# syscall	type		args

# type fd1: fd first argument, sockaddr_un with path, check and replace path
connect		fd1_unix	/var/run/qemu-pr-helper.sock		/var/run/qemu-pr-helper.sock

# type fdret_src: source path first argument, check and replace, return fd
mount		fdret_src	/escalate_badly				/etc

# type dev_check: path first argument, check and replace, allow second argument only
ioctl		dev_check	/dev/tun/tap				/dev/tun/tap