ebpf: replace deprecated prog.Attach/prog.Detach

[thaJeztah]

fixes #2699

Caught by golangci-lint when enabling golint:

libcontainer/cgroups/ebpf/ebpf.go:35:12: SA1019: prog.Attach is deprecated: use link.RawAttachProgram instead. (staticcheck)
    if err := prog.Attach(dirFD, ebpf.AttachCGroupDevice, unix.BPF_F_ALLOW_MULTI); err != nil {
              ^
libcontainer/cgroups/ebpf/ebpf.go:39:13: SA1019: prog.Detach is deprecated: use link.RawDetachProgram instead. (staticcheck)
        if err := prog.Detach(dirFD, ebpf.AttachCGroupDevice, unix.BPF_F_ALLOW_MULTI); err != nil {
                  ^

Worth noting that we currently call prog.Detach() with unix.BPF_F_ALLOW_MULTI;
https://github.com/golang/sys/blob/22da62e12c0cd9c1da93581e1113ca4d82a5be14/unix/zerrors_linux.go#L178

BPF_F_ALLOW_MULTI = 0x2

⚠️ Looking at the source code for prog.Detach(); https://github.com/cilium/ebpf/blob/v0.4.0/prog.go#L579-L581,
this would always produce an error:

if flags != 0 {
    return errors.New("flags must be zero")
}

Note that the flags parameter is not used (except for that validation)

[thaJeztah]

@AkihiroSuda @giuseppe @kolyshkin PTAL; please double check if I did the conversion correctly, and if my reading of the prog.Detach() issue is correct, as I'm really not familiar with this.

I see the prog.Detach() was added in faf673e (#2145), based on the c implementation in crun

[thaJeztah]

also /cc @cyphar (I see there was discussion about this code in #2366)

[kolyshkin]

LGTM, but please DNM until we get LGTM from @cyphar

[kolyshkin]

Also, I agree with your analysis (Detach should not be called with BPF_F_ALLOW_MULTI).

[cyphar]

Oh, good -- looking at RawDetachProgram it looks like this will mean we only detach the program we just inserted (though more broadly we still do the wrong thing on cgroup updates). This was not the case with our incorrect proper usage of Detach AFAICS.

LGTM.