// SPDX-License-Identifier: Apache-2.0
/*
Copyright (C) 2023 The Falco Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.

*/

#include <libscap/scap.h>
#include <libscap/scap-int.h>
#include <string.h>

/*
 * When adding a new event, a new line should be added with the list of ppm_sc codes mapping that
 * event. Events that are not mapped to any ppm_sc (ie: "container", "useradded"..., have NULL
 * entries.
 *
 * If adding a specific event mapping an existing generic event, remember to
 * remove the generic events from the first 2 lines.
 *
 * NOTE: first 2 lines are automatically bumped by syscalls-bumper.
 */
static const ppm_sc_code *g_events_to_sc_map[] = {
        [PPME_GENERIC_E] = (ppm_sc_code[]){PPM_SC_RESTART_SYSCALL,
                                           PPM_SC_EXIT,
                                           PPM_SC_TIME,
                                           PPM_SC_GETPID,
                                           PPM_SC_SYNC,
                                           PPM_SC_TIMES,
                                           PPM_SC_ACCT,
                                           PPM_SC_UMASK,
                                           PPM_SC_USTAT,
                                           PPM_SC_GETPPID,
                                           PPM_SC_GETPGRP,
                                           PPM_SC_SETHOSTNAME,
                                           PPM_SC_GETRUSAGE,
                                           PPM_SC_GETTIMEOFDAY,
                                           PPM_SC_SETTIMEOFDAY,
                                           PPM_SC_READLINK,
                                           PPM_SC_SWAPON,
                                           PPM_SC_REBOOT,
                                           PPM_SC_TRUNCATE,
                                           PPM_SC_FTRUNCATE,
                                           PPM_SC_GETPRIORITY,
                                           PPM_SC_SETPRIORITY,
                                           PPM_SC_STATFS,
                                           PPM_SC_FSTATFS,
                                           PPM_SC_SETITIMER,
                                           PPM_SC_GETITIMER,
                                           PPM_SC_UNAME,
                                           PPM_SC_VHANGUP,
                                           PPM_SC_WAIT4,
                                           PPM_SC_SWAPOFF,
                                           PPM_SC_SYSINFO,
                                           PPM_SC_FSYNC,
                                           PPM_SC_SETDOMAINNAME,
                                           PPM_SC_ADJTIMEX,
                                           PPM_SC_GETPGID,
                                           PPM_SC_SYSFS,
                                           PPM_SC_PERSONALITY,
                                           PPM_SC_MSYNC,
                                           PPM_SC_GETSID,
                                           PPM_SC_FDATASYNC,
                                           PPM_SC_SCHED_SETSCHEDULER,
                                           PPM_SC_SCHED_GETSCHEDULER,
                                           PPM_SC_SCHED_YIELD,
                                           PPM_SC_SCHED_GET_PRIORITY_MAX,
                                           PPM_SC_SCHED_GET_PRIORITY_MIN,
                                           PPM_SC_SCHED_RR_GET_INTERVAL,
                                           PPM_SC_MREMAP,
                                           PPM_SC_ARCH_PRCTL,
                                           PPM_SC_RT_SIGACTION,
                                           PPM_SC_RT_SIGPROCMASK,
                                           PPM_SC_RT_SIGPENDING,
                                           PPM_SC_RT_SIGTIMEDWAIT,
                                           PPM_SC_RT_SIGQUEUEINFO,
                                           PPM_SC_RT_SIGSUSPEND,
                                           PPM_SC_CAPGET,
                                           PPM_SC_GETGROUPS,
                                           PPM_SC_SETGROUPS,
                                           PPM_SC_SETFSUID,
                                           PPM_SC_SETFSGID,
                                           PPM_SC_PIVOT_ROOT,
                                           PPM_SC_MINCORE,
                                           PPM_SC_MADVISE,
                                           PPM_SC_GETTID,
                                           PPM_SC_SETXATTR,
                                           PPM_SC_LSETXATTR,
                                           PPM_SC_FSETXATTR,
                                           PPM_SC_GETXATTR,
                                           PPM_SC_LGETXATTR,
                                           PPM_SC_FGETXATTR,
                                           PPM_SC_LISTXATTR,
                                           PPM_SC_LLISTXATTR,
                                           PPM_SC_FLISTXATTR,
                                           PPM_SC_REMOVEXATTR,
                                           PPM_SC_LREMOVEXATTR,
                                           PPM_SC_FREMOVEXATTR,
                                           PPM_SC_SCHED_SETAFFINITY,
                                           PPM_SC_SCHED_GETAFFINITY,
                                           PPM_SC_SET_THREAD_AREA,
                                           PPM_SC_GET_THREAD_AREA,
                                           PPM_SC_IO_SETUP,
                                           PPM_SC_IO_DESTROY,
                                           PPM_SC_IO_GETEVENTS,
                                           PPM_SC_IO_SUBMIT,
                                           PPM_SC_IO_CANCEL,
                                           PPM_SC_EXIT_GROUP,
                                           PPM_SC_REMAP_FILE_PAGES,
                                           PPM_SC_SET_TID_ADDRESS,
                                           PPM_SC_TIMER_CREATE,
                                           PPM_SC_TIMER_SETTIME,
                                           PPM_SC_TIMER_GETTIME,
                                           PPM_SC_TIMER_GETOVERRUN,
                                           PPM_SC_TIMER_DELETE,
                                           PPM_SC_CLOCK_SETTIME,
                                           PPM_SC_CLOCK_GETTIME,
                                           PPM_SC_CLOCK_GETRES,
                                           PPM_SC_CLOCK_NANOSLEEP,
                                           PPM_SC_UTIMES,
                                           PPM_SC_MQ_OPEN,
                                           PPM_SC_MQ_UNLINK,
                                           PPM_SC_MQ_TIMEDSEND,
                                           PPM_SC_MQ_TIMEDRECEIVE,
                                           PPM_SC_MQ_NOTIFY,
                                           PPM_SC_MQ_GETSETATTR,
                                           PPM_SC_KEXEC_LOAD,
                                           PPM_SC_WAITID,
                                           PPM_SC_ADD_KEY,
                                           PPM_SC_REQUEST_KEY,
                                           PPM_SC_KEYCTL,
                                           PPM_SC_IOPRIO_SET,
                                           PPM_SC_IOPRIO_GET,
                                           PPM_SC_INOTIFY_ADD_WATCH,
                                           PPM_SC_INOTIFY_RM_WATCH,
                                           PPM_SC_FUTIMESAT,
                                           PPM_SC_READLINKAT,
                                           PPM_SC_FACCESSAT,
                                           PPM_SC_SET_ROBUST_LIST,
                                           PPM_SC_GET_ROBUST_LIST,
                                           PPM_SC_TEE,
                                           PPM_SC_VMSPLICE,
                                           PPM_SC_GETCPU,
                                           PPM_SC_EPOLL_PWAIT,
                                           PPM_SC_UTIMENSAT,
                                           PPM_SC_TIMERFD_SETTIME,
                                           PPM_SC_TIMERFD_GETTIME,
                                           PPM_SC_RT_TGSIGQUEUEINFO,
                                           PPM_SC_PERF_EVENT_OPEN,
                                           PPM_SC_FANOTIFY_INIT,
                                           PPM_SC_CLOCK_ADJTIME,
                                           PPM_SC_SYNCFS,
                                           PPM_SC_MSGSND,
                                           PPM_SC_MSGRCV,
                                           PPM_SC_MSGGET,
                                           PPM_SC_MSGCTL,
                                           PPM_SC_SHMDT,
                                           PPM_SC_SHMGET,
                                           PPM_SC_SHMCTL,
                                           PPM_SC_STATFS64,
                                           PPM_SC_FSTATFS64,
                                           PPM_SC_FSTATAT64,
                                           PPM_SC_BDFLUSH,
                                           PPM_SC_SIGPROCMASK,
                                           PPM_SC_IPC,
                                           PPM_SC__NEWSELECT,
                                           PPM_SC_SGETMASK,
                                           PPM_SC_SSETMASK,
                                           PPM_SC_SIGPENDING,
                                           PPM_SC_OLDUNAME,
                                           PPM_SC_SIGNAL,
                                           PPM_SC_NICE,
                                           PPM_SC_STIME,
                                           PPM_SC_WAITPID,
                                           PPM_SC_SHMAT,
                                           PPM_SC_RT_SIGRETURN,
                                           PPM_SC_FALLOCATE,
                                           PPM_SC_SIGALTSTACK,
                                           PPM_SC_GETRANDOM,
                                           PPM_SC_FADVISE64,
                                           PPM_SC_SOCKETCALL,
                                           PPM_SC_FSPICK,
                                           PPM_SC_FSMOUNT,
                                           PPM_SC_FSOPEN,
                                           PPM_SC_OPEN_TREE,
                                           PPM_SC_MOVE_MOUNT,
                                           PPM_SC_MOUNT_SETATTR,
                                           PPM_SC_MEMFD_SECRET,
                                           PPM_SC_IOPERM,
                                           PPM_SC_KEXEC_FILE_LOAD,
                                           PPM_SC_PIDFD_SEND_SIGNAL,
                                           PPM_SC_PKEY_ALLOC,
                                           PPM_SC_PKEY_MPROTECT,
                                           PPM_SC_PKEY_FREE,
                                           PPM_SC_LANDLOCK_CREATE_RULESET,
                                           PPM_SC_QUOTACTL_FD,
                                           PPM_SC_LANDLOCK_RESTRICT_SELF,
                                           PPM_SC_LANDLOCK_ADD_RULE,
                                           PPM_SC_EPOLL_PWAIT2,
                                           PPM_SC_MIGRATE_PAGES,
                                           PPM_SC_MOVE_PAGES,
                                           PPM_SC_PREADV2,
                                           PPM_SC_PWRITEV2,
                                           PPM_SC_QUERY_MODULE,
                                           PPM_SC_STATX,
                                           PPM_SC_SET_MEMPOLICY,
                                           PPM_SC_FANOTIFY_MARK,
                                           PPM_SC_SYNC_FILE_RANGE,
                                           PPM_SC_READAHEAD,
                                           PPM_SC_PROCESS_MRELEASE,
                                           PPM_SC_MBIND,
                                           PPM_SC_PROCESS_MADVISE,
                                           PPM_SC_MEMBARRIER,
                                           PPM_SC_MODIFY_LDT,
                                           PPM_SC_SEMTIMEDOP,
                                           PPM_SC_NAME_TO_HANDLE_AT,
                                           PPM_SC_KCMP,
                                           PPM_SC_EPOLL_CTL_OLD,
                                           PPM_SC_EPOLL_WAIT_OLD,
                                           PPM_SC_FUTEX_WAITV,
                                           PPM_SC_CREATE_MODULE,
                                           PPM_SC__SYSCTL,
                                           PPM_SC_LOOKUP_DCOOKIE,
                                           PPM_SC_IOPL,
                                           PPM_SC_IO_PGETEVENTS,
                                           PPM_SC_GETPMSG,
                                           PPM_SC_SCHED_SETATTR,
                                           PPM_SC_GET_KERNEL_SYMS,
                                           PPM_SC_RSEQ,
                                           PPM_SC_CLOSE_RANGE,
                                           PPM_SC_GET_MEMPOLICY,
                                           PPM_SC_SCHED_GETATTR,
                                           PPM_SC_NFSSERVCTL,
                                           PPM_SC_SET_MEMPOLICY_HOME_NODE,
                                           PPM_SC_FACCESSAT2,
                                           PPM_SC_EPOLL_CTL,
                                           PPM_SC_SCHED_GETPARAM,
                                           PPM_SC_PSELECT6,
                                           PPM_SC_SCHED_SETPARAM,
                                           PPM_SC_PAUSE,
                                           PPM_SC_UTIME,
                                           PPM_SC_SYSLOG,
                                           PPM_SC_USELIB,
                                           PPM_SC_ALARM,
                                           PPM_SC_SIGSUSPEND,
                                           PPM_SC_IDLE,
                                           PPM_SC_S390_RUNTIME_INSTR,
                                           PPM_SC_SIGRETURN,
                                           PPM_SC_S390_GUARDED_STORAGE,
                                           PPM_SC_TIMERFD,
                                           PPM_SC_S390_PCI_MMIO_READ,
                                           PPM_SC_SIGACTION,
                                           PPM_SC_S390_PCI_MMIO_WRITE,
                                           PPM_SC_READDIR,
                                           PPM_SC_S390_STHYI,
                                           PPM_SC_CACHESTAT,
                                           PPM_SC_FCHMODAT2,
                                           PPM_SC_MAP_SHADOW_STACK,
                                           PPM_SC_RISCV_FLUSH_ICACHE,
                                           PPM_SC_RISCV_HWPROBE,
                                           PPM_SC_FUTEX_WAKE,
                                           PPM_SC_FUTEX_REQUEUE,
                                           PPM_SC_FUTEX_WAIT,
                                           PPM_SC_SYNC_FILE_RANGE2,
                                           PPM_SC_OLDFSTAT,
                                           PPM_SC_SPU_RUN,
                                           PPM_SC_SWAPCONTEXT,
                                           PPM_SC_OLDLSTAT,
                                           PPM_SC_SPU_CREATE,
                                           PPM_SC_PCICONFIG_READ,
                                           PPM_SC_SYS_DEBUG_SETCONTEXT,
                                           PPM_SC_VM86,
                                           PPM_SC_PCICONFIG_WRITE,
                                           PPM_SC_RTAS,
                                           PPM_SC_PCICONFIG_IOBASE,
                                           PPM_SC_OLDOLDUNAME,
                                           PPM_SC_SUBPAGE_PROT,
                                           PPM_SC_MULTIPLEXER,
                                           PPM_SC_OLDSTAT,
                                           PPM_SC_SWITCH_ENDIAN,
                                           PPM_SC_LISTMOUNT,
                                           PPM_SC_STATMOUNT,
                                           PPM_SC_LSM_GET_SELF_ATTR,
                                           PPM_SC_LSM_SET_SELF_ATTR,
                                           PPM_SC_LSM_LIST_MODULES,
                                           PPM_SC_MSEAL,
                                           PPM_SC_URETPROBE,
                                           PPM_SC_REMOVEXATTRAT,
                                           PPM_SC_LISTXATTRAT,
                                           PPM_SC_GETXATTRAT,
                                           PPM_SC_SETXATTRAT,
                                           PPM_SC_OPEN_TREE_ATTR,
                                           PPM_SC_FILE_GETATTR,
                                           PPM_SC_FILE_SETATTR,
                                           -1},
        [PPME_GENERIC_X] = (ppm_sc_code[]){PPM_SC_RESTART_SYSCALL,
                                           PPM_SC_EXIT,
                                           PPM_SC_TIME,
                                           PPM_SC_GETPID,
                                           PPM_SC_SYNC,
                                           PPM_SC_TIMES,
                                           PPM_SC_ACCT,
                                           PPM_SC_UMASK,
                                           PPM_SC_USTAT,
                                           PPM_SC_GETPPID,
                                           PPM_SC_GETPGRP,
                                           PPM_SC_SETHOSTNAME,
                                           PPM_SC_GETRUSAGE,
                                           PPM_SC_GETTIMEOFDAY,
                                           PPM_SC_SETTIMEOFDAY,
                                           PPM_SC_READLINK,
                                           PPM_SC_SWAPON,
                                           PPM_SC_REBOOT,
                                           PPM_SC_TRUNCATE,
                                           PPM_SC_FTRUNCATE,
                                           PPM_SC_GETPRIORITY,
                                           PPM_SC_SETPRIORITY,
                                           PPM_SC_STATFS,
                                           PPM_SC_FSTATFS,
                                           PPM_SC_SETITIMER,
                                           PPM_SC_GETITIMER,
                                           PPM_SC_UNAME,
                                           PPM_SC_VHANGUP,
                                           PPM_SC_WAIT4,
                                           PPM_SC_SWAPOFF,
                                           PPM_SC_SYSINFO,
                                           PPM_SC_FSYNC,
                                           PPM_SC_SETDOMAINNAME,
                                           PPM_SC_ADJTIMEX,
                                           PPM_SC_GETPGID,
                                           PPM_SC_SYSFS,
                                           PPM_SC_PERSONALITY,
                                           PPM_SC_MSYNC,
                                           PPM_SC_GETSID,
                                           PPM_SC_FDATASYNC,
                                           PPM_SC_SCHED_SETSCHEDULER,
                                           PPM_SC_SCHED_GETSCHEDULER,
                                           PPM_SC_SCHED_YIELD,
                                           PPM_SC_SCHED_GET_PRIORITY_MAX,
                                           PPM_SC_SCHED_GET_PRIORITY_MIN,
                                           PPM_SC_SCHED_RR_GET_INTERVAL,
                                           PPM_SC_MREMAP,
                                           PPM_SC_ARCH_PRCTL,
                                           PPM_SC_RT_SIGACTION,
                                           PPM_SC_RT_SIGPROCMASK,
                                           PPM_SC_RT_SIGPENDING,
                                           PPM_SC_RT_SIGTIMEDWAIT,
                                           PPM_SC_RT_SIGQUEUEINFO,
                                           PPM_SC_RT_SIGSUSPEND,
                                           PPM_SC_CAPGET,
                                           PPM_SC_GETGROUPS,
                                           PPM_SC_SETGROUPS,
                                           PPM_SC_SETFSUID,
                                           PPM_SC_SETFSGID,
                                           PPM_SC_PIVOT_ROOT,
                                           PPM_SC_MINCORE,
                                           PPM_SC_MADVISE,
                                           PPM_SC_GETTID,
                                           PPM_SC_SETXATTR,
                                           PPM_SC_LSETXATTR,
                                           PPM_SC_FSETXATTR,
                                           PPM_SC_GETXATTR,
                                           PPM_SC_LGETXATTR,
                                           PPM_SC_FGETXATTR,
                                           PPM_SC_LISTXATTR,
                                           PPM_SC_LLISTXATTR,
                                           PPM_SC_FLISTXATTR,
                                           PPM_SC_REMOVEXATTR,
                                           PPM_SC_LREMOVEXATTR,
                                           PPM_SC_FREMOVEXATTR,
                                           PPM_SC_SCHED_SETAFFINITY,
                                           PPM_SC_SCHED_GETAFFINITY,
                                           PPM_SC_SET_THREAD_AREA,
                                           PPM_SC_GET_THREAD_AREA,
                                           PPM_SC_IO_SETUP,
                                           PPM_SC_IO_DESTROY,
                                           PPM_SC_IO_GETEVENTS,
                                           PPM_SC_IO_SUBMIT,
                                           PPM_SC_IO_CANCEL,
                                           PPM_SC_EXIT_GROUP,
                                           PPM_SC_REMAP_FILE_PAGES,
                                           PPM_SC_SET_TID_ADDRESS,
                                           PPM_SC_TIMER_CREATE,
                                           PPM_SC_TIMER_SETTIME,
                                           PPM_SC_TIMER_GETTIME,
                                           PPM_SC_TIMER_GETOVERRUN,
                                           PPM_SC_TIMER_DELETE,
                                           PPM_SC_CLOCK_SETTIME,
                                           PPM_SC_CLOCK_GETTIME,
                                           PPM_SC_CLOCK_GETRES,
                                           PPM_SC_CLOCK_NANOSLEEP,
                                           PPM_SC_UTIMES,
                                           PPM_SC_MQ_OPEN,
                                           PPM_SC_MQ_UNLINK,
                                           PPM_SC_MQ_TIMEDSEND,
                                           PPM_SC_MQ_TIMEDRECEIVE,
                                           PPM_SC_MQ_NOTIFY,
                                           PPM_SC_MQ_GETSETATTR,
                                           PPM_SC_KEXEC_LOAD,
                                           PPM_SC_WAITID,
                                           PPM_SC_ADD_KEY,
                                           PPM_SC_REQUEST_KEY,
                                           PPM_SC_KEYCTL,
                                           PPM_SC_IOPRIO_SET,
                                           PPM_SC_IOPRIO_GET,
                                           PPM_SC_INOTIFY_ADD_WATCH,
                                           PPM_SC_INOTIFY_RM_WATCH,
                                           PPM_SC_FUTIMESAT,
                                           PPM_SC_READLINKAT,
                                           PPM_SC_FACCESSAT,
                                           PPM_SC_SET_ROBUST_LIST,
                                           PPM_SC_GET_ROBUST_LIST,
                                           PPM_SC_TEE,
                                           PPM_SC_VMSPLICE,
                                           PPM_SC_GETCPU,
                                           PPM_SC_EPOLL_PWAIT,
                                           PPM_SC_UTIMENSAT,
                                           PPM_SC_TIMERFD_SETTIME,
                                           PPM_SC_TIMERFD_GETTIME,
                                           PPM_SC_RT_TGSIGQUEUEINFO,
                                           PPM_SC_PERF_EVENT_OPEN,
                                           PPM_SC_FANOTIFY_INIT,
                                           PPM_SC_CLOCK_ADJTIME,
                                           PPM_SC_SYNCFS,
                                           PPM_SC_MSGSND,
                                           PPM_SC_MSGRCV,
                                           PPM_SC_MSGGET,
                                           PPM_SC_MSGCTL,
                                           PPM_SC_SHMDT,
                                           PPM_SC_SHMGET,
                                           PPM_SC_SHMCTL,
                                           PPM_SC_STATFS64,
                                           PPM_SC_FSTATFS64,
                                           PPM_SC_FSTATAT64,
                                           PPM_SC_BDFLUSH,
                                           PPM_SC_SIGPROCMASK,
                                           PPM_SC_IPC,
                                           PPM_SC__NEWSELECT,
                                           PPM_SC_SGETMASK,
                                           PPM_SC_SSETMASK,
                                           PPM_SC_SIGPENDING,
                                           PPM_SC_OLDUNAME,
                                           PPM_SC_SIGNAL,
                                           PPM_SC_NICE,
                                           PPM_SC_STIME,
                                           PPM_SC_WAITPID,
                                           PPM_SC_SHMAT,
                                           PPM_SC_RT_SIGRETURN,
                                           PPM_SC_FALLOCATE,
                                           PPM_SC_SIGALTSTACK,
                                           PPM_SC_GETRANDOM,
                                           PPM_SC_FADVISE64,
                                           PPM_SC_SOCKETCALL,
                                           PPM_SC_FSPICK,
                                           PPM_SC_FSMOUNT,
                                           PPM_SC_FSOPEN,
                                           PPM_SC_OPEN_TREE,
                                           PPM_SC_MOVE_MOUNT,
                                           PPM_SC_MOUNT_SETATTR,
                                           PPM_SC_MEMFD_SECRET,
                                           PPM_SC_IOPERM,
                                           PPM_SC_KEXEC_FILE_LOAD,
                                           PPM_SC_PIDFD_SEND_SIGNAL,
                                           PPM_SC_PKEY_ALLOC,
                                           PPM_SC_PKEY_MPROTECT,
                                           PPM_SC_PKEY_FREE,
                                           PPM_SC_LANDLOCK_CREATE_RULESET,
                                           PPM_SC_QUOTACTL_FD,
                                           PPM_SC_LANDLOCK_RESTRICT_SELF,
                                           PPM_SC_LANDLOCK_ADD_RULE,
                                           PPM_SC_EPOLL_PWAIT2,
                                           PPM_SC_MIGRATE_PAGES,
                                           PPM_SC_MOVE_PAGES,
                                           PPM_SC_PREADV2,
                                           PPM_SC_PWRITEV2,
                                           PPM_SC_QUERY_MODULE,
                                           PPM_SC_STATX,
                                           PPM_SC_SET_MEMPOLICY,
                                           PPM_SC_FANOTIFY_MARK,
                                           PPM_SC_SYNC_FILE_RANGE,
                                           PPM_SC_READAHEAD,
                                           PPM_SC_PROCESS_MRELEASE,
                                           PPM_SC_MBIND,
                                           PPM_SC_PROCESS_MADVISE,
                                           PPM_SC_MEMBARRIER,
                                           PPM_SC_MODIFY_LDT,
                                           PPM_SC_SEMTIMEDOP,
                                           PPM_SC_NAME_TO_HANDLE_AT,
                                           PPM_SC_KCMP,
                                           PPM_SC_EPOLL_CTL_OLD,
                                           PPM_SC_EPOLL_WAIT_OLD,
                                           PPM_SC_FUTEX_WAITV,
                                           PPM_SC_CREATE_MODULE,
                                           PPM_SC__SYSCTL,
                                           PPM_SC_LOOKUP_DCOOKIE,
                                           PPM_SC_IOPL,
                                           PPM_SC_IO_PGETEVENTS,
                                           PPM_SC_GETPMSG,
                                           PPM_SC_SCHED_SETATTR,
                                           PPM_SC_GET_KERNEL_SYMS,
                                           PPM_SC_RSEQ,
                                           PPM_SC_CLOSE_RANGE,
                                           PPM_SC_GET_MEMPOLICY,
                                           PPM_SC_SCHED_GETATTR,
                                           PPM_SC_NFSSERVCTL,
                                           PPM_SC_SET_MEMPOLICY_HOME_NODE,
                                           PPM_SC_FACCESSAT2,
                                           PPM_SC_EPOLL_CTL,
                                           PPM_SC_SCHED_GETPARAM,
                                           PPM_SC_PSELECT6,
                                           PPM_SC_SCHED_SETPARAM,
                                           PPM_SC_PAUSE,
                                           PPM_SC_UTIME,
                                           PPM_SC_SYSLOG,
                                           PPM_SC_USELIB,
                                           PPM_SC_ALARM,
                                           PPM_SC_TIMERFD,
                                           PPM_SC_S390_PCI_MMIO_READ,
                                           PPM_SC_SIGACTION,
                                           PPM_SC_S390_PCI_MMIO_WRITE,
                                           PPM_SC_READDIR,
                                           PPM_SC_S390_STHYI,
                                           PPM_SC_SIGSUSPEND,
                                           PPM_SC_IDLE,
                                           PPM_SC_S390_RUNTIME_INSTR,
                                           PPM_SC_SIGRETURN,
                                           PPM_SC_S390_GUARDED_STORAGE,
                                           PPM_SC_CACHESTAT,
                                           PPM_SC_FCHMODAT2,
                                           PPM_SC_MAP_SHADOW_STACK,
                                           PPM_SC_RISCV_FLUSH_ICACHE,
                                           PPM_SC_RISCV_HWPROBE,
                                           PPM_SC_FUTEX_WAKE,
                                           PPM_SC_FUTEX_REQUEUE,
                                           PPM_SC_FUTEX_WAIT,
                                           PPM_SC_OLDOLDUNAME,
                                           PPM_SC_SUBPAGE_PROT,
                                           PPM_SC_PCICONFIG_IOBASE,
                                           PPM_SC_OLDSTAT,
                                           PPM_SC_SWITCH_ENDIAN,
                                           PPM_SC_MULTIPLEXER,
                                           PPM_SC_OLDLSTAT,
                                           PPM_SC_SPU_CREATE,
                                           PPM_SC_SYNC_FILE_RANGE2,
                                           PPM_SC_OLDFSTAT,
                                           PPM_SC_SPU_RUN,
                                           PPM_SC_SWAPCONTEXT,
                                           PPM_SC_PCICONFIG_WRITE,
                                           PPM_SC_RTAS,
                                           PPM_SC_PCICONFIG_READ,
                                           PPM_SC_SYS_DEBUG_SETCONTEXT,
                                           PPM_SC_VM86,
                                           PPM_SC_LSM_SET_SELF_ATTR,
                                           PPM_SC_LSM_LIST_MODULES,
                                           PPM_SC_LISTMOUNT,
                                           PPM_SC_STATMOUNT,
                                           PPM_SC_LSM_GET_SELF_ATTR,
                                           PPM_SC_MSEAL,
                                           PPM_SC_URETPROBE,
                                           PPM_SC_LISTXATTRAT,
                                           PPM_SC_GETXATTRAT,
                                           PPM_SC_SETXATTRAT,
                                           PPM_SC_REMOVEXATTRAT,
                                           PPM_SC_OPEN_TREE_ATTR,
                                           PPM_SC_FILE_GETATTR,
                                           PPM_SC_FILE_SETATTR,
                                           -1},
        [PPME_SYSCALL_OPEN_E] = (ppm_sc_code[]){PPM_SC_OPEN, -1},
        [PPME_SYSCALL_OPEN_X] = (ppm_sc_code[]){PPM_SC_OPEN, -1},
        [PPME_SYSCALL_CLOSE_E] = (ppm_sc_code[]){PPM_SC_CLOSE, -1},
        [PPME_SYSCALL_CLOSE_X] = (ppm_sc_code[]){PPM_SC_CLOSE, -1},
        [PPME_SYSCALL_READ_E] = (ppm_sc_code[]){PPM_SC_READ, -1},
        [PPME_SYSCALL_READ_X] = (ppm_sc_code[]){PPM_SC_READ, -1},
        [PPME_SYSCALL_WRITE_E] = (ppm_sc_code[]){PPM_SC_WRITE, -1},
        [PPME_SYSCALL_WRITE_X] = (ppm_sc_code[]){PPM_SC_WRITE, -1},
        [PPME_SYSCALL_BRK_1_E] = (ppm_sc_code[]){PPM_SC_BRK, -1},
        [PPME_SYSCALL_BRK_1_X] = (ppm_sc_code[]){PPM_SC_BRK, -1},
        [PPME_SYSCALL_EXECVE_8_E] = (ppm_sc_code[]){PPM_SC_EXECVE, -1},
        [PPME_SYSCALL_EXECVE_8_X] = (ppm_sc_code[]){PPM_SC_EXECVE, -1},
        [PPME_SYSCALL_CLONE_11_E] = (ppm_sc_code[]){PPM_SC_CLONE, -1},
        [PPME_SYSCALL_CLONE_11_X] = (ppm_sc_code[]){PPM_SC_CLONE, -1},
        [PPME_SYSCALL_PRCTL_E] = (ppm_sc_code[]){PPM_SC_PRCTL, -1},
        [PPME_SYSCALL_PRCTL_X] = (ppm_sc_code[]){PPM_SC_PRCTL, -1},
        [PPME_PROCEXIT_E] = (ppm_sc_code[]){PPM_SC_SCHED_PROCESS_EXIT, -1},
        [PPME_PROCEXIT_X] = NULL,
        [PPME_SOCKET_SOCKET_E] = (ppm_sc_code[]){PPM_SC_SOCKET, -1},
        [PPME_SOCKET_SOCKET_X] = (ppm_sc_code[]){PPM_SC_SOCKET, -1},
        [PPME_SOCKET_BIND_E] = (ppm_sc_code[]){PPM_SC_BIND, -1},
        [PPME_SOCKET_BIND_X] = (ppm_sc_code[]){PPM_SC_BIND, -1},
        [PPME_SOCKET_CONNECT_E] = (ppm_sc_code[]){PPM_SC_CONNECT, -1},
        [PPME_SOCKET_CONNECT_X] = (ppm_sc_code[]){PPM_SC_CONNECT, -1},
        [PPME_SOCKET_LISTEN_E] = (ppm_sc_code[]){PPM_SC_LISTEN, -1},
        [PPME_SOCKET_LISTEN_X] = (ppm_sc_code[]){PPM_SC_LISTEN, -1},
        [PPME_SOCKET_ACCEPT_E] = (ppm_sc_code[]){PPM_SC_ACCEPT, -1},
        [PPME_SOCKET_ACCEPT_X] = (ppm_sc_code[]){PPM_SC_ACCEPT, -1},
        [PPME_SOCKET_SEND_E] = (ppm_sc_code[]){PPM_SC_SEND, -1},
        [PPME_SOCKET_SEND_X] = (ppm_sc_code[]){PPM_SC_SEND, -1},
        [PPME_SOCKET_SENDTO_E] = (ppm_sc_code[]){PPM_SC_SENDTO, -1},
        [PPME_SOCKET_SENDTO_X] = (ppm_sc_code[]){PPM_SC_SENDTO, -1},
        [PPME_SOCKET_RECV_E] = (ppm_sc_code[]){PPM_SC_RECV, -1},
        [PPME_SOCKET_RECV_X] = (ppm_sc_code[]){PPM_SC_RECV, -1},
        [PPME_SOCKET_RECVFROM_E] = (ppm_sc_code[]){PPM_SC_RECVFROM, -1},
        [PPME_SOCKET_RECVFROM_X] = (ppm_sc_code[]){PPM_SC_RECVFROM, -1},
        [PPME_SOCKET_SHUTDOWN_E] = (ppm_sc_code[]){PPM_SC_SHUTDOWN, -1},
        [PPME_SOCKET_SHUTDOWN_X] = (ppm_sc_code[]){PPM_SC_SHUTDOWN, -1},
        [PPME_SOCKET_GETSOCKNAME_E] = (ppm_sc_code[]){PPM_SC_GETSOCKNAME, -1},
        [PPME_SOCKET_GETSOCKNAME_X] = (ppm_sc_code[]){PPM_SC_GETSOCKNAME, -1},
        [PPME_SOCKET_GETPEERNAME_E] = (ppm_sc_code[]){PPM_SC_GETPEERNAME, -1},
        [PPME_SOCKET_GETPEERNAME_X] = (ppm_sc_code[]){PPM_SC_GETPEERNAME, -1},
        [PPME_SOCKET_SOCKETPAIR_E] = (ppm_sc_code[]){PPM_SC_SOCKETPAIR, -1},
        [PPME_SOCKET_SOCKETPAIR_X] = (ppm_sc_code[]){PPM_SC_SOCKETPAIR, -1},
        [PPME_SOCKET_SETSOCKOPT_E] = (ppm_sc_code[]){PPM_SC_SETSOCKOPT, -1},
        [PPME_SOCKET_SETSOCKOPT_X] = (ppm_sc_code[]){PPM_SC_SETSOCKOPT, -1},
        [PPME_SOCKET_GETSOCKOPT_E] = (ppm_sc_code[]){PPM_SC_GETSOCKOPT, -1},
        [PPME_SOCKET_GETSOCKOPT_X] = (ppm_sc_code[]){PPM_SC_GETSOCKOPT, -1},
        [PPME_SOCKET_SENDMSG_E] = (ppm_sc_code[]){PPM_SC_SENDMSG, -1},
        [PPME_SOCKET_SENDMSG_X] = (ppm_sc_code[]){PPM_SC_SENDMSG, -1},
        [PPME_SOCKET_SENDMMSG_E] = (ppm_sc_code[]){PPM_SC_SENDMMSG, -1},
        [PPME_SOCKET_SENDMMSG_X] = (ppm_sc_code[]){PPM_SC_SENDMMSG, -1},
        [PPME_SOCKET_RECVMSG_E] = (ppm_sc_code[]){PPM_SC_RECVMSG, -1},
        [PPME_SOCKET_RECVMSG_X] = (ppm_sc_code[]){PPM_SC_RECVMSG, -1},
        [PPME_SOCKET_RECVMMSG_E] = (ppm_sc_code[]){PPM_SC_RECVMMSG, -1},
        [PPME_SOCKET_RECVMMSG_X] = (ppm_sc_code[]){PPM_SC_RECVMMSG, -1},
        [PPME_SOCKET_ACCEPT4_E] = (ppm_sc_code[]){PPM_SC_ACCEPT4, -1},
        [PPME_SOCKET_ACCEPT4_X] = (ppm_sc_code[]){PPM_SC_ACCEPT4, -1},
        [PPME_SYSCALL_CREAT_E] = (ppm_sc_code[]){PPM_SC_CREAT, -1},
        [PPME_SYSCALL_CREAT_X] = (ppm_sc_code[]){PPM_SC_CREAT, -1},
        [PPME_SYSCALL_PIPE_E] = (ppm_sc_code[]){PPM_SC_PIPE, -1},
        [PPME_SYSCALL_PIPE_X] = (ppm_sc_code[]){PPM_SC_PIPE, -1},
        [PPME_SYSCALL_EVENTFD_E] = (ppm_sc_code[]){PPM_SC_EVENTFD, -1},
        [PPME_SYSCALL_EVENTFD_X] = (ppm_sc_code[]){PPM_SC_EVENTFD, -1},
        [PPME_SYSCALL_FUTEX_E] = (ppm_sc_code[]){PPM_SC_FUTEX, -1},
        [PPME_SYSCALL_FUTEX_X] = (ppm_sc_code[]){PPM_SC_FUTEX, -1},
        [PPME_SYSCALL_STAT_E] = (ppm_sc_code[]){PPM_SC_STAT, -1},
        [PPME_SYSCALL_STAT_X] = (ppm_sc_code[]){PPM_SC_STAT, -1},
        [PPME_SYSCALL_LSTAT_E] = (ppm_sc_code[]){PPM_SC_LSTAT, -1},
        [PPME_SYSCALL_LSTAT_X] = (ppm_sc_code[]){PPM_SC_LSTAT, -1},
        [PPME_SYSCALL_FSTAT_E] = (ppm_sc_code[]){PPM_SC_FSTAT, -1},
        [PPME_SYSCALL_FSTAT_X] = (ppm_sc_code[]){PPM_SC_FSTAT, -1},
        [PPME_SYSCALL_STAT64_E] = (ppm_sc_code[]){PPM_SC_STAT64, -1},
        [PPME_SYSCALL_STAT64_X] = (ppm_sc_code[]){PPM_SC_STAT64, -1},
        [PPME_SYSCALL_LSTAT64_E] =
                (ppm_sc_code[]){PPM_SC_LSTAT64, -1},  // lstat64 -> is not impl by supported archs
        [PPME_SYSCALL_LSTAT64_X] =
                (ppm_sc_code[]){PPM_SC_LSTAT64, -1},  // lstat64 -> is not impl by supported archs
        [PPME_SYSCALL_FSTAT64_E] = (ppm_sc_code[]){PPM_SC_FSTAT64, -1},
        [PPME_SYSCALL_FSTAT64_X] = (ppm_sc_code[]){PPM_SC_FSTAT64, -1},
        [PPME_SYSCALL_EPOLLWAIT_E] = (ppm_sc_code[]){PPM_SC_EPOLL_WAIT, -1},
        [PPME_SYSCALL_EPOLLWAIT_X] = (ppm_sc_code[]){PPM_SC_EPOLL_WAIT, -1},
        [PPME_SYSCALL_POLL_E] = (ppm_sc_code[]){PPM_SC_POLL, -1},
        [PPME_SYSCALL_POLL_X] = (ppm_sc_code[]){PPM_SC_POLL, -1},
        [PPME_SYSCALL_SELECT_E] = (ppm_sc_code[]){PPM_SC_SELECT, -1},
        [PPME_SYSCALL_SELECT_X] = (ppm_sc_code[]){PPM_SC_SELECT, -1},
        [PPME_SYSCALL_NEWSELECT_E] = (ppm_sc_code[]){PPM_SC_SELECT, -1},
        [PPME_SYSCALL_NEWSELECT_X] = (ppm_sc_code[]){PPM_SC_SELECT, -1},
        [PPME_SYSCALL_LSEEK_E] = (ppm_sc_code[]){PPM_SC_LSEEK, -1},
        [PPME_SYSCALL_LSEEK_X] = (ppm_sc_code[]){PPM_SC_LSEEK, -1},
        [PPME_SYSCALL_LLSEEK_E] = (ppm_sc_code[]){PPM_SC__LLSEEK, -1},
        [PPME_SYSCALL_LLSEEK_X] = (ppm_sc_code[]){PPM_SC__LLSEEK, -1},
        [PPME_SYSCALL_IOCTL_2_E] = (ppm_sc_code[]){PPM_SC_IOCTL, -1},
        [PPME_SYSCALL_IOCTL_2_X] = (ppm_sc_code[]){PPM_SC_IOCTL, -1},
        [PPME_SYSCALL_GETCWD_E] = (ppm_sc_code[]){PPM_SC_GETCWD, -1},
        [PPME_SYSCALL_GETCWD_X] = (ppm_sc_code[]){PPM_SC_GETCWD, -1},
        [PPME_SYSCALL_CHDIR_E] = (ppm_sc_code[]){PPM_SC_CHDIR, -1},
        [PPME_SYSCALL_CHDIR_X] = (ppm_sc_code[]){PPM_SC_CHDIR, -1},
        [PPME_SYSCALL_FCHDIR_E] = (ppm_sc_code[]){PPM_SC_FCHDIR, -1},
        [PPME_SYSCALL_FCHDIR_X] = (ppm_sc_code[]){PPM_SC_FCHDIR, -1},
        [PPME_SYSCALL_MKDIR_E] = (ppm_sc_code[]){PPM_SC_MKDIR, -1},
        [PPME_SYSCALL_MKDIR_X] = (ppm_sc_code[]){PPM_SC_MKDIR, -1},
        [PPME_SYSCALL_RMDIR_E] = (ppm_sc_code[]){PPM_SC_RMDIR, -1},
        [PPME_SYSCALL_RMDIR_X] = (ppm_sc_code[]){PPM_SC_RMDIR, -1},
        [PPME_SYSCALL_OPENAT_E] = (ppm_sc_code[]){PPM_SC_OPENAT, -1},
        [PPME_SYSCALL_OPENAT_X] = (ppm_sc_code[]){PPM_SC_OPENAT, -1},
        [PPME_SYSCALL_LINK_E] = (ppm_sc_code[]){PPM_SC_LINK, -1},
        [PPME_SYSCALL_LINK_X] = (ppm_sc_code[]){PPM_SC_LINK, -1},
        [PPME_SYSCALL_LINKAT_E] = (ppm_sc_code[]){PPM_SC_LINKAT, -1},
        [PPME_SYSCALL_LINKAT_X] = (ppm_sc_code[]){PPM_SC_LINKAT, -1},
        [PPME_SYSCALL_UNLINK_E] = (ppm_sc_code[]){PPM_SC_UNLINK, -1},
        [PPME_SYSCALL_UNLINK_X] = (ppm_sc_code[]){PPM_SC_UNLINK, -1},
        [PPME_SYSCALL_UNLINKAT_E] = (ppm_sc_code[]){PPM_SC_UNLINKAT, -1},
        [PPME_SYSCALL_UNLINKAT_X] = (ppm_sc_code[]){PPM_SC_UNLINKAT, -1},
        [PPME_SYSCALL_PREAD_E] = (ppm_sc_code[]){PPM_SC_PREAD64, -1},
        [PPME_SYSCALL_PREAD_X] = (ppm_sc_code[]){PPM_SC_PREAD64, -1},
        [PPME_SYSCALL_PWRITE_E] = (ppm_sc_code[]){PPM_SC_PWRITE64, -1},
        [PPME_SYSCALL_PWRITE_X] = (ppm_sc_code[]){PPM_SC_PWRITE64, -1},
        [PPME_SYSCALL_READV_E] = (ppm_sc_code[]){PPM_SC_READV, -1},
        [PPME_SYSCALL_READV_X] = (ppm_sc_code[]){PPM_SC_READV, -1},
        [PPME_SYSCALL_WRITEV_E] = (ppm_sc_code[]){PPM_SC_WRITEV, -1},
        [PPME_SYSCALL_WRITEV_X] = (ppm_sc_code[]){PPM_SC_WRITEV, -1},
        [PPME_SYSCALL_PREADV_E] = (ppm_sc_code[]){PPM_SC_PREADV, -1},
        [PPME_SYSCALL_PREADV_X] = (ppm_sc_code[]){PPM_SC_PREADV, -1},
        [PPME_SYSCALL_PWRITEV_E] = (ppm_sc_code[]){PPM_SC_PWRITEV, -1},
        [PPME_SYSCALL_PWRITEV_X] = (ppm_sc_code[]){PPM_SC_PWRITEV, -1},
        [PPME_SYSCALL_DUP_E] = (ppm_sc_code[]){PPM_SC_DUP, -1},
        [PPME_SYSCALL_DUP_X] = (ppm_sc_code[]){PPM_SC_DUP, -1},
        [PPME_SYSCALL_SIGNALFD_E] = (ppm_sc_code[]){PPM_SC_SIGNALFD, -1},
        [PPME_SYSCALL_SIGNALFD_X] = (ppm_sc_code[]){PPM_SC_SIGNALFD, -1},
        [PPME_SYSCALL_KILL_E] = (ppm_sc_code[]){PPM_SC_KILL, -1},
        [PPME_SYSCALL_KILL_X] = (ppm_sc_code[]){PPM_SC_KILL, -1},
        [PPME_SYSCALL_TKILL_E] = (ppm_sc_code[]){PPM_SC_TKILL, -1},
        [PPME_SYSCALL_TKILL_X] = (ppm_sc_code[]){PPM_SC_TKILL, -1},
        [PPME_SYSCALL_TGKILL_E] = (ppm_sc_code[]){PPM_SC_TGKILL, -1},
        [PPME_SYSCALL_TGKILL_X] = (ppm_sc_code[]){PPM_SC_TGKILL, -1},
        [PPME_SYSCALL_NANOSLEEP_E] = (ppm_sc_code[]){PPM_SC_NANOSLEEP, -1},
        [PPME_SYSCALL_NANOSLEEP_X] = (ppm_sc_code[]){PPM_SC_NANOSLEEP, -1},
        [PPME_SYSCALL_TIMERFD_CREATE_E] = (ppm_sc_code[]){PPM_SC_TIMERFD_CREATE, -1},
        [PPME_SYSCALL_TIMERFD_CREATE_X] = (ppm_sc_code[]){PPM_SC_TIMERFD_CREATE, -1},
        [PPME_SYSCALL_INOTIFY_INIT_E] = (ppm_sc_code[]){PPM_SC_INOTIFY_INIT, -1},
        [PPME_SYSCALL_INOTIFY_INIT_X] = (ppm_sc_code[]){PPM_SC_INOTIFY_INIT, -1},
        [PPME_SYSCALL_GETRLIMIT_E] = (ppm_sc_code[]){PPM_SC_GETRLIMIT, PPM_SC_UGETRLIMIT, -1},
        [PPME_SYSCALL_GETRLIMIT_X] = (ppm_sc_code[]){PPM_SC_GETRLIMIT, PPM_SC_UGETRLIMIT, -1},
        [PPME_SYSCALL_SETRLIMIT_E] = (ppm_sc_code[]){PPM_SC_SETRLIMIT, -1},
        [PPME_SYSCALL_SETRLIMIT_X] = (ppm_sc_code[]){PPM_SC_SETRLIMIT, -1},
        [PPME_SYSCALL_PRLIMIT_E] = (ppm_sc_code[]){PPM_SC_PRLIMIT64, -1},
        [PPME_SYSCALL_PRLIMIT_X] = (ppm_sc_code[]){PPM_SC_PRLIMIT64, -1},
        [PPME_SCHEDSWITCH_1_E] = (ppm_sc_code[]){PPM_SC_SCHED_SWITCH, -1},
        [PPME_SCHEDSWITCH_1_X] = NULL,
        [PPME_DROP_E] = NULL,
        [PPME_DROP_X] = NULL,
        [PPME_SYSCALL_FCNTL_E] = (ppm_sc_code[]){PPM_SC_FCNTL, PPM_SC_FCNTL64, -1},
        [PPME_SYSCALL_FCNTL_X] = (ppm_sc_code[]){PPM_SC_FCNTL, PPM_SC_FCNTL64, -1},
        [PPME_SCHEDSWITCH_6_E] = (ppm_sc_code[]){PPM_SC_SCHED_SWITCH, -1},
        [PPME_SCHEDSWITCH_6_X] = NULL,
        [PPME_SYSCALL_EXECVE_13_E] = (ppm_sc_code[]){PPM_SC_EXECVE, -1},
        [PPME_SYSCALL_EXECVE_13_X] = (ppm_sc_code[]){PPM_SC_EXECVE, -1},
        [PPME_SYSCALL_CLONE_16_E] = (ppm_sc_code[]){PPM_SC_CLONE, -1},
        [PPME_SYSCALL_CLONE_16_X] = (ppm_sc_code[]){PPM_SC_CLONE, -1},
        [PPME_SYSCALL_BRK_4_E] = (ppm_sc_code[]){PPM_SC_BRK, -1},
        [PPME_SYSCALL_BRK_4_X] = (ppm_sc_code[]){PPM_SC_BRK, -1},
        [PPME_SYSCALL_MMAP_E] = (ppm_sc_code[]){PPM_SC_MMAP, -1},
        [PPME_SYSCALL_MMAP_X] = (ppm_sc_code[]){PPM_SC_MMAP, -1},
        [PPME_SYSCALL_MMAP2_E] = (ppm_sc_code[]){PPM_SC_MMAP2, -1},
        [PPME_SYSCALL_MMAP2_X] = (ppm_sc_code[]){PPM_SC_MMAP2, -1},
        [PPME_SYSCALL_MUNMAP_E] = (ppm_sc_code[]){PPM_SC_MUNMAP, -1},
        [PPME_SYSCALL_MUNMAP_X] = (ppm_sc_code[]){PPM_SC_MUNMAP, -1},
        [PPME_SYSCALL_SPLICE_E] = (ppm_sc_code[]){PPM_SC_SPLICE, -1},
        [PPME_SYSCALL_SPLICE_X] = (ppm_sc_code[]){PPM_SC_SPLICE, -1},
        [PPME_SYSCALL_PTRACE_E] = (ppm_sc_code[]){PPM_SC_PTRACE, -1},
        [PPME_SYSCALL_PTRACE_X] = (ppm_sc_code[]){PPM_SC_PTRACE, -1},
        [PPME_SYSCALL_IOCTL_3_E] = (ppm_sc_code[]){PPM_SC_IOCTL, -1},
        [PPME_SYSCALL_IOCTL_3_X] = (ppm_sc_code[]){PPM_SC_IOCTL, -1},
        [PPME_SYSCALL_EXECVE_14_E] = (ppm_sc_code[]){PPM_SC_EXECVE, -1},
        [PPME_SYSCALL_EXECVE_14_X] = (ppm_sc_code[]){PPM_SC_EXECVE, -1},
        [PPME_SYSCALL_RENAME_E] = (ppm_sc_code[]){PPM_SC_RENAME, -1},
        [PPME_SYSCALL_RENAME_X] = (ppm_sc_code[]){PPM_SC_RENAME, -1},
        [PPME_SYSCALL_RENAMEAT_E] = (ppm_sc_code[]){PPM_SC_RENAMEAT, -1},
        [PPME_SYSCALL_RENAMEAT_X] = (ppm_sc_code[]){PPM_SC_RENAMEAT, -1},
        [PPME_SYSCALL_SYMLINK_E] = (ppm_sc_code[]){PPM_SC_SYMLINK, -1},
        [PPME_SYSCALL_SYMLINK_X] = (ppm_sc_code[]){PPM_SC_SYMLINK, -1},
        [PPME_SYSCALL_SYMLINKAT_E] = (ppm_sc_code[]){PPM_SC_SYMLINKAT, -1},
        [PPME_SYSCALL_SYMLINKAT_X] = (ppm_sc_code[]){PPM_SC_SYMLINKAT, -1},
        [PPME_SYSCALL_FORK_E] = (ppm_sc_code[]){PPM_SC_FORK, -1},
        [PPME_SYSCALL_FORK_X] = (ppm_sc_code[]){PPM_SC_FORK, -1},
        [PPME_SYSCALL_VFORK_E] = (ppm_sc_code[]){PPM_SC_VFORK, -1},
        [PPME_SYSCALL_VFORK_X] = (ppm_sc_code[]){PPM_SC_VFORK, -1},
        [PPME_PROCEXIT_1_E] = (ppm_sc_code[]){PPM_SC_SCHED_PROCESS_EXIT, -1},
        [PPME_PROCEXIT_1_X] = NULL,
        [PPME_SYSCALL_SENDFILE_E] = (ppm_sc_code[]){PPM_SC_SENDFILE, PPM_SC_SENDFILE64, -1},
        [PPME_SYSCALL_SENDFILE_X] = (ppm_sc_code[]){PPM_SC_SENDFILE, PPM_SC_SENDFILE64, -1},
        [PPME_SYSCALL_QUOTACTL_E] = (ppm_sc_code[]){PPM_SC_QUOTACTL, -1},
        [PPME_SYSCALL_QUOTACTL_X] = (ppm_sc_code[]){PPM_SC_QUOTACTL, -1},
        [PPME_SYSCALL_SETRESUID_E] = (ppm_sc_code[]){PPM_SC_SETRESUID, PPM_SC_SETRESUID32, -1},
        [PPME_SYSCALL_SETRESUID_X] = (ppm_sc_code[]){PPM_SC_SETRESUID, PPM_SC_SETRESUID32, -1},
        [PPME_SYSCALL_SETRESGID_E] = (ppm_sc_code[]){PPM_SC_SETRESGID, PPM_SC_SETRESGID32, -1},
        [PPME_SYSCALL_SETRESGID_X] = (ppm_sc_code[]){PPM_SC_SETRESGID, PPM_SC_SETRESGID32, -1},
        [PPME_SCAPEVENT_E] = NULL,
        [PPME_SCAPEVENT_X] = NULL,
        [PPME_SYSCALL_SETUID_E] = (ppm_sc_code[]){PPM_SC_SETUID, PPM_SC_SETUID32, -1},
        [PPME_SYSCALL_SETUID_X] = (ppm_sc_code[]){PPM_SC_SETUID, PPM_SC_SETUID32, -1},
        [PPME_SYSCALL_SETGID_E] = (ppm_sc_code[]){PPM_SC_SETGID, PPM_SC_SETGID32, -1},
        [PPME_SYSCALL_SETGID_X] = (ppm_sc_code[]){PPM_SC_SETGID, PPM_SC_SETGID32, -1},
        [PPME_SYSCALL_GETUID_E] = (ppm_sc_code[]){PPM_SC_GETUID, PPM_SC_GETUID32, -1},
        [PPME_SYSCALL_GETUID_X] = (ppm_sc_code[]){PPM_SC_GETUID, PPM_SC_GETUID32, -1},
        [PPME_SYSCALL_GETEUID_E] = (ppm_sc_code[]){PPM_SC_GETEUID, PPM_SC_GETEUID32, -1},
        [PPME_SYSCALL_GETEUID_X] = (ppm_sc_code[]){PPM_SC_GETEUID, PPM_SC_GETEUID32, -1},
        [PPME_SYSCALL_GETGID_E] = (ppm_sc_code[]){PPM_SC_GETGID, PPM_SC_GETGID32, -1},
        [PPME_SYSCALL_GETGID_X] = (ppm_sc_code[]){PPM_SC_GETGID, PPM_SC_GETGID32, -1},
        [PPME_SYSCALL_GETEGID_E] = (ppm_sc_code[]){PPM_SC_GETEGID, PPM_SC_GETEGID32, -1},
        [PPME_SYSCALL_GETEGID_X] = (ppm_sc_code[]){PPM_SC_GETEGID, PPM_SC_GETEGID32, -1},
        [PPME_SYSCALL_GETRESUID_E] = (ppm_sc_code[]){PPM_SC_GETRESUID, PPM_SC_GETRESUID32, -1},
        [PPME_SYSCALL_GETRESUID_X] = (ppm_sc_code[]){PPM_SC_GETRESUID, PPM_SC_GETRESUID32, -1},
        [PPME_SYSCALL_GETRESGID_E] = (ppm_sc_code[]){PPM_SC_GETRESGID, PPM_SC_GETRESGID32, -1},
        [PPME_SYSCALL_GETRESGID_X] = (ppm_sc_code[]){PPM_SC_GETRESGID, PPM_SC_GETRESGID32, -1},
        [PPME_SYSCALL_EXECVE_15_E] = (ppm_sc_code[]){PPM_SC_EXECVE, -1},
        [PPME_SYSCALL_EXECVE_15_X] = (ppm_sc_code[]){PPM_SC_EXECVE, -1},
        [PPME_SYSCALL_CLONE_17_E] = (ppm_sc_code[]){PPM_SC_CLONE, -1},
        [PPME_SYSCALL_CLONE_17_X] = (ppm_sc_code[]){PPM_SC_CLONE, -1},
        [PPME_SYSCALL_FORK_17_E] = (ppm_sc_code[]){PPM_SC_FORK, -1},
        [PPME_SYSCALL_FORK_17_X] = (ppm_sc_code[]){PPM_SC_FORK, -1},
        [PPME_SYSCALL_VFORK_17_E] = (ppm_sc_code[]){PPM_SC_VFORK, -1},
        [PPME_SYSCALL_VFORK_17_X] = (ppm_sc_code[]){PPM_SC_VFORK, -1},
        [PPME_SYSCALL_CLONE_20_E] = (ppm_sc_code[]){PPM_SC_CLONE, -1},
        [PPME_SYSCALL_CLONE_20_X] = (ppm_sc_code[]){PPM_SC_CLONE, -1},
        [PPME_SYSCALL_FORK_20_E] = (ppm_sc_code[]){PPM_SC_FORK, -1},
        [PPME_SYSCALL_FORK_20_X] = (ppm_sc_code[]){PPM_SC_FORK, -1},
        [PPME_SYSCALL_VFORK_20_E] = (ppm_sc_code[]){PPM_SC_VFORK, -1},
        [PPME_SYSCALL_VFORK_20_X] = (ppm_sc_code[]){PPM_SC_VFORK, -1},
        [PPME_CONTAINER_E] = NULL,
        [PPME_CONTAINER_X] = NULL,
        [PPME_SYSCALL_EXECVE_16_E] = (ppm_sc_code[]){PPM_SC_EXECVE, -1},
        [PPME_SYSCALL_EXECVE_16_X] = (ppm_sc_code[]){PPM_SC_EXECVE, -1},
        [PPME_SIGNALDELIVER_E] = (ppm_sc_code[]){PPM_SC_SIGNAL_DELIVER, -1},
        [PPME_SIGNALDELIVER_X] = NULL,
        [PPME_PROCINFO_E] = NULL,
        [PPME_PROCINFO_X] = NULL,
        [PPME_SYSCALL_GETDENTS_E] = (ppm_sc_code[]){PPM_SC_GETDENTS, -1},
        [PPME_SYSCALL_GETDENTS_X] = (ppm_sc_code[]){PPM_SC_GETDENTS, -1},
        [PPME_SYSCALL_GETDENTS64_E] = (ppm_sc_code[]){PPM_SC_GETDENTS64, -1},
        [PPME_SYSCALL_GETDENTS64_X] = (ppm_sc_code[]){PPM_SC_GETDENTS64, -1},
        [PPME_SYSCALL_SETNS_E] = (ppm_sc_code[]){PPM_SC_SETNS, -1},
        [PPME_SYSCALL_SETNS_X] = (ppm_sc_code[]){PPM_SC_SETNS, -1},
        [PPME_SYSCALL_FLOCK_E] = (ppm_sc_code[]){PPM_SC_FLOCK, -1},
        [PPME_SYSCALL_FLOCK_X] = (ppm_sc_code[]){PPM_SC_FLOCK, -1},
        [PPME_CPU_HOTPLUG_E] = NULL,
        [PPME_CPU_HOTPLUG_X] = NULL,
        [PPME_SOCKET_ACCEPT_5_E] = (ppm_sc_code[]){PPM_SC_ACCEPT, -1},
        [PPME_SOCKET_ACCEPT_5_X] = (ppm_sc_code[]){PPM_SC_ACCEPT, -1},
        [PPME_SOCKET_ACCEPT4_5_E] = (ppm_sc_code[]){PPM_SC_ACCEPT4, -1},
        [PPME_SOCKET_ACCEPT4_5_X] = (ppm_sc_code[]){PPM_SC_ACCEPT4, -1},
        [PPME_SYSCALL_SEMOP_E] = (ppm_sc_code[]){PPM_SC_SEMOP, -1},
        [PPME_SYSCALL_SEMOP_X] = (ppm_sc_code[]){PPM_SC_SEMOP, -1},
        [PPME_SYSCALL_SEMCTL_E] = (ppm_sc_code[]){PPM_SC_SEMCTL, -1},
        [PPME_SYSCALL_SEMCTL_X] = (ppm_sc_code[]){PPM_SC_SEMCTL, -1},
        [PPME_SYSCALL_PPOLL_E] = (ppm_sc_code[]){PPM_SC_PPOLL, -1},
        [PPME_SYSCALL_PPOLL_X] = (ppm_sc_code[]){PPM_SC_PPOLL, -1},
        [PPME_SYSCALL_MOUNT_E] = (ppm_sc_code[]){PPM_SC_MOUNT, -1},
        [PPME_SYSCALL_MOUNT_X] = (ppm_sc_code[]){PPM_SC_MOUNT, -1},
        [PPME_SYSCALL_UMOUNT_E] = (ppm_sc_code[]){PPM_SC_UMOUNT, -1},
        [PPME_SYSCALL_UMOUNT_X] = (ppm_sc_code[]){PPM_SC_UMOUNT, -1},
        [PPME_K8S_E] = NULL,
        [PPME_K8S_X] = NULL,
        [PPME_SYSCALL_SEMGET_E] = (ppm_sc_code[]){PPM_SC_SEMGET, -1},
        [PPME_SYSCALL_SEMGET_X] = (ppm_sc_code[]){PPM_SC_SEMGET, -1},
        [PPME_SYSCALL_ACCESS_E] = (ppm_sc_code[]){PPM_SC_ACCESS, -1},
        [PPME_SYSCALL_ACCESS_X] = (ppm_sc_code[]){PPM_SC_ACCESS, -1},
        [PPME_SYSCALL_CHROOT_E] = (ppm_sc_code[]){PPM_SC_CHROOT, -1},
        [PPME_SYSCALL_CHROOT_X] = (ppm_sc_code[]){PPM_SC_CHROOT, -1},
        [PPME_TRACER_E] = NULL,
        [PPME_TRACER_X] = NULL,
        [PPME_MESOS_E] = NULL,
        [PPME_MESOS_X] = NULL,
        [PPME_CONTAINER_JSON_E] = NULL,
        [PPME_CONTAINER_JSON_X] = NULL,
        [PPME_SYSCALL_SETSID_E] = (ppm_sc_code[]){PPM_SC_SETSID, -1},
        [PPME_SYSCALL_SETSID_X] = (ppm_sc_code[]){PPM_SC_SETSID, -1},
        [PPME_SYSCALL_MKDIR_2_E] = (ppm_sc_code[]){PPM_SC_MKDIR, -1},
        [PPME_SYSCALL_MKDIR_2_X] = (ppm_sc_code[]){PPM_SC_MKDIR, -1},
        [PPME_SYSCALL_RMDIR_2_E] = (ppm_sc_code[]){PPM_SC_RMDIR, -1},
        [PPME_SYSCALL_RMDIR_2_X] = (ppm_sc_code[]){PPM_SC_RMDIR, -1},
        [PPME_NOTIFICATION_E] = NULL,
        [PPME_NOTIFICATION_X] = NULL,
        [PPME_SYSCALL_EXECVE_17_E] = (ppm_sc_code[]){PPM_SC_EXECVE, -1},
        [PPME_SYSCALL_EXECVE_17_X] = (ppm_sc_code[]){PPM_SC_EXECVE, -1},
        [PPME_SYSCALL_UNSHARE_E] = (ppm_sc_code[]){PPM_SC_UNSHARE, -1},
        [PPME_SYSCALL_UNSHARE_X] = (ppm_sc_code[]){PPM_SC_UNSHARE, -1},
        [PPME_INFRASTRUCTURE_EVENT_E] = NULL,
        [PPME_INFRASTRUCTURE_EVENT_X] = NULL,
        [PPME_SYSCALL_EXECVE_18_E] = (ppm_sc_code[]){PPM_SC_EXECVE, -1},
        [PPME_SYSCALL_EXECVE_18_X] = (ppm_sc_code[]){PPM_SC_EXECVE, -1},
        [PPME_PAGE_FAULT_E] = (ppm_sc_code[]){PPM_SC_PAGE_FAULT_USER, PPM_SC_PAGE_FAULT_KERNEL, -1},
        [PPME_PAGE_FAULT_X] = NULL,
        [PPME_SYSCALL_EXECVE_19_E] = (ppm_sc_code[]){PPM_SC_EXECVE, -1},
        [PPME_SYSCALL_EXECVE_19_X] = (ppm_sc_code[]){PPM_SC_EXECVE, -1},
        [PPME_SYSCALL_SETPGID_E] = (ppm_sc_code[]){PPM_SC_SETPGID, -1},
        [PPME_SYSCALL_SETPGID_X] = (ppm_sc_code[]){PPM_SC_SETPGID, -1},
        [PPME_SYSCALL_BPF_E] = (ppm_sc_code[]){PPM_SC_BPF, -1},
        [PPME_SYSCALL_BPF_X] = (ppm_sc_code[]){PPM_SC_BPF, -1},
        [PPME_SYSCALL_SECCOMP_E] = (ppm_sc_code[]){PPM_SC_SECCOMP, -1},
        [PPME_SYSCALL_SECCOMP_X] = (ppm_sc_code[]){PPM_SC_SECCOMP, -1},
        [PPME_SYSCALL_UNLINK_2_E] = (ppm_sc_code[]){PPM_SC_UNLINK, -1},
        [PPME_SYSCALL_UNLINK_2_X] = (ppm_sc_code[]){PPM_SC_UNLINK, -1},
        [PPME_SYSCALL_UNLINKAT_2_E] = (ppm_sc_code[]){PPM_SC_UNLINKAT, -1},
        [PPME_SYSCALL_UNLINKAT_2_X] = (ppm_sc_code[]){PPM_SC_UNLINKAT, -1},
        [PPME_SYSCALL_MKDIRAT_E] = (ppm_sc_code[]){PPM_SC_MKDIRAT, -1},
        [PPME_SYSCALL_MKDIRAT_X] = (ppm_sc_code[]){PPM_SC_MKDIRAT, -1},
        [PPME_SYSCALL_OPENAT_2_E] = (ppm_sc_code[]){PPM_SC_OPENAT, -1},
        [PPME_SYSCALL_OPENAT_2_X] = (ppm_sc_code[]){PPM_SC_OPENAT, -1},
        [PPME_SYSCALL_LINK_2_E] = (ppm_sc_code[]){PPM_SC_LINK, -1},
        [PPME_SYSCALL_LINK_2_X] = (ppm_sc_code[]){PPM_SC_LINK, -1},
        [PPME_SYSCALL_LINKAT_2_E] = (ppm_sc_code[]){PPM_SC_LINKAT, -1},
        [PPME_SYSCALL_LINKAT_2_X] = (ppm_sc_code[]){PPM_SC_LINKAT, -1},
        [PPME_SYSCALL_FCHMODAT_E] = (ppm_sc_code[]){PPM_SC_FCHMODAT, -1},
        [PPME_SYSCALL_FCHMODAT_X] = (ppm_sc_code[]){PPM_SC_FCHMODAT, -1},
        [PPME_SYSCALL_CHMOD_E] = (ppm_sc_code[]){PPM_SC_CHMOD, -1},
        [PPME_SYSCALL_CHMOD_X] = (ppm_sc_code[]){PPM_SC_CHMOD, -1},
        [PPME_SYSCALL_FCHMOD_E] = (ppm_sc_code[]){PPM_SC_FCHMOD, -1},
        [PPME_SYSCALL_FCHMOD_X] = (ppm_sc_code[]){PPM_SC_FCHMOD, -1},
        [PPME_SYSCALL_RENAMEAT2_E] = (ppm_sc_code[]){PPM_SC_RENAMEAT2, -1},
        [PPME_SYSCALL_RENAMEAT2_X] = (ppm_sc_code[]){PPM_SC_RENAMEAT2, -1},
        [PPME_SYSCALL_USERFAULTFD_E] = (ppm_sc_code[]){PPM_SC_USERFAULTFD, -1},
        [PPME_SYSCALL_USERFAULTFD_X] = (ppm_sc_code[]){PPM_SC_USERFAULTFD, -1},
        [PPME_PLUGINEVENT_E] = NULL,
        [PPME_PLUGINEVENT_X] = NULL,
        [PPME_CONTAINER_JSON_2_E] = NULL,
        [PPME_CONTAINER_JSON_2_X] = NULL,
        [PPME_SYSCALL_OPENAT2_E] = (ppm_sc_code[]){PPM_SC_OPENAT2, -1},
        [PPME_SYSCALL_OPENAT2_X] = (ppm_sc_code[]){PPM_SC_OPENAT2, -1},
        [PPME_SYSCALL_MPROTECT_E] = (ppm_sc_code[]){PPM_SC_MPROTECT, -1},
        [PPME_SYSCALL_MPROTECT_X] = (ppm_sc_code[]){PPM_SC_MPROTECT, -1},
        [PPME_SYSCALL_EXECVEAT_E] = (ppm_sc_code[]){PPM_SC_EXECVEAT, -1},
        [PPME_SYSCALL_EXECVEAT_X] = (ppm_sc_code[]){PPM_SC_EXECVEAT, -1},
        [PPME_SYSCALL_COPY_FILE_RANGE_E] = (ppm_sc_code[]){PPM_SC_COPY_FILE_RANGE, -1},
        [PPME_SYSCALL_COPY_FILE_RANGE_X] = (ppm_sc_code[]){PPM_SC_COPY_FILE_RANGE, -1},
        [PPME_SYSCALL_CLONE3_E] = (ppm_sc_code[]){PPM_SC_CLONE3, -1},
        [PPME_SYSCALL_CLONE3_X] = (ppm_sc_code[]){PPM_SC_CLONE3, -1},
        [PPME_SYSCALL_OPEN_BY_HANDLE_AT_E] = (ppm_sc_code[]){PPM_SC_OPEN_BY_HANDLE_AT, -1},
        [PPME_SYSCALL_OPEN_BY_HANDLE_AT_X] = (ppm_sc_code[]){PPM_SC_OPEN_BY_HANDLE_AT, -1},
        [PPME_SYSCALL_IO_URING_SETUP_E] = (ppm_sc_code[]){PPM_SC_IO_URING_SETUP, -1},
        [PPME_SYSCALL_IO_URING_SETUP_X] = (ppm_sc_code[]){PPM_SC_IO_URING_SETUP, -1},
        [PPME_SYSCALL_IO_URING_ENTER_E] = (ppm_sc_code[]){PPM_SC_IO_URING_ENTER, -1},
        [PPME_SYSCALL_IO_URING_ENTER_X] = (ppm_sc_code[]){PPM_SC_IO_URING_ENTER, -1},
        [PPME_SYSCALL_IO_URING_REGISTER_E] = (ppm_sc_code[]){PPM_SC_IO_URING_REGISTER, -1},
        [PPME_SYSCALL_IO_URING_REGISTER_X] = (ppm_sc_code[]){PPM_SC_IO_URING_REGISTER, -1},
        [PPME_SYSCALL_MLOCK_E] = (ppm_sc_code[]){PPM_SC_MLOCK, -1},
        [PPME_SYSCALL_MLOCK_X] = (ppm_sc_code[]){PPM_SC_MLOCK, -1},
        [PPME_SYSCALL_MUNLOCK_E] = (ppm_sc_code[]){PPM_SC_MUNLOCK, -1},
        [PPME_SYSCALL_MUNLOCK_X] = (ppm_sc_code[]){PPM_SC_MUNLOCK, -1},
        [PPME_SYSCALL_MLOCKALL_E] = (ppm_sc_code[]){PPM_SC_MLOCKALL, -1},
        [PPME_SYSCALL_MLOCKALL_X] = (ppm_sc_code[]){PPM_SC_MLOCKALL, -1},
        [PPME_SYSCALL_MUNLOCKALL_E] = (ppm_sc_code[]){PPM_SC_MUNLOCKALL, -1},
        [PPME_SYSCALL_MUNLOCKALL_X] = (ppm_sc_code[]){PPM_SC_MUNLOCKALL, -1},
        [PPME_SYSCALL_CAPSET_E] = (ppm_sc_code[]){PPM_SC_CAPSET, -1},
        [PPME_SYSCALL_CAPSET_X] = (ppm_sc_code[]){PPM_SC_CAPSET, -1},
        [PPME_USER_ADDED_E] = NULL,
        [PPME_USER_ADDED_X] = NULL,
        [PPME_USER_DELETED_E] = NULL,
        [PPME_USER_DELETED_X] = NULL,
        [PPME_GROUP_ADDED_E] = NULL,
        [PPME_GROUP_ADDED_X] = NULL,
        [PPME_GROUP_DELETED_E] = NULL,
        [PPME_GROUP_DELETED_X] = NULL,
        [PPME_SYSCALL_DUP2_E] = (ppm_sc_code[]){PPM_SC_DUP2, -1},
        [PPME_SYSCALL_DUP2_X] = (ppm_sc_code[]){PPM_SC_DUP2, -1},
        [PPME_SYSCALL_DUP3_E] = (ppm_sc_code[]){PPM_SC_DUP3, -1},
        [PPME_SYSCALL_DUP3_X] = (ppm_sc_code[]){PPM_SC_DUP3, -1},
        [PPME_SYSCALL_DUP_1_E] = (ppm_sc_code[]){PPM_SC_DUP, -1},
        [PPME_SYSCALL_DUP_1_X] = (ppm_sc_code[]){PPM_SC_DUP, -1},
        [PPME_SYSCALL_BPF_2_E] = (ppm_sc_code[]){PPM_SC_BPF, -1},
        [PPME_SYSCALL_BPF_2_X] = (ppm_sc_code[]){PPM_SC_BPF, -1},
        [PPME_SYSCALL_MLOCK2_E] = (ppm_sc_code[]){PPM_SC_MLOCK2, -1},
        [PPME_SYSCALL_MLOCK2_X] = (ppm_sc_code[]){PPM_SC_MLOCK2, -1},
        [PPME_SYSCALL_FSCONFIG_E] = (ppm_sc_code[]){PPM_SC_FSCONFIG, -1},
        [PPME_SYSCALL_FSCONFIG_X] = (ppm_sc_code[]){PPM_SC_FSCONFIG, -1},
        [PPME_SYSCALL_EPOLL_CREATE_E] = (ppm_sc_code[]){PPM_SC_EPOLL_CREATE, -1},
        [PPME_SYSCALL_EPOLL_CREATE_X] = (ppm_sc_code[]){PPM_SC_EPOLL_CREATE, -1},
        [PPME_SYSCALL_EPOLL_CREATE1_E] = (ppm_sc_code[]){PPM_SC_EPOLL_CREATE1, -1},
        [PPME_SYSCALL_EPOLL_CREATE1_X] = (ppm_sc_code[]){PPM_SC_EPOLL_CREATE1, -1},
        [PPME_SYSCALL_CHOWN_E] = (ppm_sc_code[]){PPM_SC_CHOWN, -1},
        [PPME_SYSCALL_CHOWN_X] = (ppm_sc_code[]){PPM_SC_CHOWN, -1},
        [PPME_SYSCALL_LCHOWN_E] = (ppm_sc_code[]){PPM_SC_LCHOWN, -1},
        [PPME_SYSCALL_LCHOWN_X] = (ppm_sc_code[]){PPM_SC_LCHOWN, -1},
        [PPME_SYSCALL_FCHOWN_E] = (ppm_sc_code[]){PPM_SC_FCHOWN, -1},
        [PPME_SYSCALL_FCHOWN_X] = (ppm_sc_code[]){PPM_SC_FCHOWN, -1},
        [PPME_SYSCALL_FCHOWNAT_E] = (ppm_sc_code[]){PPM_SC_FCHOWNAT, -1},
        [PPME_SYSCALL_FCHOWNAT_X] = (ppm_sc_code[]){PPM_SC_FCHOWNAT, -1},
        [PPME_SYSCALL_UMOUNT_1_E] = (ppm_sc_code[]){PPM_SC_UMOUNT, -1},
        [PPME_SYSCALL_UMOUNT_1_X] = (ppm_sc_code[]){PPM_SC_UMOUNT, -1},
        [PPME_SOCKET_ACCEPT4_6_E] = (ppm_sc_code[]){PPM_SC_ACCEPT4, -1},
        [PPME_SOCKET_ACCEPT4_6_X] = (ppm_sc_code[]){PPM_SC_ACCEPT4, -1},
        [PPME_SYSCALL_UMOUNT2_E] = (ppm_sc_code[]){PPM_SC_UMOUNT2, -1},
        [PPME_SYSCALL_UMOUNT2_X] = (ppm_sc_code[]){PPM_SC_UMOUNT2, -1},
        [PPME_SYSCALL_PIPE2_E] = (ppm_sc_code[]){PPM_SC_PIPE2, -1},
        [PPME_SYSCALL_PIPE2_X] = (ppm_sc_code[]){PPM_SC_PIPE2, -1},
        [PPME_SYSCALL_INOTIFY_INIT1_E] = (ppm_sc_code[]){PPM_SC_INOTIFY_INIT1, -1},
        [PPME_SYSCALL_INOTIFY_INIT1_X] = (ppm_sc_code[]){PPM_SC_INOTIFY_INIT1, -1},
        [PPME_SYSCALL_EVENTFD2_E] = (ppm_sc_code[]){PPM_SC_EVENTFD2, -1},
        [PPME_SYSCALL_EVENTFD2_X] = (ppm_sc_code[]){PPM_SC_EVENTFD2, -1},
        [PPME_SYSCALL_SIGNALFD4_E] = (ppm_sc_code[]){PPM_SC_SIGNALFD4, -1},
        [PPME_SYSCALL_SIGNALFD4_X] = (ppm_sc_code[]){PPM_SC_SIGNALFD4, -1},
        [PPME_ASYNCEVENT_E] = NULL,
        [PPME_ASYNCEVENT_X] = NULL,
        [PPME_SYSCALL_MEMFD_CREATE_E] = (ppm_sc_code[]){PPM_SC_MEMFD_CREATE, -1},
        [PPME_SYSCALL_MEMFD_CREATE_X] = (ppm_sc_code[]){PPM_SC_MEMFD_CREATE, -1},
        [PPME_SYSCALL_PIDFD_GETFD_E] = (ppm_sc_code[]){PPM_SC_PIDFD_GETFD, -1},
        [PPME_SYSCALL_PIDFD_GETFD_X] = (ppm_sc_code[]){PPM_SC_PIDFD_GETFD, -1},
        [PPME_SYSCALL_PIDFD_OPEN_E] = (ppm_sc_code[]){PPM_SC_PIDFD_OPEN, -1},
        [PPME_SYSCALL_PIDFD_OPEN_X] = (ppm_sc_code[]){PPM_SC_PIDFD_OPEN, -1},
        [PPME_SYSCALL_INIT_MODULE_E] = (ppm_sc_code[]){PPM_SC_INIT_MODULE, -1},
        [PPME_SYSCALL_INIT_MODULE_X] = (ppm_sc_code[]){PPM_SC_INIT_MODULE, -1},
        [PPME_SYSCALL_FINIT_MODULE_E] = (ppm_sc_code[]){PPM_SC_FINIT_MODULE, -1},
        [PPME_SYSCALL_FINIT_MODULE_X] = (ppm_sc_code[]){PPM_SC_FINIT_MODULE, -1},
        [PPME_SYSCALL_MKNOD_E] = (ppm_sc_code[]){PPM_SC_MKNOD, -1},
        [PPME_SYSCALL_MKNOD_X] = (ppm_sc_code[]){PPM_SC_MKNOD, -1},
        [PPME_SYSCALL_MKNODAT_E] = (ppm_sc_code[]){PPM_SC_MKNODAT, -1},
        [PPME_SYSCALL_MKNODAT_X] = (ppm_sc_code[]){PPM_SC_MKNODAT, -1},
        [PPME_SYSCALL_NEWFSTATAT_E] = (ppm_sc_code[]){PPM_SC_NEWFSTATAT, -1},
        [PPME_SYSCALL_NEWFSTATAT_X] = (ppm_sc_code[]){PPM_SC_NEWFSTATAT, -1},
        [PPME_SYSCALL_PROCESS_VM_READV_E] = (ppm_sc_code[]){PPM_SC_PROCESS_VM_READV, -1},
        [PPME_SYSCALL_PROCESS_VM_READV_X] = (ppm_sc_code[]){PPM_SC_PROCESS_VM_READV, -1},
        [PPME_SYSCALL_PROCESS_VM_WRITEV_E] = (ppm_sc_code[]){PPM_SC_PROCESS_VM_WRITEV, -1},
        [PPME_SYSCALL_PROCESS_VM_WRITEV_X] = (ppm_sc_code[]){PPM_SC_PROCESS_VM_WRITEV, -1},
        [PPME_SYSCALL_DELETE_MODULE_E] = (ppm_sc_code[]){PPM_SC_DELETE_MODULE, -1},
        [PPME_SYSCALL_DELETE_MODULE_X] = (ppm_sc_code[]){PPM_SC_DELETE_MODULE, -1},
        [PPME_SYSCALL_SETREUID_E] = (ppm_sc_code[]){PPM_SC_SETREUID, -1},
        [PPME_SYSCALL_SETREUID_X] = (ppm_sc_code[]){PPM_SC_SETREUID, -1},
        [PPME_SYSCALL_SETREGID_E] = (ppm_sc_code[]){PPM_SC_SETREGID, -1},
        [PPME_SYSCALL_SETREGID_X] = (ppm_sc_code[]){PPM_SC_SETREGID, -1},
};

#if defined(__GNUC__) || (__STDC_VERSION__ >= 201112L)
_Static_assert(sizeof(g_events_to_sc_map) / sizeof(*g_events_to_sc_map) == PPM_EVENT_MAX,
               "Missing entries in g_events_to_sc_map table.");
#endif

int scap_get_modifies_state_ppm_sc(uint8_t ppm_sc_array[PPM_SC_MAX]) {
	if(ppm_sc_array == NULL) {
		return SCAP_FAILURE;
	}

	/* Clear the array before using it.
	 * This is not necessary but just to be future-proof.
	 */
	memset(ppm_sc_array, 0, sizeof(*ppm_sc_array) * PPM_SC_MAX);

	uint8_t events_array[PPM_EVENT_MAX] = {0};
	// Collect EF_MODIFIES_STATE events
	for(int event_nr = 2; event_nr < PPM_EVENT_MAX; event_nr++) {
		if(g_event_info[event_nr].flags & EF_MODIFIES_STATE &&
		   (g_event_info[event_nr].category & EC_SYSCALL ||
		    g_event_info[event_nr].category & EC_TRACEPOINT)) {
			events_array[event_nr] = 1;
		}
	}

	// Transform them into ppm_sc
	scap_get_ppm_sc_from_events(events_array, ppm_sc_array);

	// Append UF_NEVER_DROP syscalls too!
	for(int syscall_nr = 0; syscall_nr < SYSCALL_TABLE_SIZE; syscall_nr++) {
		if(g_syscall_table[syscall_nr].flags & UF_NEVER_DROP) {
			uint32_t code = g_syscall_table[syscall_nr].ppm_sc;
			ppm_sc_array[code] = 1;
		}
	}
	return SCAP_SUCCESS;
}

int scap_get_events_from_ppm_sc(const uint8_t ppm_sc_array[PPM_SC_MAX],
                                uint8_t events_array[PPM_EVENT_MAX]) {
	if(ppm_sc_array == NULL || events_array == NULL) {
		return SCAP_FAILURE;
	}

	/* Clear the array before using it.
	 * This is not necessary but just to be future-proof.
	 */
	memset(events_array, 0, sizeof(*events_array) * PPM_EVENT_MAX);

	// Load associated events from event_table, skip generics
	for(int ev = 0; ev < PPM_EVENT_MAX; ev++) {
		const ppm_sc_code *sc_codes = g_events_to_sc_map[ev];
		while(sc_codes && *sc_codes != -1) {
			const ppm_sc_code sc_code = *sc_codes;
			sc_codes++;
			if(ppm_sc_array[sc_code]) {
				events_array[ev] = 1;
				break;
			}
		}
	}

	return SCAP_SUCCESS;
}

int scap_get_ppm_sc_from_events(const uint8_t events_array[PPM_EVENT_MAX],
                                uint8_t ppm_sc_array[PPM_SC_MAX]) {
	if(events_array == NULL || ppm_sc_array == NULL) {
		return SCAP_FAILURE;
	}

	/* Clear the array before using it.
	 * This is not necessary but just to be future-proof.
	 */
	memset(ppm_sc_array, 0, sizeof(*ppm_sc_array) * PPM_SC_MAX);

	// Load associated ppm_sc from event_table
	for(int ev = 0; ev < PPM_EVENT_MAX; ev++) {
		if(!events_array[ev]) {
			continue;
		}

		const ppm_sc_code *sc_codes = g_events_to_sc_map[ev];
		while(sc_codes && *sc_codes != -1) {
			ppm_sc_array[*sc_codes] = 1;
			sc_codes++;
		}
	}
	return SCAP_SUCCESS;
}

ppm_sc_code scap_ppm_sc_from_name(const char *name) {
	int start = 0;
	int max = PPM_SC_MAX;
	const char *sc_name = name;

	if(name == NULL) {
		return PPM_SC_UNKNOWN;
	}

	for(int i = start; i < max; i++) {
		/* We need the strlen because all empty entries in the syscall_info_table are "", so
		 * if we pass a "" we will have a match!
		 */
		if(strlen(sc_name) != 0 && strcmp(sc_name, scap_get_ppm_sc_name(i)) == 0) {
			return i;
		}
	}
	return PPM_SC_UNKNOWN;
}

ppm_sc_code scap_native_id_to_ppm_sc(int native_id) {
	if(native_id < 0 || native_id >= SYSCALL_TABLE_SIZE) {
		return PPM_SC_UNKNOWN;
	}
	return g_syscall_table[native_id].ppm_sc;
}

/* Here we must be sure that there is a 1:1 relation between syscall_id:ppm_sc
 * otherwise there is the risk to return only the first occurrence
 */
int scap_ppm_sc_to_native_id(ppm_sc_code sc_code) {
	for(int syscall_nr = 0; syscall_nr < SYSCALL_TABLE_SIZE; syscall_nr++) {
		if(g_syscall_table[syscall_nr].ppm_sc == sc_code) {
			return syscall_nr;
		}
	}
	return -1;
}
