add new syscalls collecting support

[MagpieRYL]

Motivation

Some intrusion method:

• inserting kernel module for persistence
• make a device node on disk utilizing mknod, for gaining larger attack surface

Examples in container escape:

• container starts with CAP_SYS_MODULE: inserting kernel module
• container starting with CAP_SYS_ADMIN: mknod can make a device node on disk, providing debugfs a chance to overwrite host's filesystem, with ability from the dangerous CAP_SYS_ADMIN config: mknod syscall

Feature

• https://falco.org/docs/reference/rules/supported-events/
• 👆 from the doc here, it seems that mknod and init_module has not been supported.
• Apply for the support.

[Andreagit97]

ei @MagpieRYL thank you for that, I added these syscalls into our umbrella issue #1998!
You are right! these syscalls are not supported in Falco or at least they are supported in "generic" mode (i.e. you can see when these syscalls are called but not which are their parameters)
Here you can find a more detailed report https://github.com/falcosecurity/libs/blob/master/driver/report.md

• the green ones are the "fully" supported
• the yellow ones are supported only in "generic" mode

Btw since these syscalls can have a relevant syscall impact maybe a generic implementation is not enough we will work on that ASAP :)

[incertum]

Since Falco 0.35.0 all generic syscalls are exposed to Falco, simply write a Falco rule, including init_module, and finit_module and mknod and many more. Please note Andrea's comment around them being generic hence we do not log specific args, but for Falco you can still access all of the proc.* fields from the process that issued these system calls.

[incertum]

@MagpieRYL would you be interested in contributing Falco rules https://github.com/falcosecurity/rules? We need more robust rules for container escapes in general.

[Andreagit97]

We should address this issue with:

• feat(driver): support for init_module, finit_module syscalls libs#1242
• feat(driver): support for mknod/mknodat syscall libs#1270

(Thanks @therealbobo !)