[lttng-tools.git] / src / common / event-rule / syscall.c

/*
 * Copyright (C) 2019 Jonathan Rajotte <jonathan.rajotte-julien@efficios.com>
 *
 * SPDX-License-Identifier: LGPL-2.1-only
 *
 */

#include <assert.h>
#include <common/error.h>
#include <common/macros.h>
#include <common/payload.h>
#include <common/payload-view.h>
#include <common/runas.h>
#include <lttng/event-rule/event-rule-internal.h>
#include <lttng/event-rule/syscall-internal.h>

#define IS_SYSCALL_EVENT_RULE(rule) \
	(lttng_event_rule_get_type(rule) == LTTNG_EVENT_RULE_TYPE_SYSCALL)

static void lttng_event_rule_syscall_destroy(struct lttng_event_rule *rule)
{
	struct lttng_event_rule_syscall *syscall;

	if (rule == NULL) {
		return;
	}

	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);

	free(syscall->pattern);
	free(syscall->filter_expression);
	free(syscall->internal_filter.filter);
	free(syscall->internal_filter.bytecode);
	free(syscall);
}

static bool lttng_event_rule_syscall_validate(
		const struct lttng_event_rule *rule)
{
	bool valid = false;
	struct lttng_event_rule_syscall *syscall;

	if (!rule) {
		goto end;
	}

	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);

	/* Required field. */
	if (!syscall->pattern) {
		ERR("Invalid syscall event rule: a pattern must be set.");
		goto end;
	}

	valid = true;
end:
	return valid;
}

static int lttng_event_rule_syscall_serialize(
		const struct lttng_event_rule *rule,
		struct lttng_payload *payload)
{
	int ret;
	size_t pattern_len, filter_expression_len;
	struct lttng_event_rule_syscall *syscall;
	struct lttng_event_rule_syscall_comm syscall_comm;

	if (!rule || !IS_SYSCALL_EVENT_RULE(rule)) {
		ret = -1;
		goto end;
	}

	DBG("Serializing syscall event rule");
	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);

	pattern_len = strlen(syscall->pattern) + 1;

	if (syscall->filter_expression != NULL) {
		filter_expression_len = strlen(syscall->filter_expression) + 1;
	} else {
		filter_expression_len = 0;
	}

	syscall_comm.pattern_len = pattern_len;
	syscall_comm.filter_expression_len = filter_expression_len;

	ret = lttng_dynamic_buffer_append(
			&payload->buffer, &syscall_comm, sizeof(syscall_comm));
	if (ret) {
		goto end;
	}

	ret = lttng_dynamic_buffer_append(
			&payload->buffer, syscall->pattern, pattern_len);
	if (ret) {
		goto end;
	}

	ret = lttng_dynamic_buffer_append(&payload->buffer,
			syscall->filter_expression, filter_expression_len);
end:
	return ret;
}

static bool lttng_event_rule_syscall_is_equal(const struct lttng_event_rule *_a,
		const struct lttng_event_rule *_b)
{
	bool is_equal = false;
	struct lttng_event_rule_syscall *a, *b;

	a = container_of(_a, struct lttng_event_rule_syscall, parent);
	b = container_of(_b, struct lttng_event_rule_syscall, parent);

	if (!!a->filter_expression != !!b->filter_expression) {
		goto end;
	}

	assert(a->pattern);
	assert(b->pattern);
	if (strcmp(a->pattern, b->pattern)) {
		goto end;
	}

	if (a->filter_expression && b->filter_expression) {
		if (strcmp(a->filter_expression, b->filter_expression)) {
			goto end;
		}
	} else if (!!a->filter_expression != !!b->filter_expression) {
		/* One is set and not the other. */
		goto end;
	}

	is_equal = true;
end:
	return is_equal;
}

static enum lttng_error_code lttng_event_rule_syscall_generate_filter_bytecode(
		struct lttng_event_rule *rule, uid_t uid, gid_t gid)
{
	int ret;
	enum lttng_error_code ret_code = LTTNG_OK;
	struct lttng_event_rule_syscall *syscall;
	enum lttng_event_rule_status status;
	const char *filter;
	struct lttng_filter_bytecode *bytecode = NULL;

	assert(rule);

	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);

	/* Generate the filter bytecode. */
	status = lttng_event_rule_syscall_get_filter(rule, &filter);
	if (status == LTTNG_EVENT_RULE_STATUS_UNSET) {
		filter = NULL;
	} else if (status != LTTNG_EVENT_RULE_STATUS_OK) {
		ret_code = LTTNG_ERR_FILTER_INVAL;
		goto end;
	}

	if (filter && filter[0] == '\0') {
		ret_code = LTTNG_ERR_FILTER_INVAL;
		goto end;
	}

	if (filter == NULL) {
		/* Nothing to do. */
		ret = LTTNG_OK;
		goto end;
	}

	syscall->internal_filter.filter = strdup(filter);
	if (syscall->internal_filter.filter == NULL) {
		ret_code = LTTNG_ERR_NOMEM;
		goto end;
	}

	ret = run_as_generate_filter_bytecode(
			syscall->internal_filter.filter, uid, gid, &bytecode);
	if (ret) {
		ret_code = LTTNG_ERR_FILTER_INVAL;
	}

	syscall->internal_filter.bytecode = bytecode;
	bytecode = NULL;

end:
	free(bytecode);
	return ret_code;
}

static const char *lttng_event_rule_syscall_get_internal_filter(
		const struct lttng_event_rule *rule)
{
	struct lttng_event_rule_syscall *syscall;

	assert(rule);
	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);

	return syscall->internal_filter.filter;
}

static const struct lttng_filter_bytecode *
lttng_event_rule_syscall_get_internal_filter_bytecode(
		const struct lttng_event_rule *rule)
{
	struct lttng_event_rule_syscall *syscall;

	assert(rule);
	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);

	return syscall->internal_filter.bytecode;
}

static struct lttng_event_exclusion *
lttng_event_rule_syscall_generate_exclusions(
		const struct lttng_event_rule *rule)
{
	/* Not supported. */
	return NULL;
}

struct lttng_event_rule *lttng_event_rule_syscall_create()
{
	struct lttng_event_rule *rule = NULL;
	struct lttng_event_rule_syscall *syscall_rule;

	syscall_rule = zmalloc(sizeof(struct lttng_event_rule_syscall));
	if (!syscall_rule) {
		goto end;
	}

	rule = &syscall_rule->parent;
	lttng_event_rule_init(
			&syscall_rule->parent, LTTNG_EVENT_RULE_TYPE_SYSCALL);
	syscall_rule->parent.validate = lttng_event_rule_syscall_validate;
	syscall_rule->parent.serialize = lttng_event_rule_syscall_serialize;
	syscall_rule->parent.equal = lttng_event_rule_syscall_is_equal;
	syscall_rule->parent.destroy = lttng_event_rule_syscall_destroy;
	syscall_rule->parent.generate_filter_bytecode =
			lttng_event_rule_syscall_generate_filter_bytecode;
	syscall_rule->parent.get_filter =
			lttng_event_rule_syscall_get_internal_filter;
	syscall_rule->parent.get_filter_bytecode =
			lttng_event_rule_syscall_get_internal_filter_bytecode;
	syscall_rule->parent.generate_exclusions =
			lttng_event_rule_syscall_generate_exclusions;
end:
	return rule;
}

LTTNG_HIDDEN
ssize_t lttng_event_rule_syscall_create_from_payload(
		struct lttng_payload_view *view,
		struct lttng_event_rule **_event_rule)
{
	ssize_t ret, offset = 0;
	enum lttng_event_rule_status status;
	const struct lttng_event_rule_syscall_comm *syscall_comm;
	const char *pattern;
	const char *filter_expression = NULL;
	struct lttng_buffer_view current_buffer_view;
	struct lttng_event_rule *rule = NULL;

	if (!_event_rule) {
		ret = -1;
		goto end;
	}

	if (view->buffer.size < sizeof(*syscall_comm)) {
		ERR("Failed to initialize from malformed event rule syscall: buffer too short to contain header");
		ret = -1;
		goto end;
	}

	current_buffer_view = lttng_buffer_view_from_view(
			&view->buffer, offset, sizeof(*syscall_comm));
	syscall_comm = (typeof(syscall_comm)) current_buffer_view.data;

	if (!syscall_comm) {
		ret = -1;
		goto end;
	}

	rule = lttng_event_rule_syscall_create();
	if (!rule) {
		ERR("Failed to create event rule syscall");
		ret = -1;
		goto end;
	}

	/* Skip to payload. */
	offset += current_buffer_view.size;

	/* Map the pattern. */
	current_buffer_view = lttng_buffer_view_from_view(
			&view->buffer, offset, syscall_comm->pattern_len);
	pattern = current_buffer_view.data;
	if (!pattern) {
		ret = -1;
		goto end;
	}

	if (!lttng_buffer_view_contains_string(&current_buffer_view, pattern,
			syscall_comm->pattern_len)) {
		ret = -1;
		goto end;
	}

	/* Skip after the pattern. */
	offset += syscall_comm->pattern_len;

	if (!syscall_comm->filter_expression_len) {
		goto skip_filter_expression;
	}

	/* Map the filter_expression. */
	current_buffer_view = lttng_buffer_view_from_view(&view->buffer, offset,
			syscall_comm->filter_expression_len);
	filter_expression = current_buffer_view.data;
	if (!filter_expression) {
		ret = -1;
		goto end;
	}

	if (!lttng_buffer_view_contains_string(&current_buffer_view,
				filter_expression,
				syscall_comm->filter_expression_len)) {
		ret = -1;
		goto end;
	}

	/* Skip after the pattern. */
	offset += syscall_comm->filter_expression_len;

skip_filter_expression:

	status = lttng_event_rule_syscall_set_pattern(rule, pattern);
	if (status != LTTNG_EVENT_RULE_STATUS_OK) {
		ERR("Failed to set event rule syscall pattern");
		ret = -1;
		goto end;
	}

	if (filter_expression) {
		status = lttng_event_rule_syscall_set_filter(
				rule, filter_expression);
		if (status != LTTNG_EVENT_RULE_STATUS_OK) {
			ERR("Failed to set event rule syscall pattern");
			ret = -1;
			goto end;
		}
	}

	*_event_rule = rule;
	rule = NULL;
	ret = offset;
end:
	lttng_event_rule_destroy(rule);
	return ret;
}

enum lttng_event_rule_status lttng_event_rule_syscall_set_pattern(
		struct lttng_event_rule *rule, const char *pattern)
{
	char *pattern_copy = NULL;
	struct lttng_event_rule_syscall *syscall;
	enum lttng_event_rule_status status = LTTNG_EVENT_RULE_STATUS_OK;

	if (!rule || !IS_SYSCALL_EVENT_RULE(rule) || !pattern ||
			strlen(pattern) == 0) {
		status = LTTNG_EVENT_RULE_STATUS_INVALID;
		goto end;
	}

	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
	pattern_copy = strdup(pattern);
	if (!pattern_copy) {
		status = LTTNG_EVENT_RULE_STATUS_ERROR;
		goto end;
	}

	if (syscall->pattern) {
		free(syscall->pattern);
	}

	syscall->pattern = pattern_copy;
	pattern_copy = NULL;
end:
	return status;
}

enum lttng_event_rule_status lttng_event_rule_syscall_get_pattern(
		const struct lttng_event_rule *rule, const char **pattern)
{
	struct lttng_event_rule_syscall *syscall;
	enum lttng_event_rule_status status = LTTNG_EVENT_RULE_STATUS_OK;

	if (!rule || !IS_SYSCALL_EVENT_RULE(rule) || !pattern) {
		status = LTTNG_EVENT_RULE_STATUS_INVALID;
		goto end;
	}

	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
	if (!syscall->pattern) {
		status = LTTNG_EVENT_RULE_STATUS_UNSET;
		goto end;
	}

	*pattern = syscall->pattern;
end:
	return status;
}

enum lttng_event_rule_status lttng_event_rule_syscall_set_filter(
		struct lttng_event_rule *rule, const char *expression)
{
	char *expression_copy = NULL;
	struct lttng_event_rule_syscall *syscall;
	enum lttng_event_rule_status status = LTTNG_EVENT_RULE_STATUS_OK;

	/* TODO: validate that the passed expression is valid. */

	if (!rule || !IS_SYSCALL_EVENT_RULE(rule) || !expression ||
			strlen(expression) == 0) {
		status = LTTNG_EVENT_RULE_STATUS_INVALID;
		goto end;
	}

	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
	expression_copy = strdup(expression);
	if (!expression_copy) {
		status = LTTNG_EVENT_RULE_STATUS_ERROR;
		goto end;
	}

	if (syscall->filter_expression) {
		free(syscall->filter_expression);
	}

	syscall->filter_expression = expression_copy;
	expression_copy = NULL;
end:
	return status;
}

enum lttng_event_rule_status lttng_event_rule_syscall_get_filter(
		const struct lttng_event_rule *rule, const char **expression)
{
	struct lttng_event_rule_syscall *syscall;
	enum lttng_event_rule_status status = LTTNG_EVENT_RULE_STATUS_OK;

	if (!rule || !IS_SYSCALL_EVENT_RULE(rule) || !expression) {
		status = LTTNG_EVENT_RULE_STATUS_INVALID;
		goto end;
	}

	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
	if (!syscall->filter_expression) {
		status = LTTNG_EVENT_RULE_STATUS_UNSET;
		goto end;
	}

	*expression = syscall->filter_expression;
end:
	return status;
}
Commit	Line	Data
e6a39346 JR	1	/*
	2	* Copyright (C) 2019 Jonathan Rajotte <jonathan.rajotte-julien@efficios.com>
	3	*
	4	* SPDX-License-Identifier: LGPL-2.1-only
	5	*
	6	*/
	7
	8	#include <assert.h>
	9	#include <common/error.h>
	10	#include <common/macros.h>
	11	#include <common/payload.h>
	12	#include <common/payload-view.h>
	13	#include <common/runas.h>
	14	#include <lttng/event-rule/event-rule-internal.h>
	15	#include <lttng/event-rule/syscall-internal.h>
	16
	17	#define IS_SYSCALL_EVENT_RULE(rule) \
	18	(lttng_event_rule_get_type(rule) == LTTNG_EVENT_RULE_TYPE_SYSCALL)
	19
	20	static void lttng_event_rule_syscall_destroy(struct lttng_event_rule *rule)
	21	{
	22	struct lttng_event_rule_syscall *syscall;
	23
	24	if (rule == NULL) {
	25	return;
	26	}
	27
	28	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
	29
	30	free(syscall->pattern);
	31	free(syscall->filter_expression);
	32	free(syscall->internal_filter.filter);
	33	free(syscall->internal_filter.bytecode);
	34	free(syscall);
	35	}
	36
	37	static bool lttng_event_rule_syscall_validate(
	38	const struct lttng_event_rule *rule)
	39	{
	40	bool valid = false;
	41	struct lttng_event_rule_syscall *syscall;
	42
	43	if (!rule) {
	44	goto end;
	45	}
	46
	47	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
	48
	49	/* Required field. */
	50	if (!syscall->pattern) {
	51	ERR("Invalid syscall event rule: a pattern must be set.");
	52	goto end;
	53	}
	54
	55	valid = true;
	56	end:
	57	return valid;
	58	}
	59
	60	static int lttng_event_rule_syscall_serialize(
	61	const struct lttng_event_rule *rule,
	62	struct lttng_payload *payload)
	63	{
	64	int ret;
65	size_t pattern_len, filter_expression_len;
66	struct lttng_event_rule_syscall *syscall;
67	struct lttng_event_rule_syscall_comm syscall_comm;
68
69	if (!rule \|\| !IS_SYSCALL_EVENT_RULE(rule)) {
70	ret = -1;
71	goto end;
72	}
73
74	DBG("Serializing syscall event rule");
75	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
76
77	pattern_len = strlen(syscall->pattern) + 1;
78
79	if (syscall->filter_expression != NULL) {
80	filter_expression_len = strlen(syscall->filter_expression) + 1;
81	} else {
82	filter_expression_len = 0;
83	}
84
85	syscall_comm.pattern_len = pattern_len;
86	syscall_comm.filter_expression_len = filter_expression_len;
87
88	ret = lttng_dynamic_buffer_append(
89	&payload->buffer, &syscall_comm, sizeof(syscall_comm));
90	if (ret) {
91	goto end;
92	}
93
94	ret = lttng_dynamic_buffer_append(
95	&payload->buffer, syscall->pattern, pattern_len);
96	if (ret) {
97	goto end;
98	}
99
100	ret = lttng_dynamic_buffer_append(&payload->buffer,
101	syscall->filter_expression, filter_expression_len);
102	end:
103	return ret;
104	}
105
106	static bool lttng_event_rule_syscall_is_equal(const struct lttng_event_rule *_a,
107	const struct lttng_event_rule *_b)
108	{
109	bool is_equal = false;
110	struct lttng_event_rule_syscall a, b;
111
112	a = container_of(_a, struct lttng_event_rule_syscall, parent);
113	b = container_of(_b, struct lttng_event_rule_syscall, parent);
114
115	if (!!a->filter_expression != !!b->filter_expression) {
116	goto end;
117	}
118
119	assert(a->pattern);
120	assert(b->pattern);
121	if (strcmp(a->pattern, b->pattern)) {
122	goto end;
123	}
124
125	if (a->filter_expression && b->filter_expression) {
126	if (strcmp(a->filter_expression, b->filter_expression)) {
127	goto end;
128	}
129	} else if (!!a->filter_expression != !!b->filter_expression) {
130	/* One is set and not the other. */
131	goto end;
132	}
133
134	is_equal = true;
135	end:
136	return is_equal;
137	}
138
139	static enum lttng_error_code lttng_event_rule_syscall_generate_filter_bytecode(
140	struct lttng_event_rule *rule, uid_t uid, gid_t gid)
141	{
142	int ret;
143	enum lttng_error_code ret_code = LTTNG_OK;
144	struct lttng_event_rule_syscall *syscall;
145	enum lttng_event_rule_status status;
146	const char *filter;
147	struct lttng_filter_bytecode *bytecode = NULL;
148
149	assert(rule);
150
151	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
152
153	/* Generate the filter bytecode. */
154	status = lttng_event_rule_syscall_get_filter(rule, &filter);
155	if (status == LTTNG_EVENT_RULE_STATUS_UNSET) {
156	filter = NULL;
157	} else if (status != LTTNG_EVENT_RULE_STATUS_OK) {
158	ret_code = LTTNG_ERR_FILTER_INVAL;
159	goto end;
160	}
161
162	if (filter && filter[0] == '\0') {
163	ret_code = LTTNG_ERR_FILTER_INVAL;
164	goto end;
165	}
166
167	if (filter == NULL) {
168	/* Nothing to do. */
169	ret = LTTNG_OK;
170	goto end;
171	}
172
173	syscall->internal_filter.filter = strdup(filter);
174	if (syscall->internal_filter.filter == NULL) {
175	ret_code = LTTNG_ERR_NOMEM;
176	goto end;
177	}
178
179	ret = run_as_generate_filter_bytecode(
180	syscall->internal_filter.filter, uid, gid, &bytecode);
181	if (ret) {
182	ret_code = LTTNG_ERR_FILTER_INVAL;
183	}
184
185	syscall->internal_filter.bytecode = bytecode;
186	bytecode = NULL;
187
188	end:
189	free(bytecode);
190	return ret_code;
191	}
192
193	static const char *lttng_event_rule_syscall_get_internal_filter(
194	const struct lttng_event_rule *rule)
195	{
196	struct lttng_event_rule_syscall *syscall;
197
198	assert(rule);
199	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
200
201	return syscall->internal_filter.filter;
202	}
203
204	static const struct lttng_filter_bytecode *
205	lttng_event_rule_syscall_get_internal_filter_bytecode(
206	const struct lttng_event_rule *rule)
207	{
208	struct lttng_event_rule_syscall *syscall;
209
210	assert(rule);
211	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
212
213	return syscall->internal_filter.bytecode;
214	}
215
216	static struct lttng_event_exclusion *
217	lttng_event_rule_syscall_generate_exclusions(
218	const struct lttng_event_rule *rule)
219	{
220	/* Not supported. */
221	return NULL;
222	}
223
224	struct lttng_event_rule *lttng_event_rule_syscall_create()
225	{
226	struct lttng_event_rule *rule = NULL;
227	struct lttng_event_rule_syscall *syscall_rule;
228
229	syscall_rule = zmalloc(sizeof(struct lttng_event_rule_syscall));
230	if (!syscall_rule) {
231	goto end;
232	}
233
234	rule = &syscall_rule->parent;
235	lttng_event_rule_init(
236	&syscall_rule->parent, LTTNG_EVENT_RULE_TYPE_SYSCALL);
237	syscall_rule->parent.validate = lttng_event_rule_syscall_validate;
238	syscall_rule->parent.serialize = lttng_event_rule_syscall_serialize;
239	syscall_rule->parent.equal = lttng_event_rule_syscall_is_equal;
240	syscall_rule->parent.destroy = lttng_event_rule_syscall_destroy;
241	syscall_rule->parent.generate_filter_bytecode =
242	lttng_event_rule_syscall_generate_filter_bytecode;
243	syscall_rule->parent.get_filter =
244	lttng_event_rule_syscall_get_internal_filter;
245	syscall_rule->parent.get_filter_bytecode =
246	lttng_event_rule_syscall_get_internal_filter_bytecode;
247	syscall_rule->parent.generate_exclusions =
248	lttng_event_rule_syscall_generate_exclusions;
249	end:
250	return rule;
251	}
252
253	LTTNG_HIDDEN
254	ssize_t lttng_event_rule_syscall_create_from_payload(
255	struct lttng_payload_view *view,
256	struct lttng_event_rule **_event_rule)
257	{
258	ssize_t ret, offset = 0;
259	enum lttng_event_rule_status status;
260	const struct lttng_event_rule_syscall_comm *syscall_comm;
261	const char *pattern;
262	const char *filter_expression = NULL;
263	struct lttng_buffer_view current_buffer_view;
264	struct lttng_event_rule *rule = NULL;
265
266	if (!_event_rule) {
267	ret = -1;
268	goto end;
269	}
270
271	if (view->buffer.size < sizeof(*syscall_comm)) {
272	ERR("Failed to initialize from malformed event rule syscall: buffer too short to contain header");
273	ret = -1;
274	goto end;
275	}
276
277	current_buffer_view = lttng_buffer_view_from_view(
278	&view->buffer, offset, sizeof(*syscall_comm));
279	syscall_comm = (typeof(syscall_comm)) current_buffer_view.data;
280
281	if (!syscall_comm) {
282	ret = -1;
283	goto end;
284	}
285
286	rule = lttng_event_rule_syscall_create();
287	if (!rule) {
288	ERR("Failed to create event rule syscall");
289	ret = -1;
290	goto end;
291	}
292
293	/* Skip to payload. */
294	offset += current_buffer_view.size;
295
296	/* Map the pattern. */
297	current_buffer_view = lttng_buffer_view_from_view(
298	&view->buffer, offset, syscall_comm->pattern_len);
299	pattern = current_buffer_view.data;
300	if (!pattern) {
301	ret = -1;
302	goto end;
303	}
304
305	if (!lttng_buffer_view_contains_string(&current_buffer_view, pattern,
306	syscall_comm->pattern_len)) {
307	ret = -1;
308	goto end;
309	}
310
311	/* Skip after the pattern. */
312	offset += syscall_comm->pattern_len;
313
314	if (!syscall_comm->filter_expression_len) {
315	goto skip_filter_expression;
316	}
317
318	/* Map the filter_expression. */
319	current_buffer_view = lttng_buffer_view_from_view(&view->buffer, offset,
320	syscall_comm->filter_expression_len);
321	filter_expression = current_buffer_view.data;
322	if (!filter_expression) {
323	ret = -1;
324	goto end;
325	}
326
327	if (!lttng_buffer_view_contains_string(&current_buffer_view,
328	filter_expression,
329	syscall_comm->filter_expression_len)) {
330	ret = -1;
331	goto end;
332	}
333
334	/* Skip after the pattern. */
335	offset += syscall_comm->filter_expression_len;
336
337	skip_filter_expression:
338
339	status = lttng_event_rule_syscall_set_pattern(rule, pattern);
340	if (status != LTTNG_EVENT_RULE_STATUS_OK) {
341	ERR("Failed to set event rule syscall pattern");
342	ret = -1;
343	goto end;
344	}
345
346	if (filter_expression) {
347	status = lttng_event_rule_syscall_set_filter(
348	rule, filter_expression);
349	if (status != LTTNG_EVENT_RULE_STATUS_OK) {
350	ERR("Failed to set event rule syscall pattern");
351	ret = -1;
352	goto end;
353	}
354	}
355
356	*_event_rule = rule;
357	rule = NULL;
358	ret = offset;
359	end:
360	lttng_event_rule_destroy(rule);
361	return ret;
362	}
363
364	enum lttng_event_rule_status lttng_event_rule_syscall_set_pattern(
365	struct lttng_event_rule rule, const char pattern)
366	{
367	char *pattern_copy = NULL;
368	struct lttng_event_rule_syscall *syscall;
369	enum lttng_event_rule_status status = LTTNG_EVENT_RULE_STATUS_OK;
370
371	if (!rule \|\| !IS_SYSCALL_EVENT_RULE(rule) \|\| !pattern \|\|
372	strlen(pattern) == 0) {
373	status = LTTNG_EVENT_RULE_STATUS_INVALID;
374	goto end;
375	}
376
377	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
378	pattern_copy = strdup(pattern);
379	if (!pattern_copy) {
380	status = LTTNG_EVENT_RULE_STATUS_ERROR;
381	goto end;
382	}
383
384	if (syscall->pattern) {
385	free(syscall->pattern);
386	}
387
388	syscall->pattern = pattern_copy;
389	pattern_copy = NULL;
390	end:
391	return status;
392	}
393
394	enum lttng_event_rule_status lttng_event_rule_syscall_get_pattern(
395	const struct lttng_event_rule rule, const char *pattern)
396	{
397	struct lttng_event_rule_syscall *syscall;
398	enum lttng_event_rule_status status = LTTNG_EVENT_RULE_STATUS_OK;
399
400	if (!rule \|\| !IS_SYSCALL_EVENT_RULE(rule) \|\| !pattern) {
401	status = LTTNG_EVENT_RULE_STATUS_INVALID;
402	goto end;
403	}
404
405	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
406	if (!syscall->pattern) {
407	status = LTTNG_EVENT_RULE_STATUS_UNSET;
408	goto end;
409	}
410
411	*pattern = syscall->pattern;
412	end:
413	return status;
414	}
415
416	enum lttng_event_rule_status lttng_event_rule_syscall_set_filter(
417	struct lttng_event_rule rule, const char expression)
418	{
419	char *expression_copy = NULL;
420	struct lttng_event_rule_syscall *syscall;
421	enum lttng_event_rule_status status = LTTNG_EVENT_RULE_STATUS_OK;
422
423	/* TODO: validate that the passed expression is valid. */
424
425	if (!rule \|\| !IS_SYSCALL_EVENT_RULE(rule) \|\| !expression \|\|
426	strlen(expression) == 0) {
427	status = LTTNG_EVENT_RULE_STATUS_INVALID;
428	goto end;
429	}
430
431	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
432	expression_copy = strdup(expression);
433	if (!expression_copy) {
434	status = LTTNG_EVENT_RULE_STATUS_ERROR;
435	goto end;
436	}
437
438	if (syscall->filter_expression) {
439	free(syscall->filter_expression);
440	}
441
442	syscall->filter_expression = expression_copy;
443	expression_copy = NULL;
444	end:
445	return status;
446	}
447
448	enum lttng_event_rule_status lttng_event_rule_syscall_get_filter(
449	const struct lttng_event_rule rule, const char *expression)
450	{
451	struct lttng_event_rule_syscall *syscall;
452	enum lttng_event_rule_status status = LTTNG_EVENT_RULE_STATUS_OK;
453
454	if (!rule \|\| !IS_SYSCALL_EVENT_RULE(rule) \|\| !expression) {
455	status = LTTNG_EVENT_RULE_STATUS_INVALID;
456	goto end;
457	}
458
459	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
460	if (!syscall->filter_expression) {
461	status = LTTNG_EVENT_RULE_STATUS_UNSET;
462	goto end;
463	}
464
465	*expression = syscall->filter_expression;
466	end:
467	return status;
468	}