New bpf features to consider

[yanivagman]

As bpf evolves, it gets new features in almost every new kernel release.
Following is a list of features to consider integrating with tracee:

1. kernel 4.16: functions can be declared without “always inline”. This may reduce instructions count and program size
2. kernel 4.18: Use cgroup id for containers (bpf_get_current_cgroup_id()). Another bpf helper allows getting the cgroup ids of an ancestor at some level (can be used to set policies for container ids)
3. kernel 5.3: bpf bounded loops - https://lwn.net/Articles/794934/
4. kernel 5.5: Use fentry fexit program types (based on bpf trampolines) which have zero overhead compared to kprobes. https://lwn.net/Articles/804937/
5. kernel 5.8: New capabilities - cap_bpf, cap_perfmon - https://lwn.net/Articles/822362/
6. kernel 5.8: the preferred way to submit events is using “ringbuf_output” - https://github.com/iovisor/bcc/blob/master/docs/reference_guide.md#4-bpf_ringbuf_output