[SMAGENT-981] calculate HASH of fedora atomic kernel config#1172
[SMAGENT-981] calculate HASH of fedora atomic kernel config#1172
Conversation
scripts/sysdig-probe-loader
Outdated
| elif [ ! -z "${SYSDIG_HOST_ROOT}" ] && [ -f "${SYSDIG_HOST_ROOT}/usr/lib/ostree-boot/config-${KERNEL_RELEASE}" ]; then | ||
| echo "Found kernel config at ${SYSDIG_HOST_ROOT}/usr/lib/ostree-boot/config-${KERNEL_RELEASE}" | ||
| HASH=$(md5sum "${SYSDIG_HOST_ROOT}/usr/lib/ostree-boot/config-${KERNEL_RELEASE}" | cut -d' ' -f1) | ||
| elif [ -f /usr/lib/modules/${KERNEL_RELEASE}/config ]; then |
There was a problem hiding this comment.
In order for this to work in a container, we should need another elif that checks for "${SYSDIG_HOST_ROOT}/usr/lib/modules/${KERNEL_RELEASE}/config" like we do for /boot/config and /usr/lib/ostree-boot/config. How is this working without that?
There was a problem hiding this comment.
inside the container, /lib/modules is symlink of $SYSDIG_HOST_ROOT/lib/modules. w/ such symlink in place, the code applies to both native host and container.
see sysdig/docker/local/Dockerfile line 46
RUN ln -s $SYSDIG_HOST_ROOT/lib/modules /lib/modules
this was run inside the container as confirmation of such symlink:
root@ip-172-31-9-169:/# ls -l /lib/modules
lrwxrwxrwx. 1 root root 17 Jun 26 23:50 /lib/modules -> /host/lib/modules
There was a problem hiding this comment.
From slack, we found that this works because /lib is symlinked to /usr/lib in that base image and we set up symlinks in /lib/modules to /$SYSDIG_HOST_ROOT/lib/modules in the docker entrypoint.
To make this robust, let's check /lib/modules/${KERNEL_RELEASE}/config and the same path prefixed with /$SYSDIG_HOST_ROOT. That will still work for the atomic container and will be more flexible in other cases.
feature
added HASH calculation for fedora atomic linux
how to verify
in AWS start an atomic instance, and start sysdig/agent container in interactive bash session, run /opt/draios/bin/sysdigcloud-probe-loader (or sysdigcloud-probe-loader which contains the added code piece), verified the hash was calculated by having similar output: