feat: block kernel module auto-loading from containers

[dorser]

No description provided.

[Copilot]

Pull request overview

Adds a new security event and enforcement hook to prevent kernel module auto-loading initiated from containers, and surfaces that event through the existing operators/output pipeline.

Changes:

• Introduces a new event type (CAP_MODULE_AUTOLOAD) across C headers and Go operators.
• Extends the cap-restrict BPF event payload with module_name and emits a new LSM event on kernel_module_request.
• Updates output formatting and gadget metadata to display/describe the requested module name.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
internal/operators/output.go	Adds description + output formatting for the new module-autoload event and module name field
internal/operators/operators.go	Adds a new numeric event type constant and its human-readable name mapping
include/micromize/event_types.h	Defines the new EVENT_TYPE_CAP_MODULE_AUTOLOAD enum value
gadgets/cap-restrict/program.bpf.h	Extends the cap-restrict event struct with module_name storage
gadgets/cap-restrict/program.bpf.c	Adds an LSM hook to capture/block kernel module requests and populate module_name
gadgets/cap-restrict/gadget.yaml	Documents the new module_name datasource field

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.