Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(pkg,cmd): eBPF probe must be symlinked under /root/.falco/falco-bpf.o #369

Merged
merged 1 commit into from
Dec 6, 2023

Conversation

FedeDP
Copy link
Contributor

@FedeDP FedeDP commented Dec 6, 2023

What type of PR is this?

/kind bug

Any specific area of the project related to this PR?

/area library
/area cli

What this PR does / why we need it:

Also, avoid mounting /sys/kernel/debug in bpf Cleanup method, since it makes no sense. It is actually part of the Build.

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

…pf.o.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
@@ -163,6 +163,7 @@ func (o *driverInstallOptions) RunDriverInstall(ctx context.Context) (string, er
// Print much more readable output as-is
o.Printer.DefaultText.Print(buf.String())
}
buf.Reset()
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Small bug lingered in with latest commits.

@FedeDP
Copy link
Contributor Author

FedeDP commented Dec 6, 2023

New output:

sudo ./falcoctl driver install --type ebpf
2023-12-06 17:42:05 INFO  Running falcoctl driver install
                      ├ driver version: 6.0.1+driver
                      ├ driver type: ebpf
                      ├ driver name: falco
                      ├ compile: true
                      ├ download: true
                      ├ arch: x86_64
                      ├ kernel release: 6.6.4-arch1-1
                      └ kernel version: #1 SMP PREEMPT_DYNAMIC Mon, 04 Dec 2023 00:29:19 +0000
2023-12-06 17:42:05 INFO  Found distro target: arch
2023-12-06 17:42:05 INFO  Trying to download a driver. url: https://download.falco.org/driver/6.0.1%2Bdriver/x86_64/falco_arch_6.6.4-arch1-1_1.o                                                                   
2023-12-06 17:42:05 WARN  Non-200 response from url. code: 404
2023-12-06 17:42:05 WARN  unable to find a prebuilt driver 
2023-12-06 17:42:05 INFO  Mounting debugfs for bpf driver.                                                                                                                                                         
2023-12-06 17:42:07 INFO  Copying built driver to its destination.
                      ├ src: /usr/src/falco-6.0.1+driver/bpf/probe.o
                      └ dst: /root/.falco/6.0.1+driver/x86_64/falco_arch_6.6.4-arch1-1_1.o
2023-12-06 17:42:07 INFO  Driver built. path: /root/.falco/6.0.1+driver/x86_64/falco_arch_6.6.4-arch1-1_1.o
2023-12-06 17:42:07 INFO  Symlinking eBPF probe src: /root/.falco/6.0.1+driver/x86_64/falco_arch_6.6.4-arch1-1_1.o dest: /root/.falco/falco-bpf.o
2023-12-06 17:42:07 INFO  eBPF probe symlinked 

@FedeDP
Copy link
Contributor Author

FedeDP commented Dec 6, 2023

/milestone v0.7.0

@poiana poiana added this to the v0.7.0 milestone Dec 6, 2023
@poiana poiana added the lgtm label Dec 6, 2023
@poiana
Copy link
Contributor

poiana commented Dec 6, 2023

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: FedeDP, leogr

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@poiana poiana merged commit 2b56ef4 into main Dec 6, 2023
14 checks passed
@poiana poiana deleted the fix/symlink_ebpf branch December 6, 2023 16:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants