ROX-30296: track POSIX ACL changes via inode_set_acl LSM hook

[Stringy]

Description

Adds ACL tracking via inode_set_acl hook. Due to lack of path info in this hook, it is only possible to monitor inode-tracked files (i.e. those on the host file system) this is similar to how xattrs are tracked.

An extension to the BPF checks.c file has been added, because this hook does not exist on older kernels (where ACLs were applied via xattrs, so we still have coverage on those old kernels, just through a different mechanism.)

Tests factor in this optional nature of the hook, and will only run when we know the kernel supports it.

Relies on stackrox/stackrox#21357

Checklist

• Patch has a change log entry OR does not need one.
• Investigated and inspected CI test results
• Updated documentation accordingly

Automated testing

• Added unit tests
• Added integration tests
• Added regression tests

If any of these don't apply, please comment below.

Testing Performed

Tested locally, with setfacl, and the integration tests.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: CHILL

Plan: Enterprise

Run ID: 7d5d7ee5-de4d-4559-8441-fcf0ee4811bc

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch giles/ROX-30296-track-acl

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov-commenter]

Codecov Report

❌ Patch coverage is 0% with 106 lines in your changes missing coverage. Please review.
✅ Project coverage is 31.17%. Comparing base (0116956) to head (516433e).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
fact/src/event/mod.rs	0.00%	78 Missing ⚠️
fact/src/bpf/checks.rs	0.00%	17 Missing ⚠️
fact/src/bpf/mod.rs	0.00%	11 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #878      +/-   ##
==========================================
- Coverage   32.23%   31.17%   -1.06%     
==========================================
  Files          21       21              
  Lines        2736     2829      +93     
  Branches     2736     2829      +93     
==========================================
  Hits          882      882              
- Misses       1851     1944      +93     
  Partials        3        3              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.