syscall_tracing

What Is Still Missing in System Call Tracing

This repository includes the source code of the examples of the seminar held at FOSDEM 2026.

• ptrace_set_syscall_info_patches: Kernel patches to implement missing features in PTRACE_SET_SYSCALL_INFO.
• ptrace_set_syscall_info_tracer_almost_arch_independent: Proof-of-concept to trace system calls using PTRACE_SET_SYSCALL_INFO.
• seccomp_unotify_patch: Kernel patch to implement two missing features in seccomp unotify.
• syscall_unotify_tracer: Proof-of-concept to trace system calls using seccomp unotify.
• 2025: code for FOSDEM 2025 presentation entitled: "Status and Desiderata for Syscall Tracing and Virtualization Support".