libbpf-tools/execsnoop: processes started via execveat(2) are never reported

I noticed that libbpf-tools/execsnoop only hooks sys_enter_execve and sys_exit_execve. So if a process is started with execveat(2) (that's what fexecve(3) uses under the hood), it never shows up. No error, no warning, the line is just not there.

To reproduce: build execsnoop from master, run sudo ./execsnoop, and in another terminal run a tiny program that does syscall(SYS_execveat, AT_FDCWD, "/bin/true", argv, envp, 0). You'll see the test program itself get exec'd, but not the exec it does through execveat.

This is what I got on Ubuntu 24.04, kernel 6.17.0-1022-azure, x86_64 (same on aarch64):

PCOMM            PID    PPID   RET ARGS
true             3845   3825     0 /bin/true EXECVE_MARKER
execveat_test    3846   3825     0 /tmp/execveat_test

The second line is the test program starting normally. The /bin/true EXECVEAT_MARKER exec it then performs via execveat is missing.

I have this running in CI if you want to see the full thing, including the test program source: https://github.com/ojuschugh1/bcc/actions/runs/34631964095

I have a fix ready and will open a PR in a bit.