Support Postfix operator in matchBinaries selector

[anfedotoff]

Is there an existing issue for this?

• I have searched the existing issues

Is your feature request related to a problem?

Sometimes you know only binary name and this binary can be in different folders on different machines. In operator is limited by elements count.

Describe the feature you would like

Selector can look like:

- matchBinaries:
      - operator: "Postfix"
        values:
        - "qemu-system-x86_64"

Describe your proposed solution

No response

Code of Conduct

• I agree to follow this project's Code of Conduct

[mtardy]

Thanks for opening the issue, the foundation work can be found here:

• Rework the matchBinaries selector implementation #1731
• Add Prefix and NotPrefix operators to matchBinaries #1732
• bpf: read and copy proc exe at execve for matchBinaries #1926

As stated in #1731:

Prepare the way to add the Prefix and NotPrefix operators. And after Postfix and NotPostfix.

You should be able to imitate #1732 for Postfix and NotPostfix.

As we talked about, I'll assign you to this since you wanted to work on it, please ping me for review when you have something. I can help you along the way if needed since this is something I wanted to eventually do (but I'm pleased you want to take care of it).