Signed-off-by: Anastasios Papagiannis <tasos.papagiannnis@gmail.com>

Clone events are handled in event_wake_up_new_task program. In the
case of __event_find_parent failure, we do not send an event to the
user. On the other hand, execve_map_get has already added a new
entry in execve_map. This causes an inconsistency between execve_map
and the user space process cache that may lead for events to go through
the eventcache and waing of a process that never arrives.

To solve this, we try to find our parent in the beginning of the
program. If we fail to do so, we simply stop the execution of this
program (and do not add any entries in the execve_map). This commit
also does some refactoring to cleanup the code.

Signed-off-by: Anastasios Papagiannis <tasos.papagiannnis@gmail.com>

In Tetragon we do not report process_exec and process_exit events for
kernel threads. When searching for the parent of a kernel thread, we
failed to do so and we simply ignore that.

This patch optimizes that path as we abort early by checking the
task_struct's flags.

Signed-off-by: Anastasios Papagiannis <tasos.papagiannnis@gmail.com>