new(scrips): improve systemd units for rpm and debian. by FedeDP · Pull Request #2242 · falcosecurity/falco

FedeDP · 2022-10-11T08:42:20Z

What type of PR is this?

/kind feature

Any specific area of the project related to this PR?

What this PR does / why we need it:

Unify systemd units for debian and rpm; plus, rework them to support eBPF, plugins and modern eBPF too.
One will be able to enable falco with eg: bpf by running:

systemctl enable falco-bpf.service

Moreover, since services conflicts with each other, running

systemctl start falco-kmod.service

while falco-bpf.service is active, will bring down bpf one, in favor of the kmod one.

Example dialog:

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

new(scripts): support multiple drivers in systemd units

FedeDP · 2022-10-11T08:42:27Z

@happy-dude

FedeDP · 2022-10-11T08:44:01Z

scripts/debian/postinst.in

 if [ "$1" = "configure" ] || [ "$1" = "abort-upgrade" ] || [ "$1" = "abort-deconfigure" ] || [ "$1" = "abort-remove" ] ; then
        # This will only remove masks created by d-s-h on package removal.
-        deb-systemd-helper unmask 'falco.service' >/dev/null || true
+        deb-systemd-helper unmask 'falco@kmod.target' >/dev/null || true


By default, enable falco on kmod, just like we did before.

FedeDP · 2022-10-11T08:44:41Z

scripts/systemd/falco-ebpf.service

+Description=Falco: Container Native Runtime Security with ebpf
 Documentation=https://falco.org/docs/
+PartOf=falco@ebpf.target
+Conflicts=falco-kmod.service


If you enable falco@ebpf.target it will automatically disable falco@kmod.target.

The same is true for the other way round.

FedeDP · 2022-10-11T08:45:20Z

scripts/systemd/falco-kmod-inject.service

@@ -0,0 +1,11 @@
+[Unit]


Small service that manages kmod injection.

FedeDP · 2022-10-11T14:32:53Z

/milestone 0.34.0

happy-dude · 2022-10-11T15:29:46Z

This is really cool!
This is my first time encountering the @ templating for systemd, so I'll do some extra reading on the side and learn a bit more about it.

EDIT: the below is not possible; see later comment: #2242 (comment)

With regards to taking advantage of the templating aspect of this change, can we move more options over to scripts/systemd/falco@.target ?

The following block of configuration options are shared between the two files:

Type=simple
User=root
ExecStart=/usr/bin/falco --pidfile=/var/run/falco.pid
UMask=0077
TimeoutSec=30
RestartSec=15s
Restart=on-failure
PrivateTmp=true
NoNewPrivileges=yes
ProtectHome=read-only
ProtectSystem=full
ProtectKernelTunables=true
ReadWritePaths=/sys/module/falco
RestrictRealtime=true
RestrictAddressFamilies=~AF_PACKET
StandardOutput=null

At the moment, the only option unique to falco-ebpf.service is Environment=FALCO_BPF_PROBE=.

FedeDP · 2022-10-11T15:35:22Z

The following block of configuration options are shared between the two files:

Are they inherited? I didn't know that!
Great tip!

happy-dude · 2022-10-11T15:37:43Z

Are they inherited? I didn't know that!

I'm actually not sure; let me read more into it and see if that's the case 👀

happy-dude · 2022-10-11T15:57:41Z

I've read a little more in https://www.freedesktop.org/software/systemd/man/systemd.unit.html and https://askubuntu.com/questions/659267/how-do-i-override-or-configure-systemd-services/659268#659268;

systemd unit template file options are not inherited.

Seems like the unit template serves for parameterizing the service and grabbing specifiers; in other words, templating for the service itself and not templating for writing other service unit definitions.

FedeDP · 2022-10-11T16:11:19Z

systemd unit template file options are not inherited.

:( It could be a very nice cleanup!

FedeDP · 2022-10-12T09:15:15Z

Rebased on top of master.
A couple of things to work out:

properly use falco-driver-loader to build the drivers instead of manually using dkms
add a configure step selection window to allow users to select the falco driver to use (ie: { ebpf, kmod, dontstart }

happy-dude · 2022-10-12T15:15:20Z

An aside -- I mentioned somewhere that I loaded the BPF probe/ started the Falco process differently:

ExecStart=/bin/bash -c 'FALCO_BPF_PROBE=/etc/falco-bpf/falco_debian_$(uname -r).o exec /usr/bin/falco --pidfile=/var/run/falco.pid'

This is due to my team and I creating falco-bpf probe packages alongside new kernel releases and having a naming format that's not the same as the Falco format. As far as I know, there wasn't a flexible way in a systemd unit to dynamically grab a variable value.

FedeDP · 2022-10-12T15:41:56Z

TODO:

test...
test...
test...

FedeDP · 2022-10-24T13:45:01Z

Renamed "Don't start" option to "Plugins" and rebased :)

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>

…d-inject with `PartOf`. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

…ical size to comprehend all of 5 options. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

Co-authored-by: Andrea Terzolo <andrea.terzolo@polito.it> Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

poiana · 2022-12-06T13:00:48Z

New changes are detected. LGTM label has been removed.

FedeDP · 2022-12-06T13:00:53Z

Rebased + added small fix.

happy-dude · 2022-12-14T18:54:57Z

Hey @FedeDP

I was able to pull down this branch today and play around with it.

Here is some output I was playing around with:

schan@debian:~/falco/build$ falco --version
Falco version: 0.32.1-344+2f21814
Libs version:  0.10.0-rc1
Plugin API:    2.0.0
Driver:
  API version:    3.0.0
  Schema version: 2.0.0
  Default driver: 4.0.0-rc1+driver

schan@debian:~/falco/build$ ls /lib/systemd/system/falco-*
/lib/systemd/system/falco-bpf.service          /lib/systemd/system/falco-kmod.service        /lib/systemd/system/falco-plugin.service
/lib/systemd/system/falco-kmod-inject.service  /lib/systemd/system/falco-modern-bpf.service

schan@debian:~/falco/build$ sudo systemctl enable falco-bpf.service
Created symlink /etc/systemd/system/multi-user.target.wants/falco-bpf.service → /lib/systemd/system/falco-bpf.service.

schan@debian:~/falco/build$ sudo systemctl start falco-bpf.service

schan@debian:~/falco/build$ sudo systemctl status falco-bpf.service
● falco-bpf.service - Falco: Container Native Runtime Security with ebpf
     Loaded: loaded (/lib/systemd/system/falco-bpf.service; enabled; preset: enabled)
     Active: active (running) since Wed 2022-12-14 12:52:06 CST; 6s ago
       Docs: https://falco.org/docs/
   Main PID: 88417 (falco)
      Tasks: 14 (limit: 9505)
     Memory: 22.2M
        CPU: 303ms
     CGroup: /system.slice/falco-bpf.service
             └─88417 /usr/bin/falco --pidfile=/var/run/falco.pid

Dec 14 12:52:06 debian systemd[1]: Started Falco: Container Native Runtime Security with ebpf.
Dec 14 12:52:07 debian falco[88417]: Falco version: 0.32.1-344+2f21814 (aarch64)
Dec 14 12:52:07 debian falco[88417]: Falco initialized with configuration file: /etc/falco/falco.yaml
Dec 14 12:52:07 debian falco[88417]: Loading rules from file /etc/falco/falco_rules.yaml
Dec 14 12:52:07 debian falco[88417]: Loading rules from file /etc/falco/falco_rules.local.yaml
Dec 14 12:52:07 debian falco[88417]: The chosen syscall buffer dimension is: 8388608 bytes (8 MBs)
Dec 14 12:52:07 debian falco[88417]: Starting health webserver with threadiness 6, listening on port 8765
Dec 14 12:52:07 debian falco[88417]: Enabled event sources: syscall
Dec 14 12:52:07 debian falco[88417]: Opening capture with BPF probe. BPF probe path: /root/.falco/falco-bpf.o

schan@debian:~/falco/build$ sudo systemctl disable falco-bpf
Removed "/etc/systemd/system/multi-user.target.wants/falco-bpf.service".
schan@debian:~/falco/build$ sudo systemctl stop falco-bpf
schan@debian:~/falco/build$ sudo systemctl status falco-bpf.service
○ falco-bpf.service - Falco: Container Native Runtime Security with ebpf
     Loaded: loaded (/lib/systemd/system/falco-bpf.service; disabled; preset: enabled)
     Active: inactive (dead)
       Docs: https://falco.org/docs/

Dec 14 12:52:07 debian falco[88417]: Loading rules from file /etc/falco/falco_rules.yaml
Dec 14 12:52:07 debian falco[88417]: Loading rules from file /etc/falco/falco_rules.local.yaml
Dec 14 12:52:07 debian falco[88417]: The chosen syscall buffer dimension is: 8388608 bytes (8 MBs)
Dec 14 12:52:07 debian falco[88417]: Starting health webserver with threadiness 6, listening on port 8765
Dec 14 12:52:07 debian falco[88417]: Enabled event sources: syscall
Dec 14 12:52:07 debian falco[88417]: Opening capture with BPF probe. BPF probe path: /root/.falco/falco-bpf.o
Dec 14 12:52:51 debian falco[88417]: SIGINT received, exiting...
Dec 14 12:52:51 debian systemd[1]: Stopping Falco: Container Native Runtime Security with ebpf...
Dec 14 12:52:51 debian systemd[1]: falco-bpf.service: Deactivated successfully.
Dec 14 12:52:51 debian systemd[1]: Stopped Falco: Container Native Runtime Security with ebpf.

However, I was unable to start/enable the service as described in the description with falco@bpf.target

schan@debian:~/falco/build$ sudo systemctl start falco
Failed to start falco.service: Unit falco.service is masked.

schan@debian:~/falco/build$ sudo systemctl start falco@bpf
Failed to start falco@bpf.service: Unit falco@bpf.service not found.

schan@debian:~/falco/build$ sudo systemctl start falco@bpf.target
Failed to start falco@bpf.target: Unit falco@bpf.target not found.

schan@debian:~/falco/build$ sudo systemctl start falco@bpf.service
Failed to start falco@bpf.service: Unit falco@bpf.service not found.

schan@debian:~/falco/build$ sudo systemctl status falco
○ falco.service
     Loaded: masked (Reason: Unit falco.service is masked.)
     Active: inactive (dead)


schan@debian:~/falco/build$ ls /lib/systemd/system/falco-*
/lib/systemd/system/falco-bpf.service          /lib/systemd/system/falco-kmod.service        /lib/systemd/system/falco-plugin.service
/lib/systemd/system/falco-kmod-inject.service  /lib/systemd/system/falco-modern-bpf.service

Just wanted to double check and ask if this was working as expected?

FedeDP · 2022-12-15T10:56:19Z

However, I was unable to start/enable the service as described in the description with falco@bpf.target

Yep it is expected since there is no more a falco@bpf.target 😆

FedeDP · 2022-12-15T10:57:06Z

@happy-dude i updated the OP!

leogr

I believe this PR has finally reached a very great status and is ready to be tested in the real world.

🥳

jasondellaluce

/approve

poiana · 2022-12-15T11:49:53Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: FedeDP, jasondellaluce, leogr

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [FedeDP,jasondellaluce,leogr]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

FedeDP · 2022-12-15T13:08:33Z

/unhold

poiana added release-note kind/feature dco-signoff: yes labels Oct 11, 2022

poiana added size/L approved labels Oct 11, 2022

poiana requested review from Kaizhe and jasondellaluce October 11, 2022 08:42

FedeDP commented Oct 11, 2022

View reviewed changes

poiana added this to the 0.34.0 milestone Oct 11, 2022

FedeDP mentioned this pull request Oct 11, 2022

fix(falco_service): falco service needs to write under /sys/module/falco #2238

Merged

FedeDP force-pushed the fix/systemd_units branch from 4884917 to 552872f Compare October 12, 2022 09:13

poiana added size/XL and removed size/L labels Oct 12, 2022

FedeDP force-pushed the fix/systemd_units branch 2 times, most recently from 238eaf7 to a1f0e5f Compare October 12, 2022 15:34

FedeDP force-pushed the fix/systemd_units branch from a0d40ba to 42986b4 Compare October 13, 2022 07:43

FedeDP force-pushed the fix/systemd_units branch from f2af848 to 97fd0c3 Compare October 24, 2022 13:47

FedeDP and others added 10 commits December 6, 2022 14:00

fix(scripts): fixed PartOf in bpf and modern-bpf systemd units.

c43672f

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

chore(scripts): fallback at previous insmod method, if modprobe fails.

6ad4bac

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

fix(scripts): fixed rpm dialog script.

d43879c

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

update: remove falco target

b97f08d

Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>

fix: stop also falco-kmod-inject.service unit

1e45e4c

Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>

chore(scripts): properly configure falco-kmod dependency on falco-kmo…

2cd951b

…d-inject with `PartOf`. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

chore(scripts): manage dialog cancel button, and increase dialog vert…

ab8460b

…ical size to comprehend all of 5 options. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

update(scripts): typo

42bbc2b

Co-authored-by: Andrea Terzolo <andrea.terzolo@polito.it> Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

update(scripts): typo

aa357ea

Co-authored-by: Andrea Terzolo <andrea.terzolo@polito.it> Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

chore(scripts): avoid failing if mkdir/cp/depmod fail.

2f21814

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

FedeDP dismissed jasondellaluce’s stale review via 2f21814 December 6, 2022 13:00

FedeDP force-pushed the fix/systemd_units branch from 098dbe5 to 2f21814 Compare December 6, 2022 13:00

poiana removed the lgtm label Dec 6, 2022

poiana requested a review from jasondellaluce December 6, 2022 13:00

leogr approved these changes Dec 15, 2022

View reviewed changes

poiana assigned leogr Dec 15, 2022

poiana added the lgtm label Dec 15, 2022

jasondellaluce approved these changes Dec 15, 2022

View reviewed changes

poiana removed the do-not-merge/hold label Dec 15, 2022

poiana merged commit a1d68e8 into master Dec 15, 2022

poiana deleted the fix/systemd_units branch December 15, 2022 13:09

FedeDP mentioned this pull request Jan 10, 2023

wip: update(content): update running docs for Falco 0.34. falcosecurity/falco-website#785

Closed

johananl mentioned this pull request Jun 15, 2023

No log output on Debian-based distros #2643

Closed

Conversation

FedeDP commented Oct 11, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

FedeDP commented Oct 11, 2022

Uh oh!

FedeDP Oct 11, 2022

Choose a reason for hiding this comment

Uh oh!

FedeDP Oct 11, 2022

Choose a reason for hiding this comment

Uh oh!

FedeDP Oct 11, 2022

Choose a reason for hiding this comment

Uh oh!

FedeDP Oct 11, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

FedeDP commented Oct 11, 2022

Uh oh!

happy-dude commented Oct 11, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

FedeDP commented Oct 11, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

happy-dude commented Oct 11, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

happy-dude commented Oct 11, 2022

Uh oh!

FedeDP commented Oct 11, 2022

Uh oh!

FedeDP commented Oct 12, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

happy-dude commented Oct 12, 2022

Uh oh!

FedeDP commented Oct 12, 2022

Uh oh!

FedeDP commented Oct 24, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

poiana commented Dec 6, 2022

Uh oh!

FedeDP commented Dec 6, 2022

Uh oh!

happy-dude commented Dec 14, 2022

Uh oh!

FedeDP commented Dec 15, 2022

Uh oh!

FedeDP commented Dec 15, 2022

Uh oh!

leogr left a comment

Choose a reason for hiding this comment

Uh oh!

jasondellaluce left a comment

Choose a reason for hiding this comment

Uh oh!

poiana commented Dec 15, 2022

Uh oh!

FedeDP commented Dec 15, 2022

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

FedeDP commented Oct 11, 2022 •

edited

Loading

FedeDP Oct 11, 2022 •

edited

Loading

happy-dude commented Oct 11, 2022 •

edited

Loading

FedeDP commented Oct 11, 2022 •

edited

Loading

happy-dude commented Oct 11, 2022 •

edited

Loading

FedeDP commented Oct 12, 2022 •

edited

Loading

FedeDP commented Oct 24, 2022 •

edited

Loading