fix path rename signature

[banditopazzo]

On newer kernel you need to specify the full signature, even if you don't use for last parameters

Ref: #318

[vadorovsky]

Looks like it fails on older kernels. I will try to think of some solutions, but so far the only one I have in mind is to unpack arguments directly from the void *ctx and skip the ones we don't need (flags). ctx is just an array of pointers, so we can try to treat it as size_t *.

Aya handles arguments of LSM program by treating the context as *const usize, so that should work:

https://github.com/aya-rs/aya/blob/f9b34fe76fe8a1f39c4897f2d53703858a5c6527/ebpf/aya-ebpf/src/args.rs#L33-L39

We could do that manually like:

static __always_inline void on_path_rename(void *ctx) {
  size_t *args = (size_t*) ctx;

  struct path *old_dir = (struct path*) args[0];
  struct dentry *old_dentry = (struct dentry*) args[1];
  struct path *new_dir = (struct path*) args[2];
  struct dentry *new_dentry (struct dentry*) args[3];

  pid_t tgid = tracker_interesting_tgid(&GLOBAL_INTEREST_MAP);
  if (tgid < 0)
    return;

  [...]
}

I think we would need to modify PULSAR_LSM_HOOK macro or make some other one which skips the argument unpacking.

[vadorovsky]

Just one nit.

Great to see that it works and also nice to know that BPF_PROG macro doesn't mask the ctx variable!

[vadorovsky]

Suggested change

	if ((LINUX_KERNEL_VERSION >= KERNEL_VERSION(5, 19, 0))) {
	if (LINUX_KERNEL_VERSION >= KERNEL_VERSION(5, 19, 0)) {