Bump sysdig to 0.29.1

PATCH Superseded Francis Laniel 1 participant 3 messages Apr 15, 2022

lore

Share & tools

lore

Francis Laniel

author

2022-04-15 16:20 UTC #0 lore raw

cover Bump sysdig to 0.29.1

Hi.

In this contribution, I bumped sysdig version to 0.29.1.
Indeed, following this discussion [1], Arnout Vandecappelle noted sysdig 0.27.1 cannot be cross-compiled to, e.g., aarch64 because it uses the open() syscall.

To fix this, I bumped sysdig to 0.29.1.
Sadly, some components of sysdig, like libsinsp, libscap and the kernel modules, were moved to falcosecurity/libs.
So, I added the falcosecurity-libs package.
A new patch was added to sysdig recipe to avoid compiling again falcosecurity-libs.
Nonetheless, this patch is a bit big, so I prefered to keep the RFC tag to gather your opinion about it.

I was nonetheless able to build and run sysdig with start-qemu.sh:
Welcome to Buildroot
buildroot login: root

# insmod /lib/modules/5.15.18/extra/falco.ko
falco: loading out-of-tree module taints kernel.
falco: driver loading, scap 0.1.1dev
# sysdig | head
falco: adding new consumer 00000000b5aaf410
falco: initializing ring buffer for CPU 0
falco: CPU buffer initialized, size=8388608
falco: starting capture
2 17:18:14.088681520 0 sysdig (330) > switch next=11 pgft_maj=203 pgft_min=1165 vm_size=46264 vm_rss=18072 vm_swap=
...
24 17:18:14.095103470 0 sysdig (330) > switch next=0 pgft_maj=204 pgft_min=1165 vm_size=46264 vm_rss=18072 vm_swap=
falco: deallocating consumer 00000000b5aaf410
falco: no more consumers, stopping capture

So, if you see a particular way to fix the problem I described above or any problem with this contribution, feel free to share it!

Changes since:
v1:
- Drop nlohmann-json patch and use json-for-modern-cpp in place.
- Add a patch to avoid building falcosecurity-libs twice.

Francis Laniel (2):
falcosecurity-libs: add new package
package/sysdig: bump to 0.29.1

 DEVELOPERS                                    |  1 +
 package/Config.in                             |  1 +
 ...cmake-Permit-setting-GRPC_CPP_PLUGIN.patch | 34 ++++++++
 package/falcosecurity-libs/Config.in          | 38 +++++++++
 .../falcosecurity-libs.hash                   |  5 ++
 .../falcosecurity-libs/falcosecurity-libs.mk  | 63 ++++++++++++++
 ...BUNDLED_DEPS-before-getting-nlohmann.patch | 51 ++++++++++++
 ...ATCH_COMMAND-to-fix-lua-types-and-fu.patch | 82 -------------------
 ...gainst-libabseil-cpp-which-grpc-uses.patch | 47 -----------
 ...e-Add-libsinsp.a-as-IMPORTED-library.patch | 59 +++++++++++++
 package/sysdig/Config.in                      | 31 ++-----
 package/sysdig/sysdig.hash                    |  4 +-
 package/sysdig/sysdig.mk                      | 55 ++++++-------
 13 files changed, 283 insertions(+), 188 deletions(-)
 create mode 100644 package/falcosecurity-libs/0001-cmake-Permit-setting-GRPC_CPP_PLUGIN.patch
 create mode 100644 package/falcosecurity-libs/Config.in
 create mode 100644 package/falcosecurity-libs/falcosecurity-libs.hash
 create mode 100644 package/falcosecurity-libs/falcosecurity-libs.mk
 create mode 100644 package/sysdig/0001-cmake-Check-USE_BUNDLED_DEPS-before-getting-nlohmann.patch
 delete mode 100644 package/sysdig/0001-libsinsp-Apply-PATCH_COMMAND-to-fix-lua-types-and-fu.patch
 delete mode 100644 package/sysdig/0002-Link-against-libabseil-cpp-which-grpc-uses.patch
 create mode 100644 package/sysdig/0002-cmake-Add-libsinsp.a-as-IMPORTED-library.patch

Signature · 6 lines

2.25.1

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

Francis Laniel

author

2022-04-15 16:20 UTC #1 lore raw

PATCH 1/2 falcosecurity-libs: add new package

Signed-off-by Francis Laniel <[email protected]>

---
 DEVELOPERS                                    |  1 +
 package/Config.in                             |  1 +
 ...cmake-Permit-setting-GRPC_CPP_PLUGIN.patch | 34 ++++++++++
 package/falcosecurity-libs/Config.in          | 38 +++++++++++
 .../falcosecurity-libs.hash                   |  5 ++
 .../falcosecurity-libs/falcosecurity-libs.mk  | 63 +++++++++++++++++++
 6 files changed, 142 insertions(+)
 create mode 100644 package/falcosecurity-libs/0001-cmake-Permit-setting-GRPC_CPP_PLUGIN.patch
 create mode 100644 package/falcosecurity-libs/Config.in
 create mode 100644 package/falcosecurity-libs/falcosecurity-libs.hash
 create mode 100644 package/falcosecurity-libs/falcosecurity-libs.mk

DEVELOPERS +1 -0

index ca9decb58f..d45d3d2a7b 100644
@@ -969,6 +969,7 @@ F:	package/ipmitool/
 F:	package/odhcploc/
 
 N:	Francis Laniel <[email protected]>
+F:	package/falcosecurity-libs
 F:	package/pahole/
 F:	package/sysdig/
 F:	package/tbb/

package/Config.in +1 -0

index 24f7af5ea8..3070094cc0 100644
@@ -1935,6 +1935,7 @@ menu "Other"
 	source "package/eigen/Config.in"
 	source "package/elfutils/Config.in"
 	source "package/ell/Config.in"
+	source "package/falcosecurity-libs/Config.in"
 	source "package/fftw/Config.in"
 	source "package/flann/Config.in"
 	source "package/flatbuffers/Config.in"

package/falcosecurity-libs/0001-cmake-Permit-setting-GRPC_CPP_PLUGIN.patch new file +34 -0

new file mode 100644
index 0000000000..6141d8ef72
@@ -0,0 +1,34 @@
+From 2e8a50cd4975df3ab60ee07c9675831cd5ad397f Mon Sep 17 00:00:00 2001
+From: Francis Laniel <[email protected]>
+Date: Tue, 12 Apr 2022 19:54:11 +0100
+Subject: [PATCH] cmake: Permit setting GRPC_CPP_PLUGIN.
+
+This patch enables users to set GRPC_CPP_PLUGIN while calling cmake with:
+cmake -DGRPC_CPP_PLUGIN=/path
+
+Signed-off-by: Francis Laniel <[email protected]>
+---
+ cmake/modules/grpc.cmake | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/cmake/modules/grpc.cmake b/cmake/modules/grpc.cmake
+index e5fd16b8..9d8f5934 100644
+--- a/cmake/modules/grpc.cmake
++++ b/cmake/modules/grpc.cmake
+@@ -12,9 +12,11 @@ elseif(NOT USE_BUNDLED_GRPC)
+ 		set(GRPCPP_LIB gRPC::grpc++)
+ 
+ 		# gRPC C++ plugin
+-		get_target_property(GRPC_CPP_PLUGIN gRPC::grpc_cpp_plugin LOCATION)
+ 		if(NOT GRPC_CPP_PLUGIN)
+-			message(FATAL_ERROR "System grpc_cpp_plugin not found")
++			get_target_property(GRPC_CPP_PLUGIN gRPC::grpc_cpp_plugin LOCATION)
++			if(NOT GRPC_CPP_PLUGIN)
++				message(FATAL_ERROR "System grpc_cpp_plugin not found")
++			endif()
+ 		endif()
+ 
+ 		# gRPC include dir + properly handle grpc{++,pp}
+-- 
+2.25.1
+

package/falcosecurity-libs/Config.in new file +38 -0

new file mode 100644
index 0000000000..9dd9221caa
@@ -0,0 +1,38 @@
+config BR2_PACKAGE_FALCOSECURITY_LIBS
+	bool "sysdig"
+	depends on BR2_PACKAGE_PROTOBUF_ARCH_SUPPORTS # protobuf
+	depends on BR2_LINUX_KERNEL
+	depends on BR2_INSTALL_LIBSTDCPP # jsoncpp, protobuf, tbb
+	depends on BR2_TOOLCHAIN_GCC_AT_LEAST_4_8 # protobuf
+	depends on BR2_TOOLCHAIN_HAS_THREADS # jq, protobuf, tbb
+	depends on !BR2_STATIC_LIBS # protobuf, tbb
+	depends on BR2_TOOLCHAIN_USES_GLIBC # tbb
+	depends on BR2_PACKAGE_LUAINTERPRETER_ABI_VERSION_5_1
+	select BR2_PACKAGE_C_ARES
+	select BR2_PACKAGE_ELFUTILS
+	select BR2_PACKAGE_GRPC
+	select BR2_PACKAGE_GTEST
+	select BR2_PACKAGE_HOST_GRPC
+	select BR2_PACKAGE_HOST_PROTOBUF
+	select BR2_PACKAGE_JQ
+	select BR2_PACKAGE_JSONCPP
+	select BR2_PACKAGE_LIBB64
+	select BR2_PACKAGE_LIBCURL
+	select BR2_PACKAGE_OPENSSL
+	select BR2_PACKAGE_PROTOBUF
+	select BR2_PACKAGE_TBB
+	select BR2_PACKAGE_VALIJSON
+	select BR2_PACKAGE_ZLIB
+	help
+	  falcosecurity/libs provides libsinsp, libscap, the kernel module driver
+	  and the eBPF driver sources.
+
+	  https://github.com/falcosecurity/libs
+
+comment "falcosecurity-libs needs a glibc toolchain w/ C++, threads, gcc >= 4.8, dynamic library, a Linux kernel, and luajit or lua 5.1 to be built"
+	depends on BR2_PACKAGE_PROTOBUF_ARCH_SUPPORTS
+	depends on !BR2_LINUX_KERNEL || !BR2_INSTALL_LIBSTDCPP \
+		|| !BR2_TOOLCHAIN_HAS_THREADS \
+		|| !BR2_TOOLCHAIN_GCC_AT_LEAST_4_8 || BR2_STATIC_LIBS \
+		|| !BR2_TOOLCHAIN_USES_GLIBC \
+	    || !BR2_PACKAGE_LUAINTERPRETER_ABI_VERSION_5_1

package/falcosecurity-libs/falcosecurity-libs.hash new file +5 -0

new file mode 100644
index 0000000000..7608c67590
@@ -0,0 +1,5 @@
+# sha256 locally computed
+sha256  80903bc57b7f9c5f24298ecf1531cf66ef571681b4bd1e05f6e4db704ffb380b  falcosecurity-libs-e5c53d648f3c4694385bbe488e7d47eaa36c229a.tar.gz
+sha256  a88fbf820b38b1c7fabc6efe291b8259e02ae21326f56fe31c6c9adf374b2702  COPYING
+sha256  8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643  driver/GPL2.txt
+sha256  e3f6a43d097ed68176e9738de925d98b938e1bccf6d6bd1bcd79395eca8f76ed  driver/MIT.txt

package/falcosecurity-libs/falcosecurity-libs.mk new file +63 -0

63 lines not on this page · raw message

Signature · 6 lines

2.25.1

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

Francis Laniel

author

2022-04-15 16:20 UTC #2 lore raw

PATCH 2/2 package/sysdig: bump to 0.29.1

In reply to Francis Laniel

sysdig 0.27.1 cannot be cross-compiled to, e.g., aarch64 because it uses open() syscall [1].
This patch bumps its version to enable cross-compilation.

By doing so, we can remove the previous patches.
But this commit introduces new patches.
Indeed, libsinsp (lib system inspection), libscap (lib system capture) and the kernel module were moved to falcosecurity/libs.
The problem is that it is not possible to compile sysdig with pre-compiled libs (like we do in buildroot).
So, this patch introduces a new patch to permit building sysdig with already built falcosecurity/libs.

[1] https://marc.info/?l=buildroot&m=164951521629400

Signed-off-by Francis Laniel <[email protected]>

---
 ...BUNDLED_DEPS-before-getting-nlohmann.patch | 51 ++++++++++++
 ...ATCH_COMMAND-to-fix-lua-types-and-fu.patch | 82 -------------------
 ...gainst-libabseil-cpp-which-grpc-uses.patch | 47 -----------
 ...e-Add-libsinsp.a-as-IMPORTED-library.patch | 59 +++++++++++++
 package/sysdig/Config.in                      | 31 ++-----
 package/sysdig/sysdig.hash                    |  4 +-
 package/sysdig/sysdig.mk                      | 55 ++++++-------
 7 files changed, 141 insertions(+), 188 deletions(-)
 create mode 100644 package/sysdig/0001-cmake-Check-USE_BUNDLED_DEPS-before-getting-nlohmann.patch
 delete mode 100644 package/sysdig/0001-libsinsp-Apply-PATCH_COMMAND-to-fix-lua-types-and-fu.patch
 delete mode 100644 package/sysdig/0002-Link-against-libabseil-cpp-which-grpc-uses.patch
 create mode 100644 package/sysdig/0002-cmake-Add-libsinsp.a-as-IMPORTED-library.patch

package/sysdig/0001-cmake-Check-USE_BUNDLED_DEPS-before-getting-nlohmann.patch new file +51 -0

new file mode 100644
index 0000000000..29f03b1b61
@@ -0,0 +1,51 @@
+From 0dbebd008c04d266dc41c4bec8280a0744fd5130 Mon Sep 17 00:00:00 2001
+From: Francis Laniel <[email protected]>
+Date: Wed, 13 Apr 2022 18:01:11 +0100
+Subject: [PATCH 1/2] cmake: Check USE_BUNDLED_DEPS before getting
+ nlohmann-json.
+
+Signed-off-by: Francis Laniel <[email protected]>
+---
+ cmake/modules/nlohmann-json.cmake | 29 +++++++++++++++++++----------
+ 1 file changed, 19 insertions(+), 10 deletions(-)
+
+diff --git a/cmake/modules/nlohmann-json.cmake b/cmake/modules/nlohmann-json.cmake
+index bb1279d7..feb0f071 100644
+--- a/cmake/modules/nlohmann-json.cmake
++++ b/cmake/modules/nlohmann-json.cmake
+@@ -16,13 +16,22 @@
+ # limitations under the License.
+ #
+ 
+-set(NJSON_SRC "${PROJECT_BINARY_DIR}/njson-prefix/src/njson")
+-message(STATUS "Using bundled nlohmann-json in '${NJSON_SRC}'")
+-set(NJSON_INCLUDE_DIR "${NJSON_SRC}/single_include")
+-ExternalProject_Add(
+-  njson
+-  URL "https://github.com/nlohmann/json/archive/v3.3.0.tar.gz"
+-  URL_HASH "SHA256=2fd1d207b4669a7843296c41d3b6ac5b23d00dec48dba507ba051d14564aa801"
+-  CONFIGURE_COMMAND ""
+-  BUILD_COMMAND ""
+-  INSTALL_COMMAND "")
++if(NOT USE_BUNDLED_DEPS)
++  find_path(NJSON_INCLUDE_DIR NAMES nlohmann/json.hpp)
++  if(NJSON_INCLUDE_DIR)
++    message(STATUS "Found njson: include: ${NJSON_INCLUDE_DIR}")
++  else()
++    message(FATAL_ERROR "Couldn't find system njson")
++  endif()
++else()
++  set(NJSON_SRC "${PROJECT_BINARY_DIR}/njson-prefix/src/njson")
++  message(STATUS "Using bundled nlohmann-json in '${NJSON_SRC}'")
++  set(NJSON_INCLUDE_DIR "${NJSON_SRC}/single_include")
++  ExternalProject_Add(
++    njson
++    URL "https://github.com/nlohmann/json/archive/v3.3.0.tar.gz"
++    URL_HASH "SHA256=2fd1d207b4669a7843296c41d3b6ac5b23d00dec48dba507ba051d14564aa801"
++    CONFIGURE_COMMAND ""
++    BUILD_COMMAND ""
++    INSTALL_COMMAND "")
++endif()
+-- 
+2.25.1
+

package/sysdig/0001-libsinsp-Apply-PATCH_COMMAND-to-fix-lua-types-and-fu.patch deleted +0 ~~-82~~

82 lines not on this page · raw message

package/sysdig/0002-Link-against-libabseil-cpp-which-grpc-uses.patch deleted +0 ~~-47~~

47 lines not on this page · raw message

package/sysdig/0002-cmake-Add-libsinsp.a-as-IMPORTED-library.patch new file +59 -0

59 lines not on this page · raw message

package/sysdig/Config.in +6 ~~-25~~

index 3a4c033b2b..e00516a2b5 100644
@@ -1,26 +1,11 @@
 config BR2_PACKAGE_SYSDIG
 	bool "sysdig"
-	depends on BR2_PACKAGE_PROTOBUF_ARCH_SUPPORTS # protobuf
 	depends on BR2_LINUX_KERNEL
-	depends on BR2_INSTALL_LIBSTDCPP # jsoncpp, protobuf, tbb
-	depends on BR2_TOOLCHAIN_GCC_AT_LEAST_4_8 # protobuf
-	depends on BR2_TOOLCHAIN_HAS_THREADS # elfutils, jq, protobuf, tbb
-	depends on !BR2_STATIC_LIBS # elfutils, protobuf, tbb
-	depends on BR2_USE_WCHAR # elfutils
-	depends on BR2_TOOLCHAIN_USES_GLIBC # elfutils, tbb
-	depends on BR2_PACKAGE_LUAINTERPRETER_ABI_VERSION_5_1
-	select BR2_PACKAGE_C_ARES
-	select BR2_PACKAGE_ELFUTILS
-	select BR2_PACKAGE_GRPC
-	select BR2_PACKAGE_JQ
-	select BR2_PACKAGE_JSONCPP
-	select BR2_PACKAGE_LIBB64
-	select BR2_PACKAGE_LIBCURL
+	depends on BR2_INSTALL_LIBSTDCPP # yaml-cpp
+	select BR2_PACKAGE_FALCOSECURITY_LIBS
 	select BR2_PACKAGE_NCURSES
-	select BR2_PACKAGE_OPENSSL
-	select BR2_PACKAGE_PROTOBUF
-	select BR2_PACKAGE_TBB
-	select BR2_PACKAGE_ZLIB
+	select BR2_PACKAGE_JSON_FOR_MODERN_CPP
+	select BR2_PACKAGE_YAML_CPP
 	help
 	  Sysdig is open source, system-level exploration:
 	  capture system state and activity from a running Linux

@@ -30,10 +15,6 @@ config BR2_PACKAGE_SYSDIG
 
 	  https://github.com/draios/sysdig/wiki
 
-comment "sysdig needs a glibc toolchain w/ C++, threads, gcc >= 4.8, dynamic library, a Linux kernel, and luajit or lua 5.1 to be built"
-	depends on BR2_PACKAGE_PROTOBUF_ARCH_SUPPORTS
+comment "sysdig needs a toolchain w/ C++, a Linux kernel and luajit or lua 5.1 to be built"
 	depends on !BR2_LINUX_KERNEL || !BR2_INSTALL_LIBSTDCPP \
-		|| !BR2_TOOLCHAIN_HAS_THREADS \
-		|| !BR2_TOOLCHAIN_GCC_AT_LEAST_4_8 || BR2_STATIC_LIBS \
-		|| !BR2_TOOLCHAIN_USES_GLIBC \
-	    || !BR2_PACKAGE_LUAINTERPRETER_ABI_VERSION_5_1
+		|| !BR2_PACKAGE_LUAINTERPRETER_ABI_VERSION_5_1

package/sysdig/sysdig.hash +1 -3

index 4ec46abfc3..380c9dce1e 100644
@@ -1,5 +1,3 @@
 # sha256 locally computed
-sha256  b9d05854493d245a7a7e75f77fc654508f720aab5e5e8a3a932bd8eb54e49bda  sysdig-0.27.1.tar.gz
+sha256  3721c97f0da43c1a68d2962d30363525d8532ab5f2534dfefc86d175e17e423e  sysdig-0.29.1.tar.gz
 sha256  a88fbf820b38b1c7fabc6efe291b8259e02ae21326f56fe31c6c9adf374b2702  COPYING
-sha256  8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643  driver/GPL2.txt
-sha256  e3f6a43d097ed68176e9738de925d98b938e1bccf6d6bd1bcd79395eca8f76ed  driver/MIT.txt

package/sysdig/sysdig.mk +24 ~~-31~~

73 lines not on this page · raw message

Signature · 6 lines

2.25.1

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot