[Upstream main d2b5c6a ]

[Includes username fix Upstream main 96e5028 ]

Cache UIDs/Usernames so we reduce:
- I/O on /etc/passwd for each execution especially for root user and
  other system user IDs as by default lot of software runs under those.
- Some users may watch /etc/passwd access, so caching those entries
  will reduce Tetragon generated events and improve performance overall.

We only cache UIDs from 0..999 as these are considered standard
system users, that are set by most distros packages. Distros maintainers
usually do great job to not clash such users. For anything above > 999
we do not cache it, we can that if users want such support later.

Reference:
https://github.com/systemd/systemd/blob/main/docs/UIDS-GIDS.md#summary

Signed-off-by: Djalal Harouni <[email protected]>

[ Upstream main dac9959 ]

Signed-off-by: Djalal Harouni <[email protected]>

Right now we resolve uid->username only for processes that
start after tetragon. To also handle the ones that start before,
we need to resolve the username during /proc fs scanning.

This patch adds userinfo module part of sensors/exec and call it
for both bpf exec sensors and proc_reader procfs scanning.

We keep same semantics if a process is not in mount and user host
namespaces we do not resolve its username.

Signed-off-by: Djalal Harouni <[email protected]>

Signed-off-by: Djalal Harouni <[email protected]>

Signed-off-by: Djalal Harouni <[email protected]>

Add two metrics:

- process_metadata_username_ignored_not_in_host_namespaces:
  This is to note that we did not perform uid->username resolution
  and it was ignored due the target process not being in mount or
  user host namespaces.

- process_metadata_username_failed: that is to note that we did
  try to resolve target process uid->username but it failed for some
  reasons.

Signed-off-by: Djalal Harouni <[email protected]>