lsm_get_self_attr

Implemented in Antinomie 0.7.0 · Syscall list

Synopsis

long lsm_get_self_attr(unsigned int attr, struct lsm_ctx *ctx, u32 *size, u32 flags);

Number (x86-64)	459
ABI	common
Kernel entry point	sys_lsm_get_self_attr

This is the raw kernel prototype from the pinned Linux 6.12.94 schema, not the libc wrapper.

Description

Reads the Linux security module attributes of the calling process.

Arguments

Name	Type	Meaning
attr (arg0)	unsigned int	Pointer to an attribute structure.
ctx (arg1)	struct lsm_ctx *	AIO or io_uring context handle.
size (arg2)	u32 *	Size in bytes.
flags (arg3)	u32	Option flags that change the behavior of the call.

Return value

On success: the number of attributes returned.

In an Antinomie trace the Return column and the ret filter field show the raw kernel return value. On failure that is the negative errno, for example -2 for ENOENT, not the -1 plus errno that the libc wrapper gives. syscall.errno holds the positive errno and syscall.success is false.

Common errors

Raw return	Name	Meaning
-22	EINVAL	An argument is invalid.
-7	E2BIG	An argument list or structure is too large.

Man page

lsm_get_self_attr(2) on man7.org

Captured by Antinomie

Coverage mark: Implemented. Every pointer argument has a capture rule in the pinned kernel patch and none of them records a “no decoder”, “address only” or “not observed” gap on any code path. Individual values can still be incomplete on a particular call; see the capture statuses.

Every call is recorded as an Entry record (the six argument words and the pointees copied at entry) and an Exit record (the return value and the pointees copied at exit).

Arguments

Argument	When	How	Recorded field key	Condition
attr (arg0)	Entry	raw scalar word	args.0, args.attr
ctx (arg1)	Entry	the pointer itself, as a raw word	args.1, args.raw[1]
↳ pointee	Entry	structure lsm_ctx selector	arg1.lsm_selector	flags is LSM_FLAG_SINGLE
↳ pointee	Exit	array of lsm_ctx, length from the written size	lsm.output	the call did not fail with -E2BIG
size (arg2)	Entry	the pointer itself, as a raw word	args.2, args.raw[2]
↳ pointee	Entry	u32 capacity of the buffer	lsm.capacity	always
↳ pointee	Exit	u32 size written	lsm.returned_size	result is 0 or greater, or -E2BIG
flags (arg3)	Entry	raw scalar word; Syscall Trace also decodes it into flag names (lsm_get group), listing unknown bits separately	args.3, args.flags

Filter fields

• Result: ret, syscall.errno, syscall.success, syscall.duration_ns.
• Argument words: args.attr (arg0), args.ctx (arg1), args.size (arg2), args.flags (arg3); args.0 to args.5 by position.
• Structure lsm_ctx[] behind ctx (arg1): args.ctx.<member> for ctx_len, flags, id, len.

See Syscall Trace filter for the full syntax.

For what the capture statuses mean, see Capture statuses. For what is never recorded, see Known gaps.