[Feature] eBPF backend

[kxxt]

Add an eBPF backend for

• System-wide tracing ([Feature] System-wide tracing with alternative backends #33)
• Emulating old follow-fork behavior to provide a mostly compatible interface like the old one

Benefits

• We can have gdb session nested since we no longer need ptrace.
• Detaching a tracee. This can cause some trouble for the detached tracee when seccomp-bpf is enabled(default) under ptrace mode.

Down Sides

• eBPF usually requires root
• Needs to check for kernel support and portability.
• Probably no performance improvement. Ptrace + seccomp-bpf already offers nearly zero performance overhead.

Implementation

• System-wide tracing ([Feature] System-wide tracing with alternative backends #33)

This should be fairly easy because we only need to attach to execve{,at}_sys{enter,exit} tracepoints/(fentry/fexit) and listen for events then passing them back to userspace.

Some changes are required at TUI layer to remove Breakpoint Manager and Hit Manager for this mode.

• Emulating old follow-fork behavior to provide a mostly compatible interface like the old one

✔️ Use a map to hold all tracees and follow fork in sched_process_fork.

Or alternatively maybe create a new pidns and only do tracing in that pid namespace.

[kxxt]

Available in 0.6