pkg/subsystem: skip small subsystems

And regenerate the Linux rules file.

3 files changed, 28 insertions, 18 deletions

diff --git a/pkg/subsystem/linux/parents.go b/pkg/subsystem/linux/parents.go
index f5d6efb2a..739514c68 100644
--- a/pkg/subsystem/linux/parents.go
+++ b/pkg/subsystem/linux/parents.go
@@ -13,7 +13,7 @@ import (
 // parentTransformations applies all subsystem list transformations that have been implemented.
 func parentTransformations(matrix *match.CoincidenceMatrix,
 	list []*entity.Subsystem) ([]*entity.Subsystem, error) {
-	list = dropEmptySubsystems(matrix, list)
+	list = dropSmallSubsystems(matrix, list)
 	list = dropDuplicateSubsystems(matrix, list)
 	err := setParents(matrix, list)
 	if err != nil {
@@ -49,11 +49,13 @@ func setParents(matrix *match.CoincidenceMatrix, list []*entity.Subsystem) error
 	return nil
 }
 
-// dropEmptySubsystems removes subsystems for which we have found no matches in the filesystem tree.
-func dropEmptySubsystems(matrix *match.CoincidenceMatrix, list []*entity.Subsystem) []*entity.Subsystem {
+// dropSmallSubsystems removes subsystems for which we have found only a few matches in the filesystem tree.
+func dropSmallSubsystems(matrix *match.CoincidenceMatrix, list []*entity.Subsystem) []*entity.Subsystem {
+	const cutOffCount = 2
+
 	newList := []*entity.Subsystem{}
 	for _, item := range list {
-		if matrix.Count(item) > 0 {
+		if matrix.Count(item) > cutOffCount || len(item.Syscalls) > 0 {
 			newList = append(newList, item)
 		}
 	}
diff --git a/pkg/subsystem/linux/parents_test.go b/pkg/subsystem/linux/parents_test.go
index 46a8a99f3..06f7e1a3c 100644
--- a/pkg/subsystem/linux/parents_test.go
+++ b/pkg/subsystem/linux/parents_test.go
@@ -12,7 +12,7 @@ import (
 	"github.com/stretchr/testify/assert"
 )
 
-func TestDropEmptySubsystems(t *testing.T) {
+func TestDropSmallSubsystems(t *testing.T) {
 	kernel := &entity.Subsystem{}
 	net := &entity.Subsystem{}
 	fs := &entity.Subsystem{}
@@ -22,8 +22,10 @@ func TestDropEmptySubsystems(t *testing.T) {
 	matrix.Record(kernel, net)
 	matrix.Record(kernel, fs)
 	matrix.Record(kernel, net, fs)
+	matrix.Record(kernel, net, fs)
+	matrix.Record(kernel, net, fs)
 
-	ret := dropEmptySubsystems(matrix, []*entity.Subsystem{kernel, net, fs, legal})
+	ret := dropSmallSubsystems(matrix, []*entity.Subsystem{kernel, net, fs, legal})
 	assert.ElementsMatch(t, []*entity.Subsystem{kernel, net, fs}, ret)
 }
 
diff --git a/pkg/subsystem/linux/subsystems_test.go b/pkg/subsystem/linux/subsystems_test.go
index 52cf8540c..f13009fad 100644
--- a/pkg/subsystem/linux/subsystems_test.go
+++ b/pkg/subsystem/linux/subsystems_test.go
@@ -169,17 +169,23 @@ func TestLinuxSubsystemParents(t *testing.T) {
 
 func prepareTestLinuxRepo(t *testing.T, maintainers []byte) fs.FS {
 	return fstest.MapFS{
-		`fs/ext4/fsync.c`:        {},
-		`fs/ext4/mmp.c`:          {},
-		`fs/freevxfs/vxfs_olt.c`: {},
-		`fs/file.c`:              {},
-		`fs/internal.h`:          {},
-		`include/linux/fs.h`:     {},
-		`include/linux/mm.h`:     {},
-		`include/net/ah.h`:       {},
-		`mm/memory.c`:            {},
-		`mm/shmem.c`:             {},
-		`MAINTAINERS`:            {Data: maintainers},
+		`fs/ext4/fsync.c`:          {},
+		`fs/ext4/fsync.h`:          {},
+		`fs/ext4/mmp.c`:            {},
+		`fs/ext4/mmp.h`:            {},
+		`fs/freevxfs/vxfs_olt.c`:   {},
+		`fs/freevxfs/vxfs_olt.h`:   {},
+		`fs/freevxfs/file.c`:       {},
+		`fs/file.c`:                {},
+		`fs/internal.h`:            {},
+		`include/linux/fs.h`:       {},
+		`include/linux/mm.h`:       {},
+		`include/linux/shmem_fs.h`: {},
+		`include/net/ah.h`:         {},
+		`mm/memory.c`:              {},
+		`mm/shmem.c`:               {},
+		`mm/shmem2.c`:              {},
+		`MAINTAINERS`:              {Data: maintainers},
 	}
 }
 
@@ -249,7 +255,7 @@ M:	Developer <email_shmem@email.com>
 L:	tmpfs@kvack.org
 S:	Maintained
 F:	include/linux/shmem_fs.h
-F:	mm/shmem.c
+F:	mm/shmem*
 
 THE REST
 M:	Developer <email_rest@email.com>