rules: add support to openat2 in default ruleset

[jasondellaluce]

Signed-off-by: Jason Dellaluce [email protected]

What type of PR is this?

/kind feature

/kind rule-update

Any specific area of the project related to this PR?

/area rules

What this PR does / why we need it:

This includes the openat2 in the default rulesets, following up the recent merging of falcosecurity/libs#80.

Which issue(s) this PR fixes:

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

rule(macro open_write): add support to openat2
rule(macro open_read): add support to openat2
rule(macro open_directory): add support to openat2
rule(Create files below dev): add support to openat2
rule(Container Drift Detected (open+create)): add support to openat2

[jasondellaluce]

This is a reference to the umbrella issue listing some of the high-priority missing syscalls, on which the need of openat2 arised: #676 (comment)

[jasondellaluce]

NOTE: This is blocked until #1791 gets merged, as it introduces the libs version bump that includes openat2

[leogr]

/approve

[poiana]

LGTM label has been added.

Git tree hash: 1c264e5ca93dcf5fa4d06c3e9c249f609e0df4d1

[poiana]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jasondellaluce, leogr

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [leogr]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment