Add Points to some syscalls

Added a raw syscall points to all syscalls. Added schematized syscall
points to the following syscalls:

  - timerfd_create
  - timerfd_settime
  - timerfd_gettime
  - fork, vfork
  - inotify_init, inotify_init1
  - inotify_add_watch
  - inotify_rm_watch
  - socketpair

Updates #4805

PiperOrigin-RevId: 459596784

examples/seccheck/server.cc

@@ -105,6 +105,14 @@ std::vector<Callback> dispatchers = {
     unpackSyscall<::gvisor::syscall::Clone>,
     unpackSyscall<::gvisor::syscall::Bind>,
     unpackSyscall<::gvisor::syscall::Accept>,
+    unpackSyscall<::gvisor::syscall::TimerfdCreate>,
+    unpackSyscall<::gvisor::syscall::TimerfdSetTime>,
+    unpackSyscall<::gvisor::syscall::TimerfdGetTime>,
+    unpackSyscall<::gvisor::syscall::Fork>,
+    unpackSyscall<::gvisor::syscall::InotifyInit>,
+    unpackSyscall<::gvisor::syscall::InotifyAddWatch>,
+    unpackSyscall<::gvisor::syscall::InotifyRmWatch>,
+    unpackSyscall<::gvisor::syscall::SocketPair>,
 };
 
 void unpack(absl::string_view buf) {

pkg/sentry/seccheck/metadata_amd64.go

@@ -139,6 +139,36 @@ func init() {
 			Name: "fd_path",
 		},
 	})
+	addSyscallPoint(57, "fork", nil)
+	addSyscallPoint(58, "vfork", nil)
+	addSyscallPoint(253, "inotify_init", nil)
+	addSyscallPoint(294, "inotify_init1", nil)
+	addSyscallPoint(254, "inotify_add_watch", []FieldDesc{
+		{
+			ID:   FieldSyscallPath,
+			Name: "fd_path",
+		},
+	})
+	addSyscallPoint(255, "inotify_rm_watch", []FieldDesc{
+		{
+			ID:   FieldSyscallPath,
+			Name: "fd_path",
+		},
+	})
+	addSyscallPoint(283, "timerfd_create", nil)
+	addSyscallPoint(286, "timerfd_settime", []FieldDesc{
+		{
+			ID:   FieldSyscallPath,
+			Name: "fd_path",
+		},
+	})
+	addSyscallPoint(287, "timerfd_gettime", []FieldDesc{
+		{
+			ID:   FieldSyscallPath,
+			Name: "fd_path",
+		},
+	})
+	addSyscallPoint(53, "socketpair", nil)
 
 	const lastSyscallInTable = 441
 	for i := 0; i <= lastSyscallInTable; i++ {

pkg/sentry/seccheck/metadata_arm64.go

@@ -118,6 +118,34 @@ func init() {
 			Name: "fd_path",
 		},
 	})
+	addSyscallPoint(26, "inotify_init1", nil)
+	addSyscallPoint(27, "inotify_add_watch", []FieldDesc{
+		{
+			ID:   FieldSyscallPath,
+			Name: "fd_path",
+		},
+	})
+	addSyscallPoint(28, "inotify_rm_watch", []FieldDesc{
+		{
+			ID:   FieldSyscallPath,
+			Name: "fd_path",
+		},
+	})
+	addSyscallPoint(85, "timerfd_create", nil)
+	addSyscallPoint(86, "timerfd_settime", []FieldDesc{
+		{
+			ID:   FieldSyscallPath,
+			Name: "fd_path",
+		},
+	})
+	addSyscallPoint(87, "timerfd_gettime", []FieldDesc{
+		{
+			ID:   FieldSyscallPath,
+			Name: "fd_path",
+		},
+	})
+	addSyscallPoint(199, "socketpair", nil)
+
 	const lastSyscallInTable = 441
 	for i := 0; i <= lastSyscallInTable; i++ {
 		addRawSyscallPoint(uintptr(i))

pkg/sentry/seccheck/points/common.proto

@@ -123,5 +123,13 @@ enum MessageType {
   MESSAGE_SYSCALL_CLONE = 23;
   MESSAGE_SYSCALL_BIND = 24;
   MESSAGE_SYSCALL_ACCEPT = 25;
+  MESSAGE_SYSCALL_TIMERFD_CREATE = 26;
+  MESSAGE_SYSCALL_TIMERFD_SETTIME = 27;
+  MESSAGE_SYSCALL_TIMERFD_GETTIME = 28;
+  MESSAGE_SYSCALL_FORK = 29;
+  MESSAGE_SYSCALL_INOTIFY_INIT = 30;
+  MESSAGE_SYSCALL_INOTIFY_ADD_WATCH = 31;
+  MESSAGE_SYSCALL_INOTIFY_RM_WATCH = 32;
+  MESSAGE_SYSCALL_SOCKETPAIR = 33;
 }
 // LINT.ThenChange(../../../../examples/seccheck/server.cc)

pkg/sentry/seccheck/points/syscall.proto

@@ -178,6 +178,7 @@ message Chroot {
   uint64 sysno = 3;
   string pathname = 4;
 }
+
 message Eventfd {
   gvisor.common.ContextData context_data = 1;
   Exit exit = 2;
@@ -214,3 +215,84 @@ message Accept {
   bytes address = 6;
   int32 flags = 7;
 }
+
+message TimerfdCreate {
+  gvisor.common.ContextData context_data = 1;
+  Exit exit = 2;
+  uint64 sysno = 3;
+  int32 clock_id = 4;
+  int32 flags = 5;
+}
+
+message Timespec {
+  int64 sec = 1;
+  int64 nsec = 2;
+}
+
+message ItimerSpec {
+  Timespec interval = 1;
+  Timespec value = 2;
+}
+
+message TimerfdSetTime {
+  gvisor.common.ContextData context_data = 1;
+  Exit exit = 2;
+  uint64 sysno = 3;
+  int32 fd = 4;
+  string fd_path = 5;
+  int32 flags = 6;
+  ItimerSpec new_value = 7;
+  ItimerSpec old_value = 8;
+}
+
+message TimerfdGetTime {
+  gvisor.common.ContextData context_data = 1;
+  Exit exit = 2;
+  uint64 sysno = 3;
+  int32 fd = 4;
+  string fd_path = 5;
+  ItimerSpec cur_value = 6;
+}
+
+message Fork {
+  gvisor.common.ContextData context_data = 1;
+  Exit exit = 2;
+  uint64 sysno = 3;
+}
+
+message InotifyInit {
+  gvisor.common.ContextData context_data = 1;
+  Exit exit = 2;
+  uint64 sysno = 3;
+  int32 flags = 4;
+}
+
+message InotifyAddWatch{
+  gvisor.common.ContextData context_data = 1;
+  Exit exit = 2;
+  uint64 sysno = 3;
+  int32 fd = 4;
+  string fd_path = 5;
+  string pathname = 6;
+  uint32 mask = 7;
+}
+
+message InotifyRmWatch {
+  gvisor.common.ContextData context_data = 1;
+  Exit exit = 2;
+  uint64 sysno = 3;
+  int32 fd = 4;
+  string fd_path = 5;
+  int32 wd = 6;
+}
+
+message SocketPair {
+  gvisor.common.ContextData context_data = 1;
+  Exit exit = 2;
+  uint64 sysno = 3;
+  int32 domain = 4;
+  int32 type = 5;
+  int32 protocol = 6;
+  int32 socket1 = 7;
+  int32 socket2 = 8;
+}

pkg/sentry/syscalls/linux/linux64.go

@@ -105,12 +105,12 @@ var AMD64 = &kernel.SyscallTable{
 		50:  syscalls.Supported("listen", Listen),
 		51:  syscalls.Supported("getsockname", GetSockName),
 		52:  syscalls.Supported("getpeername", GetPeerName),
-		53:  syscalls.Supported("socketpair", SocketPair),
+		53:  syscalls.SupportedPoint("socketpair", SocketPair, PointSocketpair),
 		54:  syscalls.PartiallySupported("setsockopt", SetSockOpt, "Not all socket options are supported.", nil),
 		55:  syscalls.PartiallySupported("getsockopt", GetSockOpt, "Not all socket options are supported.", nil),
 		56:  syscalls.PartiallySupportedPoint("clone", Clone, PointClone, "Mount namespace (CLONE_NEWNS) not supported. Options CLONE_PARENT, CLONE_SYSVSEM not supported.", nil),
-		57:  syscalls.Supported("fork", Fork),
-		58:  syscalls.Supported("vfork", Vfork),
+		57:  syscalls.SupportedPoint("fork", Fork, PointFork),
+		58:  syscalls.SupportedPoint("vfork", Vfork, PointVfork),
 		59:  syscalls.SupportedPoint("execve", Execve, PointExecve),
 		60:  syscalls.Supported("exit", Exit),
 		61:  syscalls.Supported("wait4", Wait4),
@@ -305,9 +305,9 @@ var AMD64 = &kernel.SyscallTable{
 		250: syscalls.Error("keyctl", linuxerr.EACCES, "Not available to user.", nil),
 		251: syscalls.CapError("ioprio_set", linux.CAP_SYS_ADMIN, "", nil), // requires cap_sys_nice or cap_sys_admin (depending)
 		252: syscalls.CapError("ioprio_get", linux.CAP_SYS_ADMIN, "", nil), // requires cap_sys_nice or cap_sys_admin (depending)
-		253: syscalls.PartiallySupported("inotify_init", InotifyInit, "Inotify events are only available inside the sandbox. Hard links are treated as different watch targets in gofer fs.", nil),
-		254: syscalls.PartiallySupported("inotify_add_watch", InotifyAddWatch, "Inotify events are only available inside the sandbox. Hard links are treated as different watch targets in gofer fs.", nil),
-		255: syscalls.PartiallySupported("inotify_rm_watch", InotifyRmWatch, "Inotify events are only available inside the sandbox. Hard links are treated as different watch targets in gofer fs.", nil),
+		253: syscalls.PartiallySupportedPoint("inotify_init", InotifyInit, PointInotifyInit, "Inotify events are only available inside the sandbox. Hard links are treated as different watch targets in gofer fs.", nil),
+		254: syscalls.PartiallySupportedPoint("inotify_add_watch", InotifyAddWatch, PointInotifyAddWatch, "Inotify events are only available inside the sandbox. Hard links are treated as different watch targets in gofer fs.", nil),
+		255: syscalls.PartiallySupportedPoint("inotify_rm_watch", InotifyRmWatch, PointInotifyRmWatch, "Inotify events are only available inside the sandbox. Hard links are treated as different watch targets in gofer fs.", nil),
 		256: syscalls.CapError("migrate_pages", linux.CAP_SYS_NICE, "", nil),
 		257: syscalls.SupportedPoint("openat", Openat, PointOpenat),
 		258: syscalls.Supported("mkdirat", Mkdirat),
@@ -335,18 +335,18 @@ var AMD64 = &kernel.SyscallTable{
 		280: syscalls.Supported("utimensat", Utimensat),
 		281: syscalls.Supported("epoll_pwait", EpollPwait),
 		282: syscalls.PartiallySupportedPoint("signalfd", Signalfd, PointSignalfd, "Semantics are slightly different.", []string{"gvisor.dev/issue/139"}),
-		283: syscalls.Supported("timerfd_create", TimerfdCreate),
+		283: syscalls.SupportedPoint("timerfd_create", TimerfdCreate, PointTimerfdCreate),
 		284: syscalls.SupportedPoint("eventfd", Eventfd, PointEventfd),
 		285: syscalls.PartiallySupported("fallocate", Fallocate, "Not all options are supported.", nil),
-		286: syscalls.Supported("timerfd_settime", TimerfdSettime),
-		287: syscalls.Supported("timerfd_gettime", TimerfdGettime),
+		286: syscalls.SupportedPoint("timerfd_settime", TimerfdSettime, PointTimerfdSettime),
+		287: syscalls.SupportedPoint("timerfd_gettime", TimerfdGettime, PointTimerfdGettime),
 		288: syscalls.SupportedPoint("accept4", Accept4, PointAccept4),
 		289: syscalls.PartiallySupportedPoint("signalfd4", Signalfd4, PointSignalfd4, "Semantics are slightly different.", []string{"gvisor.dev/issue/139"}),
 		290: syscalls.SupportedPoint("eventfd2", Eventfd2, PointEventfd2),
 		291: syscalls.Supported("epoll_create1", EpollCreate1),
 		292: syscalls.SupportedPoint("dup3", Dup3, PointDup3),
 		293: syscalls.SupportedPoint("pipe2", Pipe2, PointPipe2),
-		294: syscalls.PartiallySupported("inotify_init1", InotifyInit1, "Inotify events are only available inside the sandbox. Hard links are treated as different watch targets in gofer fs.", nil),
+		294: syscalls.PartiallySupportedPoint("inotify_init1", InotifyInit1, PointInotifyInit1, "Inotify events are only available inside the sandbox. Hard links are treated as different watch targets in gofer fs.", nil),
 		295: syscalls.Supported("preadv", Preadv),
 		296: syscalls.Supported("pwritev", Pwritev),
 		297: syscalls.Supported("rt_tgsigqueueinfo", RtTgsigqueueinfo),
@@ -456,9 +456,9 @@ var ARM64 = &kernel.SyscallTable{
 		23:  syscalls.SupportedPoint("dup", Dup, PointDup),
 		24:  syscalls.SupportedPoint("dup3", Dup3, PointDup3),
 		25:  syscalls.PartiallySupportedPoint("fcntl", Fcntl, PointFcntl, "Not all options are supported.", nil),
-		26:  syscalls.PartiallySupported("inotify_init1", InotifyInit1, "Inotify events are only available inside the sandbox. Hard links are treated as different watch targets in gofer fs.", nil),
-		27:  syscalls.PartiallySupported("inotify_add_watch", InotifyAddWatch, "Inotify events are only available inside the sandbox. Hard links are treated as different watch targets in gofer fs.", nil),
-		28:  syscalls.PartiallySupported("inotify_rm_watch", InotifyRmWatch, "Inotify events are only available inside the sandbox. Hard links are treated as different watch targets in gofer fs.", nil),
+		26:  syscalls.PartiallySupportedPoint("inotify_init1", InotifyInit1, PointInotifyInit1, "Inotify events are only available inside the sandbox. Hard links are treated as different watch targets in gofer fs.", nil),
+		27:  syscalls.PartiallySupportedPoint("inotify_add_watch", InotifyAddWatch, PointInotifyAddWatch, "Inotify events are only available inside the sandbox. Hard links are treated as different watch targets in gofer fs.", nil),
+		28:  syscalls.PartiallySupportedPoint("inotify_rm_watch", InotifyRmWatch, PointInotifyRmWatch, "Inotify events are only available inside the sandbox. Hard links are treated as different watch targets in gofer fs.", nil),
 		29:  syscalls.PartiallySupported("ioctl", Ioctl, "Only a few ioctls are implemented for backing devices and file systems.", nil),
 		30:  syscalls.CapError("ioprio_set", linux.CAP_SYS_ADMIN, "", nil), // requires cap_sys_nice or cap_sys_admin (depending)
 		31:  syscalls.CapError("ioprio_get", linux.CAP_SYS_ADMIN, "", nil), // requires cap_sys_nice or cap_sys_admin (depending)
@@ -515,9 +515,9 @@ var ARM64 = &kernel.SyscallTable{
 		82:  syscalls.PartiallySupported("fsync", Fsync, "Full data flush is not guaranteed at this time.", nil),
 		83:  syscalls.PartiallySupported("fdatasync", Fdatasync, "Full data flush is not guaranteed at this time.", nil),
 		84:  syscalls.PartiallySupported("sync_file_range", SyncFileRange, "Full data flush is not guaranteed at this time.", nil),
-		85:  syscalls.Supported("timerfd_create", TimerfdCreate),
-		86:  syscalls.Supported("timerfd_settime", TimerfdSettime),
-		87:  syscalls.Supported("timerfd_gettime", TimerfdGettime),
+		85:  syscalls.SupportedPoint("timerfd_create", TimerfdCreate, PointTimerfdCreate),
+		86:  syscalls.SupportedPoint("timerfd_settime", TimerfdSettime, PointTimerfdSettime),
+		87:  syscalls.SupportedPoint("timerfd_gettime", TimerfdGettime, PointTimerfdGettime),
 		88:  syscalls.Supported("utimensat", Utimensat),
 		89:  syscalls.CapError("acct", linux.CAP_SYS_PACCT, "", nil),
 		90:  syscalls.Supported("capget", Capget),
@@ -629,7 +629,7 @@ var ARM64 = &kernel.SyscallTable{
 		196: syscalls.PartiallySupported("shmat", Shmat, "Option SHM_RND is not supported.", nil),
 		197: syscalls.Supported("shmdt", Shmdt),
 		198: syscalls.PartiallySupported("socket", Socket, "Limited support for AF_NETLINK, NETLINK_ROUTE sockets. Limited support for SOCK_RAW.", nil),
-		199: syscalls.Supported("socketpair", SocketPair),
+		199: syscalls.SupportedPoint("socketpair", SocketPair, PointSocketpair),
 		200: syscalls.PartiallySupportedPoint("bind", Bind, PointBind, "Autobind for abstract Unix sockets is not supported.", nil),
 		201: syscalls.Supported("listen", Listen),
 		202: syscalls.SupportedPoint("accept", Accept, PointAccept),

pkg/sentry/syscalls/linux/points.go

@@ -629,3 +629,189 @@ func PointAccept4(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextD
 	flags := info.Args[3].Int()
 	return acceptHelper(t, fields, cxtData, info, flags)
 }
+
+// PointTimerfdCreate converts timerfd_create(2) syscall to proto.
+func PointTimerfdCreate(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) {
+	p := &pb.TimerfdCreate{
+		ContextData: cxtData,
+		Sysno:       uint64(info.Sysno),
+		ClockId:     info.Args[0].Int(),
+		Flags:       info.Args[1].Int(),
+	}
+
+	p.Exit = newExitMaybe(info)
+	return p, pb.MessageType_MESSAGE_SYSCALL_TIMERFD_CREATE
+}
+
+func getValues(values linux.Timespec) *pb.Timespec {
+	return &pb.Timespec{
+		Sec:  values.Sec,
+		Nsec: values.Nsec,
+	}
+}
+
+// PointTimerfdSettime converts timerfd_settime(2) syscall to proto.
+func PointTimerfdSettime(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) {
+	p := &pb.TimerfdSetTime{
+		ContextData: cxtData,
+		Sysno:       uint64(info.Sysno),
+		Fd:          info.Args[0].Int(),
+		Flags:       info.Args[1].Int(),
+	}
+
+	if fields.Local.Contains(seccheck.FieldSyscallPath) {
+		p.FdPath = getFilePath(t, int32(p.Fd))
+	}
+
+	var newVal linux.Itimerspec
+	if newValAddr := info.Args[2].Pointer(); newValAddr != 0 {
+		if _, err := newVal.CopyIn(t, newValAddr); err == nil {
+			p.NewValue = &pb.ItimerSpec{
+				Interval: getValues(newVal.Interval),
+				Value:    getValues(newVal.Value),
+			}
+		}
+	}
+	if info.Exit {
+		var oldVal linux.Itimerspec
+		if oldValAddr := info.Args[3].Pointer(); oldValAddr != 0 {
+			if _, err := oldVal.CopyIn(t, oldValAddr); err == nil {
+				p.OldValue = &pb.ItimerSpec{
+					Interval: getValues(oldVal.Interval),
+					Value:    getValues(oldVal.Value),
+				}
+			}
+		}
+	}
+
+	p.Exit = newExitMaybe(info)
+	return p, pb.MessageType_MESSAGE_SYSCALL_TIMERFD_SETTIME
+}
+
+// PointTimerfdGettime converts timerfd_gettime(2) syscall to proto.
+func PointTimerfdGettime(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) {
+	p := &pb.TimerfdGetTime{
+		ContextData: cxtData,
+		Sysno:       uint64(info.Sysno),
+		Fd:          info.Args[0].Int(),
+	}
+
+	if fields.Local.Contains(seccheck.FieldSyscallPath) {
+		p.FdPath = getFilePath(t, int32(p.Fd))
+	}
+
+	if curValAddr := info.Args[1].Pointer(); curValAddr != 0 {
+		var curVal linux.Itimerspec
+		if _, err := curVal.CopyIn(t, curValAddr); err == nil {
+			p.CurValue = &pb.ItimerSpec{
+				Interval: getValues(curVal.Interval),
+				Value:    getValues(curVal.Value),
+			}
+		}
+	}
+
+	p.Exit = newExitMaybe(info)
+	return p, pb.MessageType_MESSAGE_SYSCALL_TIMERFD_GETTIME
+}
+
+// pointForkHelper converts fork(2) and vfork(2) syscall to proto.
+func pointForkHelper(cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) {
+	p := &pb.Fork{
+		ContextData: cxtData,
+		Sysno:       uint64(info.Sysno),
+	}
+
+	p.Exit = newExitMaybe(info)
+	return p, pb.MessageType_MESSAGE_SYSCALL_FORK
+}
+
+// PointFork converts fork(2) syscall to proto.
+func PointFork(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) {
+	return pointForkHelper(cxtData, info)
+}
+
+// PointVfork converts vfork(2) syscall to proto.
+func PointVfork(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) {
+	return pointForkHelper(cxtData, info)
+}
+
+// pointInotifyInitHelper converts inotify_init(2) and inotify_init1(2) syscall to proto.
+func pointInotifyInitHelper(cxtData *pb.ContextData, info kernel.SyscallInfo, flags int32) (proto.Message, pb.MessageType) {
+	p := &pb.InotifyInit{
+		ContextData: cxtData,
+		Sysno:       uint64(info.Sysno),
+		Flags:       flags,
+	}
+
+	p.Exit = newExitMaybe(info)
+	return p, pb.MessageType_MESSAGE_SYSCALL_INOTIFY_INIT
+}
+
+// PointInotifyInit converts inotify_init(2) syscall to proto.
+func PointInotifyInit(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) {
+	return pointInotifyInitHelper(cxtData, info, 0)
+}
+
+// PointInotifyInit1 converts inotify_init1(2) syscall to proto.
+func PointInotifyInit1(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) {
+	flags := info.Args[0].Int()
+	return pointInotifyInitHelper(cxtData, info, flags)
+}
+
+// PointInotifyAddWatch converts inotify_add_watch(2) syscall to proto.
+func PointInotifyAddWatch(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) {
+	p := &pb.InotifyAddWatch{
+		ContextData: cxtData,
+		Sysno:       uint64(info.Sysno),
+		Fd:          info.Args[0].Int(),
+		Mask:        info.Args[2].Uint(),
+	}
+	if pathAddr := info.Args[1].Pointer(); pathAddr > 0 {
+		p.Pathname, _ = t.CopyInString(pathAddr, linux.PATH_MAX)
+	}
+
+	if fields.Local.Contains(seccheck.FieldSyscallPath) {
+		p.FdPath = getFilePath(t, int32(p.Fd))
+	}
+
+	p.Exit = newExitMaybe(info)
+	return p, pb.MessageType_MESSAGE_SYSCALL_INOTIFY_ADD_WATCH
+}
+
+// PointInotifyRmWatch converts inotify_add_watch(2) syscall to proto.
+func PointInotifyRmWatch(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) {
+	p := &pb.InotifyRmWatch{
+		ContextData: cxtData,
+		Sysno:       uint64(info.Sysno),
+		Fd:          info.Args[0].Int(),
+		Wd:          info.Args[2].Int(),
+	}
+
+	if fields.Local.Contains(seccheck.FieldSyscallPath) {
+		p.FdPath = getFilePath(t, int32(p.Fd))
+	}
+
+	p.Exit = newExitMaybe(info)
+	return p, pb.MessageType_MESSAGE_SYSCALL_INOTIFY_RM_WATCH
+}
+
+// PointSocketpair converts socketpair(2) syscall to proto.
+func PointSocketpair(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) {
+	p := &pb.SocketPair{
+		ContextData: cxtData,
+		Sysno:       uint64(info.Sysno),
+		Domain:      info.Args[0].Int(),
+		Type:        info.Args[1].Int(),
+		Protocol:    info.Args[2].Int(),
+	}
+	if info.Exit {
+		sockets := info.Args[3].Pointer()
+		var fds [2]int32
+		if _, err := primitive.CopyInt32SliceIn(t, sockets, fds[:]); err == nil { // if NO error
+			p.Socket1 = fds[0]
+			p.Socket2 = fds[1]
+		}
+	}
+	p.Exit = newExitMaybe(info)
+	return p, pb.MessageType_MESSAGE_SYSCALL_SOCKETPAIR
+}

pkg/sentry/syscalls/linux/vfs2/vfs2.go

@@ -57,7 +57,7 @@ func Override() {
 	s.Table[50] = syscalls.Supported("listen", Listen)
 	s.Table[51] = syscalls.Supported("getsockname", GetSockName)
 	s.Table[52] = syscalls.Supported("getpeername", GetPeerName)
-	s.Table[53] = syscalls.Supported("socketpair", SocketPair)
+	s.Table[53] = syscalls.SupportedPoint("socketpair", SocketPair, linux.PointSocketpair)
 	s.Table[54] = syscalls.Supported("setsockopt", SetSockOpt)
 	s.Table[55] = syscalls.Supported("getsockopt", GetSockOpt)
 	s.Table[59] = syscalls.SupportedPoint("execve", Execve, linux.PointExecve)
@@ -115,9 +115,9 @@ func Override() {
 	s.Table[235] = syscalls.Supported("utimes", Utimes)
 	s.Table[240] = syscalls.Supported("mq_open", MqOpen)
 	s.Table[241] = syscalls.Supported("mq_unlink", MqUnlink)
-	s.Table[253] = syscalls.PartiallySupported("inotify_init", InotifyInit, "inotify events are only available inside the sandbox.", nil)
-	s.Table[254] = syscalls.PartiallySupported("inotify_add_watch", InotifyAddWatch, "inotify events are only available inside the sandbox.", nil)
-	s.Table[255] = syscalls.PartiallySupported("inotify_rm_watch", InotifyRmWatch, "inotify events are only available inside the sandbox.", nil)
+	s.Table[253] = syscalls.PartiallySupportedPoint("inotify_init", InotifyInit, linux.PointInotifyInit, "inotify events are only available inside the sandbox.", nil)
+	s.Table[254] = syscalls.PartiallySupportedPoint("inotify_add_watch", InotifyAddWatch, linux.PointInotifyAddWatch, "inotify events are only available inside the sandbox.", nil)
+	s.Table[255] = syscalls.PartiallySupportedPoint("inotify_rm_watch", InotifyRmWatch, linux.PointInotifyRmWatch, "inotify events are only available inside the sandbox.", nil)
 	s.Table[257] = syscalls.SupportedPoint("openat", Openat, linux.PointOpenat)
 	s.Table[258] = syscalls.Supported("mkdirat", Mkdirat)
 	s.Table[259] = syscalls.Supported("mknodat", Mknodat)
@@ -139,18 +139,18 @@ func Override() {
 	s.Table[280] = syscalls.Supported("utimensat", Utimensat)
 	s.Table[281] = syscalls.Supported("epoll_pwait", EpollPwait)
 	s.Table[282] = syscalls.SupportedPoint("signalfd", Signalfd, linux.PointSignalfd)
-	s.Table[283] = syscalls.Supported("timerfd_create", TimerfdCreate)
+	s.Table[283] = syscalls.SupportedPoint("timerfd_create", TimerfdCreate, linux.PointTimerfdCreate)
 	s.Table[284] = syscalls.SupportedPoint("eventfd", Eventfd, linux.PointEventfd)
 	s.Table[285] = syscalls.PartiallySupported("fallocate", Fallocate, "Not all options are supported.", nil)
-	s.Table[286] = syscalls.Supported("timerfd_settime", TimerfdSettime)
-	s.Table[287] = syscalls.Supported("timerfd_gettime", TimerfdGettime)
+	s.Table[286] = syscalls.SupportedPoint("timerfd_settime", TimerfdSettime, linux.PointTimerfdSettime)
+	s.Table[287] = syscalls.SupportedPoint("timerfd_gettime", TimerfdGettime, linux.PointTimerfdGettime)
 	s.Table[288] = syscalls.SupportedPoint("accept4", Accept4, linux.PointAccept4)
 	s.Table[289] = syscalls.SupportedPoint("signalfd4", Signalfd4, linux.PointSignalfd4)
 	s.Table[290] = syscalls.SupportedPoint("eventfd2", Eventfd2, linux.PointEventfd2)
 	s.Table[291] = syscalls.Supported("epoll_create1", EpollCreate1)
 	s.Table[292] = syscalls.SupportedPoint("dup3", Dup3, linux.PointDup3)
 	s.Table[293] = syscalls.SupportedPoint("pipe2", Pipe2, linux.PointPipe2)
-	s.Table[294] = syscalls.PartiallySupported("inotify_init1", InotifyInit1, "inotify events are only available inside the sandbox.", nil)
+	s.Table[294] = syscalls.PartiallySupportedPoint("inotify_init1", InotifyInit1, linux.PointInotifyInit1, "inotify events are only available inside the sandbox.", nil)
 	s.Table[295] = syscalls.Supported("preadv", Preadv)
 	s.Table[296] = syscalls.Supported("pwritev", Pwritev)
 	s.Table[299] = syscalls.Supported("recvmmsg", RecvMMsg)
@@ -190,9 +190,9 @@ func Override() {
 	s.Table[23] = syscalls.SupportedPoint("dup", Dup, linux.PointDup)
 	s.Table[24] = syscalls.SupportedPoint("dup3", Dup3, linux.PointDup3)
 	s.Table[25] = syscalls.SupportedPoint("fcntl", Fcntl, linux.PointFcntl)
-	s.Table[26] = syscalls.PartiallySupported("inotify_init1", InotifyInit1, "inotify events are only available inside the sandbox.", nil)
-	s.Table[27] = syscalls.PartiallySupported("inotify_add_watch", InotifyAddWatch, "inotify events are only available inside the sandbox.", nil)
-	s.Table[28] = syscalls.PartiallySupported("inotify_rm_watch", InotifyRmWatch, "inotify events are only available inside the sandbox.", nil)
+	s.Table[26] = syscalls.PartiallySupportedPoint("inotify_init1", InotifyInit1, linux.PointInotifyInit1, "inotify events are only available inside the sandbox.", nil)
+	s.Table[27] = syscalls.PartiallySupportedPoint("inotify_add_watch", InotifyAddWatch, linux.PointInotifyAddWatch, "inotify events are only available inside the sandbox.", nil)
+	s.Table[28] = syscalls.PartiallySupportedPoint("inotify_rm_watch", InotifyRmWatch, linux.PointInotifyRmWatch, "inotify events are only available inside the sandbox.", nil)
 	s.Table[29] = syscalls.Supported("ioctl", Ioctl)
 	s.Table[32] = syscalls.Supported("flock", Flock)
 	s.Table[33] = syscalls.Supported("mknodat", Mknodat)
@@ -243,14 +243,14 @@ func Override() {
 	s.Table[82] = syscalls.Supported("fsync", Fsync)
 	s.Table[83] = syscalls.Supported("fdatasync", Fdatasync)
 	s.Table[84] = syscalls.Supported("sync_file_range", SyncFileRange)
-	s.Table[85] = syscalls.Supported("timerfd_create", TimerfdCreate)
-	s.Table[86] = syscalls.Supported("timerfd_settime", TimerfdSettime)
-	s.Table[87] = syscalls.Supported("timerfd_gettime", TimerfdGettime)
+	s.Table[85] = syscalls.SupportedPoint("timerfd_create", TimerfdCreate, linux.PointTimerfdCreate)
+	s.Table[86] = syscalls.SupportedPoint("timerfd_settime", TimerfdSettime, linux.PointTimerfdSettime)
+	s.Table[87] = syscalls.SupportedPoint("timerfd_gettime", TimerfdGettime, linux.PointTimerfdGettime)
 	s.Table[88] = syscalls.Supported("utimensat", Utimensat)
 	s.Table[180] = syscalls.Supported("mq_open", MqOpen)
 	s.Table[181] = syscalls.Supported("mq_unlink", MqUnlink)
 	s.Table[198] = syscalls.SupportedPoint("socket", Socket, linux.PointSocket)
-	s.Table[199] = syscalls.Supported("socketpair", SocketPair)
+	s.Table[199] = syscalls.SupportedPoint("socketpair", SocketPair, linux.PointSocketpair)
 	s.Table[200] = syscalls.SupportedPoint("bind", Bind, linux.PointBind)
 	s.Table[201] = syscalls.Supported("listen", Listen)
 	s.Table[202] = syscalls.SupportedPoint("accept", Accept, linux.PointAccept)