eBPF support for Falco

[gianlucaborello]

This PR supports eBPF for Falco. No special changes to the code are needed as long as Falco gets built with an eBPF-enabled libscap (now on sysdig/dev). One can simply set the environment variable SYSDIG_BPF_PROBE as described in https://github.com/draios/sysdig/wiki/eBPF-(beta) and everything will work:

gianluca@sid:~$ docker run -i -t --rm --name falco --privileged -v /var/run/docker.sock:/host/var/run/docker.sock -v /dev:/host/dev -v /proc:/host/proc:ro -v /boot:/host/boot:ro -v /lib/modules:/host/lib/modules:ro -v /usr:/host/usr:ro --net=host -e SYSDIG_BPF_PROBE="" falco
* Setting up /usr/src links from host
* Mounting debugfs
Found kernel config at /host/boot/config-4.17.0-rc3+
* Trying to compile BPF probe falco-probe-bpf (falco-probe-bpf-0.1.1dev-x86_64-4.17.0-rc3+-0224696ca075f29c3b267198dbbd4a1c.o)
* BPF probe located, it's now possible to start sysdig
Wed May  9 17:22:35 2018: Falco initialized with configuration file /etc/falco/falco.yaml
Wed May  9 17:22:35 2018: Loading rules from file /etc/falco/falco_rules.yaml:
Wed May  9 17:22:35 2018: Loading rules from file /etc/falco/falco_rules.local.yaml:
17:22:37.159101504: Notice A shell was spawned in a container with an attached terminal (user=root practical_swanson (id=ddabdd12bf25) shell=bash parent=<NA> cmdline=bash  terminal=34831)

If we later need it, but I doubt it, we can patch the command line arguments to actually take a "--bpf" parameter to directly control the BPF probe path with sinsp.