Add default node filter policy

[tfjmp]

Adding the following line: prov_policy.prov_node_filter = ENT_INODE_UNKNOWN & ENT_INODE_DIRECTORY & ENT_INODE_DIRECTORY & ENT_ENV; here

camflow-dev/security/provenance/hooks.c

Line 2905 in 0fab1b9

pr_info("Provenance: capture at boot on.");

should work.

It should be added when whole provenance capture is selected in the kernel config option.

Needs to be implemented and tested.