Closed Issif closed 1 year ago
Have you tried to build them using a local installation of driverkit?
Note, there's no 100% guarantee that all probes can be built by driverkit (headers might be missing, wrong compiler version, etc..).
I tried myself and faced the same issue. I'm not the only one, here a PR from @LucaGuerra for fixing the issue.
Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale
.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close
.
Provide feedback via https://github.com/falcosecurity/community.
/lifecycle stale
/remove-lifecycle stale
Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale
.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close
.
Provide feedback via https://github.com/falcosecurity/community.
/lifecycle stale
cc @maxgio92 @zuc
I believe this has not been fixed yet?
Exactly. The issue I think needs to be replicated and debugged. @LucaGuerra do you have more info on this?
To be noted that in the meantime Driverkit evolved and different issues have been solved.
/remove-lifecycle stale
Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale
.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close
.
Provide feedback via https://github.com/falcosecurity/community.
/lifecycle stale
Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten
.
Rotten issues close after an additional 30d of inactivity.
If this issue is safe to close now please do so with /close
.
Provide feedback via https://github.com/falcosecurity/community.
/lifecycle rotten
Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen
.
Mark the issue as fresh with /remove-lifecycle rotten
.
Provide feedback via https://github.com/falcosecurity/community. /close
@poiana: Closing this issue.
By running my script for testing if drivers are available before trying to install Falco (see here) I noticed that for some kernel versions, the module is available but not the probe, even if the driverkit config is correct.
For example, we have
falco_debian_5.10.0-9-amd64_1.ko
but notfalco_debian_5.10.0-10-amd64_1.o
.I checked Prow logs and saw this behavior are full of this kind of error:
Source: https://prow.falco.org/view/s3/falco-prow-logs/logs/rebuild-all-drivers-debian-periodic/1478924491085058048
cc @zuc @leogr