events: add execve and execveat to security_file_open syscalls (#2166)

These missing events were causing invalid parses for the
syscall_pathname argument.

Author: NDStrahilevitz

pkg/ebpf/tracee_test.go

@@ -144,7 +144,10 @@ func Test_getTailCalls(t *testing.T) {
 				{MapName: "sys_exit_tails", MapIndexes: []uint32{uint32(events.Dup), uint32(events.Dup2), uint32(events.Dup3)}, ProgName: "sys_dup_exit_tail"},
 				{MapName: "sys_enter_init_tail", MapIndexes: []uint32{uint32(events.Dup), uint32(events.Dup2), uint32(events.Dup3)}, ProgName: "sys_enter_init"},
 				{MapName: "sys_exit_init_tail", MapIndexes: []uint32{uint32(events.Dup), uint32(events.Dup2), uint32(events.Dup3)}, ProgName: "sys_exit_init"},
-				{MapName: "sys_enter_init_tail", MapIndexes: []uint32{uint32(events.Open), uint32(events.Openat), uint32(events.Openat2), uint32(events.OpenByHandleAt)}, ProgName: "sys_enter_init"},
+				{MapName: "sys_enter_init_tail", MapIndexes: []uint32{
+					uint32(events.Open), uint32(events.Openat), uint32(events.Openat2), uint32(events.OpenByHandleAt),
+					uint32(events.Execve), uint32(events.Execveat),
+				}, ProgName: "sys_enter_init"},
 				{MapName: "sys_enter_init_tail", MapIndexes: []uint32{uint32(events.Mmap), uint32(events.Mprotect)}, ProgName: "sys_enter_init"},
 				{MapName: "sys_enter_init_tail", MapIndexes: []uint32{uint32(events.Ptrace), uint32(events.ClockSettime)}, ProgName: "sys_enter_init"},
 				{MapName: "sys_enter_submit_tail", MapIndexes: []uint32{uint32(events.Ptrace), uint32(events.ClockSettime)}, ProgName: "sys_enter_submit"},

pkg/events/events.go

@@ -5151,7 +5151,10 @@ var Definitions = eventDefinitions{
 			},
 			Dependencies: dependencies{
 				TailCalls: []TailCall{
-					{MapName: "sys_enter_init_tail", MapIndexes: []uint32{uint32(Open), uint32(Openat), uint32(Openat2), uint32(OpenByHandleAt)}, ProgName: "sys_enter_init"},
+					{MapName: "sys_enter_init_tail", MapIndexes: []uint32{
+						uint32(Open), uint32(Openat), uint32(Openat2), uint32(OpenByHandleAt),
+						uint32(Execve), uint32(Execveat),
+					}, ProgName: "sys_enter_init"},
 				},
 			},
 			Sets: []string{"default", "lsm_hooks", "fs", "fs_file_ops"},