linuxPackages.opensnitch-ebpf: remove linux.dev references

[eclairevoyant]

Fixes #391351 (closure size bloated from 643 KiB to 2.48 GiB)

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 25.05 Release Notes (or backporting 24.11 and 25.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

---

Add a 👍 reaction to pull requests you find important.

[K900]

Is there really no better way to avoid the reference?

[eclairevoyant]

If you have any suggestions, I'm open to them.

[K900]

Well do you know why the reference is there in the first place?

[eclairevoyant]

Not really, this is as much as I could tell:

$ rg -uuu /nix/store/4mgx6rlcnvmzmy44dd9dhgqjg2m79ws2-linux-6.13.7-dev /nix/store/x8307bqr07qzqvdnfh8zfsm910yf9g0f-opensnitch_ebpf-1.6.7-6.13.7/etc/opensnitchd/opensnitch*.o 
/nix/store/x8307bqr07qzqvdnfh8zfsm910yf9g0f-opensnitch_ebpf-1.6.7-6.13.7/etc/opensnitchd/opensnitch-dns.o: binary file matches (found "\0" byte around offset 7)

/nix/store/x8307bqr07qzqvdnfh8zfsm910yf9g0f-opensnitch_ebpf-1.6.7-6.13.7/etc/opensnitchd/opensnitch-procs.o: binary file matches (found "\0" byte around offset 7)

/nix/store/x8307bqr07qzqvdnfh8zfsm910yf9g0f-opensnitch_ebpf-1.6.7-6.13.7/etc/opensnitchd/opensnitch.o: binary file matches (found "\0" byte around offset 7)

$ strings /nix/store/x8307bqr07qzqvdnfh8zfsm910yf9g0f-opensnitch_ebpf-1.6.7-6.13.7/etc/opensnitchd/opensnitch*.o | rg /nix/store/4mgx6rlcnvmzmy44dd9dhgqjg2m79ws2-linux-6.13.7-dev
/nix/store/4mgx6rlcnvmzmy44dd9dhgqjg2m79ws2-linux-6.13.7-dev/lib/modules/6.13.7/source/include/uapi/asm-generic
/nix/store/4mgx6rlcnvmzmy44dd9dhgqjg2m79ws2-linux-6.13.7-dev/lib/modules/6.13.7/source/include/asm-generic
/nix/store/4mgx6rlcnvmzmy44dd9dhgqjg2m79ws2-linux-6.13.7-dev/lib/modules/6.13.7/source/include/uapi/linux
/nix/store/4mgx6rlcnvmzmy44dd9dhgqjg2m79ws2-linux-6.13.7-dev/lib/modules/6.13.7/source/include/linux
/nix/store/4mgx6rlcnvmzmy44dd9dhgqjg2m79ws2-linux-6.13.7-dev/lib/modules/6.13.7/source/arch/x86/include/asm
/nix/store/4mgx6rlcnvmzmy44dd9dhgqjg2m79ws2-linux-6.13.7-dev/lib/modules/6.13.7/source/include/uapi/asm-generic
/nix/store/4mgx6rlcnvmzmy44dd9dhgqjg2m79ws2-linux-6.13.7-dev/lib/modules/6.13.7/source/include/asm-generic
/nix/store/4mgx6rlcnvmzmy44dd9dhgqjg2m79ws2-linux-6.13.7-dev/lib/modules/6.13.7/source/include/linux
/nix/store/4mgx6rlcnvmzmy44dd9dhgqjg2m79ws2-linux-6.13.7-dev/lib/modules/6.13.7/source/include/uapi/linux
/nix/store/4mgx6rlcnvmzmy44dd9dhgqjg2m79ws2-linux-6.13.7-dev/lib/modules/6.13.7/source/include/net
/nix/store/4mgx6rlcnvmzmy44dd9dhgqjg2m79ws2-linux-6.13.7-dev/lib/modules/6.13.7/source/arch/x86/include/asm
/nix/store/4mgx6rlcnvmzmy44dd9dhgqjg2m79ws2-linux-6.13.7-dev/lib/modules/6.13.7/source/include/linux/atomic
/nix/store/4mgx6rlcnvmzmy44dd9dhgqjg2m79ws2-linux-6.13.7-dev/lib/modules/6.13.7/source/include/linux/sched
/nix/store/4mgx6rlcnvmzmy44dd9dhgqjg2m79ws2-linux-6.13.7-dev/lib/modules/6.13.7/source/include/vdso
/nix/store/4mgx6rlcnvmzmy44dd9dhgqjg2m79ws2-linux-6.13.7-dev/lib/modules/6.13.7/source/include/net/netns
/nix/store/4mgx6rlcnvmzmy44dd9dhgqjg2m79ws2-linux-6.13.7-dev/lib/modules/6.13.7/source/include/linux/netfilter
/nix/store/4mgx6rlcnvmzmy44dd9dhgqjg2m79ws2-linux-6.13.7-dev/lib/modules/6.13.7/source/include/linux/device
/nix/store/4mgx6rlcnvmzmy44dd9dhgqjg2m79ws2-linux-6.13.7-dev/lib/modules/6.13.7/source/arch/x86/include/asm/fpu
/nix/store/4mgx6rlcnvmzmy44dd9dhgqjg2m79ws2-linux-6.13.7-dev/lib/modules/6.13.7/source/include/uapi/linux/hdlc
/nix/store/4mgx6rlcnvmzmy44dd9dhgqjg2m79ws2-linux-6.13.7-dev/lib/modules/6.13.7/source/include/uapi/asm-generic
/nix/store/4mgx6rlcnvmzmy44dd9dhgqjg2m79ws2-linux-6.13.7-dev/lib/modules/6.13.7/source/include/asm-generic
/nix/store/4mgx6rlcnvmzmy44dd9dhgqjg2m79ws2-linux-6.13.7-dev/lib/modules/6.13.7/source/include/uapi/linux
/nix/store/4mgx6rlcnvmzmy44dd9dhgqjg2m79ws2-linux-6.13.7-dev/lib/modules/6.13.7/source/include/linux
/nix/store/4mgx6rlcnvmzmy44dd9dhgqjg2m79ws2-linux-6.13.7-dev/lib/modules/6.13.7/source/arch/x86/include/asm
/nix/store/4mgx6rlcnvmzmy44dd9dhgqjg2m79ws2-linux-6.13.7-dev/lib/modules/6.13.7/source/include/linux/sched
/nix/store/4mgx6rlcnvmzmy44dd9dhgqjg2m79ws2-linux-6.13.7-dev/lib/modules/6.13.7/source/include/linux/atomic
/nix/store/4mgx6rlcnvmzmy44dd9dhgqjg2m79ws2-linux-6.13.7-dev/lib/modules/6.13.7/source/include/vdso
/nix/store/4mgx6rlcnvmzmy44dd9dhgqjg2m79ws2-linux-6.13.7-dev/lib/modules/6.13.7/source/arch/x86/include/asm/fpu

[eclairevoyant]

Any thoughts?

[eclairevoyant]

@onny @K900 any further feedback?

[K900]

We should really figure out why it's leaking there before we just nukeReferences it and hope for the best.

[eclairevoyant]

Okay, and that's just what you said 2 months ago, so how do you propose doing so? I'm not a C programmer, I gave a best effort
to at least list out what those references are.

By the way, I just want to remind that this is a 4000x closure size decrease over a dependency on some header files that I hope you can agree would never make sense to be there at runtime.

[eclairevoyant]

Also it's a fairly small codebase: https://github.com/evilsocket/opensnitch/tree/master/ebpf_prog

If you know what you're looking for (which I don't) it's probably easy to find. All I noticed were the extra includes in the Makefile which haven't changed in 2 years.

[K900]

It's just debug info. You can remove it with llvm-strip.

[eclairevoyant]

Why wouldn't fixupPhase take care of this? And why llvm strip specifically?

[eclairevoyant]

Anyway, review addressed, seems to work.

[eclairevoyant]

@K900 any remaining feedback?

[K900]

Sorry, thought I merged this.