search

falcosecurity / falco

Cloud Native Runtime Security
https://falco.org
Apache License 2.0
7.23k stars 891 forks source link

[Falco driver loader] falco-driver-loader on OpenShift 4.12 fails with "Cannot generate ORC metadata for CONFIG_UNWINDER_ORC=y, please install libelf-dev, libelf-devel or elfutils-libelf-devel" #2884

Closed tosmi closed 10 months ago

tosmi commented 10 months ago

Describe the bug

Tried to install falco with the 3.8.0 helm chart on an OpenShift 4.12 cluster. Falco-driver-loader init container fails with

Makefile:1005: *** "Cannot generate ORC metadata for CONFIG_UNWINDER_ORC=y, please install libelf-dev, libelf-devel or elfutils-libelf-devel".  Stop.

Using a custom falco-driver-loader image with libelf-dev included fixes the problem and falco seems to work with the eBPF driver.

We documented our steps to get falco running here.

This is the initial values file we used for the helm chart:

driver:
  kind: ebpf

falco:
  json_output: true
  json_include_output_property: true
  log_syslog: false
  log_level: info

falcosidekick:
  enabled: true
  webui:
    enabled: true

After taking the steps mention here we used the following helm chart:

driver:
  kind: ebpf
  loader:
    initContainer:
      image:
        registry: quay.io
        repository: tosmi/falco-driver-loader
        tag: 0.36.1-libelf-dev

falco:
  json_output: true
  json_include_output_property: true
  log_syslog: false
  log_level: info

falcosidekick:
  enabled: true
  webui:
    enabled: true

quay.io/tosmi/falco-driver-loader:0.36.1-libelf-dev only includes libelf-dev. See the Dockerfile used to build the updated image.

How to reproduce it

Install falco with helm chart version 3.8.0 on OpenShift 4.12 and the values file above.

Expected behaviour

falco-driver-loader should compile the ebpf module.

Environment

Andreagit97 commented 10 months ago

Ei @tosmi thank you for all the research! Have you tried to use the falco-driver-loader-legacy image? In falco 0.36 we changed the default falco-driver-loader image and the older image, meant for compatibility with older kernels (4.x and below), is currently retained as falcosecurity/falco-driver-loader-legacy. You can read more info in the official release blog post https://falco.org/blog/falco-0-36-0/. I'm saying that because looking at the dockerfile, libelf-dev seems already included https://github.com/falcosecurity/falco/blob/9eb611609a2876a5f5a5378e0613f0ff767f0d42/docker/driver-loader-legacy/Dockerfile#L34

tosmi commented 10 months ago

thanks for the quick update. i will re-test with the legacy image, sorry for this, but i'm new to the world of falco :-) i will also test the deployment of falco with openshift 4.13 because this is based on rhel 9 and comes with an updated kernel. will post my findings here. seems i should have read the release blog post before staring my adventure :-)

Andreagit97 commented 10 months ago

don't worry! you are welcome!

tosmi commented 10 months ago

closing this, falco-driver-loader-legacy fixes the issue on OpenShift 4.12. See the release notes, especially the second point about kernel versions for more info. OpenShift 4.12 uses a 4.x (RHEL 8) kernel.