[auditbeat] fim: implement ebpf backend

[mmat11]

Proposed commit message

This PR adds an additional opt-in eBPF backend to the file_integrity module. See related issues for more context.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Author's Checklist

• open source https://github.com/elastic/ebpfevents
• support setxattrs file modification events
• support directories creation events(?)

How to test this PR locally

Enable the eBPF backend in the file_integrity module config by specifying force_backend: ebpf and observe file events after running auditbeat.

Related issues

• File Integrity Monitoring | User Information - Linux integrations#7401
• [auditbeat] fim: implement kprobes backend #37796

[mmat11]

/test auditbeat integTest

[mmat11]

/test auditbeat integTest arm

[mergify]

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b matt/fim-ebpf upstream/matt/fim-ebpf
git merge upstream/main
git push upstream matt/fim-ebpf

[mmat11]

/test auditbeat integTest arm

[mmat11]

/test auditbeat integTest arm

[andrewkroh]

Just a few minor comments, I don't think anything that requires another look.

For future reference, in these larger changesets I would prefer if we didn't force push after the first peer review comments come in. Being able to view the changes since you last reviewed is valuable. At least in this repo, you are required to squash at merge so you still have an opportunity to clean up the commit message.

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 04234eb

History

• 💔 Build #1213 failed df7dc6f
• 💚 Build #1208 succeeded b9982c8

cc @mmat11

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 04234eb

History

• 💔 Build #1208 failed df7dc6f

cc @mmat11

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 04234eb

History

• 💔 Build #377 failed df7dc6f

cc @mmat11

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 04234eb

History

• 💔 Build #2426 failed df7dc6f

cc @mmat11

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 04234eb

History

• 💔 Build #1538 failed df7dc6f

cc @mmat11

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 04234eb

History

• 💔 Build #2877 failed df7dc6f
• 💚 Build #2799 succeeded ba46a56
• 💚 Build #2787 succeeded 3e7db0b
• 💔 Build #2456 failed 9b4acb4
• 💔 Build #2407 failed c372c54

cc @mmat11

[pkoutsovasilis]

LGTM!