Falco fails to build eBPF module for amazon-linux.

[michalschott]

Describe the bug

Falco fails to build eBPF module for amazon linux:

~ stern -n kube-system falco-lsbcl
+ falco-lsbcl › falco
falco-lsbcl falco * Setting up /usr/src links from host
falco-lsbcl falco * Running falco-driver-loader for: falco version=0.28.0, driver version=5c0b863ddade7a45568c0ac97d037422c9efb750
falco-lsbcl falco * Running falco-driver-loader with: driver=bpf, compile=yes, download=yes
falco-lsbcl falco * Mounting debugfs
falco-lsbcl falco * Trying to download a prebuilt eBPF probe from https://download.falco.org/driver/5c0b863ddade7a45568c0ac97d037422c9efb750/falco_amazonlinux2_5.4.129-63.229.amzn2.x86_64_1.o
falco-lsbcl falco curl: (22) The requested URL returned error: 404
falco-lsbcl falco Unable to find a prebuilt falco eBPF probe
falco-lsbcl falco * Using downloaded kernel sources for kernel version 5.4.129...
falco-lsbcl falco * Found kernel config at /host/boot/config-5.4.129-63.229.amzn2.x86_64
falco-lsbcl falco * Downloading http://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/linux-5.4.129.tar.gz
falco-lsbcl falco * Extracting kernel sources
falco-lsbcl falco * Configuring kernel
falco-lsbcl falco scripts/sign-file.c:25:30: fatal error: openssl/opensslv.h: No such file or directory
falco-lsbcl falco compilation terminated.
falco-lsbcl falco make[1]: *** [scripts/Makefile.host:107: scripts/sign-file] Error 1
falco-lsbcl falco make: *** [Makefile:1120: scripts] Error 2
falco-lsbcl falco * Trying to compile the eBPF probe (falco_amazonlinux2_5.4.129-63.229.amzn2.x86_64_1.o)
falco-lsbcl falco /usr/src/falco-5c0b863ddade7a45568c0ac97d037422c9efb750/bpf/probe.c:11:10: fatal error: 'generated/utsrelease.h' file not found
falco-lsbcl falco #include <generated/utsrelease.h>
falco-lsbcl falco          ^~~~~~~~~~~~~~~~~~~~~~~~
falco-lsbcl falco 1 error generated.
falco-lsbcl falco make[2]: *** [/usr/src/falco-5c0b863ddade7a45568c0ac97d037422c9efb750/bpf/Makefile:33: /usr/src/falco-5c0b863ddade7a45568c0ac97d037422c9efb750/bpf/probe.o] Error 1
falco-lsbcl falco make[1]: *** [Makefile:1734: /usr/src/falco-5c0b863ddade7a45568c0ac97d037422c9efb750/bpf] Error 2
falco-lsbcl falco make: *** [Makefile:18: all] Error 2
falco-lsbcl falco mv: cannot stat '/usr/src/falco-5c0b863ddade7a45568c0ac97d037422c9efb750/bpf/probe.o': No such file or directory
falco-lsbcl falco Unable to load the falco eBPF probe
falco-lsbcl falco Wed Sep  1 08:28:58 2021: Falco version 0.28.0 (driver version 5c0b863ddade7a45568c0ac97d037422c9efb750)
falco-lsbcl falco Wed Sep  1 08:28:58 2021: Falco initialized with configuration file /etc/falco/falco.yaml
falco-lsbcl falco Wed Sep  1 08:28:58 2021: Loading rules from file /etc/falco/falco_rules.yaml:
falco-lsbcl falco Wed Sep  1 08:28:58 2021: Loading rules from file /etc/falco/falco_rules.local.yaml:
falco-lsbcl falco Wed Sep  1 08:28:58 2021: Loading rules from file /etc/falco/rules.d/rules-consul.yaml:
falco-lsbcl falco Wed Sep  1 08:28:59 2021: Loading rules from file /etc/falco/rules.d/rules-falco-overrides.yaml:
falco-lsbcl falco Wed Sep  1 08:28:59 2021: Loading rules from file /etc/falco/rules.d/rules-haproxy.yaml:
falco-lsbcl falco Wed Sep  1 08:28:59 2021: Unable to load the driver.
falco-lsbcl falco Wed Sep  1 08:28:59 2021: Runtime error: can't open BPF probe '/root/.falco/falco-bpf.o': Errno 2. Exiting.
- falco-lsbcl › falco

After adding libssl-dev package to the container it compiles smoothly.

• Falco version:
  Tested with 0.28.0, 0.29.0, 0.29.1