Repository: kubernetes-sigs/security-profiles-operator
Pull request #544 (2021-07-20 11:06:44)

Use libseccomp for syscall ID to name conversion
#### What type of PR is this?

/kind cleanup

#### What this PR does / why we need it:
The library already features a conversion which is also used by the OCI
seccomp BPF hook. This way we do not have to maintain our own syscall
types any more.

#### Which issue(s) this PR fixes:

<!--
*Automatically closes linked issue when PR is merged.
Usage: `Fixes #<issue number>`, or `Fixes (paste link of issue)`.

Fixes #

or

None
-->
None
#### Does this PR have test?
None
<!--
If tests aren't applicable just write N/A.
-->

#### Special notes for your reviewer:
None
#### Does this PR introduce a user-facing change?

<!--
If no, just write "NONE" in the release-note block below.
If yes, a release note is required:
Enter your extended release note in the block below. If the PR requires additional action from users switching to the new release, include the string "action required".

For more information on release notes see: https://git.k8s.io/community/contributors/guide/release-notes.md
-->

```release-note
None
```


k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/544#" title="Author self-approved">saschagrunert</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/master/OWNERS)~~ [saschagrunert]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
codecov-commenter: # [Codecov](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/544?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None) Report
> Merging [#544](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/544?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None) (1cfc4a1) into [master](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/commit/0e2aceeb29dde7c1d63a8fcac7dba744bf603ea1?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None) (0e2acee) will **increase** coverage by `0.13%`.
> The diff coverage is `77.77%`.


```diff
@@            Coverage Diff             @@
##           master     #544      +/-   ##
==========================================
+ Coverage   43.55%   43.68%   +0.13%     
==========================================
  Files          25       25              
  Lines        1318     1323       +5     
==========================================
+ Hits          574      578       +4     
- Misses        704      705       +1     
  Partials       40       40              
```

saschagrunert: @jhrozek PTAL
k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/544#pullrequestreview-712431817" title="LGTM">jhrozek</a>*, *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/544#" title="Author self-approved">saschagrunert</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/master/OWNERS)~~ [saschagrunert]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->

Patch:
diff --git a/internal/pkg/daemon/enricher/audit.go b/internal/pkg/daemon/enricher/audit.go
index 2dee449a8..2ddece18f 100644
--- a/internal/pkg/daemon/enricher/audit.go
+++ b/internal/pkg/daemon/enricher/audit.go
@@ -73,8 +73,13 @@ func extractSeccompLine(logLine string) *auditLine {
 	if v, err := strconv.Atoi(captures[3]); err == nil {
 		line.processID = v
 	}
-	if v, err := strconv.Atoi(captures[5]); err == nil {
-		line.systemCallID = v
+
+	const (
+		base    = 10
+		bitSize = 32
+	)
+	if v, err := strconv.ParseInt(captures[5], base, bitSize); err == nil {
+		line.systemCallID = int32(v)
 	}
 
 	return &line
diff --git a/internal/pkg/daemon/enricher/enricher.go b/internal/pkg/daemon/enricher/enricher.go
index c00b61dc7..4619490eb 100644
--- a/internal/pkg/daemon/enricher/enricher.go
+++ b/internal/pkg/daemon/enricher/enricher.go
@@ -154,11 +154,12 @@ func (e *Enricher) Run() error {
 			continue
 		}
 
-		syscallName, ok := systemCalls[auditLine.systemCallID]
-		if !ok {
+		syscallName, err := syscallName(auditLine.systemCallID)
+		if err != nil {
 			e.logger.Info(
 				"no syscall name found for ID",
 				"syscallID", auditLine.systemCallID,
+				"err", err.Error(),
 			)
 			continue
 		}
diff --git a/internal/pkg/daemon/enricher/syscall.go b/internal/pkg/daemon/enricher/syscall.go
new file mode 100644
index 000000000..3b540f9ee
--- /dev/null
+++ b/internal/pkg/daemon/enricher/syscall.go
@@ -0,0 +1,26 @@
+// +build linux
+
+/*
+Copyright 2021 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package enricher
+
+import seccomp "github.com/seccomp/libseccomp-golang"
+
+// syscallName returns the syscall name for the provided ID.
+func syscallName(id int32) (string, error) {
+	return seccomp.ScmpSyscall(id).GetName()
+}
diff --git a/internal/pkg/daemon/enricher/syscall_amd64.go b/internal/pkg/daemon/enricher/syscall_amd64.go
deleted file mode 100644
index 50928865f..000000000
--- a/internal/pkg/daemon/enricher/syscall_amd64.go
+++ /dev/null
@@ -1,417 +0,0 @@
-// +build !arm64
-
-/*
-Copyright 2021 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package enricher
-
-// List of x86-x64 syscalls
-// Source: https://github.com/torvalds/linux/blob/v5.13/arch/x86/entry/syscalls/syscall_64.tbl
-var systemCalls = map[int]string{
-	0:   "read",
-	1:   "write",
-	2:   "open",
-	3:   "close",
-	4:   "stat",
-	5:   "fstat",
-	6:   "lstat",
-	7:   "poll",
-	8:   "lseek",
-	9:   "mmap",
-	10:  "mprotect",
-	11:  "munmap",
-	12:  "brk",
-	13:  "rt_sigaction",
-	14:  "rt_sigprocmask",
-	15:  "rt_sigreturn",
-	16:  "ioctl",
-	17:  "pread64",
-	18:  "pwrite64",
-	19:  "readv",
-	20:  "writev",
-	21:  "access",
-	22:  "pipe",
-	23:  "select",
-	24:  "sched_yield",
-	25:  "mremap",
-	26:  "msync",
-	27:  "mincore",
-	28:  "madvise",
-	29:  "shmget",
-	30:  "shmat",
-	31:  "shmctl",
-	32:  "dup",
-	33:  "dup2",
-	34:  "pause",
-	35:  "nanosleep",
-	36:  "getitimer",
-	37:  "alarm",
-	38:  "setitimer",
-	39:  "getpid",
-	40:  "sendfile",
-	41:  "socket",
-	42:  "connect",
-	43:  "accept",
-	44:  "sendto",
-	45:  "recvfrom",
-	46:  "sendmsg",
-	47:  "recvmsg",
-	48:  "shutdown",
-	49:  "bind",
-	50:  "listen",
-	51:  "getsockname",
-	52:  "getpeername",
-	53:  "socketpair",
-	54:  "setsockopt",
-	55:  "getsockopt",
-	56:  "clone",
-	57:  "fork",
-	58:  "vfork",
-	59:  "execve",
-	60:  "exit",
-	61:  "wait4",
-	62:  "kill",
-	63:  "uname",
-	64:  "semget",
-	65:  "semop",
-	66:  "semctl",
-	67:  "shmdt",
-	68:  "msgget",
-	69:  "msgsnd",
-	70:  "msgrcv",
-	71:  "msgctl",
-	72:  "fcntl",
-	73:  "flock",
-	74:  "fsync",
-	75:  "fdatasync",
-	76:  "truncate",
-	77:  "ftruncate",
-	78:  "getdents",
-	79:  "getcwd",
-	80:  "chdir",
-	81:  "fchdir",
-	82:  "rename",
-	83:  "mkdir",
-	84:  "rmdir",
-	85:  "creat",
-	86:  "link",
-	87:  "unlink",
-	88:  "symlink",
-	89:  "readlink",
-	90:  "chmod",
-	91:  "fchmod",
-	92:  "chown",
-	93:  "fchown",
-	94:  "lchown",
-	95:  "umask",
-	96:  "gettimeofday",
-	97:  "getrlimit",
-	98:  "getrusage",
-	99:  "sysinfo",
-	100: "times",
-	101: "ptrace",
-	102: "getuid",
-	103: "syslog",
-	104: "getgid",
-	105: "setuid",
-	106: "setgid",
-	107: "geteuid",
-	108: "getegid",
-	109: "setpgid",
-	110: "getppid",
-	111: "getpgrp",
-	112: "setsid",
-	113: "setreuid",
-	114: "setregid",
-	115: "getgroups",
-	116: "setgroups",
-	117: "setresuid",
-	118: "getresuid",
-	119: "setresgid",
-	120: "getresgid",
-	121: "getpgid",
-	122: "setfsuid",
-	123: "setfsgid",
-	124: "getsid",
-	125: "capget",
-	126: "capset",
-	127: "rt_sigpending",
-	128: "rt_sigtimedwait",
-	129: "rt_sigqueueinfo",
-	130: "rt_sigsuspend",
-	131: "sigaltstack",
-	132: "utime",
-	133: "mknod",
-	134: "uselib",
-	135: "personality",
-	136: "ustat",
-	137: "statfs",
-	138: "fstatfs",
-	139: "sysfs",
-	140: "getpriority",
-	141: "setpriority",
-	142: "sched_setparam",
-	143: "sched_getparam",
-	144: "sched_setscheduler",
-	145: "sched_getscheduler",
-	146: "sched_get_priority_max",
-	147: "sched_get_priority_min",
-	148: "sched_rr_get_interval",
-	149: "mlock",
-	150: "munlock",
-	151: "mlockall",
-	152: "munlockall",
-	153: "vhangup",
-	154: "modify_ldt",
-	155: "pivot_root",
-	156: "_sysctl",
-	157: "prctl",
-	158: "arch_prctl",
-	159: "adjtimex",
-	160: "setrlimit",
-	161: "chroot",
-	162: "sync",
-	163: "acct",
-	164: "settimeofday",
-	165: "mount",
-	166: "umount2",
-	167: "swapon",
-	168: "swapoff",
-	169: "reboot",
-	170: "sethostname",
-	171: "setdomainname",
-	172: "iopl",
-	173: "ioperm",
-	174: "create_module",
-	175: "init_module",
-	176: "delete_module",
-	177: "get_kernel_syms",
-	178: "query_module",
-	179: "quotactl",
-	180: "nfsservctl",
-	181: "getpmsg",
-	182: "putpmsg",
-	183: "afs_syscall",
-	184: "tuxcall",
-	185: "security",
-	186: "gettid",
-	187: "readahead",
-	188: "setxattr",
-	189: "lsetxattr",
-	190: "fsetxattr",
-	191: "getxattr",
-	192: "lgetxattr",
-	193: "fgetxattr",
-	194: "listxattr",
-	195: "llistxattr",
-	196: "flistxattr",
-	197: "removexattr",
-	198: "lremovexattr",
-	199: "fremovexattr",
-	200: "tkill",
-	201: "time",
-	202: "futex",
-	203: "sched_setaffinity",
-	204: "sched_getaffinity",
-	205: "set_thread_area",
-	206: "io_setup",
-	207: "io_destroy",
-	208: "io_getevents",
-	209: "io_submit",
-	210: "io_cancel",
-	211: "get_thread_area",
-	212: "lookup_dcookie",
-	213: "epoll_create",
-	214: "epoll_ctl_old",
-	215: "epoll_wait_old",
-	216: "remap_file_pages",
-	217: "getdents64",
-	218: "set_tid_address",
-	219: "restart_syscall",
-	220: "semtimedop",
-	221: "fadvise64",
-	222: "timer_create",
-	223: "timer_settime",
-	224: "timer_gettime",
-	225: "timer_getoverrun",
-	226: "timer_delete",
-	227: "clock_settime",
-	228: "clock_gettime",
-	229: "clock_getres",
-	230: "clock_nanosleep",
-	231: "exit_group",
-	232: "epoll_wait",
-	233: "epoll_ctl",
-	234: "tgkill",
-	235: "utimes",
-	236: "vserver",
-	237: "mbind",
-	238: "set_mempolicy",
-	239: "get_mempolicy",
-	240: "mq_open",
-	241: "mq_unlink",
-	242: "mq_timedsend",
-	243: "mq_timedreceive",
-	244: "mq_notify",
-	245: "mq_getsetattr",
-	246: "kexec_load",
-	247: "waitid",
-	248: "add_key",
-	249: "request_key",
-	250: "keyctl",
-	251: "ioprio_set",
-	252: "ioprio_get",
-	253: "inotify_init",
-	254: "inotify_add_watch",
-	255: "inotify_rm_watch",
-	256: "migrate_pages",
-	257: "openat",
-	258: "mkdirat",
-	259: "mknodat",
-	260: "fchownat",
-	261: "futimesat",
-	262: "newfstatat",
-	263: "unlinkat",
-	264: "renameat",
-	265: "linkat",
-	266: "symlinkat",
-	267: "readlinkat",
-	268: "fchmodat",
-	269: "faccessat",
-	270: "pselect6",
-	271: "ppoll",
-	272: "unshare",
-	273: "set_robust_list",
-	274: "get_robust_list",
-	275: "splice",
-	276: "tee",
-	277: "sync_file_range",
-	278: "vmsplice",
-	279: "move_pages",
-	280: "utimensat",
-	281: "epoll_pwait",
-	282: "signalfd",
-	283: "timerfd_create",
-	284: "eventfd",
-	285: "fallocate",
-	286: "timerfd_settime",
-	287: "timerfd_gettime",
-	288: "accept4",
-	289: "signalfd4",
-	290: "eventfd2",
-	291: "epoll_create1",
-	292: "dup3",
-	293: "pipe2",
-	294: "inotify_init1",
-	295: "preadv",
-	296: "pwritev",
-	297: "rt_tgsigqueueinfo",
-	298: "perf_event_open",
-	299: "recvmmsg",
-	300: "fanotify_init",
-	301: "fanotify_mark",
-	302: "prlimit64",
-	303: "name_to_handle_at",
-	304: "open_by_handle_at",
-	305: "clock_adjtime",
-	306: "syncfs",
-	307: "sendmmsg",
-	308: "setns",
-	309: "getcpu",
-	310: "process_vm_readv",
-	311: "process_vm_writev",
-	312: "kcmp",
-	313: "finit_module",
-	314: "sched_setattr",
-	315: "sched_getattr",
-	316: "renameat2",
-	317: "seccomp",
-	318: "getrandom",
-	319: "memfd_create",
-	320: "kexec_file_load",
-	321: "bpf",
-	322: "execveat",
-	323: "userfaultfd",
-	324: "membarrier",
-	325: "mlock2",
-	326: "copy_file_range",
-	327: "preadv2",
-	328: "pwritev2",
-	329: "pkey_mprotect",
-	330: "pkey_alloc",
-	331: "pkey_free",
-	332: "statx",
-	333: "io_pgetevents",
-	334: "rseq",
-	424: "pidfd_send_signal",
-	425: "io_uring_setup",
-	426: "io_uring_enter",
-	427: "io_uring_register",
-	428: "open_tree",
-	429: "move_mount",
-	430: "fsopen",
-	431: "fsconfig",
-	432: "fsmount",
-	433: "fspick",
-	434: "pidfd_open",
-	435: "clone3",
-	436: "close_range",
-	437: "openat2",
-	438: "pidfd_getfd",
-	439: "faccessat2",
-	440: "process_madvise",
-	441: "epoll_pwait2",
-	442: "mount_setattr",
-	444: "landlock_create_ruleset",
-	445: "landlock_add_rule",
-	446: "landlock_restrict_self",
-	512: "rt_sigaction",
-	513: "rt_sigreturn",
-	514: "ioctl",
-	515: "readv",
-	516: "writev",
-	517: "recvfrom",
-	518: "sendmsg",
-	519: "recvmsg",
-	520: "execve",
-	521: "ptrace",
-	522: "rt_sigpending",
-	523: "rt_sigtimedwait",
-	524: "rt_sigqueueinfo",
-	525: "sigaltstack",
-	526: "timer_create",
-	527: "mq_notify",
-	528: "kexec_load",
-	529: "waitid",
-	530: "set_robust_list",
-	531: "get_robust_list",
-	532: "vmsplice",
-	533: "move_pages",
-	534: "preadv",
-	535: "pwritev",
-	536: "rt_tgsigqueueinfo",
-	537: "recvmmsg",
-	538: "sendmmsg",
-	539: "process_vm_readv",
-	540: "process_vm_writev",
-	541: "setsockopt",
-	542: "getsockopt",
-	543: "io_setup",
-	544: "io_submit",
-	545: "execveat",
-	546: "preadv2",
-	547: "pwritev2",
-}
diff --git a/internal/pkg/daemon/enricher/syscall_arm64.go b/internal/pkg/daemon/enricher/syscall_arm64.go
deleted file mode 100644
index f388d4eef..000000000
--- a/internal/pkg/daemon/enricher/syscall_arm64.go
+++ /dev/null
@@ -1,291 +0,0 @@
-// +build arm64
-
-/*
-Copyright 2021 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package enricher
-
-// List of arm64 syscalls
-// Source: https://github.com/golang/go/blob/go1.16.6/src/syscall/zsysnum_linux_arm64.go
-var systemCalls = map[int]string{
-	0:   "io_setup",
-	1:   "io_destroy",
-	2:   "io_submit",
-	3:   "io_cancel",
-	4:   "io_getevents",
-	5:   "setxattr",
-	6:   "lsetxattr",
-	7:   "fsetxattr",
-	8:   "getxattr",
-	9:   "lgetxattr",
-	10:  "fgetxattr",
-	11:  "listxattr",
-	12:  "llistxattr",
-	13:  "flistxattr",
-	14:  "removexattr",
-	15:  "lremovexattr",
-	16:  "fremovexattr",
-	17:  "getcwd",
-	18:  "lookup_dcookie",
-	19:  "eventfd2",
-	20:  "epoll_create1",
-	21:  "epoll_ctl",
-	22:  "epoll_pwait",
-	23:  "dup",
-	24:  "dup3",
-	25:  "fcntl",
-	26:  "inotify_init1",
-	27:  "inotify_add_watch",
-	28:  "inotify_rm_watch",
-	29:  "ioctl",
-	30:  "ioprio_set",
-	31:  "ioprio_get",
-	32:  "flock",
-	33:  "mknodat",
-	34:  "mkdirat",
-	35:  "unlinkat",
-	36:  "symlinkat",
-	37:  "linkat",
-	38:  "renameat",
-	39:  "umount2",
-	40:  "mount",
-	41:  "pivot_root",
-	42:  "nfsservctl",
-	43:  "statfs",
-	44:  "fstatfs",
-	45:  "truncate",
-	46:  "ftruncate",
-	47:  "fallocate",
-	48:  "faccessat",
-	49:  "chdir",
-	50:  "fchdir",
-	51:  "chroot",
-	52:  "fchmod",
-	53:  "fchmodat",
-	54:  "fchownat",
-	55:  "fchown",
-	56:  "openat",
-	57:  "close",
-	58:  "vhangup",
-	59:  "pipe2",
-	60:  "quotactl",
-	61:  "getdents64",
-	62:  "lseek",
-	63:  "read",
-	64:  "write",
-	65:  "readv",
-	66:  "writev",
-	67:  "pread64",
-	68:  "pwrite64",
-	69:  "preadv",
-	70:  "pwritev",
-	71:  "sendfile",
-	72:  "pselect6",
-	73:  "ppoll",
-	74:  "signalfd4",
-	75:  "vmsplice",
-	76:  "splice",
-	77:  "tee",
-	78:  "readlinkat",
-	79:  "fstatat",
-	80:  "fstat",
-	81:  "sync",
-	82:  "fsync",
-	83:  "fdatasync",
-	84:  "sync_file_range",
-	85:  "timerfd_create",
-	86:  "timerfd_settime",
-	87:  "timerfd_gettime",
-	88:  "utimensat",
-	89:  "acct",
-	90:  "capget",
-	91:  "capset",
-	92:  "personality",
-	93:  "exit",
-	94:  "exit_group",
-	95:  "waitid",
-	96:  "set_tid_address",
-	97:  "unshare",
-	98:  "futex",
-	99:  "set_robust_list",
-	100: "get_robust_list",
-	101: "nanosleep",
-	102: "getitimer",
-	103: "setitimer",
-	104: "kexec_load",
-	105: "init_module",
-	106: "delete_module",
-	107: "timer_create",
-	108: "timer_gettime",
-	109: "timer_getoverrun",
-	110: "timer_settime",
-	111: "timer_delete",
-	112: "clock_settime",
-	113: "clock_gettime",
-	114: "clock_getres",
-	115: "clock_nanosleep",
-	116: "syslog",
-	117: "ptrace",
-	118: "sched_setparam",
-	119: "sched_setscheduler",
-	120: "sched_getscheduler",
-	121: "sched_getparam",
-	122: "sched_setaffinity",
-	123: "sched_getaffinity",
-	124: "sched_yield",
-	125: "sched_get_priority_max",
-	126: "sched_get_priority_min",
-	127: "sched_rr_get_interval",
-	128: "restart_syscall",
-	129: "kill",
-	130: "tkill",
-	131: "tgkill",
-	132: "sigaltstack",
-	133: "rt_sigsuspend",
-	134: "rt_sigaction",
-	135: "rt_sigprocmask",
-	136: "rt_sigpending",
-	137: "rt_sigtimedwait",
-	138: "rt_sigqueueinfo",
-	139: "rt_sigreturn",
-	140: "setpriority",
-	141: "getpriority",
-	142: "reboot",
-	143: "setregid",
-	144: "setgid",
-	145: "setreuid",
-	146: "setuid",
-	147: "setresuid",
-	148: "getresuid",
-	149: "setresgid",
-	150: "getresgid",
-	151: "setfsuid",
-	152: "setfsgid",
-	153: "times",
-	154: "setpgid",
-	155: "getpgid",
-	156: "getsid",
-	157: "setsid",
-	158: "getgroups",
-	159: "setgroups",
-	160: "uname",
-	161: "sethostname",
-	162: "setdomainname",
-	163: "getrlimit",
-	164: "setrlimit",
-	165: "getrusage",
-	166: "umask",
-	167: "prctl",
-	168: "getcpu",
-	169: "gettimeofday",
-	170: "settimeofday",
-	171: "adjtimex",
-	172: "getpid",
-	173: "getppid",
-	174: "getuid",
-	175: "geteuid",
-	176: "getgid",
-	177: "getegid",
-	178: "gettid",
-	179: "sysinfo",
-	180: "mq_open",
-	181: "mq_unlink",
-	182: "mq_timedsend",
-	183: "mq_timedreceive",
-	184: "mq_notify",
-	185: "mq_getsetattr",
-	186: "msgget",
-	187: "msgctl",
-	188: "msgrcv",
-	189: "msgsnd",
-	190: "semget",
-	191: "semctl",
-	192: "semtimedop",
-	193: "semop",
-	194: "shmget",
-	195: "shmctl",
-	196: "shmat",
-	197: "shmdt",
-	198: "socket",
-	199: "socketpair",
-	200: "bind",
-	201: "listen",
-	202: "accept",
-	203: "connect",
-	204: "getsockname",
-	205: "getpeername",
-	206: "sendto",
-	207: "recvfrom",
-	208: "setsockopt",
-	209: "getsockopt",
-	210: "shutdown",
-	211: "sendmsg",
-	212: "recvmsg",
-	213: "readahead",
-	214: "brk",
-	215: "munmap",
-	216: "mremap",
-	217: "add_key",
-	218: "request_key",
-	219: "keyctl",
-	220: "clone",
-	221: "execve",
-	222: "mmap",
-	223: "fadvise64",
-	224: "swapon",
-	225: "swapoff",
-	226: "mprotect",
-	227: "msync",
-	228: "mlock",
-	229: "munlock",
-	230: "mlockall",
-	231: "munlockall",
-	232: "mincore",
-	233: "madvise",
-	234: "remap_file_pages",
-	235: "mbind",
-	236: "get_mempolicy",
-	237: "set_mempolicy",
-	238: "migrate_pages",
-	239: "move_pages",
-	240: "rt_tgsigqueueinfo",
-	241: "perf_event_open",
-	242: "accept4",
-	243: "recvmmsg",
-	244: "arch_specific_syscall",
-	260: "wait4",
-	261: "prlimit64",
-	262: "fanotify_init",
-	263: "fanotify_mark",
-	264: "name_to_handle_at",
-	265: "open_by_handle_at",
-	266: "clock_adjtime",
-	267: "syncfs",
-	268: "setns",
-	269: "sendmmsg",
-	270: "process_vm_readv",
-	271: "process_vm_writev",
-	272: "kcmp",
-	273: "finit_module",
-	274: "sched_setattr",
-	275: "sched_getattr",
-	276: "renameat2",
-	277: "seccomp",
-	278: "getrandom",
-	279: "memfd_create",
-	280: "bpf",
-	281: "execveat",
-}
diff --git a/internal/pkg/daemon/enricher/syscall_unsupported.go b/internal/pkg/daemon/enricher/syscall_unsupported.go
new file mode 100644
index 000000000..8b3e962cf
--- /dev/null
+++ b/internal/pkg/daemon/enricher/syscall_unsupported.go
@@ -0,0 +1,28 @@
+// +build !linux
+
+/*
+Copyright 2021 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package enricher
+
+import "errors"
+
+var errUnsupoprtedPlatform = errors.New("unsupoprted platform")
+
+// syscallName returns the syscall name for the provided ID.
+func syscallName(id int32) (string, error) {
+	return "", errUnsupoprtedPlatform
+}
diff --git a/internal/pkg/daemon/enricher/types.go b/internal/pkg/daemon/enricher/types.go
index 332ce4664..62d2daae5 100644
--- a/internal/pkg/daemon/enricher/types.go
+++ b/internal/pkg/daemon/enricher/types.go
@@ -23,7 +23,7 @@ const (
 
 type auditLine struct {
 	processID    int
-	systemCallID int
+	systemCallID int32
 	type_        string
 	timestampID  string
 	executable   string


Test patch:
diff --git a/internal/pkg/daemon/enricher/enricher_test.go b/internal/pkg/daemon/enricher/enricher_test.go
index 517ad8705..524f55163 100644
--- a/internal/pkg/daemon/enricher/enricher_test.go
+++ b/internal/pkg/daemon/enricher/enricher_test.go
@@ -1,3 +1,5 @@
+// +build linux
+
 /*
 Copyright 2021 The Kubernetes Authors.