new(pkg,cmd): refactored builder script logic. #324

FedeDP · 2024-03-13T11:22:32Z

What type of PR is this?

/kind cleanup
/kind feature

Any specific area of the project related to this PR?

/area cmd
/area pkg

What this PR does / why we need it:

Builder script has been split in 3 different scripts:

download libs
download headers
build

This way, we can reuse download libs script among all of them. Moreover, it is useful to have a download headers script that is invokeable by itself, because it has the logic to download and extract headers for a given distro.

Finally, fixed a couple of things with local builder:

redirect stderr to stdout so that we catch errors too while building
pre initialize envMap to an empty map, instead of nil
allow to automatically download kernel headers

Basically, what we want to achieve here is to allow falcoctl driver loader to be able to fetch KernelURLs using driverkit libraries, and then extract kernel urls using the newly provided templated bash scripts (note: this is a distro specific knowledge, we cannot just "untar" the headers), and finally pass the KERNELDIR env variable back to local build processor.
In the end, this approach will enable us to drop the kernel headers dependency for Falco installations on distros supported by driverkit, at least when the headers are actually found by driverkit itself.

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Note that ~400Locs come from new _kernel.sh templates licenses.

Does this PR introduce a user-facing change?:

NONE

FedeDP · 2024-03-13T11:22:53Z

cmd/local.go

@@ -72,7 +72,7 @@ func NewLocalCmd(rootCommand *RootCmd, rootOpts *RootOptions, rootFlags *pflag.F
 	})
 	flagSet.BoolVar(&opts.useDKMS, "dkms", false, "Enforce usage of DKMS to build the kernel module.")
 	flagSet.StringVar(&opts.srcDir, "src-dir", "", "Enforce usage of local source dir to build drivers.")
-	flagSet.StringToStringVar(&opts.envMap, "env", nil, "Env variables to be enforced during the driver build.")
+	flagSet.StringToStringVar(&opts.envMap, "env", make(map[string]string), "Env variables to be enforced during the driver build.")


Default to an empty map instead of nil. Not a big deal anyway.

FedeDP · 2024-03-13T11:23:21Z

pkg/driverbuilder/builder/aliyunlinux.go

@@ -21,6 +21,9 @@ import (
 	"github.com/falcosecurity/driverkit/pkg/kernelrelease"
 )

+//go:embed templates/alinux_kernel.sh
+var alinuxKernelTemplate string


Each builder does now expose a kernel download/extract template too.

FedeDP · 2024-03-13T11:26:02Z

pkg/driverbuilder/builder/builders.go

-	parsed, err := t.Parse(b.TemplateScript())
+// TemplateDataSpecifier is an optional interface implemented by builders
+// to specify a custom template data instead of the default one.
+type TemplateDataSpecifier interface {


TemplateData method is now optional since config.ToTemplateData is enough most of the time (for now, the only exception is local builder; and i think it will remain it).

FedeDP · 2024-03-13T11:27:22Z

pkg/driverbuilder/builder/builders.go

@@ -305,13 +368,12 @@ func Targets() []string {
 func (c Config) toTemplateData(b Builder, kr kernelrelease.KernelRelease) commonTemplateData {
 	c.setGCCVersion(b, kr)
 	return commonTemplateData{
-		DriverBuildDir:    DriverDirectory,
-		ModuleDownloadURL: fmt.Sprintf("%s/%s.tar.gz", c.DownloadBaseURL, c.DriverVersion),


ModuleDownloadURL is only needed at libs download time, therefore it is now part of libsDownloadTemplateData.

FedeDP · 2024-03-13T11:29:57Z

pkg/driverbuilder/builder/templates/local.sh

@@ -48,7 +37,11 @@ mkdir -p build && cd build
 echo "* Building kmod with DKMS"
 # Build the module using DKMS
 echo "#!/usr/bin/env bash" > "/tmp/falco-dkms-make"
-echo "make CC={{ .GCCVersion }} \$@" >> "/tmp/falco-dkms-make"
+if [[ -z "${KERNELDIR}" ]]; then


Manage kerneldir in dkms script.

Builder script has been split in 3 different scripts: * download libs * download headers * build This way, we can reuse `download libs` script among all of them. Moreover, it is useful to have a download headers script that is invokeable by itself, because it has the logic to download and extract headers for a given distro. Finally, fixed a couple of things with local builder: * redirect stderr to stdout so that we catch errors too while building * pre initialize envMap to an empty map, instead of nil * manage KERNELDIR env var, if set, while building with dkms The last point allows for consumer to pass `KERNELDIR` inside `envMap` local builder processor argument to customize the build. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

FedeDP · 2024-03-13T13:28:25Z

pkg/driverbuilder/builder/templates/debian_kernel.sh

+sourcedir=$(find . -type d -name "{{ .KernelHeadersPattern }}" | head -n 1 | xargs readlink -f)
+
+# Patch makefile to avoid using absolute `/usr/src` path; instead use `..` relative one.
+sed -i 's/\/usr\/src/../g' $sourcedir/Makefile


In master, we used to install everything under /usr/src.
This is not convenient in case anybody is going to run this script on localhost (ie: not through docker); we now avoid that.
Instead, we need to patch main headers Makefile to avoid absolute path inclusion of secondary makefile.
I tested on multiple versions and this assumption holds true.

Moreover, let KernelDownloadScript method take just kernelUrls instead of full build config. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

Also, bumped driverkit to falcosecurity/driverkit#324 HEAD. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

FedeDP · 2024-03-14T08:05:05Z

Here is the output for falcoctl leveraging the new kernel downloader script: falcosecurity/falcoctl#476 (comment)

Also, bumped driverkit to falcosecurity/driverkit#324 HEAD. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

pkg/driverbuilder/kubernetes.go

FedeDP · 2024-03-14T09:45:24Z

pkg/driverbuilder/kubernetes.go

@@ -117,7 +127,8 @@ func (bp *KubernetesBuildProcessor) buildModule(b *builder.Build) error {

 	buildCmd := []string{
 		"/bin/bash",
-		"/driverkit/driverkit.sh",
+		"-l",


This is the same fix as #321

FedeDP · 2024-03-14T10:11:22Z

cmd/local.go

-	srcDir  string
-	envMap  map[string]string
+	useDKMS         bool
+	downloadHeaders bool


Local cmd now supports automatically downloading kernel headers for the build.
Note that it is not a fatal error if kernel headers are not found; it will just continue trying with locally installed ones, if any.

…in local builder. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

FedeDP · 2024-03-14T12:10:20Z

pkg/driverbuilder/builder/templates/oracle_kernel.sh

+mv usr/src/kernels/*/* /tmp/kernel
+
+# exit value
+echo /tmp/kernel


Ugliest part of the PR...the _kernel.sh template scripts MUST return the path to be used as KERNELDIR by echoing it to stdout, since it will then be used as env for the build script.

This means that the _kernel.sh script CANNOT echo anything else, since their stdout must just return the kerneldir path.
I could not find any better way to achieve this (well, we could create an output file, but that would be still ugly imho; and then we've got a new file to be cleaned up too).

FedeDP · 2024-03-14T12:12:22Z

pkg/driverbuilder/docker.go

 	if err != nil {
 		return err
 	}

+	runCmd :=


We create a new cmd that makes required scripts executables and then :

runs download-libs to download libs repo

runs download-headers capturing its stdout (see https://github.com/falcosecurity/driverkit/pull/324/files#r1524730462)

the stdout from the download-headers step will be used as KERNELDIR env variable for the driverkit.sh script, that is the actual building script

FedeDP · 2024-03-14T12:13:09Z

pkg/driverbuilder/local.go

@@ -39,9 +47,50 @@ func (lbp *LocalBuildProcessor) String() string {
 func (lbp *LocalBuildProcessor) Start(b *builder.Build) error {
 	slog.Debug("doing a new local build")

+	if lbp.useDKMS {


Moved the check from above, so that external library users gain it for free.

FedeDP · 2024-03-14T12:15:34Z

pkg/driverbuilder/local.go

 	// We don't want to download headers
 	kr := b.KernelReleaseFromBuildConfig()

+	if lbp.downloadHeaders {


Download headers support; super simple:

now local command too requires a valid target type

if the builder is not found, we just skip kernel headers download. Should never happen inside driverkit because target CLI option is validated, but can happen when used by external library users

once created the target, we just call the KernelDownloadScript method to generate the kernel download/extracting script for the target distro

we run the script capturing the output, see again https://github.com/falcosecurity/driverkit/pull/324/files#r1524730462

we add the KERNELDIR env var to the localbuilderprocessor env, that will then be used when running the local.sh build script.

FedeDP · 2024-03-14T12:16:15Z

pkg/driverbuilder/local.go

@@ -86,6 +135,20 @@ func (lbp *LocalBuildProcessor) Start(b *builder.Build) error {
 	// Fetch paths were kmod and probe will be built
 	srcModulePath := vv.GetModuleFullPath(c, kr)
 	srcProbePath := vv.GetProbeFullPath(c)
+
+	if len(lbp.srcDir) == 0 {
+		slog.Info("Downloading driver sources.")


Downloading driver sources is now done in place using the new LibsDownloadScript, just like docker build processor does.

FedeDP · 2024-03-14T12:16:38Z

pkg/driverbuilder/local.go

 		} else {
+			cmd.Stderr = cmd.Stdout // redirect stderr to stdout so that we catch it


Redirect stderr to stdout. This is an improvement.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

FedeDP · 2024-03-25T08:20:28Z

/cc @EXONER4TED

EXONER4TED

/approve

poiana · 2024-03-25T14:27:15Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: EXONER4TED, FedeDP

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [EXONER4TED,FedeDP]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Also, bumped driverkit to falcosecurity/driverkit#324 HEAD. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

poiana added kind/cleanup dco-signoff: yes kind/feature New feature or request area/cmd area/pkg labels Mar 13, 2024

poiana requested review from leodido and Lowaiz March 13, 2024 11:22

poiana added approved size/XXL labels Mar 13, 2024

FedeDP commented Mar 13, 2024

View reviewed changes

FedeDP changed the title ~~new(pkg,cmd): refactored builder script logic.~~ wip: new(pkg,cmd): refactored builder script logic. Mar 13, 2024

poiana added the do-not-merge/work-in-progress label Mar 13, 2024

FedeDP force-pushed the new/refactor_builder_logic branch from 4153ffa to ec18417 Compare March 13, 2024 12:13

fix(pkg/driverbuilder): fixed debian_kernel template.

d32b74f

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

FedeDP commented Mar 13, 2024

View reviewed changes

FedeDP mentioned this pull request Mar 13, 2024

new(pkg/driver): try to fetch kernel headers leveraging driverkit library when building drivers falcosecurity/falcoctl#476

Merged

fix(pkg/driverbuilder): fixed archlinux kernel urls discovering.

bddc7a8

Moreover, let KernelDownloadScript method take just kernelUrls instead of full build config. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

FedeDP added a commit to falcosecurity/falcoctl that referenced this pull request Mar 14, 2024

new(pkg): implemented kernel headers automatic download + extraction.

c1ddf1f

Also, bumped driverkit to falcosecurity/driverkit#324 HEAD. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

FedeDP added a commit to falcosecurity/falcoctl that referenced this pull request Mar 14, 2024

new(pkg): implemented kernel headers automatic download + extraction.

38b5d60

Also, bumped driverkit to falcosecurity/driverkit#324 HEAD. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

FedeDP added a commit to falcosecurity/falcoctl that referenced this pull request Mar 14, 2024

new(pkg): implemented kernel headers automatic download + extraction.

62c3f83

Also, bumped driverkit to falcosecurity/driverkit#324 HEAD. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

FedeDP changed the title ~~wip: new(pkg,cmd): refactored builder script logic.~~ new(pkg,cmd): refactored builder script logic. Mar 14, 2024

poiana removed the do-not-merge/work-in-progress label Mar 14, 2024

FedeDP commented Mar 14, 2024

View reviewed changes

pkg/driverbuilder/kubernetes.go Outdated Show resolved Hide resolved

FedeDP commented Mar 14, 2024

View reviewed changes

chore(cmd,pkg): support automatic kernel headers download/extraction …

98d1211

…in local builder. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

FedeDP force-pushed the new/refactor_builder_logic branch from 723d1bb to 98d1211 Compare March 14, 2024 10:13

FedeDP commented Mar 14, 2024

View reviewed changes

fix(pkg/driverbuilder): fixed kubernetes command.

bd11d56

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

poiana requested a review from EXONER4TED March 25, 2024 08:20

FedeDP mentioned this pull request Mar 25, 2024

new(pkg): use driverkit local build processor instead of implementing drivers build falcosecurity/falcoctl#356

Merged

4 tasks

EXONER4TED approved these changes Mar 25, 2024

View reviewed changes

poiana assigned EXONER4TED Mar 25, 2024

poiana added the lgtm label Mar 25, 2024

poiana merged commit 0f094fc into master Mar 25, 2024
5 checks passed

poiana deleted the new/refactor_builder_logic branch March 25, 2024 14:28

FedeDP added a commit to falcosecurity/falcoctl that referenced this pull request Mar 25, 2024

new(pkg): implemented kernel headers automatic download + extraction.

318d196

Also, bumped driverkit to falcosecurity/driverkit#324 HEAD. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

poiana pushed a commit to falcosecurity/falcoctl that referenced this pull request Mar 28, 2024

new(pkg): implemented kernel headers automatic download + extraction.

d5539af

Also, bumped driverkit to falcosecurity/driverkit#324 HEAD. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

FedeDP mentioned this pull request Mar 29, 2024

fix(pkg/driverbuilder): properly export KERNELDIR in kernel-download scripts #330

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

new(pkg,cmd): refactored builder script logic. #324

new(pkg,cmd): refactored builder script logic. #324

FedeDP commented Mar 13, 2024 •

edited

FedeDP Mar 13, 2024

FedeDP Mar 13, 2024

FedeDP Mar 13, 2024

FedeDP Mar 13, 2024

FedeDP Mar 13, 2024

FedeDP Mar 13, 2024

FedeDP commented Mar 14, 2024

FedeDP Mar 14, 2024

FedeDP Mar 14, 2024

FedeDP Mar 14, 2024

FedeDP Mar 14, 2024

FedeDP Mar 14, 2024

FedeDP Mar 14, 2024

FedeDP Mar 14, 2024

FedeDP Mar 14, 2024 •

edited

FedeDP commented Mar 25, 2024

EXONER4TED left a comment

poiana commented Mar 25, 2024

		} else {
		cmd.Stderr = cmd.Stdout // redirect stderr to stdout so that we catch it

new(pkg,cmd): refactored builder script logic. #324

new(pkg,cmd): refactored builder script logic. #324

Conversation

FedeDP commented Mar 13, 2024 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

FedeDP commented Mar 14, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

FedeDP Mar 14, 2024 • edited

Choose a reason for hiding this comment

FedeDP commented Mar 25, 2024

EXONER4TED left a comment

Choose a reason for hiding this comment

poiana commented Mar 25, 2024

FedeDP commented Mar 13, 2024 •

edited

FedeDP Mar 14, 2024 •

edited