AppArmor recorder: add readdir support

internal/pkg/daemon/bpfrecorder/bpf/recorder.bpf.c

@@ -36,6 +36,7 @@
 #define PROT_NONE 0x0
 
 #define S_IFIFO 0010000
+#define S_IFDIR 0040000
 
 #define CAP_OPT_NOAUDIT 0b10
 
@@ -165,13 +166,29 @@ static __always_inline int register_file_event(struct file * file, u64 flags)
         return 0;
     }
 
-    int ok = bpf_d_path(&file->f_path, event->data, sizeof(event->data));
-    if (ok < 0) {
-        bpf_printk("register_file_event bpf_d_path failed: %i\n", ok);
+    int pathlen = bpf_d_path(&file->f_path, event->data, sizeof(event->data));
+    if (pathlen < 0) {
+        bpf_printk("register_file_event bpf_d_path failed: %i\n", pathlen);
         bpf_ringbuf_discard(event, 0);
         return 0;
     }
 
+    if (file->f_inode->i_mode & S_IFDIR) {
+        // more checks than necessary, but only checking each offset
+        // individually makes the ebpf verifier happy.
+        if (pathlen >= 2 && pathlen - 2 < sizeof(event->data) &&
+            pathlen - 1 < sizeof(event->data) &&
+            pathlen < sizeof(event->data)) {
+            if (event->data[pathlen - 2] != '/') {
+                // No trailing slash, add `/` and move null byte.
+                event->data[pathlen - 1] = '/';
+                event->data[pathlen] = '\0';
+            }
+        } else {
+            bpf_printk("failed to fixup directory entry, not enough space.");
+        }
+    }
+
     event->pid = pid;
     event->mntns = mntns;
     event->type = EVENT_TYPE_APPARMOR_FILE;

internal/pkg/daemon/bpfrecorder/bpfrecorder_apparmor.go

@@ -23,7 +23,6 @@ import (
 	"errors"
 	"fmt"
 	"log"
-	"path/filepath"
 	"regexp"
 	"slices"
 	"strings"
@@ -241,8 +240,6 @@ func (b *AppArmorRecorder) GetAppArmorProcessed(mntns uint32) BpfAppArmorProcess
 }
 
 func replaceVarianceInFilePath(filePath string) string {
-	filePath = filepath.Clean(filePath)
-
 	// Replace PID value with a apparmor variable.
 	pathWithPid := regexp.MustCompile(`^/proc/\d+/`)
 	filePath = pathWithPid.ReplaceAllString(filePath, "/proc/@{pid}/")