COS probes with kernel release >= 6.x do not get the correct version

thought-machine / falco-probes

Automated build and mirror of eBPF kernel probes for use as a driver with the Falco runtime security agent (https://falco.org/)

Apache License 2.0

16 stars 4 forks source link

COS probes with kernel release >= 6.x do not get the correct version #79

Closed mhbardsley closed 5 months ago

mhbardsley commented 5 months ago

It appears the mechanism to extract the kernel version from COS kernel releases >= 6.x does not work, and this results in the probes having an incorrect format before they get used by Falco. See, for example the logs 1 which show kernel_version as being empty.

We should have a tested and consistent way to reliably extract the kernel_version from all COS probes.