[auditbeat/fim/kprobes] Correct seccomp policy for arm64

[pkoutsovasilis]

seccomp.ModifyDefaultPolicy for amd64 whitelists the specified syscalls. On the contrary, for arm64 the same function blacklists them 🙂 Thus this PR adjusts the code of kprobes Backend of FIM to add the missing syscalls only for amd64.

Proposed commit message

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Disruptive User Impact

N/A

Author's Checklist

N/A

How to test this PR locally

N/A

Related issues

N/A

Use cases

N/A

Screenshots

N/A

Logs

N/A

[haesbaert]

Forgive my ignorance, but aren't you missing the //go:build amd64 in the beginning of the file?

[pkoutsovasilis]

Forgive my ignorance, but aren't you missing the //go:build amd64 in the beginning of the file?

no worries, because the name ends with _linux_amd64.go this file will compile only for linux and amd64. Makes sense?

[pkoutsovasilis]

@haesbaert since you left a comment and if I am not mistaken it is resolved, for the shake of completion (and since you are part of sec-linux-platform) could you also approve this PR?

[haesbaert]

@haesbaert since you left a comment and if I am not mistaken it is resolved, for the shake of completion (and since you are part of sec-linux-platform) could you also approve this PR?

ofc ❤️