ebpf: don't submit exit events unless required

exit and exit_group syscall are always submitted to userspace even when
not chosen by the user.
Only submit these events when required.

Author: yanivagman

pkg/ebpf/c/tracee.bpf.c

@@ -2535,7 +2535,7 @@ int tracepoint__raw_syscalls__sys_enter(struct bpf_raw_tracepoint_args *ctx)
     if (sys->id != SYS_EXIT && sys->id != SYS_EXIT_GROUP && sys->id != SYS_RT_SIGRETURN) {
         sys->ts = data.context.ts;
         data.task_info->syscall_traced = true;
-    } else if (sys->id != SYS_RT_SIGRETURN) {
+    } else if ((sys->id != SYS_RT_SIGRETURN) && (should_submit(sys->id, data.config))) {
         data.buf_off = sizeof(event_context_t);
         data.context.argnum = 0;
         save_to_submit_buf(&data, &sys->args.args[0], sizeof(int), 0);