cleanup(libsinsp): removed unused PPME_SYSCALL_MKDIR_X statements

The current implementation does no longer emit PPME_SYSCALL_MKDIR_X
events and these events are also converted to PPME_SYSCALL_MKDIR_2_X
events for older scap files. Remove unused PPME_SYSCALL_MKDIR_X
statements from the codebase.

Added the CIF_FALLBACK_TO_EMPTY flag for parameters copied from
the enter event.

Signed-off-by: Tero Kauppinen <[email protected]>

Author: terror96

test/libscap/test_suites/engines/savefile/converter.cpp

@@ -3937,23 +3937,26 @@ TEST_F(convert_event_test, PPME_SYSCALL_MKDIR_2_E_store) {
 	assert_event_storage_presence(evt);
 }
 
-TEST_F(convert_event_test, PPME_SYSCALL_MKDIR_2_X_to_3_params_no_enter) {
+TEST_F(convert_event_test, PPME_SYSCALL_MKDIR_2_X_2_to_3_params_no_enter) {
 	constexpr uint64_t ts = 12;
 	constexpr int64_t tid = 25;
 
 	constexpr int64_t res = 89;
 	constexpr char path[] = "/hello";
 
-	// Defaulted to 0
-	constexpr uint32_t mode = 0;
+	// Set to empty values
+	constexpr auto mode = empty_value<uint32_t>();
+
+	const std::set<uint32_t> expected_empty_param_indexes{2};
 
 	assert_single_conversion_success(
 	        CONVERSION_COMPLETED,
 	        create_safe_scap_event(ts, tid, PPME_SYSCALL_MKDIR_2_X, 2, res, path),
-	        create_safe_scap_event(ts, tid, PPME_SYSCALL_MKDIR_2_X, 3, res, path, mode));
+	        create_safe_scap_event(ts, tid, PPME_SYSCALL_MKDIR_2_X, 3, res, path, mode),
+	        expected_empty_param_indexes);
 }
 
-TEST_F(convert_event_test, PPME_SYSCALL_MKDIR_2_X_to_3_params_with_enter) {
+TEST_F(convert_event_test, PPME_SYSCALL_MKDIR_2_X_2_to_3_params_with_enter) {
 	constexpr uint64_t ts = 12;
 	constexpr int64_t tid = 25;
 
@@ -3972,7 +3975,7 @@ TEST_F(convert_event_test, PPME_SYSCALL_MKDIR_2_X_to_3_params_with_enter) {
 	        create_safe_scap_event(ts, tid, PPME_SYSCALL_MKDIR_2_X, 3, res, path, mode));
 }
 
-TEST_F(convert_event_test, PPME_SYSCALL_MKDIR_to_MKDIR_2_with_enter) {
+TEST_F(convert_event_test, PPME_SYSCALL_MKDIR_X_1_to_2_X_3_with_enter) {
 	constexpr uint64_t ts = 12;
 	constexpr int64_t tid = 25;
 

userspace/libscap/engine/savefile/converter/table.cpp

@@ -300,15 +300,17 @@ const std::unordered_map<conversion_key, conversion_info> g_conversion_table = {
         /*====================== MKDIR ======================*/
         {conversion_key{PPME_SYSCALL_MKDIR_2_E, 1}, conversion_info().action(C_ACTION_STORE)},
         {conversion_key{PPME_SYSCALL_MKDIR_2_X, 2},
-         conversion_info().action(C_ACTION_ADD_PARAMS).instrs({{C_INSTR_FROM_ENTER, 0}})},
+         conversion_info()
+                 .action(C_ACTION_ADD_PARAMS)
+                 .instrs({{C_INSTR_FROM_ENTER, 0, CIF_FALLBACK_TO_EMPTY}})},
         {conversion_key{PPME_SYSCALL_MKDIR_E, 2}, conversion_info().action(C_ACTION_STORE)},
         {conversion_key{PPME_SYSCALL_MKDIR_X, 1},
          conversion_info()
                  .desired_type(PPME_SYSCALL_MKDIR_2_X)
                  .action(C_ACTION_CHANGE_TYPE)
                  .instrs({{C_INSTR_FROM_OLD, 0},
-                          {C_INSTR_FROM_ENTER, 0},
-                          {C_INSTR_FROM_ENTER, 1}})},
+                          {C_INSTR_FROM_ENTER, 0, CIF_FALLBACK_TO_EMPTY},
+                          {C_INSTR_FROM_ENTER, 1, CIF_FALLBACK_TO_EMPTY}})},
         /*====================== UNSHARE ======================*/
         {conversion_key{PPME_SYSCALL_UNSHARE_E, 1}, conversion_info().action(C_ACTION_STORE)},
         {conversion_key{PPME_SYSCALL_UNSHARE_X, 1},

userspace/libsinsp/event.cpp

@@ -1700,7 +1700,6 @@ void sinsp_evt::save_enter_event_params(sinsp_evt *enter_evt) {
 
 	std::vector<const char *> *pnames = NULL;
 	switch(get_type()) {
-	case PPME_SYSCALL_MKDIR_X:
 	case PPME_SYSCALL_RMDIR_X:
 	case PPME_SYSCALL_UNLINK_X:
 		pnames = &path_param;

userspace/libsinsp/sinsp_filtercheck_fspath.cpp

@@ -153,8 +153,6 @@ void sinsp_filter_check_fspath::create_fspath_checks() {
 	std::shared_ptr<sinsp_filter_check> evt_arg_dev = create_event_check("evt.rawarg.dev");
 	std::shared_ptr<sinsp_filter_check> evt_arg_dir = create_event_check("evt.rawarg.dir");
 
-	m_success_checks->emplace(PPME_SYSCALL_MKDIR_X, evt_arg_res_eq_0);
-
 	m_path_checks->emplace(PPME_SYSCALL_MKDIR_2_X, evt_arg_path);
 	m_success_checks->emplace(PPME_SYSCALL_MKDIR_2_X, evt_arg_res_eq_0);
 
@@ -319,7 +317,6 @@ uint8_t* sinsp_filter_check_fspath::extract_single(sinsp_evt* evt,
 
 		// For some event types we need to get the values from the enter event instead.
 		switch(evt->get_type()) {
-		case PPME_SYSCALL_MKDIR_X:
 		case PPME_SYSCALL_RMDIR_X:
 		case PPME_SYSCALL_UNLINK_X:
 			enter_param = evt->get_enter_evt_param("path");