# list of syscalls that open a FD on the network
# (in the exit_syscall event)
NET_OPEN_SYSCALLS = ["sys_accept", "syscall_entry_accept",
+ "sys_accept4", "syscall_entry_accept4",
"sys_socket", "syscall_entry_socket"]
# list of syscalls that can duplicate a FD
DUP_OPEN_SYSCALLS = ["sys_fcntl", "syscall_entry_fcntl",
# SOFTWARE.
import socket
-import operator
from linuxautomaton import sp, sv, common
from babeltrace import CTFScope
current_syscall["filename"] = event["filename"]
if event["flags"] & common.O_CLOEXEC == common.O_CLOEXEC:
current_syscall["cloexec"] = 1
- elif name in ["sys_accept", "syscall_entry_accept"]:
+ elif name in ["sys_accept", "syscall_entry_accept",
+ "sys_accept4", "syscall_entry_accept4"]:
if "family" in event.keys() and event["family"] == socket.AF_INET:
ipport = "%s:%d" % (common.get_v4_addr_str(event["v4addr"]),
event["sport"])