csysdig Crashes When `~/chisels` Directory Is Missing

[nazdridoy]

When attempting to run csysdig without the ~/chisels directory present, the program crashes with the following error message:

$ sudo csysdig
filesystem error: directory iterator cannot open directory: No such file or directory [./chisels/]

This is problematic because I do not have a ~/chisels folder, and I am not sure why I need to have a folder for personal views just to run csysdig. It seems that the core functionality of the program should not require this directory.

Expected Behavior

I would expect csysdig to handle the absence of the ~/chisels directory gracefully, either by creating the directory automatically or by providing a more user-friendly error message that explains the necessity of the directory and how to resolve the issue.

Suggested Solution

1. Automatically create the ~/chisels directory if it does not exist.
2. Provide a more informative error message and instructions on how to resolve the issue.
3. Consider using $XDG_CONFIG_HOME instead of the user's home directory for storing configuration files, which would be more in line with XDG Base Directory Specification standards.

Steps to Reproduce

1. Install Sysdig.
2. Run sudo csysdig without having a ~/chisels directory.

Additional Information

version: sysdig version 0.35.1 os: Archlinux

• I am not using any personal views or chisels, so the ~/chisels directory is unnecessary for my use case.
• I would appreciate if the solution does not require manual intervention to create the directory every time I install or update Sysdig.

[therealbobo]

Hey @nazdridoy! Thank you for the issue! We already patched this problem and release a patch release )0.35.2) 😁 On the other hand supporting XDG directories is a good point and maybe we should do that.

[nazdridoy]

We already patched this problem and release a patch release )0.35.2)

great! i guess it'll be available in arch repo soon.

supporting XDG directories is a good point and maybe we should do that.

please do... many of us would really appriciate that.

[eugenesan]

I just tested with 0.35.3 and the issue is not fixed. The problem appeared somewhere between 0.32.0 and 0.35.0.

I am building Debian package that installs chisels to /usr/share/sysdig/chisels. sysdig still looks for chisels in current directory. ln -s /usr/share/sysdig/chisels fixes the issue.

If there are any new config options to specify location of the chisels/plugins please let us know.

readlink("/root", 0x7ffc013228a0, 1023) = -1 EINVAL (Invalid argument)
readlink("/root/.chisels", 0x7ffc013228a0, 1023) = -1 ENOENT (No such file or directory)
faccessat2(AT_FDCWD, "/root/.chisels/", F_OK, AT_EACCESS) = -1 ENOENT (No such file or directory)
newfstatat(AT_FDCWD, "/proc/1/root", {st_mode=S_IFDIR|0755, st_size=424, ...}, 0) = 0
openat(AT_FDCWD, "/usr/lib/ssl/openssl.cnf", O_RDONLY) = 3
newfstatat(3, "", {st_mode=S_IFREG|0644, st_size=12324, ...}, AT_EMPTY_PATH) = 0
newfstatat(AT_FDCWD, "/proc/1/root", {st_mode=S_IFDIR|0755, st_size=424, ...}, 0) = 0
newfstatat(AT_FDCWD, "/usr/share/sysdig/plugins/", 0x7ffc01322330, 0) = -1 ENOENT (No such file or directory)
newfstatat(AT_FDCWD, "/root/.terminfo", 0x6342d493d6e0, 0) = -1 ENOENT (No such file or directory)
newfstatat(AT_FDCWD, "/etc/terminfo", {st_mode=S_IFDIR|0755, st_size=12, ...}, 0) = 0
newfstatat(AT_FDCWD, "/lib/terminfo", 0x6342d493d770, 0) = -1 ENOENT (No such file or directory)
newfstatat(AT_FDCWD, "/usr/share/terminfo", {st_mode=S_IFDIR|0755, st_size=84, ...}, 0) = 0
access("/etc/terminfo/x/xterm-1003", R_OK) = -1 ENOENT (No such file or directory)
access("/usr/share/terminfo/x/xterm-1003", R_OK) = 0
openat(AT_FDCWD, "/usr/share/terminfo/x/xterm-1003", O_RDONLY) = 3
newfstatat(3, "", {st_mode=S_IFREG|0644, st_size=3946, ...}, AT_EMPTY_PATH) = 0
access("/etc/terminfo/x/xterm-1003", R_OK) = -1 ENOENT (No such file or directory)
access("/usr/share/terminfo/x/xterm-1003", R_OK) = 0
openat(AT_FDCWD, "/usr/share/terminfo/x/xterm-1003", O_RDONLY) = 3
newfstatat(3, "", {st_mode=S_IFREG|0644, st_size=3946, ...}, AT_EMPTY_PATH) = 0
filesystem error: directory iterator cannot open directory: No such file or directory [./chisels/]
+++ exited with 1 +++

[therealbobo]

Hey @eugenesan! The current version of sysdig (at least the one compiled by the ci) seems to work correctly even if no chisel directory is present. How are you building the package? By the way, it's possible to specify a specific chisel directory using the environment variable SYSDIG_CHISEL_DIR.

[therealbobo]

@eugenesan by any chance, are you referring to the variable that sets the chisel directory during the build? In that case you should modify the file here:

userspace/sysdig/config_sysdig.h.in
24:#define SYSDIG_CHISELS_DIR "${CMAKE_INSTALL_PREFIX}/share/sysdig/chisels"

[eugenesan]

@therealbobo Sorry for the delayed response.

The issue is not related to the configuration. I've tracked the problem to falcosecurity call: https://github.com/draios/sysdig/blob/1e0fd10044108d7511b01700b7c53cd9a6c4c1f4/userspace/sysdig/csysdig.cpp#L236 The SYSDIG_CHISELS_DIR definitely contains the correct path and the function being called seems OK and didn't change for a while: https://github.com/falcosecurity/libs/blob/a6be3efda7cf6c38c22d43b1a71976b3c646c38c/userspace/chisel/chisel_utils.cpp#L148

But still the path never ends up in the list or being tested/accessed and I am getting: filesystem error: directory iterator cannot open directory: No such file or directory [./chisels/]

Maybe it's a toolchain or 3rd part library bug? I am testing on Ubuntu 23.10.

[therealbobo]

This sounds really strange! I'm on ubuntu 22.04 and I cannot get a repro. Do you mind sharing the cmake commands you are using? 🤔 @eugenesan

[eugenesan]

This sounds really strange! I'm on ubuntu 22.04 and I cannot get a repro. Do you mind sharing the cmake commands you are using? 🤔 @eugenesan

Here are the build logs for Ubuntu 23.10 (same issue on 24.04) and corresponding package:

• sysdig: https://launchpadlibrarian.net/718335621/buildlog_ubuntu-mantic-amd64.sysdig_0.35.0+repack-1build3~eugenesan~mantic2_BUILDING.txt.gz
• falcosecurity: https://launchpad.net/~eugenesan/+archive/ubuntu/ppa/+build/27894895/+files/buildlog_ubuntu-mantic-amd64.falcosecurity-libs_0.14.3-1~eugenesan~mantic1_BUILDING.txt.gz
• https://launchpad.net/~eugenesan/+archive/ubuntu/ppa/+packages?field.name_filter=sysdig&field.status_filter=published&field.series_filter=mantic

On 22.04 it worked with slighly older versions. Here are the logs and corresponding package:

• sysdig: https://launchpad.net/~eugenesan/+archive/ubuntu/ppa/+build/26475443/+files/buildlog_ubuntu-jammy-amd64.sysdig_0.32.0-1~eugenesan~jammy1_BUILDING.txt.gz
• falcosecurity: https://launchpad.net/~eugenesan/+archive/ubuntu/ppa/+build/26475308/+files/buildlog_ubuntu-jammy-amd64.falcosecurity-libs_0.11.3+repack-1~eugenesan~jammy1_BUILDING.txt.gz
• https://launchpad.net/~eugenesan/+archive/ubuntu/ppa/+packages?field.name_filter=sysdig&field.status_filter=published&field.series_filter=jammy

[eugenesan]

Fixed in https://github.com/draios/sysdig/releases/tag/0.36.0 (Probably by 8f2d04a3c1123d62fac004d7c94d70c3c0bfde40)

[jasondellaluce]

@eugenesan thanks for checking this. Can we close this issue?

[eugenesan]

@eugenesan thanks for checking this. Can we close this issue?

I believe we can close the issue. Thanks

Note for future readers:
Since I am not sure where exactly the issue was fixed, the minimal known to work combination is:
sysdig - 0.36.0
falcosecurity-libs - 0.15.1