Remove SYS_PTRACE

[pellared]

Testing if SYS_PTRACE capability is needed as it seems to be missing in https://github.com/open-telemetry/opentelemetry-go-instrumentation/blob/main/examples/rolldice/docker-compose.yaml.

[pellared]

@edeNFed @RonFed Do you know from where the SYS_PTRACE requirement comes from? I do not think it is valid.

[RonFed]

@edeNFed @RonFed Do you know from where the SYS_PTRACE requirement comes from?

It is there since we are using ptrace to allocate memory for the traced process.
Assuming we are running as root (which we have to assume I think), this is probably not needed

[pellared]

@edeNFed @RonFed Do you know from where the SYS_PTRACE requirement comes from?

It is there since we are using ptrace to allocate memory for the traced process. Assuming we are running as root (which we have to assume I think), this is probably not needed

You are right.

From https://docs.docker.com/engine/reference/run/#runtime-privilege-and-linux-capabilities

The --privileged flag gives all capabilities to the container.

I was thinking if we could run without root (unprivileged). But I do not know enough about eBPF security to know if there is a possibility to securely configure it.

I quickly ran through :

• https://access.redhat.com/security/cve/cve-2022-0002
• https://pentera.io/blog/the-good-bad-and-compromisable-aspects-of-linux-ebpf/

I think we can merge this PR.