Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

ubuntu 18.04 hwo to install falco #3381

Open
zer0-1s opened this issue Oct 15, 2024 · 2 comments
Open

ubuntu 18.04 hwo to install falco #3381

zer0-1s opened this issue Oct 15, 2024 · 2 comments
Labels
kind/bug

Comments

@zer0-1s
Copy link

zer0-1s commented Oct 15, 2024

Describe the bug
I refer to the link of the following article.

https://v0-32.falco.org/docs/getting-started/installation/

Setting up g++ (4:7.4.0-1ubuntu2.3) ...
update-alternatives: using /usr/bin/g++ to provide /usr/bin/c++ (c++) in auto mode
Setting up falco (0.39.1) ...
[POST-INSTALL] Disable all possible 'falco' services:
Failed to stop falco-kmod.service: Unit falco-kmod.service not loaded.
Failed to stop falco-bpf.service: Unit falco-bpf.service not loaded.
Failed to stop falco-modern-bpf.service: Unit falco-modern-bpf.service not loaded.
Failed to stop falco-custom.service: Unit falco-custom.service not loaded.
Failed to stop falcoctl-artifact-follow.service: Unit falcoctl-artifact-follow.service not loaded.
[POST-INSTALL] Configure falcoctl 'auto' driver type:
2024-10-14 18:46:14 INFO  Running falcoctl driver config
                      ├ name: falco
                      ├ version: 7.3.0+driver
                      ├ type: kmod
                      ├ host-root: /
                      └ repos: https://download.falco.org/driver
2024-10-14 18:46:14 INFO  Committing driver config to specialized configuration
                      │   file under
                      └ directory: /etc/falco/config.d
2024-10-14 18:46:14 INFO  Storing falcoctl driver config 

[POST-INSTALL] Trigger deamon-reload:
[POST-INSTALL] Call 'falcoctl driver install for kmod:
2024-10-14 18:46:14 INFO  Running falcoctl driver install
                      ├ driver version: 7.3.0+driver
                      ├ driver type: kmod
                      ├ driver name: falco
                      ├ compile: true
                      ├ download: false
                      ├ target: ubuntu-generic
                      ├ arch: x86_64
                      ├ kernel release: 5.4.0-150-generic
                      └ kernel version: #167~18.04.1-Ubuntu SMP Wed May 24 00:51:42 UTC 2023
2024-10-14 18:46:14 INFO  Check if kernel module is still loaded.               
2024-10-14 18:46:14 INFO  OK! There is no module loaded. 
2024-10-14 18:46:14 INFO  Check all versions of kernel module in dkms. 
2024-10-14 18:46:14 INFO  OK! There are no module versions in dkms. 
2024-10-14 18:46:14 INFO  Trying to compile the requested driver                
2024-10-14 18:46:14 INFO  Trying automatic kernel headers download. 
2024-10-14 18:46:23 WARN  Failed to generate script.
                      └ err: kernel headers not found
2024-10-14 18:46:24 INFO  Trying to dkms install module. gcc: /usr/bin/gcc
2024-10-14 18:46:56 INFO  kernel module available.
                      └ path: /root/.falco/7.3.0+driver/x86_64/falco_ubuntu-generic_5.4.0-150-generic_167~18.04.1.ko
2024-10-14 18:46:56 INFO  Success: module found and loaded in dkms.
                      └ driver: /root/.falco/7.3.0+driver/x86_64/falco_ubuntu-generic_5.4.0-150-generic_167~18.04.1.ko
[POST-INSTALL] Enable 'falco-kmod.service':
Created symlink /etc/systemd/system/falco.service → /usr/lib/systemd/system/falco-kmod.service.
Created symlink /etc/systemd/system/multi-user.target.wants/falco-kmod.service → /usr/lib/systemd/system/falco-kmod.service.
[POST-INSTALL] Start 'falco-kmod.service':
Failed to start falco-kmod.service: Unit falco-kmod.service is not loaded properly: Exec format error.
See system logs and 'systemctl status falco-kmod.service' for details.
Setting up build-essential (12.4ubuntu1) ...
Processing triggers for man-db (2.8.3-2ubuntu0.1) ...
Processing triggers for libc-bin (2.27-3ubuntu1.4) ...
root@ubuntu:/home/falco# uname -r
5.4.0-150-generic
root@ubuntu:/home/falco# systemctl start falco-kmod.service
Failed to start falco-kmod.service: Unit falco-kmod.service is not loaded properly: Exec format error.
See system logs and 'systemctl status falco-kmod.service' for details.
root@ubuntu:/home/falco# systemctl start falco-kmod.service
Failed to start falco-kmod.service: Unit falco-kmod.service is not loaded properly: Exec format error.
See system logs and 'systemctl status falco-kmod.service' for details.
root@ubuntu:/home/falco# systemctl status falco-kmod.service
● falco-kmod.service - Falco: Container Native Runtime Security with kmod
   Loaded: error (Reason: Exec format error)
   Active: inactive (dead)
     Docs: https://falco.org/docs/

Oct 14 18:46:13 ubuntu systemd[1]: /usr/lib/systemd/system/falco-kmod.service:13: Executable path is not absolute: kill -1 $MAINPID
Oct 14 18:46:56 ubuntu systemd[1]: /usr/lib/systemd/system/falco-kmod.service:13: Executable path is not absolute: kill -1 $MAINPID

How to reproduce it

ubuntu 18.04

root@ubuntu:/home/falco# uname -r
5.4.0-150-generic

Expected behaviour

Screenshots

Successfully installed falco.

image

Environment
image

  • Falco version:
  • System info:
root@ubuntu:/home/falco# falco --support | jq .system_info
Mon Oct 14 19:19:34 2024: Falco version: 0.39.1 (x86_64)
Mon Oct 14 19:19:34 2024: Falco initialized with configuration files:
Mon Oct 14 19:19:34 2024:    /etc/falco/config.d/engine-kind-falcoctl.yaml | schema validation: ok
Mon Oct 14 19:19:34 2024:    /etc/falco/falco.yaml | schema validation: ok
Mon Oct 14 19:19:34 2024: System info: Linux version 5.4.0-150-generic (buildd@bos03-amd64-012) (gcc version 7.5.0 (Ubuntu 7.5.0-3ubuntu1~18.04)) #167~18.04.1-Ubuntu SMP Wed May 24 00:51:42 UTC 2023
Mon Oct 14 19:19:34 2024: Loading rules from:
Mon Oct 14 19:19:34 2024:    /etc/falco/falco_rules.yaml | schema validation: ok
Mon Oct 14 19:19:34 2024:    /etc/falco/falco_rules.local.yaml | schema validation: none
{
  "machine": "x86_64",
  "nodename": "ubuntu",
  "release": "5.4.0-150-generic",
  "sysname": "Linux",
  "version": "#167~18.04.1-Ubuntu SMP Wed May 24 00:51:42 UTC 2023"
}
root@ubuntu:/home/falco#
  • Cloud provider or hardware configuration:
  • OS:
root@ubuntu:/home/falco# cat /etc/os-release
NAME="Ubuntu"
VERSION="18.04.6 LTS (Bionic Beaver)"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 18.04.6 LTS"
VERSION_ID="18.04"
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
VERSION_CODENAME=bionic
UBUNTU_CODENAME=bionic
  • Kernel:
5.4.0-150-generic
  • Installation method:

https://v0-32.falco.org/docs/getting-started/installation/

from

curl -s https://falco.org/repo/falcosecurity-3672BA8F.asc | apt-key add -
echo "deb https://download.falco.org/packages/deb stable main" | tee -a /etc/apt/sources.list.d/falcosecurity.list
apt-get update -y

apt-get -y install linux-headers-$(uname -r)

apt-get install -y falco

Additional context
@zer0-1s
Copy link
Author

zer0-1s commented Oct 16, 2024 •
edited
Loading

My idea is to test whether falco can detect container escape vulnerabilities. To quickly reproduce vulnerabilities, metarget is used. And metarget has the best support for Ubuntu 18.04.

@zer0-1s
Copy link
Author

zer0-1s commented Dec 2, 2024

#1325
Refer to the discussion above,try to make on branch 0.24.0 of falco

git clone https://github.com/falcosecurity/falco.git
cd falco
mkdir -p build
cd build
cmake -DUSE_BUNDLED_DEPS=ON ..

still error

cc1plus: warning: unrecognized command line option ‘-Wno-class-memaccess’
[ 98%] Building CXX object userspace/falco/CMakeFiles/falco.dir/schema.pb.cc.o
cc1plus: warning: unrecognized command line option ‘-Wno-class-memaccess’
cc1plus: warning: unrecognized command line option ‘-Wno-class-memaccess’
cc1plus: warning: unrecognized command line option ‘-Wno-class-memaccess’
cc1plus: warning: unrecognized command line option ‘-Wno-class-memaccess’
cc1plus: warning: unrecognized command line option ‘-Wno-class-memaccess’
[100%] Linking CXX executable falco
../../curl-prefix/src/curl/lib/.libs/libcurl.a(libcurl_la-openssl.o): In function `Curl_ossl_sha256sum':
openssl.c:(.text+0x13c): undefined reference to `EVP_MD_CTX_new'
openssl.c:(.text+0x177): undefined reference to `EVP_MD_CTX_free'
../../curl-prefix/src/curl/lib/.libs/libcurl.a(libcurl_la-openssl.o): In function `Curl_ossl_md5sum':
openssl.c:(.text+0x1cc): undefined reference to `EVP_MD_CTX_new'
openssl.c:(.text+0x207): undefined reference to `EVP_MD_CTX_free'
../../curl-prefix/src/curl/lib/.libs/libcurl.a(libcurl_la-openssl.o): In function `Curl_ossl_version':
openssl.c:(.text+0xf04): undefined reference to `OpenSSL_version_num'
../../curl-prefix/src/curl/lib/.libs/libcurl.a(libcurl_la-openssl.o): In function `ossl_connect_step1':
openssl.c:(.text+0x18b1): undefined reference to `TLS_client_method'
openssl.c:(.text+0x19c3): undefined reference to `SSL_CTX_set_options'
openssl.c:(.text+0x1a3d): undefined reference to `SSL_CTX_set_ciphersuites'
openssl.c:(.text+0x1b4c): undefined reference to `SSL_CTX_set_keylog_callback'
openssl.c:(.text+0x2830): undefined reference to `OPENSSL_sk_pop'
openssl.c:(.text+0x286f): undefined reference to `OPENSSL_sk_num'
openssl.c:(.text+0x2898): undefined reference to `OPENSSL_sk_pop_free'
openssl.c:(.text+0x2b9f): undefined reference to `OPENSSL_sk_pop_free'
../../curl-prefix/src/curl/lib/.libs/libcurl.a(libcurl_la-openssl.o): In function `servercert':
openssl.c:(.text+0x359b): undefined reference to `X509_get0_notBefore'
openssl.c:(.text+0x35f7): undefined reference to `X509_get0_notAfter'
openssl.c:(.text+0x37b4): undefined reference to `OPENSSL_sk_num'
openssl.c:(.text+0x3800): undefined reference to `OPENSSL_sk_value'
openssl.c:(.text+0x3906): undefined reference to `X509_get_X509_PUBKEY'
openssl.c:(.text+0x3941): undefined reference to `X509_get_X509_PUBKEY'
openssl.c:(.text+0x3a38): undefined reference to `OPENSSL_sk_num'
openssl.c:(.text+0x3a9b): undefined reference to `OPENSSL_sk_value'
openssl.c:(.text+0x3b75): undefined reference to `X509_get_version'
openssl.c:(.text+0x3d1b): undefined reference to `X509_get0_extensions'
openssl.c:(.text+0x3d28): undefined reference to `OPENSSL_sk_num'
openssl.c:(.text+0x3d44): undefined reference to `OPENSSL_sk_num'
openssl.c:(.text+0x3d61): undefined reference to `OPENSSL_sk_value'
openssl.c:(.text+0x3e8c): undefined reference to `OPENSSL_sk_num'
openssl.c:(.text+0x3ea7): undefined reference to `X509_get0_notBefore'
openssl.c:(.text+0x3f09): undefined reference to `X509_get0_notAfter'
openssl.c:(.text+0x3f93): undefined reference to `EVP_PKEY_get0_RSA'
openssl.c:(.text+0x3fad): undefined reference to `RSA_get0_key'
openssl.c:(.text+0x470b): undefined reference to `EVP_PKEY_get0_DSA'
openssl.c:(.text+0x472e): undefined reference to `DSA_get0_pqg'
openssl.c:(.text+0x4740): undefined reference to `DSA_get0_key'
openssl.c:(.text+0x47e8): undefined reference to `ASN1_STRING_get0_data'
openssl.c:(.text+0x4814): undefined reference to `EVP_PKEY_get0_DH'
openssl.c:(.text+0x4837): undefined reference to `DH_get0_pqg'
openssl.c:(.text+0x4849): undefined reference to `DH_get0_key'
openssl.c:(.text+0x48f1): undefined reference to `ASN1_STRING_get0_data'
openssl.c:(.text+0x496e): undefined reference to `ASN1_STRING_get0_data'
openssl.c:(.text+0x4e00): undefined reference to `ASN1_STRING_get0_data'
collect2: error: ld returned 1 exit status
userspace/falco/CMakeFiles/falco.dir/build.make:568: recipe for target 'userspace/falco/falco' failed
make[3]: *** [userspace/falco/falco] Error 1
CMakeFiles/Makefile2:7544: recipe for target 'userspace/falco/CMakeFiles/falco.dir/all' failed
make[2]: *** [userspace/falco/CMakeFiles/falco.dir/all] Error 2
CMakeFiles/Makefile2:7556: recipe for target 'userspace/falco/CMakeFiles/falco.dir/rule' failed
make[1]: *** [userspace/falco/CMakeFiles/falco.dir/rule] Error 2
Makefile:2578: recipe for target 'falco' failed
make: *** [falco] Error 2

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
kind/bug
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@zer0-1s