fix: use thread safe wrapper for ksyms table

pkg/ebpf/ksymbols.go

@@ -8,6 +8,7 @@ import (
 
 	"github.com/aquasecurity/tracee/pkg/errfmt"
 	"github.com/aquasecurity/tracee/pkg/events"
+	"github.com/aquasecurity/tracee/pkg/utils/ksyms"
 )
 
 var maxKsymNameLen = 64 // Most match the constant in the bpf code
@@ -39,7 +40,7 @@ func SendKsymbolsToMap(bpfKsymsMap *libbpfgo.BPFMap, ksymbols map[string]*helper
 
 func (t *Tracee) NewKernelSymbols() error {
 	// reading kallsyms needs CAP_SYSLOG
-	kernelSymbols, err := helpers.NewLazyKernelSymbolsMap()
+	kernelSymbols, err := ksyms.NewSafeKsymbolTable()
 	if err != nil {
 		return errfmt.WrapError(err)
 	}

pkg/utils/ksyms/safe_ksym_table.go

@@ -0,0 +1,49 @@
+package ksyms
+
+import (
+	"sync"
+
+	"github.com/aquasecurity/libbpfgo/helpers"
+)
+
+type safeKsymbolTable struct {
+	helpers.KernelSymbolTable
+	l *sync.Mutex
+}
+
+// NewSafeKsymbolTable returns a safe wrapper for implementations of the KernelSymbolTable interface.
+// The wrapper is needed because provided implementations do not guarentee thread-safety.
+func NewSafeKsymbolTable() (*safeKsymbolTable, error) {
+	table, err := helpers.NewLazyKernelSymbolsMap()
+	if err != nil {
+		return nil, err
+	}
+
+	return &safeKsymbolTable{
+		table, new(sync.Mutex),
+	}, nil
+}
+
+func (t *safeKsymbolTable) TextSegmentContains(addr uint64) (bool, error) {
+	t.l.Lock()
+	defer t.l.Unlock()
+	return t.KernelSymbolTable.TextSegmentContains(addr)
+}
+
+func (t *safeKsymbolTable) GetSymbolByName(owner string, name string) (*helpers.KernelSymbol, error) {
+	t.l.Lock()
+	defer t.l.Unlock()
+	return t.KernelSymbolTable.GetSymbolByName(owner, name)
+}
+
+func (t *safeKsymbolTable) GetSymbolByAddr(addr uint64) (*helpers.KernelSymbol, error) {
+	t.l.Lock()
+	defer t.l.Unlock()
+	return t.KernelSymbolTable.GetSymbolByAddr(addr)
+}
+
+func (t *safeKsymbolTable) Refresh() error {
+	t.l.Lock()
+	defer t.l.Unlock()
+	return t.KernelSymbolTable.Refresh()
+}