Skip to content

Conversation

@zestrada
Copy link
Collaborator

@zestrada zestrada commented Dec 8, 2025

This PR adds the ability to unregister syscall hooks and adds a unit test for the same.

@zestrada zestrada requested a review from Copilot December 8, 2025 22:54
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR adds the ability to unregister syscall hooks at runtime, enabling dynamic control over which syscalls are being monitored. The implementation adds a new unregister_syscall_hook method to the Syscalls API and includes comprehensive testing to verify that hooks can be successfully unregistered and that subsequent syscalls no longer trigger the unregistered hook.

Key changes:

  • Added unregister_syscall_hook method to clean up registered syscall hooks
  • Updated test infrastructure to verify unregistration behavior (expecting exactly 1 getpid hook call before unregistration)
  • Removed unused _name_to_hook_ptr dictionary tracking
  • Bumped IGLOO_DRIVER_VERSION to 0.0.30 to support the new unregistration functionality

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

File Description
pyplugins/apis/syscalls.py Added unregister_syscall_hook method and removed unused _name_to_hook_ptr tracking; updated type imports
pyplugins/testing/syscall_test.py Added test logic for hook unregistration, storing hook reference and verifying it's only called once
tests/unit_tests/test_target/patches/tests/syscall.yaml Added test expectation for unregister functionality and second getpid call to verify hook is inactive
Dockerfile Bumped IGLOO_DRIVER_VERSION to 0.0.30; removed trailing whitespace

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment on lines +1001 to +1002
bool
True if unregistered successfully, False otherwise.
Copy link

Copilot AI Dec 8, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The docstring documents the return type as bool, but the function signature declares it as Generator[bool, None, None]. These should be consistent. Since the function uses yield from, it returns a generator that yields a boolean value. The docstring should reflect this:

Returns
-------
Generator[bool, None, None]
    A generator that yields True if unregistered successfully, False otherwise.
Suggested change
bool
True if unregistered successfully, False otherwise.
Generator[bool, None, None]
A generator that yields True if unregistered successfully, False otherwise.

Copilot uses AI. Check for mistakes.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants