Unable to run Tracee locally

[MrZLeo]

I have a machine that running Ubuntu 24.04 LTS with custom Linux 6.12.1 kernel. I found that only docker are able to run Tracee but I have special requirement that must run Tracee locally.

I use this command for docker and it works:

docker run --name tracee -it --rm \
  --pid=host --cgroupns=host --privileged \
  -v /etc/os-release:/etc/os-release-host:ro \
  -v /var/run:/var/run:ro \
  aquasec/tracee:latest

And I do these locally but fail with error message:

# make all
# ./dist/tracee-ebpf

{"level":"warn","ts":1740729506.437951,"msg":"libbpf: prog 'syscall__execve_enter': failed to load: -13"}
{"level":"warn","ts":1740729506.439204,"msg":"libbpf: failed to load object ''"}
{"level":"fatal","ts":1740729506.445795,"msg":"Tracee runner failed","error":"cmd.Runner.Run: error initializing Tracee: ebpf.(*Tracee).Init: ebpf.(*Tracee).initBPF: failed to load BPF object: permission denied"}
...