = syscalls.PartiallySupported("inotify_add_watch", InotifyAddWatch, "inotify events are only available inside the sandbox.", nil)
 	s.Table[28] = syscalls.PartiallySupported("inotify_rm_watch", InotifyRmWatch, "inotify events are only available inside the sandbox.", nil)
@@ -212,14 +212,14 @@ func Override() {
 	s.Table[48] = syscalls.Supported("faccessat", Faccessat)
 	s.Table[49] = syscalls.SupportedPoint("chdir", Chdir, linux.PointChdir)
 	s.Table[50] = syscalls.SupportedPoint("fchdir", Fchdir, linux.PointFchdir)
-	s.Table[51] = syscalls.Supported("chroot", Chroot)
+	s.Table[51] = syscalls.SupportedPoint("chroot", Chroot, linux.PointChroot)
 	s.Table[52] = syscalls.Supported("fchmod", Fchmod)
 	s.Table[53] = syscalls.Supported("fchmodat", Fchmodat)
 	s.Table[54] = syscalls.Supported("fchownat", Fchownat)
 	s.Table[55] = syscalls.Supported("fchown", Fchown)
 	s.Table[56] = syscalls.SupportedPoint("openat", Openat, linux.PointOpenat)
 	s.Table[57] = syscalls.SupportedPoint("close", Close, linux.PointClose)
-	s.Table[59] = syscalls.Supported("pipe2", Pipe2)
+	s.Table[59] = syscalls.SupportedPoint("pipe2", Pipe2, linux.PointPipe2)
 	s.Table[61] = syscalls.Supported("getdents64", Getdents64)
 	s.Table[62] = syscalls.Supported("lseek", Lseek)
 	s.Table[63] = syscalls.SupportedPoint("read", Read, linux.PointRead)
@@ -233,7 +233,7 @@ func Override() {
 	s.Table[71] = syscalls.Supported("sendfile", Sendfile)
 	s.Table[72] = syscalls.Supported("pselect", Pselect)
 	s.Table[73] = syscalls.Supported("ppoll", Ppoll)
-	s.Table[74] = syscalls.Supported("signalfd4", Signalfd4)
+	s.Table[74] = syscalls.SupportedPoint("signalfd4", Signalfd4, linux.PointSignalfd4)
 	s.Table[76] = syscalls.Supported("splice", Splice)
 	s.Table[77] = syscalls.Supported("tee", Tee)
 	s.Table[78] = syscalls.Supported("readlinkat", Readlinkat)
@@ -251,9 +251,9 @@ func Override() {
 	s.Table[181] = syscalls.Supported("mq_unlink", MqUnlink)
 	s.Table[198] = syscalls.SupportedPoint("socket", Socket, linux.PointSocket)
 	s.Table[199] = syscalls.Supported("socketpair", SocketPair)
-	s.Table[200] = syscalls.Supported("bind", Bind)
+	s.Table[200] = syscalls.SupportedPoint("bind", Bind, linux.PointBind)
 	s.Table[201] = syscalls.Supported("listen", Listen)
-	s.Table[202] = syscalls.Supported("accept", Accept)
+	s.Table[202] = syscalls.SupportedPoint("accept", Accept, linux.PointAccept)
 	s.Table[203] = syscalls.SupportedPoint("connect", Connect, linux.PointConnect)
 	s.Table[204] = syscalls.Supported("getsockname", GetSockName)
 	s.Table[205] = syscalls.Supported("getpeername", GetPeerName)
@@ -268,7 +268,7 @@ func Override() {
 	s.Table[221] = syscalls.SupportedPoint("execve", Execve, linux.PointExecve)
 	s.Table[222] = syscalls.Supported("mmap", Mmap)
 	s.Table[223] = syscalls.PartiallySupported("fadvise64", Fadvise64, "Not all options are supported.", nil)
-	s.Table[242] = syscalls.Supported("accept4", Accept4)
+	s.Table[242] = syscalls.SupportedPoint("accept4", Accept4, linux.PointAccept4)
 	s.Table[243] = syscalls.Supported("recvmmsg", RecvMMsg)
 	s.Table[267] = syscalls.Supported("syncfs", Syncfs)
 	s.Table[269] = syscalls.Supported("sendmmsg", SendMMsg)