read BPF license from ELF

[leodido]

What type of PR is this?

/kind bug

/kind feature

Any specific area of the project related to this PR?

/area driver-ebpf

/area libscap

What this PR does / why we need it:

While it is indeed correct that the license section is in the BPF probe source code (see 8918b95),
our custom BPF loader should read it by parsing the ELF and then accordingly use the read value in the bpf_attr instance.

Which issue(s) this PR fixes:

Rather than always enforcing the license in the libscap loader - like the #37 attempt does - this PR reads the actual value from the ELF and then uses it in our custom loading phases (see load_tracepoint > bpf_load_program)

Special notes for your reviewer:

Supersedes #37

• rebase on master as soon build: upgrade deps and cmakefiles improvements #30 gets merged in.

Does this PR introduce a user-facing change?:

fix(userspace/libscap): read the license section for the BPF ELF
fix(userspace/libscap): pass the read license to the `bpf` syscall via `bpf_attr`

[leogr]

This is great! 👏

I have tried your change on Falco (by using a test branch) and everything works as expected (see here).

So #37 is not needed anymore.

PS
I will approve again once it is rebased on master.

[poiana]

LGTM label has been added.

Git tree hash: 83f9320effa113ae586161017264da7a1e376e81

[leogr]

/retest

[leogr]

/approve

🥳

[poiana]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: leogr

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [leogr]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment