main.go: fix missing security lockdown sysfs file

[rafaeldtinoco]

After commit a5bc030, tracee-make stopped being able to run tracee-ebpf because the lack of '/sys/kernel/security' dir inside the container. That also happened to any other system not providing that file.

Exit only if lockdown mode is explicitly set to CONFIDENTIALITY, otherwise ignore it.

Fix: #1396

[rafaeldtinoco]

@simar7 would you mind checking this PR (to see if solves your issue) and +1'ing it so it can be merged ? Thanks!

[simar7]

As discussed offline, we would need to add some unit tests for libbpfgo where this logic is present: https://github.com/aquasecurity/libbpfgo/blob/main/helpers/osinfo.go this would make it easier for the downstream users of libbpfgo to be able to safely use and guard themselves against regressions.

[rafaeldtinoco]

As discussed offline, we would need to add some unit tests for libbpfgo where this logic is present: https://github.com/aquasecurity/libbpfgo/blob/main/helpers/osinfo.go this would make it easier for the downstream users of libbpfgo to be able to safely use and guard themselves against regressions.

I'm adding this as a TODO of aquasecurity/libbpfgo#123 (because we're using that PR to stabilize the next libbpfgo release).

Let me know if you agree to my arguments on the comments you've made. I'll add the unit test to that PR so we're covered for it.

[Edit]
I see you opened aquasecurity/libbpfgo#124 for the osinfo tests (which I agree would be a good initial case to someone wanting to contribute).

[simar7]

As discussed offline, we would need to add some unit tests for libbpfgo where this logic is present: https://github.com/aquasecurity/libbpfgo/blob/main/helpers/osinfo.go this would make it easier for the downstream users of libbpfgo to be able to safely use and guard themselves against regressions.

I'm adding this as a TODO of aquasecurity/libbpfgo#123 (because we're using that PR to stabilize the next libbpfgo release).

Let me know if you agree to my arguments on the comments you've made. I'll add the unit test to that PR so we're covered for it.

[Edit]

I see you opened aquasecurity/libbpfgo#124 for the osinfo tests (which I agree would be a good initial case to someone wanting to contribute).

Yeah sounds good to me. I like to write the tests with the code but it is just one way to go about them.

[rafaeldtinoco]

@grantseltzer not sure if I need another approval (from you, for example) to get this merged. Could you +1 this based on Simars review ? Thanks!

[grantseltzer]

L G T M ! @rafaeldtinoco