^^&&^^

Edit File: sysc_keyctl.stp

# keyctl _____________________________________________________
# long sys_keyctl(int option,
#            unsigned long arg2,
#            unsigned long arg3,
#            unsigned long arg4,
#            unsigned long arg5)
# long compat_sys_keyctl(u32 option, u32 arg2, u32 arg3, u32 arg4, u32 arg5)
#

@define _SYSCALL_KEYCTL_NAME
%(
	name = "keyctl"
%)

@define _SYSCALL_KEYCTL_REGARGS
%(
	option = int_arg(1)
	arg2 = ulong_arg(2)
	arg3 = ulong_arg(3)
	arg4 = ulong_arg(4)
	arg5 = ulong_arg(5)
%)

probe syscall.keyctl = dw_syscall.keyctl !, nd_syscall.keyctl ? {}
probe syscall.keyctl.return = dw_syscall.keyctl.return !, nd_syscall.keyctl.return ? {}

# dw_keyctl _____________________________________________________

probe dw_syscall.keyctl = kernel.function("compat_sys_keyctl").call ?,
                       kernel.function("sys_keyctl").call ?
{
	@_SYSCALL_KEYCTL_NAME
	option = __int32($option)
	arg2 = @__compat_ulong($arg2)
	arg3 = @__compat_ulong($arg3)
	arg4 = @__compat_ulong($arg4)
	arg5 = @__compat_ulong($arg5)
	@__keyctl_argstr(option, arg2, arg3, arg4, arg5)
}
probe dw_syscall.keyctl.return = kernel.function("compat_sys_keyctl").return ?,
                              kernel.function("sys_keyctl").return ?
{
	@_SYSCALL_KEYCTL_NAME
	@SYSC_RETVALSTR($return)
}

# nd_keyctl _____________________________________________________

probe nd_syscall.keyctl = nd1_syscall.keyctl!, nd2_syscall.keyctl!, tp_syscall.keyctl
  { }

probe nd1_syscall.keyctl = kprobe.function("compat_sys_keyctl") ?,
                           kprobe.function("sys_keyctl") ?
{
	@_SYSCALL_KEYCTL_NAME
	asmlinkage()
	@_SYSCALL_KEYCTL_REGARGS
	@__keyctl_argstr(option, arg2, arg3, arg4, arg5)
}

/* kernel 4.17+ */
probe nd2_syscall.keyctl = kprobe.function(@arch_syscall_prefix "compat_sys_keyctl") ?,
                           kprobe.function(@arch_syscall_prefix "sys_keyctl") ?
{
	__set_syscall_pt_regs(pointer_arg(1))
	@_SYSCALL_KEYCTL_NAME
	@_SYSCALL_KEYCTL_REGARGS
	@__keyctl_argstr(option, arg2, arg3, arg4, arg5)
}

/* kernel 3.5+, but undesirable because it affects all syscalls */
probe tp_syscall.keyctl = kernel.trace("sys_enter")
{
	__set_syscall_pt_regs($regs)
	@__syscall_compat_gate(@const("__NR_keyctl"), @const("__NR_compat_keyctl"))
	@_SYSCALL_KEYCTL_NAME
	@_SYSCALL_KEYCTL_REGARGS
	@__keyctl_argstr(option, arg2, arg3, arg4, arg5)
}

probe nd_syscall.keyctl.return = nd1_syscall.keyctl.return!, nd2_syscall.keyctl.return!, tp_syscall.keyctl.return
  { }

probe nd1_syscall.keyctl.return = kprobe.function("compat_sys_keyctl").return ?,
                                  kprobe.function("sys_keyctl").return ?
{
	@_SYSCALL_KEYCTL_NAME
	@SYSC_RETVALSTR(returnval())
}

/* kernel 4.17+ */
probe nd2_syscall.keyctl.return = kprobe.function(@arch_syscall_prefix "compat_sys_keyctl").return ?,
                                  kprobe.function(@arch_syscall_prefix "sys_keyctl").return ?
{
	@_SYSCALL_KEYCTL_NAME
	@SYSC_RETVALSTR(returnval())
}

/* kernel 3.5+, but undesirable because it affects all syscalls */
probe tp_syscall.keyctl.return = kernel.trace("sys_exit")
{
	__set_syscall_pt_regs($regs)
	@__syscall_compat_gate(@const("__NR_keyctl"), @const("__NR_compat_keyctl"))
	@_SYSCALL_KEYCTL_NAME
	@SYSC_RETVALSTR($ret)
}