Support for cross-compiling kernel module and building under yocto

[enok71]

Motivation
I want to install falco on an embedded system built with bitbake/yocto which builds all software from source-code using a cross-compiler.

Feature
The cmake structure should support cross-compilation for a start. Currently it seems the kernel module assumes build host has the same architecture as the target.

Even better would be to provide yocto recipes for falcosecurity/libs, including the kernel module, and for the falco application. Either contribute those recipes to e.g. openembeddeds meta-security layer or publish your own meta-falcosecurity layer on github.

Alternatives
Alternative would be to ditch falco and use some application based on seccomp. There is public yocto recipe for libseccomp.

Additional context
Our host is arm64 based. We use yocto 5.1.

[Benik3]

That would be really nice.
There is an old receipt on openembedded for 0.28.0: https://layers.openembedded.org/layerindex/recipe/351148/
I tried it for my system (STM32MP157 with Yocto 4 kirkstone). It built, but not running well (keeps crashing on some seg. fault).
I tried to update it to the last version but without luck. It looks like the sysdig has problem with correct building bundled libs under Yocto, it also doesn't detect correct kernel (It takes kernel version from the building machine, not Yocto).