Fix file_modification event & tv_nsec read

[geyslan]

Close: #5242

1. Explain what the PR does

a3b4acc fix(ebpf): mask bit 31 from tv_nsec

Mask MG_FLOOR flag (bit 31) from tv_nsec in get_ctime_nanosec_from_inode
to strip the multigranularity floor marker that kernels >= 6.13 with
CONFIG_FS_MGTIME store in the raw inode field (commit 4e40eff).

--

0072d7f fix(ebpf): detect file_modification on filesystems bypassing VFS write hooks

Filesystems like btrfs update inode timestamps directly without calling
file_modified()/file_update_time(), so Tracee's write-time kprobes never
fire and file_modification events go undetected.

Add a close-time fallback in trace_filp_close: compare ctime and file
size at close against values captured at fd_install. If either changed,
submit the event. The existing write-time detection path continues to
work for filesystems that call file_modified() (e.g. tmpfs, ext4).

• Introduce file_mod_value_t (op, open_ctime, open_size) as the
  file_modification_map value type, replacing the bare s32
• Filter fd_install to only track regular files opened for writing
  (FMODE_WRITE), reducing map pressure
• Defer path string extraction in filp_close until an event is actually
  submitted
• Use get_file_id() instead of get_file_info() where only device, inode,
  and ctime are needed, avoiding unnecessary path resolution

--

2. Explain how to test it

One may want to test writing to files on tmpfs, ext4, btrfs etc. After, compare the new ctime output by Tracee with what you can get from the file via stat --printf='%.9Z\n' ${filename} | sed 's/\.//'.

3. Other comments

[Copilot]

Pull request overview

This PR fixes issue #5242 where file_modification events were not being reported for all file modifications, particularly on filesystems like btrfs that bypass VFS write hooks. The fix includes two distinct changes: (1) masking bit 31 from tv_nsec to handle the multigranularity floor flag introduced in kernel 6.13, and (2) implementing a close-time fallback detection mechanism for filesystems that update inode timestamps directly without calling file_modified() or file_update_time().

Changes:

• Added tv_nsec bit 31 masking to strip the MG_FLOOR flag from kernels >= 6.13 with CONFIG_FS_MGTIME
• Introduced close-time fallback detection in trace_filp_close that compares ctime and file size at close against values captured at open
• Enhanced the file_modification_map to store open_ctime and open_size in addition to the operation state

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
pkg/events/core.go	Clarified probe requirement comments to be more concise
pkg/ebpf/c/types.h	Added file_mod_value_t struct to store operation state, open_ctime, and open_size
pkg/ebpf/c/maps.h	Updated file_modification_map value type from s32 to file_mod_value_t
pkg/ebpf/c/tracee.bpf.c	Enhanced fd_install to filter FMODE_WRITE files and store open state; added close-time detection in filp_close; updated common_file_modification_ret to preserve open_ctime
pkg/ebpf/c/common/filesystem.h	Added bit 31 masking to tv_nsec to handle MG_FLOOR flag in kernels >= 6.13

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 35.43%. Comparing base (235daa0) to head (a3b4acc).
⚠️ Report is 186 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5243      +/-   ##
==========================================
+ Coverage   33.51%   35.43%   +1.91%     
==========================================
  Files         250      239      -11     
  Lines       28908    31524    +2616     
==========================================
+ Hits         9688    11169    +1481     
- Misses      18609    19642    +1033     
- Partials      611      713     +102     

Flag	Coverage Δ
unit	35.43% <ø> (+1.91%)	⬆️

Files with missing lines	Coverage Δ
pkg/events/core.go	52.17% <ø> (ø)

... and 109 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[geyslan]

Pinging for reviewing. 😬