chore: convert getuid32 and ugetrlimit and _llseek too.

Signed-off-by: Federico Di Pierro <[email protected]>
falcosecurity · Oct 18, 2023 · 1e509df · 1e509df
1 parent 994f7e4
commit 1e509df
Showing 1 changed file with 15 additions and 0 deletions.
diff --git a/main.go b/main.go
@@ -617,6 +617,21 @@ var ia32TranslatorMap = map[int64]int64{
 	 * Forcefully convert it.
 	 */
 	214: 106,
+	/*
+	 * getuid32 ia32 only; but it sends same event as getuid.
+	 * Forcefully convert it.
+	 */
+	199: 102,
+	/*
+	 * ugetrlimit ia32 only; but it sends same event as getrlimit.
+	 * Forcefully convert it.
+	 */
+	191: 97,
+	/*
+	 * _llseek ia32 only; but it sends a compatible with lseek event.
+	 * Forcefully convert it.
+	 */
+	140: 8,
 	/*
 	 * umount ia32 only; send a semi compatible umount2 instead.
 	 * (only exit event is actually compatible, see https://github.com/falcosecurity/libs/blob/master/driver/event_table.c#L444