Review VM_ vs PROT_ naming for mmap/mprotect-related BPF and events**

[geyslan]

Summary

pkg/ebpf/c/vmlinux_missing.h defines kernel-style VM_READ / VM_WRITE / VM_EXEC / VM_SHARED (145:149:pkg/ebpf/c/vmlinux_missing.h), matching include/linux/mm.h / struct vm_area_struct->vm_flags.

Some call sites also handle values that are not vm_flags but userland protection requests from mmap(2) / mprotect(2) (uapi PROT_*, same numeric bits for R/W/X on typical Linux, different meaning).

The issue is to review every use of those VM_* symbols in the tree (below), decide where the code should use PROT_* names (and optional PROT_* #defines in vmlinux_missing.h for BPF) so readers and future diffs match kernel semantics, and where VM_* must stay because the value is really vma->vm_flags.

Scope: current VM_{READ,WRITE,EXEC} uses (excluding syscall name noise)

File	Program / function	Value being tested	Related events / signals
tracee.bpf.c	trace_mmap_alert	prot = mmap syscall 3rd arg	mem_prot_alert (mmap W|X)
tracee.bpf.c	trace_security_mmap_file	PARM2 prot (mmap request on hook)	shared_object_loaded, security_mmap_file
tracee.bpf.c	trace_security_file_mprotect	PARM2 reqprot	security_file_mprotect, mem_prot_alert (mprotect heuristics)
tracee.bpf.c	same	prev_prot = get_vma_flags(vma)	same — expected to stay VM_*

SYSCALL_PROCESS_VM_WRITEV in arch.h is unrelated; ignore for this review.

User space (out of vmlinux_missing.h but part of the same story)

• pkg/events/parse_args.go: which fields are parsed with ParseMmapProt vs ParseVmFlags for security_file_mprotect, mem_prot_alert, etc. (prot / reqprot vs prev_prot).

• common/parsers/data_parsers.go: ParseMmapProt vs ParseVmFlags already encode the uapi vs kernel split; align naming in docs/comments with BPF once nomenclature is decided.

Acceptance criteria

• Each row above has an explicit decision: keep VM_*, or use PROT_* in code/comments (and add minimal PROT_* in vmlinux_missing.h for BPF if needed, without redefinition clashes with BTF headers).

• Mixed comparisons (e.g. reqprot vs prev_prot) are documented where both layers appear: PROT_* vs VM_* in the same if is intentional and obvious.

• Optional: short dev note in vmlinux_missing.h next to the VM_* or new PROT_* block pointing to this issue.

Notes

This is a naming / review item; same bit masks, behaviour unchanged unless a bug is found in classification.