fix(tp/syscalls): detach handle_getdents_patch on sys_exit_getdents64 (#176)

确保 handle_getdents_patch 仅通过尾调用执行。
移除在 sys_exit_getdents64 上的 attach，避免非尾调用路径被意外触发。

Signed-off-by: zyj <zhongyinjiebit@sina.com>
Co-authored-by: zyj <zhongyinjiebit@sina.com>

Author: Tim-xiaofan

src/24-hide/pidhide.bpf.c

@@ -174,7 +174,7 @@ int handle_getdents_exit(struct trace_event_raw_sys_exit *ctx)
     return 0;
 }
 
-SEC("tp/syscalls/sys_exit_getdents64")
+SEC("tp/unused")
 int handle_getdents_patch(struct trace_event_raw_sys_exit *ctx)
 {
     // Only patch if we've already checked and found our pid's folder to hide

src/24-hide/pidhide.c

@@ -180,6 +180,9 @@ int main(int argc, char **argv)
         goto cleanup;
     }
 
+	// 禁用 patch 程序的自动 attach，因为它只能通过尾调用执行
+    bpf_program__set_autoattach(skel->progs.handle_getdents_patch, false);
+
     // Setup Maps for tail calls
     int index = PROG_01;
     int prog_fd = bpf_program__fd(skel->progs.handle_getdents_exit);