Cgroup

[haesbaert]

Add cgroups to quark_process{}
Only for EBPF atm, basically the same dance we do other paths.
Currently we replace the existing cgroup with the new one for every event, but
likely this is only needed at fork, consider changing this in the future.

+++

Signal root cgroup as /, not NUL
Before this change if a process was in the root cgroup, we would get a zero
length string. If an error ocurred it would also return a zero length string.

Change it so that a successful case of a root process actually sends "/" and not
a zero length string, this way quark can know if it should signal it knows the
cgroup path or not.

[Copilot]

Pull Request Overview

This PR adds support for cgroups in quark_process for EBPF, ensuring that the root cgroup is signaled as "/" rather than as a zero-length string.

• Updates the data structures (quark_process, raw_task) to include a new cgroup field.
• Implements and integrates a new cgroup processing function (sproc_cgroup) and updates event handling and tests accordingly.
• Adjusts documentation and helper functions (e.g., in PathResolver.h and bpf_queue.c) to support proper cgroup resolution.

Reviewed Changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
qutil.c	Added a helper function comment for load_file_nostat
quark_queue_get_event.3	Documented the new cgroup field in the event format
quark.h	Updated structs and flag definitions with cgroup support
quark.c	Added cgroup processing logic, updated free routines, and event flag handling for cgroup
quark-test.c	Updated tests and introduced an openfmt helper for cgroup testing
elastic-ebpf/GPL/Events/PathResolver.h	Modified path resolution to signal root cgroup as "/"
bpf_queue.c	Integrated cgroup extraction from EBPF events into the task structure

Comments suppressed due to low confidence (1)

quark-test.c:602

• [nitpick] Consider using the same variable name (e.g., 'cwd') for the current working directory as used elsewhere in the code to maintain consistency and avoid potential confusion.

char path[PATH_MAX];