File: lseek_e.cpp

package info (click to toggle)
falcosecurity-libs 0.20.0-3
  • links: PTS, VCS
  • area: main
  • in suites: forky, sid, trixie
  • size: 23,732 kB
  • sloc: ansic: 532,812; cpp: 100,792; python: 1,490; sh: 532; makefile: 195
file content (45 lines) | stat: -rw-r--r-- 1,179 bytes parent folder | download
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
#include "../../event_class/event_class.h"

#ifdef __NR_lseek
TEST(SyscallEnter, lseekE) {
	auto evt_test = get_syscall_event_test(__NR_lseek, ENTER_EVENT);

	evt_test->enable_capture();

	/*=============================== TRIGGER SYSCALL  ===========================*/

	int fd = -1;
	off_t offset = 7;
	int whence = SEEK_SET;
	assert_syscall_state(SYSCALL_FAILURE, "lseek", syscall(__NR_lseek, fd, offset, whence));

	/*=============================== TRIGGER SYSCALL ===========================*/

	evt_test->disable_capture();

	evt_test->assert_event_presence();

	if(HasFatalFailure()) {
		return;
	}

	evt_test->parse_event();

	evt_test->assert_header();

	/*=============================== ASSERT PARAMETERS  ===========================*/

	/* Parameter 1: fd (type: PT_FD) */
	evt_test->assert_numeric_param(1, (int64_t)fd);

	/* Parameter 2: offset (type: PT_UINT64) */
	evt_test->assert_numeric_param(2, (uint64_t)offset);

	/* Parameter 3: whence (type: PT_ENUMFLAGS8) */
	evt_test->assert_numeric_param(3, (uint8_t)PPM_SEEK_SET);

	/*=============================== ASSERT PARAMETERS  ===========================*/

	evt_test->assert_num_params_pushed(3);
}
#endif