prctl

Partial in Antinomie 0.7.0 · Syscall list

Synopsis

long prctl(int option, unsigned long arg2, unsigned long arg3, unsigned long arg4, unsigned long arg5);

Number (x86-64)	157
ABI	common
Kernel entry point	sys_prctl

This is the raw kernel prototype from the pinned Linux 6.12.94 schema, not the libc wrapper.

Description

Controls many per-process or per-thread settings, such as the name, seccomp mode and dumpable flag, selected by an option.

Arguments

Name	Type	Meaning
option (arg0)	int	prctl option code (PR_SET_NAME, PR_SET_SECCOMP, …).
arg2 (arg1)	unsigned long	Command-specific argument.
arg3 (arg2)	unsigned long	Command-specific argument.
arg4 (arg3)	unsigned long	Command-specific argument.
arg5 (arg4)	unsigned long	Command-specific argument.

Return value

On success: an option-specific value, usually 0.

In an Antinomie trace the Return column and the ret filter field show the raw kernel return value. On failure that is the negative errno, for example -2 for ENOENT, not the -1 plus errno that the libc wrapper gives. syscall.errno holds the positive errno and syscall.success is false.

Common errors

Raw return	Name	Meaning
-14	EFAULT	A pointer argument points outside the accessible address space.
-22	EINVAL	An argument is invalid.
-1	EPERM	The operation is not permitted for this process.

Man page

prctl(2) on man7.org

Captured by Antinomie

Coverage mark: Partial. Known options decode their pointer role. An unknown option records a prctl.unknown_selector “no decoder” gap, and the user-dispatch selector byte is recorded with the “not observed asynchronously” status.

Every call is recorded as an Entry record (the six argument words and the pointees copied at entry) and an Exit record (the return value and the pointees copied at exit).

Arguments

Argument	When	How	Recorded field key	Condition
option (arg0)	Entry	raw scalar word	args.0, args.option
arg2 (arg1)	Entry	raw scalar word	args.1, args.arg2
arg3 (arg2)	Entry	raw scalar word	args.2, args.arg3
arg4 (arg3)	Entry	raw scalar word	args.3, args.arg4
arg5 (arg4)	Entry	raw scalar word	args.4, args.arg5

Family notes

• Selector: option. Inputs such as the thread name for PR_SET_NAME (16 bytes), PR_SET_VMA_ANON_NAME (80 bytes), seccomp filter programs and PR_SET_MM structures are copied at entry; outputs such as PR_GET_NAME and PR_GET_AUXV are copied at exit on success.

Other recorded fields

arg1.name, arg1.value, arg1.tid_address, arg1.auxv, arg2.program, arg4.name, prctl.unknown_selector, arg4.selector, arg4.cookie, arg2.mm_map, arg2.mm_map.auxv, arg2.size, arg2.auxv. When and how each is recorded: Not documented yet.

Derived and lifecycle records

• When the call changes the task’s credentials, a lifecycle.creds record gives the ids (in the initial user namespace), the capability sets and the securebits after the change. Written by a base built for Antinomie 0.7.0 or later.

Filter fields

• Result: ret, syscall.errno, syscall.success, syscall.duration_ns.
• Argument words: args.option (arg0), args.arg2 (arg1), args.arg3 (arg2), args.arg4 (arg3), args.arg5 (arg4); args.0 to args.5 by position.
• Structure u32 behind arg2 (arg1): args.arg2.<member> for value.
• Structure u32 behind arg3 (arg2): args.arg3.<member> for value.
• Structure u64 behind arg5 (arg4): args.arg5.<member> for value.

See Syscall Trace filter for the full syntax.

Known gaps

• See the coverage mark above for the code paths that record a gap.

For what the capture statuses mean, see Capture statuses. For what is never recorded, see Known gaps.