generate a systemd service SystemCallFilter by specifying a list of syscalls, eg. from strace -c

systemd-callgroups.sh

#!/bin/bash
# generate SystemCallFilter from list of syscalls
#
# run this script, type or paste a list of syscalls and this script will return the required @callgroups
## Sjon Hortensius, 2020
set -ue

# dynamically initialize callgroups
declare -A callgroup
while IFS= read -r line
do
	[[ ${#line} -eq 0 ]] && continue

	if [[ $line == @* ]]
	then
		group=${line:1}
	elif [[ $line != \ *\#* ]]
	then
		callgroup[${line##    }]=$group
	fi
done < <(systemd-analyze syscall-filter)

# now read syscalls, eg. from strace -c
while read -r syscall
do
	if [[ ${callgroup[$syscall]} ]]
	then
		echo \@${callgroup[$syscall]}
	else
		echo $syscall
	fi
done | sort -u | tr '\n' ' '