On Sun, Nov 01, 2020 at 10:27:38PM +0100, Paweł Jasiak wrote: > I am trying to run examples from man fanotify.7 but fanotify_mark always > fail with errno = EFAULT. > > fanotify_mark declaration is > > SYSCALL_DEFINE5(fanotify_mark, int, fanotify_fd, unsigned int, flags, > __u64, mask, int, dfd, > const char __user *, pathname) Don't worry about that. You aren't calling the SYSCALL, you're calling glibc and glibc is turning it into a syscall. extern int fanotify_mark (int __fanotify_fd, unsigned int __flags, uint64_t __mask, int __dfd, const char *__pathname) > When > > fanotify_mark(4, FAN_MARK_ADD | FAN_MARK_ONLYDIR, > FAN_CREATE | FAN_ONDIR, AT_FDCWD, 0xdeadc0de) The last argument is supposed to be a pointer to a string. I'm guessing there's no string at 0xdeadc0de.