creat

Implemented in Antinomie 0.7.0 · Syscall list

Synopsis

long creat(const char *pathname, umode_t mode);

Number (x86-64)	85
ABI	common
Kernel entry point	sys_creat

This is the raw kernel prototype from the pinned Linux 6.12.94 schema, not the libc wrapper.

Description

Creates or truncates a file and opens it for writing. It is equivalent to open with create, write-only and truncate.

Arguments

Name	Type	Meaning
pathname (arg0)	const char *	Path, as a NUL-terminated string in user memory.
mode (arg1)	umode_t	Permission bits (and, for some calls, the file type) for a file or directory being created or changed.

Return value

On success: A new file descriptor (a non-negative number).

In an Antinomie trace the Return column and the ret filter field show the raw kernel return value. On failure that is the negative errno, for example -2 for ENOENT, not the -1 plus errno that the libc wrapper gives. syscall.errno holds the positive errno and syscall.success is false.

Common errors

Raw return	Name	Meaning
-13	EACCES	Permission denied.
-21	EISDIR	The path names a directory where a file is needed.
-24	EMFILE	The process has too many open file descriptors.

Man page

creat(2) on man7.org

Captured by Antinomie

Coverage mark: Implemented. Every pointer argument has a capture rule in the pinned kernel patch and none of them records a “no decoder”, “address only” or “not observed” gap on any code path. Individual values can still be incomplete on a particular call; see the capture statuses.

Every call is recorded as an Entry record (the six argument words and the pointees copied at entry) and an Exit record (the return value and the pointees copied at exit).

Arguments

Argument	When	How	Recorded field key	Condition
pathname (arg0)	Entry	the pointer itself, as a raw word	args.0, args.raw[0]
↳ pointee	Entry	NUL-terminated string, up to 4,096 bytes (PATH_MAX)	arg0.path	always
mode (arg1)	Entry	raw scalar word	args.1, args.mode

Derived and lifecycle records

• A lifecycle.file_id record (kind Open) gives the device, inode and generation of the opened file, so Triage can follow one file across its names. Written by a base built for Antinomie 0.7.0 or later.

Filter fields

• Result: ret, syscall.errno, syscall.success, syscall.duration_ns.
• Argument words: args.pathname (arg0), args.mode (arg1); args.0 to args.5 by position.
• Captured strings: the args.<name> field of a path argument, and args.path, give the captured text instead of the pointer.

See Syscall Trace filter for the full syntax.

For what the capture statuses mean, see Capture statuses. For what is never recorded, see Known gaps.