Bump sysdig and falco libs

RFC PATCH Superseded Francis Laniel 2 participants 7 messages Aug 11, 2023 – Aug 13, 2023

lore

Share & tools

lore

Francis Laniel

author

2023-08-11 15:27 UTC #0 lore raw

v2 cover Bump sysdig and falco libs

Hi.

With this contribution, I bumped sysdig and falcosecurity-libs. Sadly, I am not fully satisfied with the result, hence the fact I marked it as RFC because I would like to get your feedback to make it better.

First of all, sysdig builds and runs:
Welcome to Buildroot
buildroot login: root

# sysdig --version
sysdig version 0.31.4
# sysdig | head
scap: loading out-of-tree module taints kernel.
scap: driver loading, scap
scap: adding new consumer (____ptrval____)
scap: initializing ring buffer for CPU 0
scap: CPU buffer initialized, size=8388608
26 15:12:28.226519423 0 sysdig (108) > switch next=0 pgft_maj=10 pgft_min=1348 vm_size=47288 vm_rss=19408 vm_swap=0
27 15:12:28.227409149 0 <NA> (0) > switch next=13 pgft_maj=0 pgft_min=0 vm_size=0 vm_rss=0 vm_swap=0
...

Nonetheless, I had to increase the minimal size of the image as libsinsp.a is quite big:

# du -sh /sysdig/libsinsp.a
171.4M  /sysdig/libsinsp.a
I am not forcefully sure where this library is used, I will investigate and
maybe we can run everything without it.

Secondly, I had to tweak heavily the libscap CMakeLists.txt to install several shared libraries.
Indeed, the libraries are compiled as static, but the sysdig binary is not static, so it needs plenty of shared libraries to be run from the image. I am not really sure what is the best solution here (either compiling sysdig as static or not), but in any case my patch for CMakeLists.txt is not really clean.

Finally, I had to modify the magical number in falcosecurity-libs.mk for API_VERSION and SCHEMA_VERSION.
While this is not really a big pain, I am wondering if this is not possible to read the corresponding values from the corresponding files (i.e. API_VERSION and SCHEMA_VERSION).
So, for future update we would not need to take care of it ourselves.

Changes since:
v1:
* Removed everything regarding VALIJSON in sysdig.mk.
* Bumped first falcosecurity-libs to avoid problem when building it.
* Added runtime test for sysdig.

Francis Laniel (3):
package/falcosecurity-libs: bump to version 0.10.5 package/sysdig: bump to version 0.31.4 support/testing/package: add new test for sysdig

 .../0002-cmake-Install-shared-libraries.patch | 61 +++++++++++++++++++
 .../falcosecurity-libs.hash                   |  2 +-
 .../falcosecurity-libs/falcosecurity-libs.mk  | 10 +--
 package/sysdig/sysdig.hash                    |  2 +-
 package/sysdig/sysdig.mk                      |  9 ++-
 .../testing/tests/package/test_sysdig.config  |  1 +
 support/testing/tests/package/test_sysdig.py  | 46 ++++++++++++++
 7 files changed, 122 insertions(+), 9 deletions(-)
 create mode 100644 package/falcosecurity-libs/0002-cmake-Install-shared-libraries.patch
 create mode 100644 support/testing/tests/package/test_sysdig.config
 create mode 100644 support/testing/tests/package/test_sysdig.py

--
2.34.1

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

Francis Laniel

author

2023-08-11 15:27 UTC #1 lore raw

RFC PATCH v2 1/3 package/falcosecurity-libs: bump to version 0.10.5

Signed-off-by Francis Laniel <[email protected]>

---
 .../0002-cmake-Install-shared-libraries.patch | 61 +++++++++++++++++++
 .../falcosecurity-libs.hash                   |  2 +-
 .../falcosecurity-libs/falcosecurity-libs.mk  | 10 +--
 3 files changed, 67 insertions(+), 6 deletions(-)
 create mode 100644 package/falcosecurity-libs/0002-cmake-Install-shared-libraries.patch

package/falcosecurity-libs/0002-cmake-Install-shared-libraries.patch new file +61 -0

new file mode 100644
index 0000000000..38a8bdd4f4
@@ -0,0 +1,61 @@
+From b6d847fe8aa0513c6d19bd8187133699b9c4efd3 Mon Sep 17 00:00:00 2001
+From: Francis Laniel <[email protected]>
+Date: Fri, 28 Apr 2023 15:14:27 +0100
+Subject: [PATCH] cmake: Install shared libraries.
+
+This is needed as sysdig is compiled as a non static binary which relies on
+these libraries.
+
+Signed-off-by: Francis Laniel <[email protected]>
+---
+ cmake/modules/libelf.cmake       |  2 +-
+ userspace/libscap/CMakeLists.txt | 16 +++++++++++++++-
+ 2 files changed, 16 insertions(+), 2 deletions(-)
+
+diff --git a/cmake/modules/libelf.cmake b/cmake/modules/libelf.cmake
+index 8ca2f4f7..73d13d26 100644
+--- a/cmake/modules/libelf.cmake
++++ b/cmake/modules/libelf.cmake
+@@ -10,7 +10,7 @@ if(LIBELF_INCLUDE)
+     add_custom_target(libelf)
+ elseif(NOT USE_BUNDLED_LIBELF)
+     find_path(LIBELF_INCLUDE elf.h PATH_SUFFIXES elf)
+-    find_library(LIBELF_LIB NAMES libelf.a libelf.so)
++    find_library(LIBELF_LIB NAMES libelf.so)
+     if(LIBELF_LIB)
+         message(STATUS "Found LIBELF: include: ${LIBELF_INCLUDE}, lib: ${LIBELF_LIB}")
+     else()
+diff --git a/userspace/libscap/CMakeLists.txt b/userspace/libscap/CMakeLists.txt
+index ae4760df..59378fea 100644
+--- a/userspace/libscap/CMakeLists.txt
++++ b/userspace/libscap/CMakeLists.txt
+@@ -70,7 +70,7 @@ endif()
+ 
+ include_directories(${CMAKE_CURRENT_SOURCE_DIR})
+ 
+-add_library(scap STATIC
++add_library(scap SHARED
+ 	${targetfiles})
+ 
+ if (CMAKE_SYSTEM_NAME MATCHES "SunOS")
+@@ -212,3 +212,17 @@ if(CMAKE_SYSTEM_PROCESSOR STREQUAL "x86_64" AND CMAKE_SYSTEM_NAME MATCHES "Linux
+ 		target_link_libraries(scap scap_engine_gvisor)
+ 	endif()
+ endif()
++
++install(TARGETS scap)
++install(TARGETS scap_engine_udig)
++install(TARGETS scap_engine_savefile)
++install(TARGETS scap_engine_bpf)
++install(TARGETS scap_engine_noop)
++install(TARGETS scap_engine_source_plugin)
++install(TARGETS scap_engine_kmod)
++install(TARGETS scap_engine_nodriver)
++install(TARGETS scap_event_schema)
++install(TARGETS scap_platform)
++install(TARGETS scap_engine_util)
++install(TARGETS scap_error)
++install(TARGETS driver_event_schema)
+-- 
+2.34.1
+

package/falcosecurity-libs/falcosecurity-libs.hash +1 -1

index 2e239ca2fe..ef805cbcf6 100644
@@ -1,5 +1,5 @@
 # sha256 locally computed
-sha256  80903bc57b7f9c5f24298ecf1531cf66ef571681b4bd1e05f6e4db704ffb380b  falcosecurity-libs-e5c53d648f3c4694385bbe488e7d47eaa36c229a.tar.gz
+sha256  2a4b37c08bec4ba81326314831f341385aff267062e8d4483437958689662936  falcosecurity-libs-0.10.5.tar.gz
 sha256  21ec9433a87459b3477faf542bacec419dc03af841309eac35edeffe481cf10b  COPYING
 sha256  8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643  driver/GPL2.txt
 sha256  f17d3f2c2d565a74a7d5bf96f880c43701e141897e8dff0c8aa13e5d07aaf226  driver/MIT.txt

package/falcosecurity-libs/falcosecurity-libs.mk +5 -5

index 92d5c61832..039b64bd5c 100644
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-FALCOSECURITY_LIBS_VERSION = e5c53d648f3c4694385bbe488e7d47eaa36c229a
+FALCOSECURITY_LIBS_VERSION = 0.10.5
 FALCOSECURITY_LIBS_SITE = $(call github,falcosecurity,libs,$(FALCOSECURITY_LIBS_VERSION))
 FALCOSECURITY_LIBS_LICENSE = Apache-2.0 (userspace), MIT or GPL-2.0 (driver)
 FALCOSECURITY_LIBS_LICENSE_FILES = COPYING driver/MIT.txt driver/GPL2.txt

@@ -63,11 +63,11 @@ define FALCOSECURITY_LIBS_MODULE_GEN_MAKEFILE
 	$(SED) 's/@DRIVER_NAME@/$(FALCOSECURITY_LIBS_DRIVER_NAME)/;' $(@D)/driver/Makefile
 
 	$(INSTALL) -m 0644 $(@D)/driver/driver_config.h.in $(@D)/driver/driver_config.h
-	$(SED) 's/\$${PPM_API_CURRENT_VERSION_MAJOR}/1/;' $(@D)/driver/driver_config.h
+	$(SED) 's/\$${PPM_API_CURRENT_VERSION_MAJOR}/3/;' $(@D)/driver/driver_config.h
 	$(SED) 's/\$${PPM_API_CURRENT_VERSION_MINOR}/0/;' $(@D)/driver/driver_config.h
-	$(SED) 's/\$${PPM_API_CURRENT_VERSION_PATCH}/0/;' $(@D)/driver/driver_config.h
-	$(SED) 's/\$${PPM_SCHEMA_CURRENT_VERSION_MAJOR}/1/;' $(@D)/driver/driver_config.h
-	$(SED) 's/\$${PPM_SCHEMA_CURRENT_VERSION_MINOR}/0/;' $(@D)/driver/driver_config.h
+	$(SED) 's/\$${PPM_API_CURRENT_VERSION_PATCH}/1/;' $(@D)/driver/driver_config.h
+	$(SED) 's/\$${PPM_SCHEMA_CURRENT_VERSION_MAJOR}/2/;' $(@D)/driver/driver_config.h
+	$(SED) 's/\$${PPM_SCHEMA_CURRENT_VERSION_MINOR}/2/;' $(@D)/driver/driver_config.h
 	$(SED) 's/\$${PPM_SCHEMA_CURRENT_VERSION_PATCH}/0/;' $(@D)/driver/driver_config.h
 	$(SED) 's/\$${DRIVER_VERSION}//;' $(@D)/driver/driver_config.h
 	$(SED) 's/\$${DRIVER_NAME}/$(FALCOSECURITY_LIBS_DRIVER_NAME)/;' $(@D)/driver/driver_config.h

Signature · 6 lines

2.34.1

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

Yann E. MORIN

2023-08-13 07:52 UTC #2 lore raw

Re: [Buildroot] [RFC PATCH v2 1/3] package/falcosecurity-libs: bump to version 0.10.5

Francis, All,

On 2023-08-11 17:27 +0200, Francis Laniel spake thusly:

Quoted 1 line

Signed-off-by Francis Laniel <[email protected]>

You need to expand on the commit log. Having an overview in the cover letter as you did is very good to understand a series as a whole.

But the cover letter is not going to get comitted to the git history, shile the commit logs are. So we really need to have the details of the change in the commit log.

Quoted 13 lines

---
 .../0002-cmake-Install-shared-libraries.patch | 61 +++++++++++++++++++
 .../falcosecurity-libs.hash                   |  2 +-
 .../falcosecurity-libs/falcosecurity-libs.mk  | 10 +--
 3 files changed, 67 insertions(+), 6 deletions(-)
 create mode 100644 package/falcosecurity-libs/0002-cmake-Install-shared-libraries.patch

package/falcosecurity-libs/0002-cmake-Install-shared-libraries.patch new file +0 -0

new file mode 100644
index 0000000000..38a8bdd4f4

package/falcosecurity-libs/0002-cmake-Install-shared-libraries.patch line 7

Quoted 7 lines

package/falcosecurity-libs/0002-cmake-Install-shared-libraries.patch new file +7 -0

@@ -0,0 +1,61 @@
+From b6d847fe8aa0513c6d19bd8187133699b9c4efd3 Mon Sep 17 00:00:00 2001
+From: Francis Laniel <[email protected]>
+Date: Fri, 28 Apr 2023 15:14:27 +0100
+Subject: [PATCH] cmake: Install shared libraries.
+
+This is needed as sysdig is compiled as a non static binary which relies on
+these libraries.

As I said in the review of the cover letter, this has nothing to do with the fact that sysdig is static or not, but the fact that falcosecurity-libs does not install those libs while sysdig needs to link against them.

So I think it would still work if you even installed just the static version of those libs (but I agree that it is nicer if they are shared).

Otherwise, this change is not very intrusive. It would be nice to submit that upstream, indeed, so we don;t have to maintain it forever, but it is relatively clean.

Is there a reason why the search for a shared libelf is done in the same patch that generates shared libs?

Quoted 6 lines

package/falcosecurity-libs/0002-cmake-Install-shared-libraries.patch new file +6 -0

+Signed-off-by: Francis Laniel <[email protected]>
+---
+ cmake/modules/libelf.cmake       |  2 +-
+ userspace/libscap/CMakeLists.txt | 16 +++++++++++++++-
+ 2 files changed, 16 insertions(+), 2 deletions(-)
+

package/falcosecurity-libs/0002-cmake-Install-shared-libraries.patch line 24

Quoted 10 lines

package/falcosecurity-libs/0002-cmake-Install-shared-libraries.patch new file +10 -0

+diff --git a/cmake/modules/libelf.cmake b/cmake/modules/libelf.cmake
+index 8ca2f4f7..73d13d26 100644
+--- a/cmake/modules/libelf.cmake
++++ b/cmake/modules/libelf.cmake
+@@ -10,7 +10,7 @@ if(LIBELF_INCLUDE)
+     add_custom_target(libelf)
+ elseif(NOT USE_BUNDLED_LIBELF)
+     find_path(LIBELF_INCLUDE elf.h PATH_SUFFIXES elf)
+-    find_library(LIBELF_LIB NAMES libelf.a libelf.so)
++    find_library(LIBELF_LIB NAMES libelf.so)

Maybe keep libelf.a but in reverse order, so as to prefer the shared variant, and fallback to the static one?

find_library(LIBELF_LIB NAMES libelf.so libelf.a)

package/falcosecurity-libs/0002-cmake-Install-shared-libraries.patch line 37

Quoted 13 lines

package/falcosecurity-libs/0002-cmake-Install-shared-libraries.patch new file +13 -0

+     if(LIBELF_LIB)
+         message(STATUS "Found LIBELF: include: ${LIBELF_INCLUDE}, lib: ${LIBELF_LIB}")
+     else()
+diff --git a/userspace/libscap/CMakeLists.txt b/userspace/libscap/CMakeLists.txt
+index ae4760df..59378fea 100644
+--- a/userspace/libscap/CMakeLists.txt
++++ b/userspace/libscap/CMakeLists.txt
+@@ -70,7 +70,7 @@ endif()
+ 
+ include_directories(${CMAKE_CURRENT_SOURCE_DIR})
+ 
+-add_library(scap STATIC
++add_library(scap SHARED

Rather than forcing staitic or shared, it should probably be left out entorely, to let the build decide based on BUILD_SHARED_LIBS:

https://cmake.org/cmake/help/v3.27/manual/cmake-variables.7.html#variables-that-change-behavior
https://cmake.org/cmake/help/v3.27/variable/BUILD_SHARED_LIBS.html

package/falcosecurity-libs/0002-cmake-Install-shared-libraries.patch line 58

Quoted 13 lines

package/falcosecurity-libs/0002-cmake-Install-shared-libraries.patch new file +13 -0

++install(TARGETS scap)
++install(TARGETS scap_engine_udig)
++install(TARGETS scap_engine_savefile)
++install(TARGETS scap_engine_bpf)
++install(TARGETS scap_engine_noop)
++install(TARGETS scap_engine_source_plugin)
++install(TARGETS scap_engine_kmod)
++install(TARGETS scap_engine_nodriver)
++install(TARGETS scap_event_schema)
++install(TARGETS scap_platform)
++install(TARGETS scap_engine_util)
++install(TARGETS scap_error)
++install(TARGETS driver_event_schema)

You'd still need to install them, whether they are static or shared.

[--SNIP--]

package/falcosecurity-libs/falcosecurity-libs.mk

Quoted 4 lines

package/falcosecurity-libs/falcosecurity-libs.mk +0 -0
index 92d5c61832..039b64bd5c 100644

[--SNIP--]

package/falcosecurity-libs/falcosecurity-libs.mk define FALCOSECURITY_LIBS_MODULE_GEN_MAKEFILE · line 70

Quoted 13 lines

package/falcosecurity-libs/falcosecurity-libs.mk +4 -4

@@ -63,11 +63,11 @@ define FALCOSECURITY_LIBS_MODULE_GEN_MAKEFILE
 	$(SED) 's/@DRIVER_NAME@/$(FALCOSECURITY_LIBS_DRIVER_NAME)/;' $(@D)/driver/Makefile
 
 	$(INSTALL) -m 0644 $(@D)/driver/driver_config.h.in $(@D)/driver/driver_config.h
-	$(SED) 's/\$${PPM_API_CURRENT_VERSION_MAJOR}/1/;' $(@D)/driver/driver_config.h
+	$(SED) 's/\$${PPM_API_CURRENT_VERSION_MAJOR}/3/;' $(@D)/driver/driver_config.h
 	$(SED) 's/\$${PPM_API_CURRENT_VERSION_MINOR}/0/;' $(@D)/driver/driver_config.h
-	$(SED) 's/\$${PPM_API_CURRENT_VERSION_PATCH}/0/;' $(@D)/driver/driver_config.h
-	$(SED) 's/\$${PPM_SCHEMA_CURRENT_VERSION_MAJOR}/1/;' $(@D)/driver/driver_config.h
-	$(SED) 's/\$${PPM_SCHEMA_CURRENT_VERSION_MINOR}/0/;' $(@D)/driver/driver_config.h
+	$(SED) 's/\$${PPM_API_CURRENT_VERSION_PATCH}/1/;' $(@D)/driver/driver_config.h
+	$(SED) 's/\$${PPM_SCHEMA_CURRENT_VERSION_MAJOR}/2/;' $(@D)/driver/driver_config.h
+	$(SED) 's/\$${PPM_SCHEMA_CURRENT_VERSION_MINOR}/2/;' $(@D)/driver/driver_config.h

As you noticed in the cover letter, it would be much better to extract those from the files where they are defined, rather than hardcode them here, which as you noticed, is quite a burden to maintain.

FTR, I did that for erlang and it was recently applied:

b574a9606e62 package/erlang: do not hard-code the Erlang Interface Version (EI_VSN)

So yes, it'd be nice to do the same here.

Regards,
Yann E. MORIN.

Quoted 10 lines

package/falcosecurity-libs/falcosecurity-libs.mk +0 -0

 	$(SED) 's/\$${PPM_SCHEMA_CURRENT_VERSION_PATCH}/0/;' $(@D)/driver/driver_config.h
 	$(SED) 's/\$${DRIVER_VERSION}//;' $(@D)/driver/driver_config.h
 	$(SED) 's/\$${DRIVER_NAME}/$(FALCOSECURITY_LIBS_DRIVER_NAME)/;' $(@D)/driver/driver_config.h

Signature · 6 lines

2.34.1

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

Signature · 10 lines

.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 561 099 427 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

Francis Laniel

author

2023-08-11 15:27 UTC #3 lore raw

RFC PATCH v2 2/3 package/sysdig: bump to version 0.31.4

In reply to Francis Laniel

Signed-off-by Francis Laniel <[email protected]>

---
 package/sysdig/sysdig.hash | 2 +-
 package/sysdig/sysdig.mk   | 9 +++++++--
 2 files changed, 8 insertions(+), 3 deletions(-)

package/sysdig/sysdig.hash +1 -1

index cda3de5e7c..902f6f2b82 100644
@@ -1,3 +1,3 @@
 # sha256 locally computed
-sha256  6b96797859002ab69a2bed4fdba1c7fe8064ecf8661621ae7d8fbf8599ffa636  sysdig-0.29.3.tar.gz
+sha256  b8f43326506f85e99a3455f51b75ee79bf4db9dc12908ef43af672166274a795  sysdig-0.31.4.tar.gz
 sha256  a88fbf820b38b1c7fabc6efe291b8259e02ae21326f56fe31c6c9adf374b2702  COPYING

package/sysdig/sysdig.mk +7 -2

index bafe534a16..fe725a8064 100644
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-SYSDIG_VERSION = 0.29.3
+SYSDIG_VERSION = 0.31.4
 SYSDIG_SITE = $(call github,draios,sysdig,$(SYSDIG_VERSION))
 SYSDIG_LICENSE = Apache-2.0
 SYSDIG_LICENSE_FILES = COPYING

@@ -26,13 +26,18 @@ SYSDIG_DEPENDENCIES = \
 # grpc_cpp_plugin is needed to build falcosecurity libs, so we give the host
 # one there.
 SYSDIG_CONF_OPTS += -DFALCOSECURITY_LIBS_SOURCE_DIR=$(FALCOSECURITY_LIBS_SRCDIR) \
+	-DDRIVER_SOURCE_DIR=$(FALCOSECURITY_LIBS_SRCDIR)/driver \
 	-DBUILD_DRIVER=OFF \
 	-DGRPC_CPP_PLUGIN=$(HOST_DIR)/bin/grpc_cpp_plugin \
 	-DDRIVER_NAME=$(FALCOSECURITY_LIBS_DRIVER_NAME) \
 	-DENABLE_DKMS=OFF \
 	-DUSE_BUNDLED_DEPS=OFF \
+	-DUSE_BUNDLED_TBB=OFF \
+	-DUSE_BUNDLED_B64=OFF \
+	-DUSE_BUNDLED_JSONCPP=OFF \
+	-DUSE_BUNDLED_VALIJSON=OFF \
+	-DUSE_BUNDLED_RE2=OFF \
 	-DWITH_CHISEL=ON \
-	-DVALIJSON_INCLUDE=$(BUILD_DIR)/valijson-0.6/include/valijson \
 	-DSYSDIG_VERSION=$(SYSDIG_VERSION)
 
 $(eval $(cmake-package))

Signature · 6 lines

2.34.1

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

Yann E. MORIN

2023-08-13 07:59 UTC #4 lore raw

Re: [Buildroot] [RFC PATCH v2 2/3] package/sysdig: bump to version 0.31.4

Francis, All,

On 2023-08-11 17:27 +0200, Francis Laniel spake thusly:

Quoted 1 line

Signed-off-by Francis Laniel <[email protected]>

Ditto, please expand on the commit log.

Quoted 28 lines

---
 package/sysdig/sysdig.hash | 2 +-
 package/sysdig/sysdig.mk   | 9 +++++++--
 2 files changed, 8 insertions(+), 3 deletions(-)

package/sysdig/sysdig.hash +1 -1

index cda3de5e7c..902f6f2b82 100644
@@ -1,3 +1,3 @@
 # sha256 locally computed
-sha256  6b96797859002ab69a2bed4fdba1c7fe8064ecf8661621ae7d8fbf8599ffa636  sysdig-0.29.3.tar.gz
+sha256  b8f43326506f85e99a3455f51b75ee79bf4db9dc12908ef43af672166274a795  sysdig-0.31.4.tar.gz
 sha256  a88fbf820b38b1c7fabc6efe291b8259e02ae21326f56fe31c6c9adf374b2702  COPYING

package/sysdig/sysdig.mk +1 -1

index bafe534a16..fe725a8064 100644
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-SYSDIG_VERSION = 0.29.3
+SYSDIG_VERSION = 0.31.4
 SYSDIG_SITE = $(call github,draios,sysdig,$(SYSDIG_VERSION))
 SYSDIG_LICENSE = Apache-2.0
 SYSDIG_LICENSE_FILES = COPYING

package/sysdig/sysdig.mk SYSDIG_DEPENDENCIES = \ · line 29

Quoted 4 lines

package/sysdig/sysdig.mk +1 -0

@@ -26,13 +26,18 @@ SYSDIG_DEPENDENCIES = \
 # grpc_cpp_plugin is needed to build falcosecurity libs, so we give the host
 # one there.
 SYSDIG_CONF_OPTS += -DFALCOSECURITY_LIBS_SOURCE_DIR=$(FALCOSECURITY_LIBS_SRCDIR) \
+	-DDRIVER_SOURCE_DIR=$(FALCOSECURITY_LIBS_SRCDIR)/driver \

Why do you need to peek into the source tree of falcsecurity-libs?

And if you need the already built driver, then you need to peek into the build dir, nto the source dir.

package/sysdig/sysdig.mk SYSDIG_DEPENDENCIES = \ · line 39

Quoted 10 lines

package/sysdig/sysdig.mk +5 -0

 	-DBUILD_DRIVER=OFF \
 	-DGRPC_CPP_PLUGIN=$(HOST_DIR)/bin/grpc_cpp_plugin \
 	-DDRIVER_NAME=$(FALCOSECURITY_LIBS_DRIVER_NAME) \
 	-DENABLE_DKMS=OFF \
 	-DUSE_BUNDLED_DEPS=OFF \
+	-DUSE_BUNDLED_TBB=OFF \
+	-DUSE_BUNDLED_B64=OFF \
+	-DUSE_BUNDLED_JSONCPP=OFF \
+	-DUSE_BUNDLED_VALIJSON=OFF \
+	-DUSE_BUNDLED_RE2=OFF \

If the bundled copies are disabled, don't you instead need to add dependencies to the unbundled copies? I.e.

    SYSDIG_DPENDENCIES = \
        [...]
        tbb \
        libb64 \
        jsoncpp \
        valijson \
        re2

package/sysdig/sysdig.mk SYSDIG_DEPENDENCIES = \ · line 35

Quoted 2 lines

package/sysdig/sysdig.mk +0 -1

 	-DWITH_CHISEL=ON \
-	-DVALIJSON_INCLUDE=$(BUILD_DIR)/valijson-0.6/include/valijson \

Urk, this was so wrong... There was no dependnecy to valijson, and the version is hard-coded so it has not been correct since 2022-10-22 when valijson was bumped to 0.7...

Good that you get rid of it...

Could you look into master and see at fixing it there?

Regards,
Yann E. MORIN.

Quoted 10 lines

package/sysdig/sysdig.mk +0 -0

 	-DSYSDIG_VERSION=$(SYSDIG_VERSION)
 
 $(eval $(cmake-package))

Signature · 6 lines

2.34.1

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

Signature · 10 lines

.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 561 099 427 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

Francis Laniel

author

2023-08-11 15:27 UTC #5 lore raw

RFC PATCH v2 3/3 support/testing/package: add new test for sysdig

In reply to Francis Laniel

Signed-off-by Francis Laniel <[email protected]>

---
 .../testing/tests/package/test_sysdig.config  |  1 +
 support/testing/tests/package/test_sysdig.py  | 46 +++++++++++++++++++
 2 files changed, 47 insertions(+)
 create mode 100644 support/testing/tests/package/test_sysdig.config
 create mode 100644 support/testing/tests/package/test_sysdig.py

support/testing/tests/package/test_sysdig.config new file +1 -0

new file mode 100644
index 0000000000..6450f34933
@@ -0,0 +1 @@
+CONFIG_IPV6=y

support/testing/tests/package/test_sysdig.py new file +46 -0

46 lines not on this page · raw message

Signature · 6 lines

2.34.1

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

Yann E. MORIN

2023-08-13 07:34 UTC #6 lore raw

In reply to Francis Laniel

Francis, All,

On 2023-08-11 17:27 +0200, Francis Laniel spake thusly:

Quoted 19 lines

With this contribution, I bumped sysdig and falcosecurity-libs. Sadly, I am not fully satisfied with the result, hence the fact I marked it as RFC because I would like to get your feedback to make it better.
First of all, sysdig builds and runs:
Welcome to Buildroot
buildroot login: root
# sysdig --version
sysdig version 0.31.4
# sysdig | head
scap: loading out-of-tree module taints kernel.
scap: driver loading, scap
scap: adding new consumer (____ptrval____)
scap: initializing ring buffer for CPU 0
scap: CPU buffer initialized, size=8388608
26 15:12:28.226519423 0 sysdig (108) > switch next=0 pgft_maj=10 pgft_min=1348 vm_size=47288 vm_rss=19408 vm_swap=0
27 15:12:28.227409149 0 <NA> (0) > switch next=13 pgft_maj=0 pgft_min=0 vm_size=0 vm_rss=0 vm_swap=0
...

Quoted 6 lines

Nonetheless, I had to increase the minimal size of the image as libsinsp.a is quite big:
# du -sh /sysdig/libsinsp.a
171.4M  /sysdig/libsinsp.a
I am not forcefully sure where this library is used, I will investigate and
maybe we can run everything without it.

There is no need to have static libs (.a files) on the target, as static libs are only used at linking phase, which happens on the build machine.

So, unless sysdig embeds a linker and generates an executalbe from those, it should be safe to remove.

Quoted 6 lines

Secondly, I had to tweak heavily the libscap CMakeLists.txt to install several shared libraries.
Indeed, the libraries are compiled as static, but the sysdig binary is not static, so it needs plenty of shared libraries to be run from the image. I am not really sure what is the best solution here (either compiling sysdig as static or not), but in any case my patch for CMakeLists.txt is not really clean.

I don't quite understand this part.

If the libraries are present as static libs at build time, then sysdig would be statically linked to those, even if sysdig is not itself a statically linked binary.

Indeed, it's possible to have, say;

ld libfoo.a libbar.so main.o -o myprogram

where myprogram would then be a dynamically linked executable,, which would have been linked with libfoo.a and dynamically linked with libbar.so.

So you'll have to expand a bit on that part...

Ah, I think I understand what you are trying to say: falcosecurity-libs build libscap.a and does not install it, but sysdig needs to link against it, right?

If so, then it has nothing to do with the fact that sysdig is not static, but just about the fact that sysdig needs to link with those libraries.

I'll also further reply to the sysdig bump...

Quoted 6 lines

Finally, I had to modify the magical number in falcosecurity-libs.mk for API_VERSION and SCHEMA_VERSION.
While this is not really a big pain, I am wondering if this is not possible to read the corresponding values from the corresponding files (i.e. API_VERSION and SCHEMA_VERSION).
So, for future update we would not need to take care of it ourselves.

That is what I was going to suggest while reviewing patch 1/3. I'll reply further there.

Regards,
Yann E. MORIN.

Quoted 30 lines

Changes since:
v1:
* Removed everything regarding VALIJSON in sysdig.mk.
* Bumped first falcosecurity-libs to avoid problem when building it.
* Added runtime test for sysdig.
Francis Laniel (3):
package/falcosecurity-libs: bump to version 0.10.5 package/sysdig: bump to version 0.31.4 support/testing/package: add new test for sysdig
 .../0002-cmake-Install-shared-libraries.patch | 61 +++++++++++++++++++
 .../falcosecurity-libs.hash                   |  2 +-
 .../falcosecurity-libs/falcosecurity-libs.mk  | 10 +--
 package/sysdig/sysdig.hash                    |  2 +-
 package/sysdig/sysdig.mk                      |  9 ++-
 .../testing/tests/package/test_sysdig.config  |  1 +
 support/testing/tests/package/test_sysdig.py  | 46 ++++++++++++++
 7 files changed, 122 insertions(+), 9 deletions(-)
 create mode 100644 package/falcosecurity-libs/0002-cmake-Install-shared-libraries.patch
 create mode 100644 support/testing/tests/package/test_sysdig.config
 create mode 100644 support/testing/tests/package/test_sysdig.py
--
2.34.1
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

Signature · 10 lines

.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 561 099 427 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot