libs
libs copied to clipboard
falcosecurity
bpf: fix build on some kernels
Signed-off-by: Alban Crequy [email protected]
What type of PR is this?
Uncomment one (or more)
/kind <>lines:
/kind bug
/kind cleanup
/kind design
/kind documentation
/kind failing-test
/kind feature
Any specific area of the project related to this PR?
Uncomment one (or more)
/area <>lines:
/area build
/area driver-kmod
/area driver-ebpf
/area libscap
/area libsinsp
/area tests
/area proposals
What this PR does / why we need it:
This PR makes the bpf code compile on kernel 5.13.0-1023-azure (Ubuntu 20.04.4 LTS)
On some new kernels, the bpf code does not compile because some kernel headers expect KBUILD_MODNAME to be defined.
Tested on Ubuntu 20.04.4 LTS with Linux 5.13.0-1023-azure.
Symptoms:
In file included from /.../sysdig/bpf/probe.c:22:
In file included from /.../sysdig/bpf/filler_helpers.h:13:
In file included from ./include/net/sock.h:59:
In file included from ./include/linux/filter.h:27:
In file included from ./include/net/sch_generic.h:21:
./include/net/flow_offload.h:324:4: error: use of undeclared identifier 'KBUILD_MODNAME'
NL_SET_ERR_MSG_MOD(extack, "Mixing HW stats types for actions is not supported");
^
./include/linux/netlink.h:102:27: note: expanded from macro 'NL_SET_ERR_MSG_MOD'
NL_SET_ERR_MSG((extack), KBUILD_MODNAME ": " msg)
Our BPF code does not use the functions using KBUILD_MODNAME, so it is safe to set it to an arbitrary value to make it compile.
Which issue(s) this PR fixes:
Fixes #
Special notes for your reviewer:
Does this PR introduce a user-facing change?:
NONE
Hi @alban. Thanks for your PR.
I'm waiting for a falcosecurity member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.
Once the patch is verified, the new status will be reflected by the ok-to-test label.
I understand the commands that are listed here.
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.
[APPROVALNOTIFIER] This PR is NOT APPROVED
This pull-request has been approved by: alban
To complete the pull request process, please assign fededp after the PR has been reviewed.
You can assign the PR to them by writing /assign @fededp in a comment when ready.
The full list of commands accepted by this bot can be found here.
Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment
Wow thank you very much! I love tiny yet important fixes :)
/cc @Andreagit97 /ok-to-test
Hi @alban thank you for this PR! If I understand well, you have compiled our bpf probe from the source on this machine Ubuntu 20.04.4 LTS with Linux 5.13.0-1023-azure and it doesn't work, am I wrong?
I ask it because I don't understand these logs really well, why is there sysdig word?
In file included from /.../sysdig/bpf/probe.c:22:
In file included from /.../sysdig/bpf/filler_helpers.h:13:
Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close.
Provide feedback via https://github.com/falcosecurity/community.
/lifecycle stale
Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.
If this issue is safe to close now please do so with /close.
Provide feedback via https://github.com/falcosecurity/community.
/lifecycle rotten
Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.
Provide feedback via https://github.com/falcosecurity/community. /close
@poiana: Closed this PR.
In response to this:
Rotten issues close after 30d of inactivity.
Reopen the issue with
/reopen.Mark the issue as fresh with
/remove-lifecycle rotten.Provide feedback via https://github.com/falcosecurity/community. /close
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.