Build bpftool from source (#1954)

Downstream builds with ubi 8, which ships a bpftool that is old and
doesn't work with the latest Falco changes on Arm and Z. In order to
circumvent this, we can simply build from source.

.gitmodules

@@ -64,3 +64,7 @@
 [submodule "third_party/uthash"]
 	path = builder/third_party/uthash
 	url = https://github.com/troydhanson/uthash.git
+[submodule "builder/third_party/bpftool"]
+	path = builder/third_party/bpftool
+	url = https://github.com/libbpf/bpftool
+	branch = v7.3.0

builder/Dockerfile

@@ -12,6 +12,7 @@ RUN dnf -y update \
         bison \
         ca-certificates \
         clang-17.0.6 \
+        llvm-17.0.6 \
         cmake \
         cracklib-dicts \
         diffutils \
@@ -42,7 +43,6 @@ RUN dnf -y update \
         valgrind \
         wget \
         which \
-        bpftool \
         # for USDT support
         systemtap-sdt-devel \
     && dnf clean all

builder/install/90-bpftool.sh

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+
+set -e
+
+cd third_party/bpftool
+
+# Replace libbpf with our submodule
+rm -rf libbpf/
+ln -s ../libbpf libbpf
+
+mkdir src/build
+make V=1 -C src ${NPROCS:+-j ${NPROCS}} all install

collector/container/konflux.Dockerfile

@@ -19,7 +19,7 @@ RUN /tmp/.konflux/scripts/subscription-manager-bro.sh register /mnt && \
         wget \
         unzip \
         clang \
-        bpftool \
+        llvm \
         cmake-3.18.2-9.el8 \
         gcc-c++ \
         openssl-devel \