Using systemtap for rewriting syscalls?

[Riccardo Murri <riccardo dot murri at uzh dot ch>]

Hello,

I'm completely new to systemtap, so please pardon me if this question
is trivial or is already answered in the docs -- there's so much to read!

On one of the systems I manage, a directory has become unreadable but
I cannot take the system down for repairs for some time.  However,
directories below it are fine, and the unreadable directory is only an
issue with programs that recursively perform `lstat()` on every path
component.

Would it be possible to use systemtap to live-patch the system to
return a fixed value for `lstat()` if the path argument is the path to
the unreadable dir?  In pseudo-code:

    probe kernel.syscall.lstat {
      if (argument_path == "/path/to/bad/dir") {
        /* return fake statbuf */
        memcpy({.st_dev=..., .st_ino=..., ...}, argument_buf);
      } else {
        /* forward call to kernel */
        do_real_lstat(argument_buf, argument_path);
    }

If that makes sense, where can I start looking for examples to adapt
and/or relevant documentation?

Thank you very much for any hint!

Riccardo