Add dynamic parameter extraction

The discussion for this PR can be found here https://github.com/cilium/tetragon/issues/3142

This is currently a draft. I wanted to start the discussion before submitting the final code, as I think, it is a big enough PR.

Take this PR in the today state as a proof of concept for dynamic parameter extraction. I will continue to work on this PR until the below checks are done.

At the current state, the PR is able to

[x] Extract parameters from LSM programs
[x] Extract parameters from kprobes programs
[x] Handle exception for uprobes as it is not part of BTF
[ ] Have unit tests for all cases
[ ] Have written documentation

Description

This PR introduce the dynamic parameter extraction

Comments

I do not like the use of OverwriteType parameter. But since the function argSelectorType does not receive EventConfig, it is not possible to search for the type using directly BTF types. So I suggest doing another PR before this one is merged to do so if possible. Then I'll remove the parameter. It is also not possible to add an if condition for uprobes in this function. So if the user defines the parameter, it will overwrite the type at this moment.
I choose to use u8 to store the offset, as the verifier does not allow me to use u16. At this moment, I don't know if it is possible to found offset > 255 in BTF structures. For my uses cases, using u8 was enough.
I would appreciate seeing a closer relationship between BTF and the existing types. This mean that we could directly call it from YAML instead of hard-coding it. At least doing so for primitives types, and hard-code only the complex structures

Test the PR

You can use the following config

apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
  name: "lsm"
spec:
  lsmhooks:
  - hook: "bprm_check_security"
    args:
      - index: 0
        type: "linux_binprm"
        extractParam: "file.f_path.dentry.d_name.name"
        overwriteType: "string"
    selectors:
      - matchArgs:
        - index: 0
          operator: "Postfix"
          values:
            - "ls"
            - "sh"
            - "bash"

If you want to test it with more arguments, you can use bprm_creds_from_file hook. It has struct linux_binprm and struct file which are supported.

Name	Link
Latest commit	1fb7dbca69ced745a76f9f0ca36c5e39ff0dc4a3
Latest deploy log	https://app.netlify.com/sites/tetragon/deploys/674216bc2d27200008186dd3
Deploy Preview	https://deploy-preview-3143--tetragon.netlify.app
Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

cilium / tetragon