feat(ebpf): support events fallback with events state

pkg/ebpf/tracee.go

@@ -206,6 +206,29 @@ func (t *Tracee) addDependencyEventToState(evtID events.ID, dependantEvts []even
 	}
 }
 
+// updateDependenciesStateRecursive change all dependencies submit states to match
+// the current state of event emit and dependants submit.
+func (t *Tracee) updateDependenciesStateRecursive(eventNode *dependencies.EventNode) {
+	for _, dependencyEventID := range eventNode.GetDependencies().GetIDs() {
+		dependencyNode, ok := t.eventsDependencies.GetEvent(dependencyEventID)
+		if !ok { // event does not exist anymore in dependencies
+			t.removeEventFromState(dependencyEventID)
+			continue
+		}
+		dependencyState := t.eventsState[dependencyEventID]
+		newState := events.EventState{
+			Emit:   dependencyState.Emit,
+			Submit: dependencyState.Emit,
+		}
+		for _, dependantID := range dependencyNode.GetDependants() {
+			dependantState := t.eventsState[dependantID]
+			newState.Submit |= dependantState.Submit
+		}
+		t.eventsState[dependencyEventID] = newState
+		t.updateDependenciesStateRecursive(dependencyNode)
+	}
+}
+
 func (t *Tracee) removeEventFromState(evtID events.ID) {
 	logger.Debugw("Cancel event", "event", events.Core.GetDefinitionByID(evtID).GetName())
 	delete(t.eventsState, evtID)
@@ -248,6 +271,11 @@ func New(cfg config.Config) (*Tracee, error) {
 		func(node *dependencies.EventNode) {
 			t.removeEventFromState(node.GetID())
 		})
+	t.eventsDependencies.SubscribeChange(
+		func(oldNode *dependencies.EventNode, newNode *dependencies.EventNode) {
+			t.updateDependenciesStateRecursive(oldNode)
+			t.addDependenciesToStateRecursive(newNode)
+		})
 
 	// Initialize capabilities rings soon
 
@@ -928,7 +956,7 @@ func (t *Tracee) validateKallsymsDependencies() {
 	}
 
 	validateEvent := func(eventId events.ID) {
-		missingDepSyms := getUnavKsyms(evtDefSymDeps(eventId), t.kernelSymbols)
+		missingDepSyms := getUnavailbaleKsymbols(evtDefSymDeps(eventId), t.kernelSymbols)
 		shouldFailEvent := false
 		for _, symDep := range missingDepSyms {
 			if symDep.IsRequired() {