Update probed function sys_execve to do_execve

[Northern-Lights]

This is to address #184: #184

sys_execve does not appear to be an available filter function:

# grep execve /sys/kernel/debug/tracing/available_filter_functions 
audit_log_execve_info
do_execveat_common.isra.37
__ia32_compat_sys_execve
__ia32_compat_sys_execveat
__ia32_sys_execve
__ia32_sys_execveat
__x64_sys_execve
__x64_sys_execveat
do_execve
do_execveat

In order to fix this, I tried __x64_sys_execve and do_execve. Both appear to allow the daemon to proceed with initialization and to properly operate the packet filter. The UI connects to the daemon and pops up windows upon alerts with no issue.

[Northern-Lights]

If changing the syscall will break compatibility, I could make a slice of possible syscalls, e.g. []string{"sys_execve", "do_execve"}. Then, if an error is returned on the first one, we can move on and try the next.

[evilsocket]

need some time to test this, did you go for the slice approach?

[Northern-Lights]

Sorry, I saw your comment a little late. It is not currently trying both in a slice, although I see you've already merged the PR. I'll be happy to add it in if anything pops up in the issues section.