Update README.md according to latest config changes

Author: axtloss

README.md

@@ -12,8 +12,9 @@ syscalls:
   - umount2
     log: true
     block: true
-    arg0: 1
-    arg0_char: false
+    arg0:
+        content: 1
+        isChar: false
 ```
 the name of the object is what gets interpreted as the syscall name, here the name `umount2` is taken, but `SYS_umount2` would also be accepted.
 each syscall object can have a total of 6 args, reaching from arg0 to arg5, each also having an Argo_char option, which needs to be set if the argN field is set.
@@ -25,23 +26,63 @@ syscalls:
   - umount2
     log: true
     block: true
-    arg0: 3
-    arg0_char: false
+    arg0:
+        content: "/some/path"
+        isChar: true
+        isFdesc: false
+        matchtype: "begins"
+```
+In this example, syscall interceptor checks if the argument in the syscall begins with "/some/path", meaning that trying to call `umount2` on `/some/path` or `/some/path/nested` would be blocked.
+
+
+  - umount2
+    log: true
+    block: true
+    arg0:
+        content: 3
+        isChar: false
 ```
 In the case, that the argument is a char pointer, it can be specified how the argument should be matched, possible options are "full", "begins" and "contains":
 ```
 log_file: /some/random/path
+syscalls:It is also possible that some syscalls (such as arg0 in mount_setattr) use file descriptors to access files, in this case it is not possible for syscall-interceptor to intercept a sycall based on a clear path, instead the `isFdesc` option has to be set to true:
+```
+log_file: /some/random/path
 syscalls:
-  - umount2
+  - mount_setattr
     log: true
     block: true
-    arg0: "/some/path"
-    arg0_char: true
-    arg0_matchtype: "begins"
+    arg0:
+        content: "/some/path"
+        isChar: true
+        isFdesc: true
+        matchtype: "begins"
 ```
-In this example, syscall interceptor checks if the argument in the syscall begins with "/some/path", meaning that trying to call `umount2` on `/some/path` or `/some/path/nested` would be blocked.
 
-In the future an extra tool may be developed to either fully generate or at least assist with the generation of a configuration file.
+In the case where a syscall accepts both (also mount_setattr), two entries for the same syscall can be configured:
+```
+log_file: /some/random/path
+syscalls:
+  - mount_setattr
+    log: true
+    block: true
+    arg0:
+        content: "/some/path"
+        isChar: true
+        isFdesc: true
+        matchtype: "begins"
+  - mount_setattr
+    log: true
+    block: true
+    arg1:
+        content: "/some/path"
+        isChar: true
+        isFdesc: false
+        matchtype: "begins"
+```
+In this case a `mount_setattr` syscall gets blocked if either the file descriptor in `arg0` points to `/some/path` or if `arg1` equals `/some/path`
+
+In the future an extra tool may be developed to either fully generate or at least assist with the generation of a configuration file, for now `strace` can be used to check which syscalls a program uses.
 
 ## Building
 Dependencies: