You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When running Falco (0.26.1) without using the new --alternate-lua-dir flag (introduced by #1419), Falco is unable to start.
How to reproduce it
Simply run Falco.
Expected behavior
Falco to run successfully.
Screenshots
sudo ./build/userspace/falco/falco -c falco.yaml -r rules/falco_rules.yaml 0.06
Mon Oct 12 09:39:23 2020: Falco version 0.26.1-1+8b56360f (driver version 2aa88dcf6243982697811df4c1b484bcbe9488a2)
Mon Oct 12 09:39:23 2020: Falco initialized with configuration file falco.yaml
Mon Oct 12 09:39:23 2020: Loading rules from file rules/falco_rules.yaml:
Mon Oct 12 09:39:23 2020: Runtime error: Could not find Falco Lua entrypoint (tried /usr/share/falco/lua/output.lua, /home/vagrant/workspace/falcosecurity/falco/userspace/engine/lua/output.lua). Exiting.
Additional context
After a bit of investigation, I found the problem.
When --alternate-lua-dir is not specified, it gets the value of FALCO_ENGINE_SOURCE_LUA_DIR constant (its default).
This directory is used by the falco_engine ctor and by the falco_outputs::init.
The problem is that the falco_outputs::init was using FALCO_SOURCE_LUA_DIR (before the PR introducing this flag) by default while now, in the particular case described into this issue, it uses FALCO_ENGINE_SOURCE_LUA_DIR.
Compare line 91/92 in the aforementioned PR to spot the exact location of the problem.
The current build system does not move output.lua into FALCO_ENGINE_SOURCE_LUA_DIR and so Falco is not able to find it.
NOTA BENE
Please notice this does not happen with packaged Falco versions (DEB, etc.) because the build system takes care to move all the Lua files in one directory, in this case.
SOLUTIONS
Introduce another --alternate-lua-dir (one for the engine Lua files, one for the outputs Lua files)
Wait for PR Falco outputs refactoring #1412 to be merged in (should solve the problem at its root - ie., remove Lua files for outputs).
The text was updated successfully, but these errors were encountered:
leodido
changed the title
New flag --alternate-lua-dir does not account for other Lua directories
New flag --alternate-lua-dir does not account for falco_outputs Lua files
Oct 12, 2020
Describe the bug
When running Falco (0.26.1) without using the new
--alternate-lua-dir
flag (introduced by #1419), Falco is unable to start.How to reproduce it
Simply run Falco.
Expected behavior
Falco to run successfully.
Screenshots
Additional context
After a bit of investigation, I found the problem.
When
--alternate-lua-dir
is not specified, it gets the value ofFALCO_ENGINE_SOURCE_LUA_DIR
constant (its default).This directory is used by the
falco_engine
ctor and by thefalco_outputs::init
.The problem is that the
falco_outputs::init
was usingFALCO_SOURCE_LUA_DIR
(before the PR introducing this flag) by default while now, in the particular case described into this issue, it usesFALCO_ENGINE_SOURCE_LUA_DIR
.Compare line 91/92 in the aforementioned PR to spot the exact location of the problem.
The current build system does not move
output.lua
intoFALCO_ENGINE_SOURCE_LUA_DIR
and so Falco is not able to find it.NOTA BENE
Please notice this does not happen with packaged Falco versions (DEB, etc.) because the build system takes care to move all the Lua files in one directory, in this case.
SOLUTIONS
--alternate-lua-dir
(one for the engine Lua files, one for the outputs Lua files)The text was updated successfully, but these errors were encountered: