[CWS-5648] disable sysctl events and snapshot when only PEDS is enabled (#44252)

paulcacheux · web-flow · commit 5f8c092d7d80 · 2025-12-16T08:51:30.000Z
### What does this PR do?

When running in PEDS mode, we should disable sysctl events. This PR does exactly that.

### Motivation

### Describe how you validated your changes

### Additional Notes


Co-authored-by: paul.cacheux &lt;paul.cacheux@datadoghq.com&gt;
diff --git a/pkg/security/module/cws_linux.go b/pkg/security/module/cws_linux.go
@@ -24,6 +24,7 @@ func DisableRuntimeSecurity(config *config.Config) {
 	config.Probe.NetworkEnabled = false
 	config.RuntimeSecurity.ActivityDumpEnabled = false
 	config.RuntimeSecurity.SecurityProfileEnabled = false
+	config.RuntimeSecurity.SysCtlEnabled = false
 }
 
 // platform specific init function

Original file line number	Diff line number	Diff line change
`@@ -24,6 +24,7 @@ func DisableRuntimeSecurity(config *config.Config) {`
`24`	`24`	`config.Probe.NetworkEnabled = false`
`25`	`25`	`config.RuntimeSecurity.ActivityDumpEnabled = false`
`26`	`26`	`config.RuntimeSecurity.SecurityProfileEnabled = false`
	`27`	`+ config.RuntimeSecurity.SysCtlEnabled = false`
`27`	`28`	`}`
`28`	`29`
`29`	`30`	`// platform specific init function`