added syscall information to init_module event

Signed-off-by: qjerome <qjerome@rawsec.lu>

kunai-common/src/bpf_events/events/init_module.rs

@@ -23,6 +23,15 @@ pub enum InitModuleArgs {
     FInit(FInit),
 }
 
+impl InitModuleArgs {
+    pub const fn syscall_name(&self) -> &'static str {
+        match self {
+            Self::Init(_) => "init_module",
+            Self::FInit(_) => "finit_module",
+        }
+    }
+}
+
 impl InitModuleArgs {
     pub fn uargs(&self) -> u64 {
         match self {

kunai/src/bin/main.rs

@@ -810,6 +810,7 @@ impl EventProcessor {
             ancestors: self.get_ancestors_string(&info),
             command_line,
             exe: exe.into(),
+            syscall: event.data.args.syscall_name().into(),
             module_name: event.data.name.to_string(),
             args: event.data.uargs.to_string(),
             loaded: event.data.loaded,

kunai/src/events.rs

@@ -576,6 +576,7 @@ pub struct InitModuleData {
     pub ancestors: String,
     pub command_line: String,
     pub exe: File,
+    pub syscall: String,
     pub module_name: String,
     pub args: String,
     pub loaded: bool,