ftruncate64¶

Intro¶

ftruncate64 - Truncate a file to a specified length, 64 bit version.

Description¶

ftruncate64() truncates the given file to a specified length. It should not be assumed that the file offset is maintained or set to zero after a call to ftruncate64(). The specified length can be larger or smaller than the current size of the file, with the latter case causing the file to be truncated. The new size of the file can be obtained using fstat64().

Edge-cases or drawbacks appear mostly if the file is opened in append mode or the file size is greater than the size allowed in the filesystem.

Arguments¶

fd:int - File descriptor for the file to be truncated.
length:off_t - Desired length of the file, after truncation.

Available Tags¶

K - Originated from kernel-space.
U - Originated from user space (for example, pointer to user space memory used to get it)
TOCTOU - Vulnerable to TOCTOU (time of check, time of use)
OPT - Optional argument - might not always be available (passed with null value)

Hooks¶

sys_ftruncate64¶

Type¶

Kprobes

Purpose¶

Observe the behavior of the ftruncate64 syscall.

Example Use Case¶

ftruncate64() could be used to improve performance of a program that reads and writes large chunks of data to the same file, when multiple threads are used for the task. When the thread reading from the file is finished, the file length can be reduced and the other thread will not need to process the extra data, as it will no longer be available.

Issues¶

If the file is opened in append mode, it can lead to unexpected results.

ftruncate() - The same functionality without the 64-bit length support.

This document was automatically generated by OpenAI and needs review. It might not be accurate and might contain errors. The authors of Tracee recommend that the user reads the "events.go" source file to understand the events and their arguments better.