Bump sysdig and falco libs

RFC PATCH New Francis Laniel 1 participant 4 messages Aug 18, 2023

lore

Share & tools

lore

Francis Laniel

author

2023-08-18 15:52 UTC #0 lore raw

v3 cover Bump sysdig and falco libs

Hi.

With this contribution, I bumped sysdig and falcosecurity-libs. Sadly, I am not fully satisfied with the result, hence the fact I marked it as RFC because I would like to get your feedback to make it better.

First of all, sysdig builds and runs:
Welcome to Buildroot
buildroot login: root

# sysdig --version
sysdig version 0.31.4
# sysdig | head
scap: loading out-of-tree module taints kernel.
scap: driver loading, scap
scap: adding new consumer (____ptrval____)
scap: initializing ring buffer for CPU 0
scap: CPU buffer initialized, size=8388608
26 15:12:28.226519423 0 sysdig (108) > switch next=0 pgft_maj=10 pgft_min=1348 vm_size=47288 vm_rss=19408 vm_swap=0
27 15:12:28.227409149 0 <NA> (0) > switch next=13 pgft_maj=0 pgft_min=0 vm_size=0 vm_rss=0 vm_swap=0
...

Nonetheless, I had to increase the minimal size of the image as libsinsp.a is quite big:

# du -sh /sysdig/libsinsp.a
171.4M  /sysdig/libsinsp.a
I am not forcefully sure where this library is used, I will investigate and
maybe we can run everything without it.
This /sysdig directory is installed by sysdig Cmake due to the following being
present in cmake_install.cmake:
if(CMAKE_INSTALL_COMPONENT STREQUAL "scap" OR NOT CMAKE_INSTALL_COMPONENT)
  list(APPEND CMAKE_ABSOLUTE_DESTINATION_FILES
   "/sysdig/driver/")
  if(CMAKE_WARN_ON_ABSOLUTE_INSTALL_DESTINATION)
    message(WARNING "ABSOLUTE path INSTALL DESTINATION : ${CMAKE_ABSOLUTE_DESTINATION_FILES}")
  endif()
  if(CMAKE_ERROR_ON_ABSOLUTE_INSTALL_DESTINATION)
    message(FATAL_ERROR "ABSOLUTE path INSTALL DESTINATION forbidden (by caller): ${CMAKE_ABSOLUTE_DESTINATION_FILES}")
  endif()
  file(INSTALL DESTINATION "/sysdig/driver" TYPE DIRECTORY FILES "/home/francis-buildroot/buildroot/output/build/sysdig-0.31.4/buildroot-build/driver/src/" FILES_MATCHING>
endif()

Changes since:
v1:
* Removed everything regarding VALIJSON in sysdig.mk.
* Bumped first falcosecurity-libs to avoid problem when building it.
* Added runtime test for sysdig.
v2:
* Automatically got value for API_VERSION and SCHEMA_VERSION.
* Added DEPS as sysdig dependencies.

Francis Laniel (3):
package/falcosecurity-libs: bump to version 0.10.5 package/sysdig: bump to version 0.31.4 support/testing/package: add new test for sysdig

 .../0002-cmake-Install-shared-libraries.patch | 61 +++++++++++++++++++
 .../falcosecurity-libs.hash                   |  2 +-
 .../falcosecurity-libs/falcosecurity-libs.mk  | 29 +++++----
 package/sysdig/sysdig.hash                    |  2 +-
 package/sysdig/sysdig.mk                      | 15 ++++-
 .../testing/tests/package/test_sysdig.config  |  1 +
 support/testing/tests/package/test_sysdig.py  | 46 ++++++++++++++
 7 files changed, 140 insertions(+), 16 deletions(-)
 create mode 100644 package/falcosecurity-libs/0002-cmake-Install-shared-libraries.patch
 create mode 100644 support/testing/tests/package/test_sysdig.config
 create mode 100644 support/testing/tests/package/test_sysdig.py

--
2.34.1

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

Francis Laniel

author

2023-08-18 15:53 UTC #1 lore raw

RFC PATCH v3 1/3 package/falcosecurity-libs: bump to version 0.10.5

This commit adds a new patch to ensure the libscap*.so are installed to the target as sysdig is dynamically linked.
It also modified the recipe to automatically get API_VERSION and SCHEMA_VERSION from respecting files.

Signed-off-by Francis Laniel <[email protected]>

---
 .../0002-cmake-Install-shared-libraries.patch | 61 +++++++++++++++++++
 .../falcosecurity-libs.hash                   |  2 +-
 .../falcosecurity-libs/falcosecurity-libs.mk  | 29 +++++----
 3 files changed, 80 insertions(+), 12 deletions(-)
 create mode 100644 package/falcosecurity-libs/0002-cmake-Install-shared-libraries.patch

package/falcosecurity-libs/0002-cmake-Install-shared-libraries.patch new file +61 -0

new file mode 100644
index 0000000000..38aaaf599b
@@ -0,0 +1,61 @@
+From e730f130b5cb2c3cdef795f3be47d8139f1982cf Mon Sep 17 00:00:00 2001
+From: Francis Laniel <[email protected]>
+Date: Fri, 28 Apr 2023 15:14:27 +0100
+Subject: [PATCH] cmake: Install shared libraries.
+
+This is needed as sysdig is compiled as a non static binary which relies on
+these libraries.
+
+Signed-off-by: Francis Laniel <[email protected]>
+---
+ cmake/modules/libelf.cmake       |  2 +-
+ userspace/libscap/CMakeLists.txt | 16 +++++++++++++++-
+ 2 files changed, 16 insertions(+), 2 deletions(-)
+
+diff --git a/cmake/modules/libelf.cmake b/cmake/modules/libelf.cmake
+index 8ca2f4f7..73d13d26 100644
+--- a/cmake/modules/libelf.cmake
++++ b/cmake/modules/libelf.cmake
+@@ -10,7 +10,7 @@ if(LIBELF_INCLUDE)
+     add_custom_target(libelf)
+ elseif(NOT USE_BUNDLED_LIBELF)
+     find_path(LIBELF_INCLUDE elf.h PATH_SUFFIXES elf)
+-    find_library(LIBELF_LIB NAMES libelf.a libelf.so)
++    find_library(LIBELF_LIB NAMES libelf.so)
+     if(LIBELF_LIB)
+         message(STATUS "Found LIBELF: include: ${LIBELF_INCLUDE}, lib: ${LIBELF_LIB}")
+     else()
+diff --git a/userspace/libscap/CMakeLists.txt b/userspace/libscap/CMakeLists.txt
+index ae4760df..08c401b2 100644
+--- a/userspace/libscap/CMakeLists.txt
++++ b/userspace/libscap/CMakeLists.txt
+@@ -70,7 +70,7 @@ endif()
+ 
+ include_directories(${CMAKE_CURRENT_SOURCE_DIR})
+ 
+-add_library(scap STATIC
++add_library(scap SHARED
+ 	${targetfiles})
+ 
+ if (CMAKE_SYSTEM_NAME MATCHES "SunOS")
+@@ -212,3 +212,17 @@ if(CMAKE_SYSTEM_PROCESSOR STREQUAL "x86_64" AND CMAKE_SYSTEM_NAME MATCHES "Linux
+ 		target_link_libraries(scap scap_engine_gvisor)
+ 	endif()
+ endif()
++
++install(TARGETS scap COMPONENT ${CMAKE_PROJECT_NAME})
++install(TARGETS scap_engine_udig COMPONENT ${CMAKE_PROJECT_NAME})
++install(TARGETS scap_engine_savefile COMPONENT ${CMAKE_PROJECT_NAME})
++install(TARGETS scap_engine_bpf COMPONENT ${CMAKE_PROJECT_NAME})
++install(TARGETS scap_engine_noop COMPONENT ${CMAKE_PROJECT_NAME})
++install(TARGETS scap_engine_source_plugin COMPONENT ${CMAKE_PROJECT_NAME})
++install(TARGETS scap_engine_kmod COMPONENT ${CMAKE_PROJECT_NAME})
++install(TARGETS scap_engine_nodriver COMPONENT ${CMAKE_PROJECT_NAME})
++install(TARGETS scap_event_schema COMPONENT ${CMAKE_PROJECT_NAME})
++install(TARGETS scap_platform COMPONENT ${CMAKE_PROJECT_NAME})
++install(TARGETS scap_engine_util COMPONENT ${CMAKE_PROJECT_NAME})
++install(TARGETS scap_error COMPONENT ${CMAKE_PROJECT_NAME})
++install(TARGETS driver_event_schema COMPONENT ${CMAKE_PROJECT_NAME})
+-- 
+2.34.1
+

package/falcosecurity-libs/falcosecurity-libs.hash +1 -1

index 2e239ca2fe..ef805cbcf6 100644
@@ -1,5 +1,5 @@
 # sha256 locally computed
-sha256  80903bc57b7f9c5f24298ecf1531cf66ef571681b4bd1e05f6e4db704ffb380b  falcosecurity-libs-e5c53d648f3c4694385bbe488e7d47eaa36c229a.tar.gz
+sha256  2a4b37c08bec4ba81326314831f341385aff267062e8d4483437958689662936  falcosecurity-libs-0.10.5.tar.gz
 sha256  21ec9433a87459b3477faf542bacec419dc03af841309eac35edeffe481cf10b  COPYING
 sha256  8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643  driver/GPL2.txt
 sha256  f17d3f2c2d565a74a7d5bf96f880c43701e141897e8dff0c8aa13e5d07aaf226  driver/MIT.txt

package/falcosecurity-libs/falcosecurity-libs.mk +18 ~~-11~~

index 92d5c61832..65f4ceae4d 100644
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-FALCOSECURITY_LIBS_VERSION = e5c53d648f3c4694385bbe488e7d47eaa36c229a
+FALCOSECURITY_LIBS_VERSION = 0.10.5
 FALCOSECURITY_LIBS_SITE = $(call github,falcosecurity,libs,$(FALCOSECURITY_LIBS_VERSION))
 FALCOSECURITY_LIBS_LICENSE = Apache-2.0 (userspace), MIT or GPL-2.0 (driver)
 FALCOSECURITY_LIBS_LICENSE_FILES = COPYING driver/MIT.txt driver/GPL2.txt

@@ -32,6 +32,16 @@ FALCOSECURITY_LIBS_DRIVER_NAME = scap
 FALCOSECURITY_LIBS_MODULE_SUBDIRS = driver
 FALCOSECURITY_LIBS_MODULE_MAKE_OPTS = KERNELDIR=$(LINUX_DIR)
 
+API_VERSION = $(subst ., ,$(shell cat $(@D)/driver/API_VERSION))
+API_VERSION_MAJOR = $(word 1,$(API_VERSION))
+API_VERSION_MINOR = $(word 2,$(API_VERSION))
+API_VERSION_PATCH = $(word 3,$(API_VERSION))
+
+SCHEMA_VERSION = $(subst ., ,$(shell cat $(@D)/driver/SCHEMA_VERSION))
+SCHEMA_VERSION_MAJOR = $(word 1,$(SCHEMA_VERSION))
+SCHEMA_VERSION_MINOR = $(word 2,$(SCHEMA_VERSION))
+SCHEMA_VERSION_PATCH = $(word 3,$(SCHEMA_VERSION))
+
 # falcosecurity-libs module needs these two kernel options to be set:
 # CONFIG_TRACEPOINTS
 # CONFIG_HAVE_SYSCALL_TRACEPOINTS

@@ -51,9 +61,6 @@ endef
 # For the DRIVER_NAME, we set it to FALCOSECURITY_LIBS_DRIVER_NAME.
 # So, when sysdig will be run, it will automatically load
 # FALCOSECURITY_LIBS_DRIVER_NAME.ko.
-# We also need to do the same process for driver_config.h.in.
-# PPM_API_CURRENT_VERSION_* were take from driver/API_VERSION and
-# PPM_SCHEMA_CURRENT_VERSION_* from driver/SCHEMA_VERSION.
 # For the others, it was taken by inspecting
 # falcosecurity-libs/*/CMakeLists.txt, which normally creates these
 # files, but doesn't work well with the kernel-module infrastructure.

@@ -63,16 +70,16 @@ define FALCOSECURITY_LIBS_MODULE_GEN_MAKEFILE
 	$(SED) 's/@DRIVER_NAME@/$(FALCOSECURITY_LIBS_DRIVER_NAME)/;' $(@D)/driver/Makefile
 
 	$(INSTALL) -m 0644 $(@D)/driver/driver_config.h.in $(@D)/driver/driver_config.h
-	$(SED) 's/\$${PPM_API_CURRENT_VERSION_MAJOR}/1/;' $(@D)/driver/driver_config.h
-	$(SED) 's/\$${PPM_API_CURRENT_VERSION_MINOR}/0/;' $(@D)/driver/driver_config.h
-	$(SED) 's/\$${PPM_API_CURRENT_VERSION_PATCH}/0/;' $(@D)/driver/driver_config.h
-	$(SED) 's/\$${PPM_SCHEMA_CURRENT_VERSION_MAJOR}/1/;' $(@D)/driver/driver_config.h
-	$(SED) 's/\$${PPM_SCHEMA_CURRENT_VERSION_MINOR}/0/;' $(@D)/driver/driver_config.h
-	$(SED) 's/\$${PPM_SCHEMA_CURRENT_VERSION_PATCH}/0/;' $(@D)/driver/driver_config.h
+	$(SED) 's/\$${PPM_API_CURRENT_VERSION_MAJOR}/$(API_VERSION_MAJOR)/;' $(@D)/driver/driver_config.h
+	$(SED) 's/\$${PPM_API_CURRENT_VERSION_MINOR}/$(API_VERSION_MINOR)/;' $(@D)/driver/driver_config.h
+	$(SED) 's/\$${PPM_API_CURRENT_VERSION_PATCH}/$(API_VERSION_PATCH)/;' $(@D)/driver/driver_config.h
+	$(SED) 's/\$${PPM_SCHEMA_CURRENT_VERSION_MAJOR}/$(SCHEMA_VERSION_MAJOR)/;' $(@D)/driver/driver_config.h
+	$(SED) 's/\$${PPM_SCHEMA_CURRENT_VERSION_MINOR}/$(SCHEMA_VERSION_MINOR)/;' $(@D)/driver/driver_config.h
+	$(SED) 's/\$${PPM_SCHEMA_CURRENT_VERSION_PATCH}/$(SCHEMA_VERSION_PATCH)/;' $(@D)/driver/driver_config.h
 	$(SED) 's/\$${DRIVER_VERSION}//;' $(@D)/driver/driver_config.h
 	$(SED) 's/\$${DRIVER_NAME}/$(FALCOSECURITY_LIBS_DRIVER_NAME)/;' $(@D)/driver/driver_config.h
 	$(SED) 's/\$${DRIVER_DEVICE_NAME}/$(FALCOSECURITY_LIBS_DRIVER_NAME)/;' $(@D)/driver/driver_config.h
-	$(SED) 's/\$${GIT_COMMIT}/0.1.1dev/;' $(@D)/driver/driver_config.h
+	$(SED) 's/\$${GIT_COMMIT}//;' $(@D)/driver/driver_config.h
 endef
 FALCOSECURITY_LIBS_POST_PATCH_HOOKS += FALCOSECURITY_LIBS_MODULE_GEN_MAKEFILE

Signature · 6 lines

2.34.1

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

Francis Laniel

author

2023-08-18 15:53 UTC #2 lore raw

RFC PATCH v3 2/3 package/sysdig: bump to version 0.31.4

In reply to Francis Laniel

This commit also sets all the BUNDLED_DEPS as off and add them as dependencies. This way, we ensure building sysdig the buildroot way and not by wgetting some packages from distant URL.

We also specify DRIVER_SOURCE_DIR, otherwise configuration would fail with the following error message:
CMake Error at cmake/modules/driver.cmake:53 (add_subdirectory):
The source directory

/.../buildroot/output/build/sysdig-0.31.4/buildroot-build/driver-repo/driver-prefix/src/driver

does not contain a CMakeLists.txt file.
Call Stack (most recent call first):
cmake/modules/falcosecurity-libs.cmake:97 (include) CMakeLists.txt:149 (include)

Signed-off-by Francis Laniel <[email protected]>

---
 package/sysdig/sysdig.hash |  2 +-
 package/sysdig/sysdig.mk   | 15 ++++++++++++---
 2 files changed, 13 insertions(+), 4 deletions(-)

package/sysdig/sysdig.hash +1 -1

index cda3de5e7c..902f6f2b82 100644
@@ -1,3 +1,3 @@
 # sha256 locally computed
-sha256  6b96797859002ab69a2bed4fdba1c7fe8064ecf8661621ae7d8fbf8599ffa636  sysdig-0.29.3.tar.gz
+sha256  b8f43326506f85e99a3455f51b75ee79bf4db9dc12908ef43af672166274a795  sysdig-0.31.4.tar.gz
 sha256  a88fbf820b38b1c7fabc6efe291b8259e02ae21326f56fe31c6c9adf374b2702  COPYING

package/sysdig/sysdig.mk +12 -3

index bafe534a16..965cdc69c7 100644
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-SYSDIG_VERSION = 0.29.3
+SYSDIG_VERSION = 0.31.4
 SYSDIG_SITE = $(call github,draios,sysdig,$(SYSDIG_VERSION))
 SYSDIG_LICENSE = Apache-2.0
 SYSDIG_LICENSE_FILES = COPYING

@@ -17,8 +17,12 @@ SYSDIG_SUPPORTS_IN_SOURCE_BUILD = NO
 
 SYSDIG_DEPENDENCIES = \
 	falcosecurity-libs \
-	ncurses \
 	json-for-modern-cpp \
+	libb64 \
+	re2 \
+	tbb \
+	ncurses \
+	valijson \
 	yaml-cpp
 
 # Don't build the driver as part of the 'standard' procedure, it has been built

@@ -26,13 +30,18 @@ SYSDIG_DEPENDENCIES = \
 # grpc_cpp_plugin is needed to build falcosecurity libs, so we give the host
 # one there.
 SYSDIG_CONF_OPTS += -DFALCOSECURITY_LIBS_SOURCE_DIR=$(FALCOSECURITY_LIBS_SRCDIR) \
+	-DDRIVER_SOURCE_DIR=$(FALCOSECURITY_LIBS_SRCDIR)/driver \
 	-DBUILD_DRIVER=OFF \
 	-DGRPC_CPP_PLUGIN=$(HOST_DIR)/bin/grpc_cpp_plugin \
 	-DDRIVER_NAME=$(FALCOSECURITY_LIBS_DRIVER_NAME) \
 	-DENABLE_DKMS=OFF \
 	-DUSE_BUNDLED_DEPS=OFF \
+	-DUSE_BUNDLED_TBB=OFF \
+	-DUSE_BUNDLED_B64=OFF \
+	-DUSE_BUNDLED_JSONCPP=OFF \
+	-DUSE_BUNDLED_VALIJSON=OFF \
+	-DUSE_BUNDLED_RE2=OFF \
 	-DWITH_CHISEL=ON \
-	-DVALIJSON_INCLUDE=$(BUILD_DIR)/valijson-0.6/include/valijson \
 	-DSYSDIG_VERSION=$(SYSDIG_VERSION)
 
 $(eval $(cmake-package))

Signature · 6 lines

2.34.1

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

Francis Laniel

author

2023-08-18 15:53 UTC #3 lore raw

RFC PATCH v3 3/3 support/testing/package: add new test for sysdig

In reply to Francis Laniel

Signed-off-by Francis Laniel <[email protected]>

---
 .../testing/tests/package/test_sysdig.config  |  1 +
 support/testing/tests/package/test_sysdig.py  | 46 +++++++++++++++++++
 2 files changed, 47 insertions(+)
 create mode 100644 support/testing/tests/package/test_sysdig.config
 create mode 100644 support/testing/tests/package/test_sysdig.py

support/testing/tests/package/test_sysdig.config new file +1 -0

new file mode 100644
index 0000000000..6450f34933
@@ -0,0 +1 @@
+CONFIG_IPV6=y

support/testing/tests/package/test_sysdig.py new file +46 -0

46 lines not on this page · raw message

Signature · 6 lines

2.34.1

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot