Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Falco probe loader build in Linuxkit (docker4mac, docker4win) #657

Closed
fntlnz opened this issue Jun 10, 2019 · 10 comments

Comments

@fntlnz
Copy link
Member

commented Jun 10, 2019

@janbeerden in #656 reported that he is not able to run Falco on a Kind (Kubernetes in Docker) cluster.

Then, Jan reported his execution log, and it was immediately clear that what he was seeing was because there's no prebuilt module for Linuxkit kernels (usually used in Docker for Mac and Windows installations)

Execution log
* Setting up /usr/src links from host
* Unloading falco-probe, if present
* Running dkms install for falco
Error! echo
Your kernel headers for kernel 4.9.125-linuxkit cannot be found at
/lib/modules/4.9.125-linuxkit/build or /lib/modules/4.9.125-linuxkit/source.
* Running dkms build failed, couldn't find /var/lib/dkms/falco/0.15.1/build/make.log
* Trying to load a system falco-probe, if present
* Trying to find precompiled falco-probe for 4.9.125-linuxkit
Found kernel config at /proc/config.gz
* Trying to download precompiled module from https://s3.amazonaws.com/download.draios.com/stable/sysdig-probe-binaries/falco-probe-0.15.1-x86_64-4.9.125-linuxkit-598c2d809165b47f38383b83b6ff4798.ko
curl: (22) The requested URL returned error: 404 Not Found
Download failed, consider compiling your own falco-probe and loading it or getting in touch with the sysdig community
Mon Jun 10 20:30:26 2019: Falco initialized with configuration file /etc/falco/falco.yaml
Mon Jun 10 20:30:26 2019: Loading rules from file /etc/falco/falco_rules.yaml:
Mon Jun 10 20:30:27 2019: Loading rules from file /etc/falco/falco_rules.local.yaml:
Mon Jun 10 20:30:27 2019: Loading rules from file /etc/falco/k8s_audit_rules.yaml:
Mon Jun 10 20:30:28 2019: Unable to load the driver. Exiting.
Mon Jun 10 20:30:28 2019: Runtime error: error opening device /host/dev/falco0. Make sure you have root credentials and that the falco-probe module is loaded.. Exiting.

Those Linuxkit distros also lack a package manager or a way to install or even obtain kernel headers so the only viable option seems to be to figure it out on CI and prebuild the kernel module for those.

@fntlnz fntlnz closed this Jun 11, 2019

@fntlnz fntlnz reopened this Jun 11, 2019

@poiana poiana added the needs-kind label Jun 11, 2019

@fntlnz

This comment has been minimized.

Copy link
Member Author

commented Jun 11, 2019

/kind feature

@poiana poiana added kind/feature and removed needs-kind labels Jun 11, 2019

@fntlnz fntlnz changed the title Falco probe loader prebuilt module for Linuxkit Falco probe loader build in Linuxkit Jun 27, 2019

@fntlnz

This comment has been minimized.

Copy link
Member Author

commented Jun 27, 2019

@mfdii pointed out that on linuxkit (docker4win and docker4mac) we can build headers using a docker container build using a Dockerfile like this

FROM linuxkit/kernel:4.9.125 AS ksrc
FROM alpine:3.4
ARG FALCOVER=0.13.1
ARG SYSDIGVER=0.24.2

COPY --from=ksrc /kernel-dev.tar /

RUN apk add --no-cache --update wget ca-certificates \
    build-base gcc abuild binutils \
    bc \
    cmake \
    git \
    autoconf && \
  export KERNELVER=`uname -r  | cut -d '-' -f 1`  && \
  export KERNELDIR=/usr/src/linux-headers-4.9.125-linuxkit/ && \
  tar xf /kernel-dev.tar && \
  cd $KERNELDIR && \
  zcat /proc/1/root/proc/config.gz > .config && \
  make olddefconfig && \
  mkdir -p /falco/build && \
  mkdir /src && \
  cd /src && \
  wget https://github.com/falcosecurity/falco/archive/$FALCOVER.tar.gz && \
  tar zxf $FALCOVER.tar.gz && \
  wget https://github.com/draios/sysdig/archive/$SYSDIGVER.tar.gz && \
  tar zxf $SYSDIGVER.tar.gz && \
  mv sysdig-$SYSDIGVER sysdig && \ 
  cd /falco/build && \
  cmake /src/falco-$FALCOVER && \
  make driver && \
  rm -rf /src && \
  apk del wget ca-certificates \
    build-base gcc abuild binutils \
    bc \
    cmake \
    git \
    autoconf

CMD ["insmod","/falco/build/driver/falco-probe.ko"] 
docker build -t falco-docker4win:latest .

Here's how to start it:

$ docker run -it --rm --privileged falco-docker4win:latest
$ docker run -e "SYSDIG_SKIP_LOAD=1" -i -t --name falco --privileged -v /var/run/docker.sock:/host/var/run/docker.sock -v /dev:/host/dev -v /proc:/host/proc:ro -v /boot:/host/boot:ro -v /lib/modules:/host/lib/modules:ro -v /usr:/host/usr:ro falcosecurity/falco

I think that this one should be built-in the probe loader entrypoint when detected that we are on Linuxkit or something like that? Wdyt?

An alternative would just be to include this in the install documentation for such environments so that users are aware.

@fntlnz fntlnz changed the title Falco probe loader build in Linuxkit Falco probe loader build in Linuxkit (docker4mac, docker4win) Jun 27, 2019

@leodido

This comment has been minimized.

Copy link
Member

commented Jun 27, 2019

Let's start with including it into the installation docs.

@fntlnz

This comment has been minimized.

Copy link
Member Author

commented Jun 27, 2019

/kind documentation

@dghoshal-lbl

This comment has been minimized.

Copy link

commented Jul 10, 2019

I tried a similar Dockerfile to build sysdig on my docker4mac (linuxkit) and it failed because there is nothing on /lib/modules for the specific linux headers. Can someone please let me know how to get the modules and build sysdig correctly on linuxkit?

@fntlnz

This comment has been minimized.

Copy link
Member Author

commented Jul 11, 2019

Did you try exactly the one I posted here @dghoshal-lbl ? #657 (comment)

@dghoshal-lbl

This comment has been minimized.

Copy link

commented Jul 11, 2019

Not for falco. I am trying the same for sysdig on linuxkit (docker4mac). The build fails because there's no /lib/modules.

@dghoshal-lbl

This comment has been minimized.

Copy link

commented Jul 12, 2019

@fntlnz Any idea how to build the required kernel modules for sysdig on linuxkit (docker4mac)?

@mfdii

This comment has been minimized.

Copy link
Member

commented Aug 16, 2019

FROM alpine:3.4
ARG SYSDIGVER=0.24.2

COPY --from=ksrc /kernel-dev.tar /

RUN apk add --no-cache --update wget ca-certificates \
    build-base gcc abuild binutils \
    bc \
    cmake \
    git \
    autoconf && \
  export KERNELVER=`uname -r  | cut -d '-' -f 1`  && \
  export KERNELDIR=/usr/src/linux-headers-4.9.125-linuxkit/ && \
  tar xf /kernel-dev.tar && \
  cd $KERNELDIR && \
  zcat /proc/1/root/proc/config.gz > .config && \
  make olddefconfig && \
  mkdir -p /sysdig/build && \
  mkdir /src && \
  cd /src && \
  wget https://github.com/draios/sysdig/archive/$SYSDIGVER.tar.gz && \
  tar zxf $SYSDIGVER.tar.gz && \
  mv sysdig-$SYSDIGVER sysdig && \ 
  cd /sysdig/build && \
  cmake /src/sysdig && \
  make driver && \
  rm -rf /src && \
  apk del wget ca-certificates \
    build-base gcc abuild binutils \
    bc \
    cmake \
    git \
    autoconf

CMD ["insmod","/sysdig/build/driver/sysdig-probe.ko"] ```

The above should work but I haven't tested. 

Closing this as it's for sysdig not Falco. 

@mfdii mfdii closed this Aug 16, 2019

@Issif

This comment has been minimized.

Copy link

commented Aug 30, 2019

@mfdii helped me a lot of months ago with same issue, here my results if can help : https://github.com/Issif/falco-docker4windows/tree/4.9.184

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
6 participants
You can’t perform that action at this time.