openat2
Implemented in Antinomie 0.7.0 · Syscall list
Synopsis
Section titled “Synopsis”long openat2(int dfd, const char *filename, struct open_how *how, size_t size);| Number (x86-64) | 437 |
| ABI | common |
| Kernel entry point | sys_openat2 |
This is the raw kernel prototype from the pinned Linux 6.12.94 schema, not the libc wrapper.
Description
Section titled “Description”Like openat, with the options in an extensible structure that also controls path resolution.
Arguments
Section titled “Arguments”| Name | Type | Meaning |
|---|---|---|
dfd (arg0) |
int |
Directory file descriptor that a relative path is resolved against, or AT_FDCWD (-100) for the current directory. |
filename (arg1) |
const char * |
Path of the file to open. |
how (arg2) |
struct open_how * |
Pointer to a struct open_how (flags, mode, resolve). |
size (arg3) |
size_t |
Size in bytes. |
Return value
Section titled “Return value”On success: A new file descriptor (a non-negative number).
In an Antinomie trace the Return column and the ret filter field show the raw kernel return value. On failure that is the negative errno, for example -2 for ENOENT, not the -1 plus errno that the libc wrapper gives. syscall.errno holds the positive errno and syscall.success is false.
Common errors
Section titled “Common errors”| Raw return | Name | Meaning |
|---|---|---|
-7 |
E2BIG |
An argument list or structure is too large. |
-22 |
EINVAL |
An argument is invalid. |
-2 |
ENOENT |
A path component or the named object does not exist. |
Man page
Section titled “Man page”Captured by Antinomie
Section titled “Captured by Antinomie”Coverage mark: Implemented. Every pointer argument has a capture rule in the pinned kernel patch and none of them records a “no decoder”, “address only” or “not observed” gap on any code path. Individual values can still be incomplete on a particular call; see the capture statuses.
Every call is recorded as an Entry record (the six argument words and the pointees copied at entry) and an Exit record (the return value and the pointees copied at exit).
Arguments
Section titled “Arguments”| Argument | When | How | Recorded field key | Condition |
|---|---|---|---|---|
dfd (arg0) |
Entry | raw scalar word | args.0, args.dfd |
|
filename (arg1) |
Entry | the pointer itself, as a raw word | args.1, args.raw[1] |
|
| ↳ pointee | Entry | NUL-terminated string, up to 4,096 bytes (PATH_MAX) | arg1.path |
always |
how (arg2) |
Entry | the pointer itself, as a raw word | args.2, args.raw[2] |
|
| ↳ pointee | Entry | structure open_how, size from usize (arg3), versioned |
arg2.open_how |
always |
size (arg3) |
Entry | raw scalar word | args.3, args.size |
Derived and lifecycle records
Section titled “Derived and lifecycle records”- A
lifecycle.file_idrecord (kind Open) gives the device, inode and generation of the opened file, so Triage can follow one file across its names. Written by a base built for Antinomie 0.7.0 or later.
Filter fields
Section titled “Filter fields”- Result:
ret,syscall.errno,syscall.success,syscall.duration_ns. - Argument words:
args.dfd(arg0),args.filename(arg1),args.how(arg2),args.size(arg3);args.0toargs.5by position. - Captured strings: the
args.<name>field of a path argument, andargs.path, give the captured text instead of the pointer. - Structure
open_howbehindhow(arg2):args.how.<member>forflags,mode,resolve.
See Syscall Trace filter for the full syntax.
For what the capture statuses mean, see Capture statuses. For what is never recorded, see Known gaps.