fix(sinsp): Support 'mmap' and 'mmap2' system calls filtering by fd values

[eddyduer-sysdig]

What type of PR is this?

/kind bug

Any specific area of the project related to this PR?

/area driver-kmod

/area driver-bpf

/area driver-modern-bpf

/area libsinsp

Does this PR require a change in the driver versions?

/version driver-SCHEMA-version-minor

What this PR does / why we need it:

Parser assumed that FD is always first. For mmap and mmap2 this is not the case, so parsing using any of the FD fields (e.g. fd.name) did not work

Which issue(s) this PR fixes:

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

fix: filtering for 'mmap' and 'mmap2' using fd values

[poiana]

Welcome @eddyduer-sysdig! It looks like this is your first PR to falcosecurity/libs 🎉

[github-actions]

Please double check driver/SCHEMA_VERSION file. See versioning.

/hold

[jasondellaluce]

Hey @eddyduer-sysdig thanks for the contribution. Few points for proceeding:

• If the PR is ready for review, please remove the Draft status so that other maintainers will know they can take a look
• Make sure you sign-off all your commit as that's a requirement for our governance

@FedeDP do we usually bump the SCHEMA version minor/patch when we change the EF_* flags of events, like in this case?

[FedeDP]

/milestone next-driver

[Andreagit97]

/approve

[poiana]

LGTM label has been added.

Git tree hash: 342d1580030f0cef45458fcbbaf3928ec6d8ab44

[FedeDP]

/approve

[poiana]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Andreagit97, eddyduer-sysdig, FedeDP

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [Andreagit97,FedeDP]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[jasondellaluce]

/unhold