fix: clock time detection

The detection was rework since the libbpfgo func BPFHelperIsSupported
changed. When supported is true we avoid checking error, otherwise we
raise an error when the operation is not permitted.

In the last case the helper is not supported so the monotonic is set.

pkg/ebpf/tracee.go

@@ -386,15 +386,18 @@ func (t *Tracee) Init(ctx gocontext.Context) error {
 		func() error {
 			supported, innerErr := bpf.BPFHelperIsSupported(bpf.BPFProgTypeKprobe, bpf.BPFFuncKtimeGetBootNs)
 
+			if supported {
+				// If supported, default is already CLOCK_BOOTTIME.
+				return nil
+			}
+
 			// only report if operation not permitted
 			if errors.Is(innerErr, syscall.EPERM) {
 				return innerErr
 			}
 
-			// If BPFFuncKtimeGetBootNs is not available, eBPF will generate events based on monotonic time.
-			if !supported {
-				usedClockID = traceetime.CLOCK_MONOTONIC
-			}
+			// Use monotonic time if the helper isn't supported.
+			usedClockID = traceetime.CLOCK_MONOTONIC
 			return nil
 		})
 	if err != nil {