Add remaining events from bypass

[haesbaert]

commit bdffe76 (HEAD -> rem-events, origin/rem-events)
Author: Christiano Haesbaert haesbaert@elastic.co
Date: Wed Oct 29 15:28:42 2025 +0100

Mount /dev/shm and fix "source" for all mounts.

This virtual mounts can have any arbitrary string in the first parameter, it's
what it shows up on /proc/mounts as the first word.

Our cgroup2 code is incorrectly looking at the first word of each line, instead
of the third, see https://github.com/elastic/quark/issues/257

RHEL 9.3 doesn't work for shmget.

Since t_memfd and t_shm_open depend on QQ_FILE, also disable them where we know
our file probes fail.

commit cefe5ff
Author: Christiano Haesbaert haesbaert@elastic.co
Date: Tue Oct 28 20:19:58 2025 +0100

Add QQ_SHM

This enables all the shared memory related events outside of bypass under
QQ_SHM.

They were condensed into quark_shm{} since it fits quark better, to have on
event type by "subject".

Bugs
~~~~
MEMFD_OPEN's path is broken in the probe, so disable it.
SHMEM_OPEN is a bit buggy, a shmem_open(O_CREAT...) generates a file event
instead of a SHMEM_OPEN event, but an open on an existing one works.

https://github.com/elastic/quark/issues/255
https://github.com/elastic/quark/issues/256

commit c1e2f26
Author: Christiano Haesbaert haesbaert@elastic.co
Date: Tue Oct 28 11:57:21 2025 +0100

Add QQ_MODULE_LOAD

Pretty straightforward, don't bother saving allocations for strings like we do
for QQ_FILE, this is a uber low volume event, so just allocate and save some
code.

commit c7827c6
Author: Christiano Haesbaert haesbaert@elastic.co
Date: Tue Oct 28 09:18:54 2025 +0100

Add QQ_PTRACE

Before we could only use the ptrace probes in bypass mode, and for that we were
abusing QQ_MEMFD, start peeling the stuff out of QQ_MEMFD so we can have it all
outside bypass.

PTRACE is pretty straightforward, we just bubble up what we get from the probes.

ptrace

[nicholasberlin]

That was fast. Thanks!

[haesbaert]

I think this is ready for some bashing, I didn't obsess much so there's likely still something wrong.
Tomorrow I'll properly test it, have to write some test programs to trigger the events and whatnot.

[nicholasberlin]

LGTM