Module syscall 

Syscall routing: which numbers go where, and the handlers for each tier.

Modules

direct

Handlers for the syscalls that take a ptrace stop when ptrace is available, served through user notification when it is not.

notify

Handlers for syscalls answered through seccomp user notification.

nr

x86_64 syscall numbers used by the filter and the handlers.

traced

Handlers for syscalls that take a ptrace stop: the path (or socket address) is rewritten in the tracee’s memory and the syscall proceeds.

Constants

CLONE_NEWNS_FLAGS

CLONE_NEW* bits of clone, clone3 and unshare flags.

DUMPABLE_SYSCALLS

Syscalls whose dumpable-flag operations go to the listener.

FAKE_ROOT_SYSCALLS

Syscalls added to the notify tier by -0: identity queries answered as root, identity changes accepted, descriptor ownership changes forgiven.

NAMESPACE_FLAG_SYSCALLS

Syscalls whose namespace flags are refused with EPERM by the filter itself, as a default container refuses them: a tracee in a mount namespace of its own could not be served by a supervisor that does the filesystem work in its own. clone3 carries its flags in memory and is inspected by a handler instead; setns is refused outright.

NOTIFY_SYSCALLS

Syscalls answered by the supervisor through user notification.

NO_PTRACE_SYSCALLS

Syscalls served through notification instead of a ptrace stop when there is no ptrace: the trace tier plus fchdir (the working directory is virtual then) and the clone family (the child’s state is snapshotted at the fork).

REFUSED_SYSCALLS

Syscalls refused with EPERM unconditionally.

TRACE_SYSCALLS

Syscalls that take a ptrace stop so their arguments can be edited in place.