in rule/rule.go [538:573]
func addSyscall(rule *ruleData, syscall string) error {
if syscall == "all" {
rule.allSyscalls = true
return nil
}
rule.allSyscalls = false
syscallNum, err := strconv.Atoi(syscall)
if err != nil {
if !errors.Is(err, strconv.ErrSyntax) {
return fmt.Errorf("failed to parse syscall number '%v': %w", syscall, err)
}
arch := rule.arch
if arch == "" {
arch, err = getRuntimeArch()
if err != nil {
return fmt.Errorf("failed to add syscall: %w", err)
}
}
// Convert name to number.
table, found := reverseSyscall[arch]
if !found {
return fmt.Errorf("syscall table not found for arch %v", arch)
}
syscallNum, found = table[syscall]
if !found {
return fmt.Errorf("unknown syscall '%v' for arch %v", syscall, arch)
}
}
rule.syscalls = append(rule.syscalls, uint32(syscallNum))
return nil
}