draios/sysdig — pull request #206 by ret2libc (2014-07-10 23:11:09+00:00)
Title: dynamic parameters and ptrace filler

I have implemented a filler for the ptrace syscall. The parameters addr and data can store different kind of values, depending on the request (similar to the optvalue parameter in getsockopt syscall). To handle this kind of parameters i have marked them as PT_DYN and i have modified the ppm_param_info structure to hold extra infos, so that we can store, with the parameter infos, an array of possible kind of parameters that the parameter can actually contain.

The driver store, at the first byte of the packet, the index in the array and then the data depending on the type, as usual. In this way, the userspace part can extract the first byte, understand what kind of parameter to parse(through a lookup in the array associated with the info of the parameter) and then proceeding as usual.

I think in this way we could have a good level of flexibility.

Let me know what you think!