5 ms·

There is an existing project that tracks and gather syscalls in the linux kernel, for all ABIs: https://github.com/mebeim/systrack https://github.com/mebeim/sys

by halb 8mo ago

There is an existing project that tracks and gather syscalls in the linux kernel, for all ABIs: https://github.com/mebeim/systrack https://github.com/mebeim/systrack . The author maintains a table here, which is incredibly useful: https://syscalls.mebeim.net/?table=x86/64/x64/latest https://syscalls.mebeim.net/?table=x86/64/x64/latest

rwmj 8mo ago
And https://gpages.juszkiewicz.com.pl/syscalls-table/syscalls.html https://gpages.juszkiewicz.com.pl/syscalls-table/syscalls.ht... , https://github.com/hrw/syscalls-table/ https://github.com/hrw/syscalls-table/
tanelpoder 8mo ago
I also wrote a little Python tool that iterates through syscall tracepoint declarations in debugfs (/sys/kernel/debug) and lists available syscalls and their arguments available in your currently running system: https://tanelpoder.com/posts/list-linux-system-call-arguments-with-syscallargs/ https://tanelpoder.com/posts/list-linux-system-call-argument... Debugfs does not show platform-specific syscall internal numbers though (but the stable syscall IDs). Apparently debugfs does not show all syscalls, excluding "some weird ones" as mentioned by mebeim/systrack author in an earlier HN discussion: https://news.ycombinator.com/item?id=41018135#41020166 https://news.ycombinator.com/item?id=41018135#41020166
phkahler 8mo ago
Cosmopolitan also deals with things at this level across OSes too: https://cosmo.zip/ https://cosmo.zip/
westurner 8mo ago
TIL about systrack, which extracts syscalls from vmlinuz kernel images. https://github.com/mebeim/systrack https://github.com/mebeim/systrack /? tool to dump a list of all syscalls in a binary on Linux, like nm objdump, transitively searches dynamically linked https://www.google.com/search?q=tool+to+dump+a+list+of+all+syscalls+in+a+binary+on+Linux%2C+like+nm+objdump%2C+transitively+searches+dynamically+linked https://www.google.com/search?q=tool+to+dump+a+list+of+all+s... : - list-syscalls.rb "A script to statically list syscalls used by a given binary" https://gist.github.com/koute/166f82bfee5e27324077891008fca6eb https://gist.github.com/koute/166f82bfee5e27324077891008fca6... - "B-Side: Binary-Level Static System Call Identification" (2024) x86-64 https://arxiv.org/abs/2410.18053v1 https://arxiv.org/abs/2410.18053v1 - Systemd has SyscallFilter= From https://news.ycombinator.com/item?id=44947469 https://news.ycombinator.com/item?id=44947469 : > desbma/shh generates SyscallFilter and other systemd unit rules from straces similar to how audit2allow generates SELinux policies by grepping for AVC denials in permissive mode desbma/shh: https://github.com/desbma/shh https://github.com/desbma/shh

by halb 8mo ago

rwmj 8mo ago

And https://gpages.juszkiewicz.com.pl/syscalls-table/syscalls.html https://gpages.juszkiewicz.com.pl/syscalls-table/syscalls.ht... , https://github.com/hrw/syscalls-table/ https://github.com/hrw/syscalls-table/

tanelpoder 8mo ago

I also wrote a little Python tool that iterates through syscall tracepoint declarations in debugfs (/sys/kernel/debug) and lists available syscalls and their arguments available in your currently running system: https://tanelpoder.com/posts/list-linux-system-call-arguments-with-syscallargs/ https://tanelpoder.com/posts/list-linux-system-call-argument... Debugfs does not show platform-specific syscall internal numbers though (but the stable syscall IDs). Apparently debugfs does not show all syscalls, excluding "some weird ones" as mentioned by mebeim/systrack author in an earlier HN discussion: https://news.ycombinator.com/item?id=41018135#41020166 https://news.ycombinator.com/item?id=41018135#41020166

phkahler 8mo ago

Cosmopolitan also deals with things at this level across OSes too: https://cosmo.zip/ https://cosmo.zip/

westurner 8mo ago

TIL about systrack, which extracts syscalls from vmlinuz kernel images. https://github.com/mebeim/systrack https://github.com/mebeim/systrack /? tool to dump a list of all syscalls in a binary on Linux, like nm objdump, transitively searches dynamically linked https://www.google.com/search?q=tool+to+dump+a+list+of+all+syscalls+in+a+binary+on+Linux%2C+like+nm+objdump%2C+transitively+searches+dynamically+linked https://www.google.com/search?q=tool+to+dump+a+list+of+all+s... : - list-syscalls.rb "A script to statically list syscalls used by a given binary" https://gist.github.com/koute/166f82bfee5e27324077891008fca6eb https://gist.github.com/koute/166f82bfee5e27324077891008fca6... - "B-Side: Binary-Level Static System Call Identification" (2024) x86-64 https://arxiv.org/abs/2410.18053v1 https://arxiv.org/abs/2410.18053v1 - Systemd has SyscallFilter= From https://news.ycombinator.com/item?id=44947469 https://news.ycombinator.com/item?id=44947469 : > desbma/shh generates SyscallFilter and other systemd unit rules from straces similar to how audit2allow generates SELinux policies by grepping for AVC denials in permissive mode desbma/shh: https://github.com/desbma/shh https://github.com/desbma/shh