Parse generated/utsversion.h to parse the Kernel Version on newer COS kernels

thought-machine / falco-probes

Automated build and mirror of eBPF kernel probes for use as a driver with the Falco runtime security agent (https://falco.org/)

Apache License 2.0

16 stars 4 forks source link

Parse generated/utsversion.h to parse the Kernel Version on newer COS kernels #80

Closed mhbardsley closed 4 months ago

mhbardsley commented 4 months ago

Fixes https://github.com/thought-machine/falco-probes/issues/79

It looks like these kernel releases no longer place the UTS_VERSION variable in the generated/compile.h header file, instead favouring a dedicated file, generated/utsversion.h. Therefore get it from here.

This is untested but should not cause any regressions. We will know if this works because COS probes for kernel versions >= 6 will be formatted with a kernel version number, if it can be found.