[FEATURE] Adding support for prctl Syscall

[therealbobo]

Motivation

The prctl syscall can be used to manipulate the information about a process. In particular can be used to change the process name in attempt to hide a malicious behaviour with a "false identity" (e.g. renaming itself to ssh). It would be nice if Falco could detect such a behaviour.

Feature

Implement the prctl syscall in the 3 drivers.

[Andreagit97]

Ei @therealbobo thank you for that! this syscall should be already tracked in this issue falcosecurity/falco#1998

[therealbobo]

Hey @Andreagit97, I didn't notice that! I'd like to keep this open because the prctl could hide a malicious behaviour and I think that its implementation could be very useful for the community! If you want I could try to work on it! 😄

[jasondellaluce]

Thanks @therealbobo! I agree with you this syscall can have high priority due to the good security-related info it carries. Looking forward to see what you come up with!

[jasondellaluce]

/milestone next-driver