Try out and improve the new skill /add-syscall

[milantracy]

Description

the new claude skill add-syscall was added at fbef16a

please share your feedback on the skill, PRs are welcome

Is this feature related to a specific bug?

No response

Do you have a specific solution in mind?

No response

[milantracy]

I found some candidates that may not need heavy effort level:

1. fallocate — FALLOC_FL_KEEP_SIZE (easiest) - File: pkg/sentry/syscalls/linux/sys_file.go:1625

• Currently mode != 0 returns ENOTSUP — meaning all flags are rejected.
• FALLOC_FL_KEEP_SIZE is the most commonly used flag (used by databases, ext4 prealloc). It just means "allocate space but don't grow the visible file size." The mode is already passed
  through to file.Allocate(), and the gofer filesystem already forwards it to the host — so this may be as simple as removing the mode != 0 check and adding validation for supported mode
  combinations in the syscall handler.
• tmpfs would also need handling in allocateLocked.

2. preadv2/pwritev2 — RWF_DSYNC / RWF_SYNC (easy)

• File: pkg/sentry/fsimpl/gofer/regular_file.go:130
• Currently only RWF_HIPRI is accepted; RWF_DSYNC and RWF_SYNC return EOPNOTSUPP.
• For gofer files backed by a host FD, these could be forwarded to the host preadv2/pwritev2. For 9P, they could trigger an explicit fsync after the write. Relatively self-contained.

3. prctl — PR_GET_THP_DISABLE / PR_SET_THP_DISABLE (easy)

• File: pkg/sentry/syscalls/linux/sys_prctl.go:347-348
• Currently hits EmitUnimplementedEvent + EINVAL.
• gVisor doesn't use transparent huge pages, so PR_GET_THP_DISABLE can return 1 (disabled) and PR_SET_THP_DISABLE can be a no-op. Very small change — just add two cases to the switch.

4. prctl — PR_GET_TIMERSLACK / PR_SET_TIMERSLACK (easy)

• File: pkg/sentry/syscalls/linux/sys_prctl.go:342-343
• Timer slack is used for timer coalescing. The kernel Task struct may already have a TimerSlack field. This would be a simple get/set of that field.

5. fallocate — FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE (medium)

• Hole-punching is common (used by tmpfiles, databases, container runtimes). tmpfs already supports decommitting pages, so the mechanism exists. Gofer could forward to the host.

6. getrusage — ru_maxrss (medium)

• File: pkg/sentry/syscalls/linux/sys_rusage.go
• Maximum RSS is tracked by the memory manager. It's just not plumbed into the rusage struct yet. Programs like /usr/bin/time use this.