Skip to content

fix(pkg,cmd): eBPF probe must be symlinked under /root/.falco/falco-bpf.o#369

Merged
poiana merged 1 commit intomainfrom
fix/symlink_ebpf
Dec 6, 2023
Merged

fix(pkg,cmd): eBPF probe must be symlinked under /root/.falco/falco-bpf.o#369
poiana merged 1 commit intomainfrom
fix/symlink_ebpf

Conversation

@FedeDP
Copy link
Contributor

@FedeDP FedeDP commented Dec 6, 2023

What type of PR is this?

/kind bug

Any specific area of the project related to this PR?

/area library
/area cli

What this PR does / why we need it:

Also, avoid mounting /sys/kernel/debug in bpf Cleanup method, since it makes no sense. It is actually part of the Build.

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

…pf.o.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
// Print much more readable output as-is
o.Printer.DefaultText.Print(buf.String())
}
buf.Reset()
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Small bug lingered in with latest commits.

@FedeDP
Copy link
Contributor Author

FedeDP commented Dec 6, 2023

New output:

sudo ./falcoctl driver install --type ebpf
2023-12-06 17:42:05 INFO  Running falcoctl driver install
                      ├ driver version: 6.0.1+driver
                      ├ driver type: ebpf
                      ├ driver name: falco
                      ├ compile: true
                      ├ download: true
                      ├ arch: x86_64
                      ├ kernel release: 6.6.4-arch1-1
                      └ kernel version: #1 SMP PREEMPT_DYNAMIC Mon, 04 Dec 2023 00:29:19 +0000
2023-12-06 17:42:05 INFO  Found distro target: arch
2023-12-06 17:42:05 INFO  Trying to download a driver. url: https://download.falco.org/driver/6.0.1%2Bdriver/x86_64/falco_arch_6.6.4-arch1-1_1.o                                                                   
2023-12-06 17:42:05 WARN  Non-200 response from url. code: 404
2023-12-06 17:42:05 WARN  unable to find a prebuilt driver 
2023-12-06 17:42:05 INFO  Mounting debugfs for bpf driver.                                                                                                                                                         
2023-12-06 17:42:07 INFO  Copying built driver to its destination.
                      ├ src: /usr/src/falco-6.0.1+driver/bpf/probe.o
                      └ dst: /root/.falco/6.0.1+driver/x86_64/falco_arch_6.6.4-arch1-1_1.o
2023-12-06 17:42:07 INFO  Driver built. path: /root/.falco/6.0.1+driver/x86_64/falco_arch_6.6.4-arch1-1_1.o
2023-12-06 17:42:07 INFO  Symlinking eBPF probe src: /root/.falco/6.0.1+driver/x86_64/falco_arch_6.6.4-arch1-1_1.o dest: /root/.falco/falco-bpf.o
2023-12-06 17:42:07 INFO  eBPF probe symlinked 

@FedeDP
Copy link
Contributor Author

FedeDP commented Dec 6, 2023

/milestone v0.7.0

@poiana poiana added this to the v0.7.0 milestone Dec 6, 2023
@poiana poiana added the lgtm label Dec 6, 2023
@poiana
Copy link
Contributor

poiana commented Dec 6, 2023

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: FedeDP, leogr

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@poiana poiana merged commit 2b56ef4 into main Dec 6, 2023
@poiana poiana deleted the fix/symlink_ebpf branch December 6, 2023 16:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants