timerfd_create¶

Intro¶

timerfd_create - creates a file descriptor for use with the timerfd routines.

Description¶

The timerfd_create() system call creates a new timer object and returns a file descriptor that refers to it. The clockid argument specifies the clock that is used to mark the progress of the timer. The flags argument specifies optional creation flags; currently only TFD_CLOEXEC is supported.

Once created, the file descriptor can be used to wait for the expiration of the timer using read(), select(), or poll().

Arguments¶

clockid:int - specifies the clock that is used to mark the progress of the timer.
flags:int[OPT] - specifies optional creation flags; currently only TFD_CLOEXEC is supported.

Available Tags¶

K - Originated from kernel-space.
U - Originated from user space (for example, pointer to user space memory used to get it)
TOCTOU - Vulnerable to TOCTOU (time of check, time of use)
OPT - Optional argument - might not always be available (passed with null value)

Hooks¶

sys_timerfd_create¶

Type¶

KProbe

Purpose¶

To hook the kernel entry point for the timerfd_create system call.

Example Use Case¶

A process that needs to track time at the system level could use this event to create a file descriptor for a timer and use that to track time in the process.

Issues¶

No known issues.

timerfd_settime, timerfd_gettime

This document was automatically generated by OpenAI and needs review. It might not be accurate and might contain errors. The authors of Tracee recommend that the user reads the "events.go" source file to understand the events and their arguments better.