thought-machine / falco-probes

Automated build and mirror of eBPF kernel probes for use as a driver with the Falco runtime security agent (https://falco.org/)
Apache License 2.0
16 stars 4 forks source link

Fix COS kernel config location and build errors #59

Closed markchalloner closed 1 year ago

markchalloner commented 1 year ago

Falco-driver-builder expects the kernel to be in one of several places of which we use /lib/modules/<kernel_release>/config. This commit fixes a bug where an extraneous + was added to the /lib/modules/<kernel_release> folder (resulting in /lib/modules/<kernel_release>+/config), meaning falco-driver-loader was unable to find the config.

markchalloner commented 1 year ago

Tested locally, and fixes these errors:

12:23AM ERR error encountered error="could not build probe for 'cos-93-16623-227-41': could not build falco probe: non-zero exit-code (1) for: \n* Setting up /usr/src links from host\nFALCO_VERSION: 0.24.0\nDRIVER_NAME: falco\nDRIVER_VERSION: 85c88952b018fdbce2464222c3303229f5bfcfad\n* Running falco-driver-loader for: falco version=0.24.0, driver version=85c88952b018fdbce2464222c3303229f5bfcfad, arch=x86_64, kernel release=5.10.133, kernel version=1\n* Running falco-driver-loader with: driver=bpf, compile=yes, download=no\n* Mounting debugfs\nmount: /sys/kernel/debug: permission denied.\n* Filename 'falco_cos_5.10.133_1.o' is composed of:\n - driver name: falco\n - target identifier: cos\n - kernel release: 5.10.133\n - kernel version: 1\n* COS detected (build 16623.227.41), using COS kernel headers\nCannot find kernel config\n"

However during build, older versions raise now errors like:

In file included from ./include/net/sch_generic.h:21:
./include/net/flow_offload.h:317:4: error: use of undeclared identifier 'KBUILD_MODNAME'
...
In file included from ./include/net/sch_generic.h:21:
./include/net/flow_offload.h:317:4: error: expected ';' at end of declaration

Simplest solution would be just to limit the versions we build...

markchalloner commented 1 year ago

Also fixing forward compatibility issues:

markchalloner commented 1 year ago

@ggilligan12 looks like the AWS probes are building again. COS ones still running at this point in time.