Include bpftrace by src part2 pkg bpftrace

[christoph-zededa]

has to be changed once #3915 is merged

[eriknordmark]

Is there a standard place to pull this from an repo upstream so that we can get a version string etc?

[christoph-zededa]

I switched to the official repository and put my code as patches on top.

[eriknordmark]

It would be good to have a security review with @shjala once he is back - to make sure we are aware of how to handle arbitrary ebpf code or whether we will instead somehow provide approved and signed ebpf programs.

[shjala]

@eriknordmark we had a discussion with Christoph, the main concerns are two helper functions 1) bpf_override_return which can be disabled via CONFIG_BPF_KPROBE_OVERRIDE kernel config and 2) bpf_probe_write_user which can be disabled by setting kernel lockdown mode to confidentiality but that might cause some problems as it comes with a bunch more restrictions like blocking direct PCI access or blocking raw io port access which might cause problem for Qemu, so a small patch for kernel to disable those helper functions unconditionally might be more appropriate.

The proposed changes will unblock the PR for now...

[christoph-zededa]

Moved to draft state until I have done the security changes for the kernel.