Missing falco prebuilt module falco_amazonlinux2_4.14.268-205.500.amzn2.x86_64_1.ko

[mcbarzi]

Describe the bug

Missing prebuilt falco module for latest ami

• Setting up /usr/src links from host
• Running falco-driver-loader for: falco version=0.29.1, driver version=17f5df52a7d9ed6bb12d3b1768460def8439936d
• Running falco-driver-loader with: driver=module, compile=yes, download=yes
• Unloading falco module, if present
• Trying to load a system falco module, if present
• Looking for a falco module locally (kernel 4.14.268-205.500.amzn2.x86_64)
• Trying to download a prebuilt falco module from https://download.falco.org/driver/17f5df52a7d9ed6bb12d3b1768460def8439936d/falco_amazonlinux2_4.14.268-205.500.amzn2.x86_64_1.ko curl: (22) The requested URL returned error: 404 Unable to find a prebuilt falco module
• Trying to dkms install falco module with GCC /usr/bin/gcc DIRECTIVE: MAKE="'/tmp/falco-dkms-make'"
• Running dkms build failed, couldn't find /var/lib/dkms/falco/17f5df52a7d9ed6bb12d3b1768460def8439936d/build/make.log (with GCC /usr/bin/gcc)
• Trying to dkms install falco module with GCC /usr/bin/gcc-8 DIRECTIVE: MAKE="'/tmp/falco-dkms-make'"
• Running dkms build failed, couldn't find /var/lib/dkms/falco/17f5df52a7d9ed6bb12d3b1768460def8439936d/build/make.log (with GCC /usr/bin/gcc-8)
• Trying to dkms install falco module with GCC /usr/bin/gcc-6 DIRECTIVE: MAKE="'/tmp/falco-dkms-make'"
• Running dkms build failed, couldn't find /var/lib/dkms/falco/17f5df52a7d9ed6bb12d3b1768460def8439936d/build/make.log (with GCC /usr/bin/gcc-6)
• Trying to dkms install falco module with GCC /usr/bin/gcc-5 DIRECTIVE: MAKE="'/tmp/falco-dkms-make'"
• Running dkms build failed, couldn't find /var/lib/dkms/falco/17f5df52a7d9ed6bb12d3b1768460def8439936d/build/make.log (with GCC /usr/bin/gcc-5) Consider compiling your own falco driver and loading it or getting in touch with the Falco community Mon Mar 14 07:13:02 2022: Falco version 0.29.1 (driver version 17f5df52a7d9ed6bb12d3b1768460def8439936d)

How to reproduce it

Expected behaviour

Screenshots

Environment

• Falco version: 0.29.1, 0.31.1
• System info:
• Cloud provider or hardware configuration: AWS EKS 1.19
• OS:Amazon linux 2
• Kernel:
• Installation method: Using helm chart for kubernetes

Additional context

[maxgio92]

Hello @mcbarzi , thanks for the opened issue and welcome!

The way the prebuilt drivers are distributed is a best effort way, but you can help us have the coverage as wide as possible. And you can contribute to this repo, by adding a configuration for your Amazon Linux kernel release (i.e. 4.14.268-205.500.amzn2.x8664).

If you see the structure of this repository you'll find a driverkit/config/ folder; in this folder you have one folder per Falco driver version (as a SHA hash).

Inside each of them you have one build configuration per kernel release, and each of them will be consumed by Driverkit, during the CI process.

In your case you'll end up with a config file named _amazonlinux2_4.14.268-205.500.amzn2.x86_641.yaml, with a content like:

kernelversion: 1
kernelrelease: 4.14.268-205.500.amzn2.x86_64
target: amazonlinux2
output:
  module: output/<Falco Driver version>/falco_amazonlinux2_4.14.268-205.500.amzn2.x86_64_1.ko

and if you can do it for each Falco driver version you see under driverkit/config in this repo.

Note: keep in mind that then, the CI (in detail Driverkit) will say if there will be kernel headers available for this kernel release, otherwise it won't be possible to build Falco drivers in the CI.

Feel free to ask and reach out if you need something else :-)

Have a nice day

[zuc]

This is now solved thanks to #654.

/close

[poiana]

@zuc: Closing this issue.

In response to [this](https://github.com/falcosecurity/test-infra/issues/652#issuecomment-1072559337): >This is now solved thanks to #654. > >/close Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.