Falco bpf driver does not build from source on CentOS 8 #1129
Comments
|
Looks like that fix would be here: https://github.com/draios/sysdig/blob/dev/driver/bpf/fillers.h |
|
Can you try again against the current master @smijolovic ? |
|
I'll try that tomorrow for sure. I bumped into this issue on 0.21.0 which was holding me up - #896 - that seems to be addressed for the next release as well (I hope) |
|
Same issue on master: Scanning dependencies of target bpf The same solution (sed -i "s/KERNEL_VERSION.*/KERNEL_VERSION(4, 18, 0)/g" fillers.h) allows the driver to compile. |
|
Bump Seeing the same exact issue on 0.22.1 as well. Same fix (sed -i "s/KERNEL_VERSION.*/KERNEL_VERSION(4, 18, 0)/g" fillers.h) works. |
|
/milestone 0.23.0 |
|
@smijolovic we investigated the issue you have reported and made some changes to the driver code about vpid (look here). That code builds now, but we need some time to investigate it also works correctly at runtime! It would be awesome if you could try it, debug it a bit and tell us what you discovered. It'd help us a lot! :) |
|
I can pull from master and run it later today, assuming it's checked in. |
|
Sorry for the delay. Still seeing errors on the build of the driver: Scanning dependencies of target bpf |
|
Still working on this, got a bit delayed but it's a priority. |
|
no worries - the workaround is still addressing the short term issue. |
|
We just pushed a fix for this draios/sysdig#1650 Once it's merged there we can include it in Falco. |
Falco version: 0.21.0
CentOS 8.1
kernel version 4.18.0-147.5.1.el8_1.x86_64
cmake -DBUILD_BPF=ON ..
make bpf
In file included from /home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/probe.c:23:
/home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/fillers.h:1369:21: error: no member named 'pids' in 'struct task_struct'
return _READ(task->pids[PIDTYPE_PID].pid);
~~~~ ^
/home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/plumbing_helpers.h:18:28: note: expanded from macro '_READ'
#define _READ(P) ({ typeof(P) _val;
^
In file included from /home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/probe.c:23:
/home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/fillers.h:1369:21: error: no member named 'pids' in 'struct task_struct'
return _READ(task->pids[PIDTYPE_PID].pid);
~~~~ ^
/home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/plumbing_helpers.h:20:44: note: expanded from macro '_READ'
bpf_probe_read(&_val, sizeof(_val), &P);
^
In file included from /home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/probe.c:23:
/home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/fillers.h:1369:9: error: returning 'void' from a function with incompatible result type
'struct pid *'
return _READ(task->pids[PIDTYPE_PID].pid);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/plumbing_helpers.h:18:18: note: expanded from macro '_READ'
#define _READ(P) ({ typeof(P) _val;
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from /home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/probe.c:23:
/home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/fillers.h:1426:15: error: use of undeclared identifier '__PIDTYPE_TGID'; did you mean
'PIDTYPE_TGID'?
if (type == __PIDTYPE_TGID)
^~~~~~~~~~~~~~
PIDTYPE_TGID
./include/linux/pid.h:13:2: note: 'PIDTYPE_TGID' declared here
PIDTYPE_TGID,
^
In file included from /home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/probe.c:23:
/home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/fillers.h:1432:33: error: no member named 'pids' in 'struct task_struct'
nr = bpf_pid_nr_ns(_READ(task->pids[type].pid), ns);
~~~~ ^
/home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/plumbing_helpers.h:18:28: note: expanded from macro '_READ'
#define _READ(P) ({ typeof(P) _val;
^
In file included from /home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/probe.c:23:
/home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/fillers.h:1432:33: error: no member named 'pids' in 'struct task_struct'
nr = bpf_pid_nr_ns(_READ(task->pids[type].pid), ns);
~~~~ ^
/home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/plumbing_helpers.h:20:44: note: expanded from macro '_READ'
bpf_probe_read(&_val, sizeof(_val), &P);
^
In file included from /home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/probe.c:23:
/home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/fillers.h:1432:21: error: passing 'void' to parameter of incompatible type
'struct pid *'
nr = bpf_pid_nr_ns(_READ(task->pids[type].pid), ns);
^~~~~~~~~~~~~~~~~~~~~~~~~~~
/home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/plumbing_helpers.h:18:18: note: expanded from macro '_READ'
#define _READ(P) ({ typeof(P) _val;
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/fillers.h:1389:56: note: passing argument to parameter 'pid' here
static __always_inline pid_t bpf_pid_nr_ns(struct pid *pid,
^
/home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/fillers.h:1448:34: error: use of undeclared identifier '__PIDTYPE_TGID'; did you mean
'PIDTYPE_TGID'?
return bpf_task_pid_nr_ns(task, __PIDTYPE_TGID, NULL);
^~~~~~~~~~~~~~
PIDTYPE_TGID
./include/linux/pid.h:13:2: note: 'PIDTYPE_TGID' declared here
PIDTYPE_TGID,
^
8 errors generated.
make[6]: *** [/home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/Makefile:33: /home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/probe.o] Error 1
make[5]: *** [Makefile:1547: module/home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf] Error 2
make[5]: Leaving directory '/usr/src/kernels/4.18.0-147.5.1.el8_1.x86_64'
make[4]: *** [Makefile:18: all] Error 2
make[4]: Leaving directory '/home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf'
make[3]: *** [driver/bpf/CMakeFiles/bpf.dir/build.make:60: driver/bpf/CMakeFiles/bpf] Error 2
make[3]: Leaving directory '/home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build'
make[2]: *** [CMakeFiles/Makefile2:623: driver/bpf/CMakeFiles/bpf.dir/all] Error 2
make[2]: Leaving directory '/home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build'
make[1]: *** [CMakeFiles/Makefile2:635: driver/bpf/CMakeFiles/bpf.dir/rule] Error 2
make[1]: Leaving directory '/home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build'
make: *** [Makefile:371: bpf] Error 2
Digging into the fillers.h file, I noticed the following 4 lines:
1368 #if LINUX_VERSION_CODE < KERNEL_VERSION(4, 19, 0)
1405 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 19, 0)
1424 #if LINUX_VERSION_CODE < KERNEL_VERSION(4, 19, 0)
1447 #if LINUX_VERSION_CODE < KERNEL_VERSION(4, 19, 0)
It appears as if the kernel versions might be too "forward". When those 4 lines were replaced with:
KERNEL_VERSION(4, 18, 0)
The driver compiled cleanly with no errors or warnings.
The text was updated successfully, but these errors were encountered: