Build scap_open test from source instead of CMakeList

[liorzemah]

Describe the bug I am trying to build scap_open test from source instead of CMakeList. First, I am building falcolibs according to https://github.com/falcosecurity/libs/tree/afca72cec1994a5834f9ec2e9687b4be4a1c3c61 Secondly, I am trying to compile scap_open with gcc and then link the object file and all static falcolibs.

How to reproduce it

1. follow https://github.com/falcosecurity/libs/tree/afca72cec1994a5834f9ec2e9687b4be4a1c3c61
2. cd ../userspace/libscap/examples/01-open
3. gcc -c scap_open.c -I "$FALCOLIBS_DIR" -I "$FALCOLIBS_DIR/userspace/libscap" -I "$FALCOLIBS_DIR/userspace/common" -I "$FALCOLIBS_DIR/userspace/libscap/ringbuffer" -I "$FALCOLIBS_DIR/driver" -I "$FALCOLIBS_DIR/driver/src" -I "$FALCOLIBS_DIR/userspace/libscap/linux"
4. gcc -o main scap_open.o -L"$FALCOLIBS_DIR/build/libscap" -L"$FALCOLIBS_DIR/build/libscap/engine/source_plugin" -L"$FALCOLIBS_DIR/build/libscap/engine/noop" -L"$FALCOLIBS_DIR/build/libscap/engine/nodriver" -L"$FALCOLIBS_DIR/build/libscap/engine/bpf" -L"$FALCOLIBS_DIR/build/libscap/engine/kmod" -L"$FALCOLIBS_DIR/build/libscap/engine/udig" -L/lib/x86_64-linux-gnu/ -Wl,-Bstatic -lscap -lscap_engine_source_plugin -lscap_engine_noop -lscap_engine_nodriver -lscap_engine_bpf -lscap_engine_kmod -lscap_engine_udig -Wl,-Bdynamic

I got the following error after step 4: scap_open.o: In function print_parameter': scap_open.c:(.text+0x256): undefined reference to g_event_info' scap_open.o: In function print_modern_probe_syscalls': scap_open.c:(.text+0x994): undefined reference to g_syscall_code_routing_table' scap_open.c:(.text+0x9b6): undefined reference to g_syscall_table' scap_open.c:(.text+0x9cf): undefined reference to g_syscall_info_table' scap_open.c:(.text+0x9eb): undefined reference to g_syscall_info_table' scap_open.c:(.text+0xa44): undefined reference to g_syscall_table' scap_open.c:(.text+0xa5b): undefined reference to g_syscall_info_table' scap_open.c:(.text+0xa76): undefined reference to g_syscall_info_table' scap_open.c:(.text+0xa8e): undefined reference to g_syscall_info_table' scap_open.o: In function print_actual_drivers_syscalls': scap_open.c:(.text+0xb78): undefined reference to g_syscall_code_routing_table' scap_open.c:(.text+0xbb5): undefined reference to g_syscall_table' scap_open.c:(.text+0xbd0): undefined reference to g_syscall_info_table' scap_open.o: In function validate_syscalls': scap_open.c:(.text+0xcd6): undefined reference to g_syscall_code_routing_table' scap_open.c:(.text+0xcf2): undefined reference to g_syscall_table' scap_open.c:(.text+0xd08): undefined reference to g_syscall_info_table' scap_open.c:(.text+0xd43): undefined reference to g_syscall_table' scap_open.c:(.text+0xd57): undefined reference to g_syscall_info_table' scap_open.c:(.text+0xd6f): undefined reference to g_syscall_info_table' scap_open.o: In function parse_CLI_options': scap_open.c:(.text+0x1231): undefined reference to g_syscall_info_table' /home/falcolibs/build/libscap/libscap.a(scap.c.o): In function scap_open_live_int': /home/falcolibs/userspace/libscap/scap.c:256: undefined reference to check_api_compatibility' /home/falcolibs/build/libscap/libscap.a(scap_savefile.c.o): In function scap_next_offline': /home/falcolibs/userspace/libscap/scap_savefile.c:2946: undefined reference to g_event_info' /home/falcolibs/build/libscap/engine/kmod/libscap_engine_kmod.a(scap_kmod.c.o): In function scap_kmod_init': /home/falcolibs/userspace/libscap/engine/kmod/scap_kmod.c:106: undefined reference to devset_init' /home/falcolibs/userspace/libscap/engine/kmod/scap_kmod.c:111: undefined reference to fill_syscalls_of_interest' /home/falcolibs/userspace/libscap/engine/kmod/scap_kmod.c:119: undefined reference to g_syscall_table' /home/falcolibs/userspace/libscap/engine/kmod/scap_kmod.c:119: undefined reference to g_syscall_table' /home/falcolibs/build/libscap/engine/udig/libscap_engine_udig.a(scap_udig.c.o): In function udig_alloc_ring': /home/falcolibs/userspace/libscap/engine/udig/scap_udig.c:52: undefined reference to shm_open' /home/falcolibs/userspace/libscap/engine/udig/scap_udig.c:76: undefined reference to shm_open' /home/falcolibs/build/libscap/engine/udig/libscap_engine_udig.a(scap_udig.c.o): In function udig_alloc_ring_descriptors': /home/falcolibs/userspace/libscap/engine/udig/scap_udig.c:159: undefined reference to shm_open' /home/falcolibs/userspace/libscap/engine/udig/scap_udig.c:165: undefined reference to shm_open' /home/falcolibs/userspace/libscap/engine/udig/scap_udig.c:189: undefined reference to shm_unlink' /home/falcolibs/userspace/libscap/engine/udig/scap_udig.c:182: undefined reference to shm_unlink' /home/falcolibs/build/libscap/engine/udig/libscap_engine_udig.a(scap_udig.c.o): In function init': /home/falcolibs/userspace/libscap/engine/udig/scap_udig.c:884: undefined reference to devset_init' /home/falcolibs/build/libscap/engine/udig/libscap_engine_udig.a(scap_udig.c.o): In function udig_alloc_ring': /home/falcolibs/userspace/libscap/engine/udig/scap_udig.c:52: undefined reference to shm_open' /home/falcolibs/userspace/libscap/engine/udig/scap_udig.c:76: undefined reference to shm_open' collect2: error: ld returned 1 exit status

Expected behaviour Step 4 succeeded and created a new executable file.

Screenshots

Environment

• Falco version: I'm not using Falco engine, only Falcolibs (I cloned this repo, the last version)

• Cloud provider or hardware configuration:
• OS: NAME="Ubuntu" VERSION="16.04.4 LTS (Xenial Xerus)" ID=ubuntu ID_LIKE=debian PRETTY_NAME="Ubuntu 16.04.4 LTS" VERSION_ID="16.04" HOME_URL="http://www.ubuntu.com/" SUPPORT_URL="http://help.ubuntu.com/" BUG_REPORT_URL="http://bugs.launchpad.net/ubuntu/" VERSION_CODENAME=xenial UBUNTU_CODENAME=xenial

• Kernel: 4.15.0-142-generic

• Installation method: from source

Additional context

[FedeDP]

Hi! Just a question: why won't you use cmake instead? Just like described here: https://github.com/falcosecurity/libs/blob/master/userspace/libscap/examples/01-open/README.md#build-%EF%B8%8F

[Andreagit97]

yeah unfortunately we never tried to build it directly from the source because even if it's a small program it requires a lot of dependencies

[liorzemah]

Hi! Just a question: why won't you use cmake instead? Just like described here: https://github.com/falcosecurity/libs/blob/master/userspace/libscap/examples/01-open/README.md#build-%EF%B8%8F

I already have existing project that I would like to integrate flacolibs into it. This is difficult to convert this project to work with cmake.

In the first step that described above i followed this guide, I built the libs with cmake like you mentioned. In the other steps I try to link the created .a libs into my own project (that not involve cmake)

[Andreagit97]

Uhm @liorzemah I understand your point, we will take a look at it

[liorzemah]

I succeeded to build scap_open test wihtout CMakeList, I created makefile for that and created PR.

[Andreagit97]

Thank you for this!

[Molter73]

First off, thanks @liorzemah for your interest in the repo!

Before I review #486, would you mind giving us a bit more context on what you are trying to achieve?

I don't want to be a negative Nancy, but from reading the issue, I gather you are trying to integrate scap_open into a project that uses plain makefiles. In said project you must be compiling the userspace components through the use of CMake, which in turn could also compile scap_open, the only difference between this and the proposed Makefile would be the location where scap_open.o and scap_open are output. The proposed Makefile would leave those binaries under userspace/libscap/examples/01-open/, where the CMake approach leaves them under build/libscap/examples/01-open/scap-open and build/libscap/examples/01-open/CMakeFiles/scap-open.dir/scap_open.c.o

Am I missing something else? Have you tried using those files directly on your project?

[liorzemah]

@Molter73 Correct, and it tested

[liorzemah]

@Molter73 The benefit of this makefile is that it gives another way to create projects that using Falcolibs' static libraries instead of forcing to build CMakeList that wrap Falcolibs CMakeList

[Molter73]

But you are not constrained to using a CMakeList in your project to use the falco libs, you can call cmake from a make target like this:

.PHONY: falco-libs
falco-libs:
	rm -rf build/ && mkdir build/
	cmake -B build/ -S libs/
	make -C build/ scap-open

Then you'll have the built artifacts under build. If you need access to the source code present in scap-open.c, I would suggest you add a library target to the existing CMakeLists.txt and use that newly built library in your project.

[Molter73]

Also, (and sorry this just hit me), the code in scap-open.c is an example on how the libraries could be used, so I don't know if we want to expose it to be directly used by external projects. You might be better off copying the code into your project and linking against libscap, this would also let you freely modify how scap-open behaves in your project. I would like to hear what other maintainers think of this, though.

[Andreagit97]

From the implementation point of view, the feature seems more or less ok, what I actually don't understand is how useful it can be ... as @Molter73 said you are not constrained to use the CMake, and moreover looking at how you would use this in your documentation :point_down:

mkdir build && cd build
cmake -DUSE_BUNDLED_DEPS=ON -DBUILD_LIBSCAP_GVISOR=OFF -DCREATE_TEST_TARGETS=OFF ..
make scap
cd ../userspace/libscap/example/01-open/
make

IMHO it doesn't have so much sense, build all with cmake, call make scap and after it, call another makefile in another folder when you can simply do like this:

mkdir build && cd build
cmake -DUSE_BUNDLED_DEPS=ON -DBUILD_LIBSCAP_GVISOR=OFF -DCREATE_TEST_TARGETS=OFF ..
make scap-open

So yes, I have some doubts about this feature request :thinking:

Also, (and sorry this just hit me), the code in scap-open.c is an example on how the libraries could be used, so I don't know if we want to expose it to be directly used by external projects.

And yes, this is another interesting point, the scap-open is just an example that can be used to test the drivers is not maintained as an independent project, so it could also be broken sometimes, we try to to do our best to maintain it always working but it is not granted...

[FedeDP]

I agree with both Andrea and Mauro here. @liorzemah can you help us understand what's the difference between invoking make scap-open and using your makefile?

I see no point in supporting 2 different build systems, considering that cmake should be a generator around plain make too.

Moreover, as they said, scap-open is not really meant to be used as a real standalone program; yet, it is a great example that shows how to use libscap :) and i hope that we will use it in our CI to e2e test libscap, therefore we will be able to guarantee that is builds and works fine.

[liorzemah]

I am understanding your point, maybe it's useless.

[FedeDP]

Nothing it's useless :) but we'd like to understand the use cases before eventually accepting it! Do you think using make scap-open would solve your issue?

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[poiana]

Stale issues rot after 30d of inactivity.

Mark the issue as fresh with /remove-lifecycle rotten.

Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle rotten

[poiana]

Rotten issues close after 30d of inactivity.

Reopen the issue with /reopen.

Mark the issue as fresh with /remove-lifecycle rotten.

Provide feedback via https://github.com/falcosecurity/community. /close

[poiana]

@poiana: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.

Reopen the issue with /reopen.

Mark the issue as fresh with /remove-lifecycle rotten.

Provide feedback via https://github.com/falcosecurity/community. /close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.