correct rule conditions to support syscall variants

[leogr]

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind bug

/kind rule-update

Any specific area of the project related to this PR?

/area rules

What this PR does / why we need it:

This PR fixes some rule/macro conditions to:

• Make Mkdir binary dirs also work with mkdirat syscall
• Make Modify binary dirs also work with rename, renameat, and unlinkat syscalls
• Make Create files below dev also work with openat syscall

Additional context can be found in commits' messages.

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

This is my first PR that fix the rules :)

Test cases

• Mkdir binary dirs with mkdirat

docker run --rm -it falcosecurity/event-generator:0.3.0 run syscall.MkdirBinaryDirs

• Modify binary dirs with rename

sudo touch /bin/test-falco-rules
sudo rename test-falco-rules test-falco-rules-renamed /bin/test-falco-rules

• Modify binary dirs with renameat

docker run --rm -it falcosecurity/event-generator:0.3.0 run syscall.ModifyBinaryDirs

• Modify binary dirs with unlinkat

sudo touch /bin/test-falco-rules
sudo rm /bin/test-falco-rules

• Create files below dev with openat

docker run --rm -it falcosecurity/event-generator:0.3.0 run syscall.CreateFilesBelowDev

Additional notes
There're still some missing syscalls that should be added but are not currently supported by sinsp, for example:

• renameat2 ( see also "renameat2" syscall support draios/sysdig#1603 )
• openat2

I will fill a separate issue for those Reported on #676

Related issues

• Alerts for mkdir should include mkdirat #337
• An experiment to automatically test rules with the event-generator as suggested in Falco Rule Integration Test event-generator#30

Does this PR introduce a user-facing change?:

rule(Mkdir binary dirs): correct condition in macro `bin_dir_mkdir` to catch `mkdirat` syscall
rule(Modify binary dirs): correct condition in macro `bin_dir_rename` to catch `rename`, `renameat`, and `unlinkat` syscalls
rule(Create files below dev): correct condition to catch `openat` syscall

[leogr]

/cc @Kaizhe

[leogr]

/milestone 0.24.0

[leodido]

SGTM

[poiana]

LGTM label has been added.

Git tree hash: b1c76d6eb22d7050be66f1e5fc8480ec88505098

[mstemm]

Great improvement!

[poiana]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: fntlnz, leodido, mstemm

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• rules/OWNERS [fntlnz,leodido,mstemm]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment