WP1c: Block /dev/mem and /dev/kmem via eBPF LSM

[Brad-Edwards]

Context

DMA/hardware-level memory access via /dev/mem bypasses all software protections. No hook exists to block it.

Work

• Extend ebpf/owlbear_lsm.bpf.c owl_file_open: if dentry name is mem or kmem and parent is dev, return -EPERM
• New event OWL_EVENT_DEV_MEM_ACCESS (0x0106) in include/owlbear_events.h and ebpf/owlbear_common.bpf.h
• New cheats/dev_mem_reader.c: attempts to open /dev/mem

Tests

2 E2E assertions (open blocked with EPERM, event emitted).

Part of v2.0.0