Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

sysdig: 0.35.3 -> 0.36.0 #300630

Merged
merged 3 commits into from
Apr 1, 2024
Merged

sysdig: 0.35.3 -> 0.36.0 #300630

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
b6e65a1
sysdig: 0.35.3 -> 0.36.0
SebTM Apr 1, 2024
50625bd
sysdig: fix formattig
SebTM Apr 1, 2024
1a92639
sysdig: disable hardened and zen kernels
Mic92 Apr 1, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
113 changes: 59 additions & 54 deletions pkgs/os-specific/linux/sysdig/default.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,38 +1,36 @@
{ lib, stdenv, fetchFromGitHub, cmake, kernel, installShellFiles, pkg-config
, luajit, ncurses, perl, jsoncpp, openssl, curl, jq, gcc, elfutils, tbb, protobuf, grpc
, yaml-cpp, nlohmann_json, re2, zstd, uthash
}:
, luajit, ncurses, perl, jsoncpp, openssl, curl, jq, gcc, elfutils, tbb
, protobuf, grpc, yaml-cpp, nlohmann_json, re2, zstd, uthash }:

let
# Compare with https://github.com/draios/sysdig/blob/0.35.1/cmake/modules/falcosecurity-libs.cmake
libsRev = "0.14.2";
libsHash = "sha256-sWrniRB/vQd1BZnsiz+wLHugrF3LhuAr9e9gDMavLoo=";
# Compare with https://github.com/draios/sysdig/blob/0.36.0/cmake/modules/falcosecurity-libs.cmake
libsRev = "0.15.1";
libsHash = "sha256-CsKa5ybRj7Mjb71xNwd8FtDprOMfpJMrm3mvkeqZE3o=";

# Compare with https://github.com/falcosecurity/libs/blob/0.14.2/cmake/modules/valijson.cmake
# Compare with https://github.com/falcosecurity/libs/blob/0.15.1/cmake/modules/valijson.cmake
valijson = fetchFromGitHub {
owner = "tristanpenman";
repo = "valijson";
rev = "v0.6";
hash = "sha256-ZD19Q2MxMQd3yEKbY90GFCrerie5/jzgO8do4JQDoKM=";
rev = "v1.0.2";
hash = "sha256-wvFdjsDtKH7CpbEpQjzWtLC4RVOU9+D2rSK0Xo1cJqo=";
};

# https://github.com/draios/sysdig/blob/0.35.1/cmake/modules/driver.cmake
# https://github.com/draios/sysdig/blob/0.36.0/cmake/modules/driver.cmake
SebTM marked this conversation as resolved.
Show resolved Hide resolved
driver = fetchFromGitHub {
owner = "falcosecurity";
repo = "libs";
rev = "7.0.0+driver";
hash = "sha256-kXqvfM7HbGh2wEGaO4KBkFDW+m5gpOShJZKJLu9McKk=";
};
in
stdenv.mkDerivation rec {
in stdenv.mkDerivation rec {
pname = "sysdig";
version = "0.35.3";
version = "0.36.0";

src = fetchFromGitHub {
owner = "draios";
repo = "sysdig";
rev = version;
hash = "sha256-wvCnWzQbkkM8qEG93li22P67WX1bGX9orTk+2vsBHZY=";
hash = "sha256-EQnmtxByTsSawQPFmTe2pBMcv5rFaNtST+2KXZSFuoo=";
};

nativeBuildInputs = [ cmake perl installShellFiles pkg-config ];
Expand All @@ -58,12 +56,14 @@ stdenv.mkDerivation rec {
hardeningDisable = [ "pic" ];

postUnpack = ''
cp -r ${fetchFromGitHub {
owner = "falcosecurity";
repo = "libs";
rev = libsRev;
hash = libsHash;
}} libs
cp -r ${
fetchFromGitHub {
owner = "falcosecurity";
repo = "libs";
rev = libsRev;
hash = libsHash;
}
} libs
chmod -R +w libs

substituteInPlace libs/userspace/libscap/libscap.pc.in libs/userspace/libsinsp/libsinsp.pc.in \
Expand All @@ -72,6 +72,13 @@ stdenv.mkDerivation rec {

cp -r ${driver} driver-src
chmod -R +w driver-src

# Hacky but needed until https://github.com/draios/sysdig/issues/2077 is resolved for kernel >= 6.8 as strlcpy got removed and build fails
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is hacky but the simplest solution (I found) to fix the build and due to the condition in the code I'm sure it's not executed for 6.8-kernel - is there a better way?

Tried combinations with "-Wno-error" etc. but seems to not be help.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, the function's simply gone. It's not some compilation warning we can just ignore =)

Copy link
Contributor Author

@SebTM SebTM Apr 1, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The issue is this is a build error breaking the build so I can't ignore it without patching it so far as said no "-W" combination worked for me ...

Happy to try something else if you have a different solution

${lib.optionalString
(kernel != null && lib.versionAtLeast kernel.version "6.8") ''
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is neat! But it's my understanding that strscpy has been around for a while. If this substitution is safe to do (and I do not know if it is), I'd guess it's safe to do in all kernel versions we support.

Copy link
Contributor Author

@SebTM SebTM Apr 1, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd guess it's safe to do in all kernel versions we support.

I wouldn't do this it's only removed from kernel >= 6.8 in the kernel-sources build against and so only causing an issue there as the function definition is missing even it would never be used because it has a check in the pm_events.c for kernel-version.

substituteInPlace libs/driver/ppm_events.c driver-src/driver/ppm_events.c --replace-fail "strlcpy" "strscpy"
''}

cmakeFlagsArray+=(
"-DFALCOSECURITY_LIBS_SOURCE_DIR=$(pwd)/libs"
"-DDRIVER_SOURCE_DIR=$(pwd)/driver-src/driver"
Expand All @@ -91,10 +98,10 @@ stdenv.mkDerivation rec {
] ++ lib.optional (kernel == null) "-DBUILD_DRIVER=OFF";

env.NIX_CFLAGS_COMPILE =
# needed since luajit-2.1.0-beta3
"-DluaL_reg=luaL_Reg -DluaL_getn(L,i)=((int)lua_objlen(L,i)) " +
# fix compiler warnings been treated as errors
"-Wno-error";
# needed since luajit-2.1.0-beta3
"-DluaL_reg=luaL_Reg -DluaL_getn(L,i)=((int)lua_objlen(L,i)) " +
# fix compiler warnings been treated as errors
"-Wno-error";

preConfigure = ''
if ! grep -q "${libsRev}" cmake/modules/falcosecurity-libs.cmake; then
Expand All @@ -107,39 +114,37 @@ stdenv.mkDerivation rec {
export KERNELDIR="${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
'';

postInstall =
''
# Fix the bash completion location
installShellCompletion --bash $out/etc/bash_completion.d/sysdig
rm $out/etc/bash_completion.d/sysdig
rmdir $out/etc/bash_completion.d
rmdir $out/etc
''
+ lib.optionalString (kernel != null) ''
make install_driver
kernel_dev=${kernel.dev}
kernel_dev=''${kernel_dev#${builtins.storeDir}/}
kernel_dev=''${kernel_dev%%-linux*dev*}
if test -f "$out/lib/modules/${kernel.modDirVersion}/extra/scap.ko"; then
sed -i "s#$kernel_dev#................................#g" $out/lib/modules/${kernel.modDirVersion}/extra/scap.ko
else
for i in $out/lib/modules/${kernel.modDirVersion}/{extra,updates}/scap.ko.xz; do
if test -f "$i"; then
xz -d $i
sed -i "s#$kernel_dev#................................#g" ''${i%.xz}
xz -9 ''${i%.xz}
fi
done
fi
'';

postInstall = ''
# Fix the bash completion location
installShellCompletion --bash $out/etc/bash_completion.d/sysdig
rm $out/etc/bash_completion.d/sysdig
rmdir $out/etc/bash_completion.d
rmdir $out/etc
'' + lib.optionalString (kernel != null) ''
make install_driver
kernel_dev=${kernel.dev}
kernel_dev=''${kernel_dev#${builtins.storeDir}/}
kernel_dev=''${kernel_dev%%-linux*dev*}
if test -f "$out/lib/modules/${kernel.modDirVersion}/extra/scap.ko"; then
sed -i "s#$kernel_dev#................................#g" $out/lib/modules/${kernel.modDirVersion}/extra/scap.ko
else
for i in $out/lib/modules/${kernel.modDirVersion}/{extra,updates}/scap.ko.xz; do
if test -f "$i"; then
xz -d $i
sed -i "s#$kernel_dev#................................#g" ''${i%.xz}
xz -9 ''${i%.xz}
fi
done
fi
'';

meta = with lib; {
description = "A tracepoint-based system tracing tool for Linux (with clients for other OSes)";
description =
"A tracepoint-based system tracing tool for Linux (with clients for other OSes)";
license = with licenses; [ asl20 gpl2 mit ];
maintainers = [maintainers.raskin];
platforms = ["x86_64-linux"] ++ platforms.darwin;
broken = kernel != null && versionOlder kernel.version "4.14";
maintainers = [ maintainers.raskin ];
platforms = [ "x86_64-linux" ] ++ platforms.darwin;
broken = kernel != null && ((versionOlder kernel.version "4.14") || kernel.isHardened || kernel.isZen);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Disabled non-standard kernel configuration for now, since they cause too much trouble.
If someone feels strongly about supporting them, I would expect them also to step up and help maintaining them.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fine for me as well, did it with minimal-broken in mind but I don't use them/necessarily have time to maintain them ;)

homepage = "https://sysdig.com/opensource/";
downloadPage = "https://github.com/draios/sysdig/releases";
};
Expand Down