chore(test/drivers): move to use openat2 exit event to test at least …

…an exit event. Signed-off-by: Federico Di Pierro <[email protected]>
falcosecurity · Oct 6, 2023 · 6d35991 · 6d35991
1 parent bdab9cf
commit 6d35991
Showing 1 changed file with 15 additions and 12 deletions.
diff --git a/test/drivers/test_suites/actions_suite/ia32.cpp.in b/test/drivers/test_suites/actions_suite/ia32.cpp.in
@@ -141,7 +141,7 @@ TEST(Actions, ia32_execve_compat)
 #ifdef __NR_openat2
 TEST(Actions, ia32_openat2_e)
 {
-	auto evt_test = get_syscall_event_test(__NR_openat2, ENTER_EVENT);
+	auto evt_test = get_syscall_event_test(__NR_openat2, EXIT_EVENT);
 
 	evt_test->enable_capture();
 
@@ -180,24 +180,27 @@ TEST(Actions, ia32_openat2_e)
 
   /*=============================== ASSERT PARAMETERS  ===========================*/
 
-  /* Parameter 1: dirfd (type: PT_FD) */
-  evt_test->assert_numeric_param(1, (int64_t)11);
+  /* Parameter 1: fd (type: PT_FD) */
+  evt_test->assert_numeric_param(1, (int64_t)-EBADF);
 
- 	/* Parameter 2: name (type: PT_FSPATH) */
- 	evt_test->assert_charbuf_param(2, "mock_path");
+  /* Parameter 2: dirfd (type: PT_FD) */
+  evt_test->assert_numeric_param(2, (int64_t)11);
 
-  /* Parameter 3: flags (type: PT_FLAGS32) */
-	evt_test->assert_numeric_param(3, (uint32_t)PPM_O_RDWR);
+  	/* Parameter 3: name (type: PT_FSPATH) */
+  	evt_test->assert_charbuf_param(3, "mock_path");
 
-	/* Parameter 4: mode (type: PT_UINT32) */
-	evt_test->assert_numeric_param(4, (uint32_t)0);
+  	/* Parameter 4: flags (type: PT_FLAGS32) */
+  	evt_test->assert_numeric_param(4, (uint32_t)PPM_O_RDWR);
 
-	/* Parameter 5: resolve (type: PT_FLAGS32) */
-	evt_test->assert_numeric_param(5, (uint32_t)PPM_RESOLVE_BENEATH | PPM_RESOLVE_NO_MAGICLINKS);
+  	/* Parameter 5: mode (type: PT_UINT32) */
+  	evt_test->assert_numeric_param(5, (uint32_t)0);
+
+  	/* Parameter 6: resolve (type: PT_FLAGS32) */
+  	evt_test->assert_numeric_param(6, (uint32_t)PPM_RESOLVE_BENEATH | PPM_RESOLVE_NO_MAGICLINKS);
 
  	/*=============================== ASSERT PARAMETERS  ===========================*/
 
- 	evt_test->assert_num_params_pushed(5);
+ 	evt_test->assert_num_params_pushed(6);
 }
 #endif