fix(bpf): disable preemption during hook processing

[Molter73]

Description

This prevents the hooks from being preempted and replaced by another hook that might overwrite the contents of the shared per-CPU maps before sending the event to the ringbuffer. A similar issue was found to be corrupting events in Falco and is addressed in this PR of our fork, see the discussion there for more details: stackrox/falcosecurity-libs#98

In order to call bpf_preempt_enable/disable aya needs to support ksyms, which is currently only supported on main, therefore we pin the dependency to a commit known to work. We will unpin this once a new aya release is created.

As a final simplification, to prevent new hooks and branches in existing one from having to remember to re-enable preemption before exiting some macro magic is used. We can potentially leverage these macros to define some other common patterns in the future.

Checklist

• Patch has a change log entry OR does not need one.
• Investigated and inspected CI test results
• Updated documentation accordingly

Automated testing

• Added unit tests
• Added integration tests
• Added regression tests

If any of these don't apply, please comment below.

Testing Performed

CI should be enough.

Summary by CodeRabbit

• Bug Fixes
  • Improved compatibility with updated kernel interfaces and map operations.
  • Enhanced reliability across file, path, inode, mount, rename, directory, symlink, instantiation, extended-attribute, and access-control event handling.
  • Preserved existing event tracking and error handling behavior across supported monitoring hooks.
  • Improved operation across environments with differing kernel capabilities.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: CHILL

Plan: Enterprise

Run ID: eab96400-bbaa-448e-88c7-860811f35496

📥 Commits

Reviewing files that changed from the base of the PR and between bfb13c4 and 61cebd7.

📒 Files selected for processing (1)

• fact-ebpf/src/bpf/main.c

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

---

📝 Walkthrough

Walkthrough

The PR pins aya to a Git revision, updates map insertion calls for reference-based APIs, and replaces manual LSM BPF entry points with generated wrappers that preserve existing handler logic and preemption guards.

Changes

AYA and LSM compatibility

Layer / File(s)	Summary
AYA revision and map API alignment Cargo.toml, fact/src/bpf/mod.rs, fact/src/host_scanner.rs	The workspace pins aya to a Git revision. LPM trie and inode map insertions now pass references to their arguments.
Generated LSM wrapper macros fact-ebpf/src/bpf/main.c	Variadic macros generate typed LSM entry points, inline handlers, preemption guards, and shared return paths.
LSM hook migration fact-ebpf/src/bpf/main.c	File, path, inode, mount, rename, directory, symlink, instantiation, xattr, and ACL hooks use the generated wrappers. Existing event processing, metrics handling, null handling, and error behavior remain in place.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 61ceb

The PR updates BPF hook processing to prevent preemption and pins a compatible dependency version; no actionable merge-blocking risk remains beyond normal checks and review.

Suggested reviewers: joukovirtanen, rhacs-bot

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 3 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely describes the primary change: disabling preemption during BPF hook processing.
Description check	✅ Passed	The description explains the problem, solution, Aya dependency pin, macro changes, checklist status, and testing performed. The unchecked documentation and automated-test items are addressed by the st…

Full details: Description check

Explanation

The description explains the problem, solution, Aya dependency pin, macro changes, checklist status, and testing performed. The unchecked documentation and automated-test items are addressed by the stated scope and the note that CI is sufficient.

✨ Finishing Touches 💡 2

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch mauro/feat/disable-preemption

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov-commenter]

Codecov Report

❌ Patch coverage is 0% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 33.96%. Comparing base (489b29f) to head (61cebd7).
⚠️ Report is 3 commits behind head on main.

Files with missing lines	Patch %	Lines
fact/src/bpf/mod.rs	0.00%	1 Missing ⚠️
fact/src/host_scanner.rs	0.00%	1 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1569   +/-   ##
=======================================
  Coverage   33.96%   33.96%           
=======================================
  Files          22       22           
  Lines        3421     3421           
  Branches     3421     3421           
=======================================
  Hits         1162     1162           
  Misses       2254     2254           
  Partials        5        5           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.