event-auditor: ebpf for pattern-map, process-spec-map and process-filter-map management

[geyslan]

• license attribution for kernel code

  
  As per https://www.kernel.org/doc/html/v5.0/process/license-rules.html, the SPDX license identifier should be added in the first possible line and follow different comment styles based on the file type.

  C source: // SPDX-License-Identifier: <SPDX License Expression>
  C header: /* SPDX-License-Identifier: <SPDX License Expression> */
  ASM:      /* SPDX-License-Identifier: <SPDX License Expression> */
  

  P.S. The checkpatch.pl kernel script can be incorporated into CI to check these coding style rules. E.g.: ./checkpatch.pl --no-tree -f file.c

  There's also vscode extension for that matter.

  Name: checkpatch
  Id: idanp.checkpatch
  Description: Using linux kernel checkpatch tool to lint code.
  VS Marketplace Link: https://marketplace.visualstudio.com/items?itemName=idanp.checkpatch

  Partially fixes add proper license headers (GPL, Apache) #280

• add #include guards to shared.h
• libbpf
  • get rid of libbpf git submodule downloading it to KubeArmor/BPF
    • create install_libbpf.sh
    • run install_libbpf.sh in contribution/self-managed-k8s/setup.sh
• ebpf code
  • move them to KubeArmor/BPF
  • create ebpf manager for pattern-map, process-spec-map and process-filter-map
    • onNewProcess
    • onExitProcess
• eBPF programs and maps handlers (userspace)
  • Rename/Create eBPF object Handlers (a file per handler)
  • processSpecHandler.go: use InitializeProcessMaps() and DestroyProcessMaps() as the start and end points

It will fix: #293.

WIP

[geyslan]

This PR was closed and split into #295 and other to be raised.