fix: clock time detection

The detection was rework since the libbpfgo func BPFHelperIsSupported
changed. When supported is true we avoid checking error, otherwise we
raise an error when the operation is not permitted.

In the last case the helper is not supported so the monotonic is set.

pkg/ebpf/tracee.go

@@ -3,14 +3,12 @@ package ebpf
 import (
 	gocontext "context"
 	"encoding/binary"
-	"errors"
 	"fmt"
 	"os"
 	"strconv"
 	"strings"
 	"sync"
 	"sync/atomic"
-	"syscall"
 	"unsafe"
 
 	"kernel.org/pub/linux/libs/security/libcap/cap"
@@ -386,15 +384,15 @@ func (t *Tracee) Init(ctx gocontext.Context) error {
 		func() error {
 			supported, innerErr := bpf.BPFHelperIsSupported(bpf.BPFProgTypeKprobe, bpf.BPFFuncKtimeGetBootNs)
 
-			// only report if operation not permitted
-			if errors.Is(innerErr, syscall.EPERM) {
-				return innerErr
+			if innerErr != nil {
+				logger.Debugw("Detect clock timing", "error", innerErr)
 			}
 
-			// If BPFFuncKtimeGetBootNs is not available, eBPF will generate events based on monotonic time.
 			if !supported {
+				// Use monotonic time if the helper isn't supported.
 				usedClockID = traceetime.CLOCK_MONOTONIC
 			}
+
 			return nil
 		})
 	if err != nil {