chore(pipeline): streamline time args normalization

Instead of using a helper, and then using it in a specialized processor
function - use function currying to enable creating generic time argument
processors.

Author: NDStrahilevitz

pkg/ebpf/processor.go

@@ -126,7 +126,7 @@ func (t *Tracee) registerEventProcessors() {
 
 	// Convert all time relate args to nanoseconds since epoch.
 	// NOTE: Make sure to convert time related args (of your event) in here.
-	t.RegisterEventProcessor(events.SchedProcessFork, t.processSchedProcessFork)
+	t.RegisterEventProcessor(events.SchedProcessFork, t.normalizeTimeArg("start_time"))
 	t.RegisterEventProcessor(events.All, t.normalizeEventCtxTimes)
 
 	//

pkg/ebpf/processor_funcs.go

@@ -360,24 +360,21 @@ func (t *Tracee) normalizeEventCtxTimes(event *trace.Event) error {
 	return nil
 }
 
-// processSchedProcessFork processes a sched_process_fork event by normalizing the start time.
-func (t *Tracee) processSchedProcessFork(event *trace.Event) error {
-	return t.normalizeEventArgTime(event, "start_time")
-}
-
-// normalizeEventArgTime normalizes the event arg time to be relative to tracee start time or
-// current time.
-func (t *Tracee) normalizeEventArgTime(event *trace.Event, argName string) error {
-	arg := events.GetArg(event, argName)
-	if arg == nil {
-		return errfmt.Errorf("couldn't find argument %s of event %s", argName, event.EventName)
-	}
-	argTime, ok := arg.Value.(uint64)
-	if !ok {
-		return errfmt.Errorf("argument %s of event %s is not of type uint64", argName, event.EventName)
+// normalizeTimeArg returns a processor function for some argument name
+// which normalizes said event arg time to be relative to tracee start time or current time.
+func (t *Tracee) normalizeTimeArg(argName string) func(event *trace.Event) error {
+	return func(event *trace.Event) error {
+		arg := events.GetArg(event, argName)
+		if arg == nil {
+			return errfmt.Errorf("couldn't find argument %s of event %s", argName, event.EventName)
+		}
+		argTime, ok := arg.Value.(uint64)
+		if !ok {
+			return errfmt.Errorf("argument %s of event %s is not of type uint64", argName, event.EventName)
+		}
+		arg.Value = t.timeNormalizer.NormalizeTime(int(argTime))
+		return nil
 	}
-	arg.Value = t.timeNormalizer.NormalizeTime(int(argTime))
-	return nil
 }
 
 // addHashArg calculate file hash (in a best-effort efficiency manner) and add it as an argument