package/uthash: new package

PATCH Applied Angelo Compagnucci 2 participants 19 messages Oct 30 – Nov 6

Share & tools

Angelo Compagnucci

author

2026-10-30 15:24 UTC #0 lore raw

PATCH 1/9 package/uthash: new package

uthash is a set of C macros implementing hash tables, linked lists, dynamic arrays and other data structures, provided as headers only.

It is needed by falcosecurity-libs, which otherwise downloads uthash.h at build time.

Signed-off-by Angelo Compagnucci <[email protected]>

---
 DEVELOPERS                 |  1 +
 package/Config.in          |  1 +
 package/sysdig/Config.in   |  2 +-
 package/uthash/Config.in   |  8 ++++++++
 package/uthash/uthash.hash |  3 +++
 package/uthash/uthash.mk   | 19 +++++++++++++++++++
 6 files changed, 33 insertions(+), 1 deletion(-)
 create mode 100644 package/uthash/Config.in
 create mode 100644 package/uthash/uthash.hash
 create mode 100644 package/uthash/uthash.mk

DEVELOPERS +1 -0

index b4ada4e1f9..8ca72bec84 100644
@@ -261,6 +261,7 @@ F:	package/sam-ba/
 F:	package/sshguard/
 F:	package/sunwait/
 F:	package/sysdig/
+F:	package/uthash/
 
 N:	Andy Shevchenko <[email protected]>
 F:	package/fb-test-app/

package/Config.in +1 -0

index 796c4f1ad6..02932e5ac1 100644
@@ -2323,6 +2323,7 @@ endif
 	source "package/tllist/Config.in"
 	source "package/tz/Config.in"
 	source "package/tzdata/Config.in"
+	source "package/uthash/Config.in"
 	source "package/uvw/Config.in"
 	source "package/volk/Config.in"
 	source "package/xapian/Config.in"

package/sysdig/Config.in +1 -1

index 73ac03e240..038a9734aa 100644
@@ -24,7 +24,7 @@ config BR2_PACKAGE_SYSDIG
 
 	  https://github.com/draios/sysdig/wiki
 
-comment "sysdig needs a glibc toolchain w/ C++, threads, wchar, gcc >= 10, dynamic library, a Linux kernel, and luajit or lua 5.1 to be built"
+comment "sysdig needs a glibc or musl toolchain w/ C++, threads, wchar, gcc >= 10, dynamic library, a Linux kernel, and luajit or lua 5.1 to be built"
 	depends on BR2_PACKAGE_LIBABSEIL_CPP_ARCH_SUPPORTS
 	depends on BR2_PACKAGE_PROTOBUF_ARCH_SUPPORTS
 	depends on BR2_TOOLCHAIN_HAS_SYNC_4 || BR2_TOOLCHAIN_HAS_ATOMIC

package/uthash/Config.in new file +8 -0

new file mode 100644
index 0000000000..e19c277abd
@@ -0,0 +1,8 @@
+config BR2_PACKAGE_UTHASH
+	bool "uthash"
+	help
+	  uthash is a set of C macros implementing hash tables, linked
+	  lists, dynamic arrays and other data structures, provided as
+	  headers only.
+
+	  https://troydhanson.github.io/uthash/

package/uthash/uthash.hash new file +3 -0

new file mode 100644
index 0000000000..37a5a66aba
@@ -0,0 +1,3 @@
+# Locally computed
+sha256  387ba027946d7c64e9aa19cc53b2edcd714f8f9dca9fa8e3aaef17e0e8e3d736  uthash-2.4.0.tar.gz
+sha256  40f48f89e1d0095bf1c5fb4d00affd74959c3ff77463b672cf7fac547d1d6465  LICENSE

package/uthash/uthash.mk new file +19 -0

new file mode 100644
index 0000000000..2107a90d56
@@ -0,0 +1,19 @@
+################################################################################
+#
+# uthash
+#
+################################################################################
+
+UTHASH_VERSION = 2.4.0
+UTHASH_SITE = $(call github,troydhanson,uthash,v$(UTHASH_VERSION))
+UTHASH_LICENSE = BSD-1-Clause
+UTHASH_LICENSE_FILES = LICENSE
+UTHASH_INSTALL_STAGING = YES
+UTHASH_INSTALL_TARGET = NO
+
+define UTHASH_INSTALL_STAGING_CMDS
+	$(INSTALL) -d $(STAGING_DIR)/usr/include
+	$(INSTALL) -m 0644 $(@D)/src/*.h $(STAGING_DIR)/usr/include
+endef
+
+$(eval $(generic-package))

Signature · 6 lines

2.34.1

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

Angelo Compagnucci

author

2026-10-30 15:24 UTC #1 lore raw

PATCH 2/9 package/webrtc-audio-processing: fix build with musl

webrtc/rtc_base/system/file_wrapper.h uses int64_t without including <stdint.h>. With glibc it is defined anyway, as <stdlib.h>, included by the C++ <string> header, includes <sys/types.h>, but not with musl:

../webrtc/rtc_base/system/file_wrapper.h:86:21: error: 'int64_t' has not been declared

Backport the upstream fix adding the missing include.

This was not noticed before, as webrtc-audio-processing selects libabseil-cpp, which was not available on musl.

Signed-off-by Angelo Compagnucci <[email protected]>

---
 ...-file_wrapper.h-Fix-build-with-GCC13.patch | 30 +++++++++++++++++++
 1 file changed, 30 insertions(+)
 create mode 100644 package/webrtc-audio-processing/0002-file_wrapper.h-Fix-build-with-GCC13.patch

package/webrtc-audio-processing/0002-file_wrapper.h-Fix-build-with-GCC13.patch new file +30 -0

new file mode 100644
index 0000000000..deecb8e3c6
@@ -0,0 +1,30 @@
+From 9a202fb8c218223d24dfbbe6130053c68111e97a Mon Sep 17 00:00:00 2001
+From: "L. E. Segovia" <[email protected]>
+Date: Sat, 23 Mar 2024 16:34:50 -0300
+Subject: [PATCH] file_wrapper.h: Fix build with GCC13
+
+It is a missed instance of cdec109331de34958a892a1418d67806b171b862 (!31).
+
+Fixes #32
+
+Upstream: https://gitlab.freedesktop.org/pulseaudio/webrtc-audio-processing/-/commit/9a202fb8c218223d24dfbbe6130053c68111e97a
+Signed-off-by: Angelo Compagnucci <[email protected]>
+---
+ webrtc/rtc_base/system/file_wrapper.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/webrtc/rtc_base/system/file_wrapper.h b/webrtc/rtc_base/system/file_wrapper.h
+index 42c463c..bfd8fcd 100644
+--- a/webrtc/rtc_base/system/file_wrapper.h
++++ b/webrtc/rtc_base/system/file_wrapper.h
+@@ -13,6 +13,7 @@
+ 
+ #include <stddef.h>
+ #include <stdio.h>
++#include <stdint.h>
+ 
+ #include <string>
+ 
+-- 
+GitLab
+

Signature · 6 lines

2.34.1

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

Thomas Petazzoni via buildroot

Applied

2026-11-01 21:27 UTC #2 lore raw

Re: [Buildroot] [PATCH 2/9] package/webrtc-audio-processing: fix build with musl

Quoted 4 lines · Angelo Compagnucci

webrtc/rtc_base/system/file_wrapper.h uses int64_t without including <stdint.h>. With glibc it is defined anyway, as <stdlib.h>, included by the C++ <string> header, includes <sys/types.h>, but not with musl:

Quoted 8 lines

../webrtc/rtc_base/system/file_wrapper.h:86:21: error: 'int64_t' has not been declared
Backport the upstream fix adding the missing include.
This was not noticed before, as webrtc-audio-processing selects libabseil-cpp, which was not available on musl.
Signed-off-by Angelo Compagnucci <[email protected]>

Applied to master, thanks!

Best regards,

Thomas Petazzoni

Signature · 7 lines

Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

Raphaël Mélotte via buildroot

Applied

2026-11-06 16:10 UTC #3 lore raw

Re: [Buildroot] [PATCH 2/9] package/webrtc-audio-processing: fix build with musl

In reply to Angelo Compagnucci

In reply of:

Quoted 4 lines

webrtc/rtc_base/system/file_wrapper.h uses int64_t without including <stdint.h>. With glibc it is defined anyway, as <stdlib.h>, included by the C++ <string> header, includes <sys/types.h>, but not with musl:

Quoted 8 lines

../webrtc/rtc_base/system/file_wrapper.h:86:21: error: 'int64_t' has not been declared
Backport the upstream fix adding the missing include.
This was not noticed before, as webrtc-audio-processing selects libabseil-cpp, which was not available on musl.
Signed-off-by Angelo Compagnucci <[email protected]>

Applied to 2025.02.x, 2026.08.x. Thanks

Quoted 31 lines

---
 ...-file_wrapper.h-Fix-build-with-GCC13.patch | 30 +++++++++++++++++++
 1 file changed, 30 insertions(+)
 create mode 100644 package/webrtc-audio-processing/0002-file_wrapper.h-Fix-build-with-GCC13.patch

package/webrtc-audio-processing/0002-file_wrapper.h-Fix-build-with-GCC13.patch new file +20 -0

new file mode 100644
index 0000000000..deecb8e3c6
@@ -0,0 +1,30 @@
+From 9a202fb8c218223d24dfbbe6130053c68111e97a Mon Sep 17 00:00:00 2001
+From: "L. E. Segovia" <[email protected]>
+Date: Sat, 23 Mar 2024 16:34:50 -0300
+Subject: [PATCH] file_wrapper.h: Fix build with GCC13
+
+It is a missed instance of cdec109331de34958a892a1418d67806b171b862 (!31).
+
+Fixes #32
+
+Upstream: https://gitlab.freedesktop.org/pulseaudio/webrtc-audio-processing/-/commit/9a202fb8c218223d24dfbbe6130053c68111e97a
+Signed-off-by: Angelo Compagnucci <[email protected]>
+---
+ webrtc/rtc_base/system/file_wrapper.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/webrtc/rtc_base/system/file_wrapper.h b/webrtc/rtc_base/system/file_wrapper.h
+index 42c463c..bfd8fcd 100644
+--- a/webrtc/rtc_base/system/file_wrapper.h
++++ b/webrtc/rtc_base/system/file_wrapper.h
+@@ -13,6 +13,7 @@

package/webrtc-audio-processing/0002-file_wrapper.h-Fix-build-with-GCC13.patch line 30

Quoted 10 lines

package/webrtc-audio-processing/0002-file_wrapper.h-Fix-build-with-GCC13.patch new file +10 -0
+ 
+ #include <stddef.h>
+ #include <stdio.h>
++#include <stdint.h>
+ 
+ #include <string>
+ 
+-- 
+GitLab
+

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

Angelo Compagnucci

author

2026-10-30 15:24 UTC #4 lore raw

PATCH 3/9 package/libabseil-cpp: allow building with musl

In reply to Angelo Compagnucci

libabseil-cpp depends on BR2_TOOLCHAIN_HAS_UCONTEXT, which is not set for musl, as it doesn't provide the {get,make,set}context functions.

However, absl/debugging/internal/examine_stack.cc only uses the ucontext data structures, to get the program counter from the signal context, and never calls those functions. musl provides those data structures, so allow building with musl.

On 32-bit powerpc, examine_stack.cc assumes the glibc layout of mcontext_t (uc_mcontext.uc_regs), which is different with musl, so keep it disabled there.

examine_stack.cc was build-tested with the Bootlin musl toolchains for aarch64, armv7, i686, x86-64, m68k, mips32el, powerpc64, powerpc64le, riscv32, riscv64, s390x and sh4, and libabseil-cpp, re2, protobuf, grpc and webrtc-audio-processing with the aarch64 and armv7 musl toolchains.

Signed-off-by Angelo Compagnucci <[email protected]>

---
 package/libabseil-cpp/Config.in | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

package/libabseil-cpp/Config.in +5 -1

index aba065fca7..ea037f5de2 100644
@@ -13,7 +13,11 @@ config BR2_PACKAGE_LIBABSEIL_CPP_ARCH_SUPPORTS
 	default y if BR2_sh
 	default y if BR2_sparc || BR2_sparc64
 	default y if BR2_x86_64
-	depends on BR2_TOOLCHAIN_HAS_UCONTEXT
+	# Only the ucontext data structures are used, not the
+	# {get,make,set}context functions, so musl is supported, except
+	# on 32-bit powerpc, where the glibc mcontext_t layout is assumed.
+	depends on BR2_TOOLCHAIN_HAS_UCONTEXT || BR2_TOOLCHAIN_USES_MUSL
+	depends on !(BR2_powerpc && BR2_TOOLCHAIN_USES_MUSL)
 	# absl/base/internal/direct_mmap.h only implements DirectMmap()
 	# with mmap2 for the o32 ABI on MIPS, and its 64-bit fallback
 	# fails to build with the n32 ABI, where long is 32-bit

Signature · 6 lines

2.34.1

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

Thomas Petazzoni via buildroot

Applied

2026-11-01 21:29 UTC #5 lore raw

Re: [Buildroot] [PATCH 3/9] package/libabseil-cpp: allow building with musl

Quoted 12 lines · Angelo Compagnucci

libabseil-cpp depends on BR2_TOOLCHAIN_HAS_UCONTEXT, which is not set for musl, as it doesn't provide the {get,make,set}context functions.
However, absl/debugging/internal/examine_stack.cc only uses the ucontext data structures, to get the program counter from the signal context, and never calls those functions. musl provides those data structures, so allow building with musl.
On 32-bit powerpc, examine_stack.cc assumes the glibc layout of mcontext_t (uc_mcontext.uc_regs), which is different with musl, so keep it disabled there.

Quoted 6 lines

examine_stack.cc was build-tested with the Bootlin musl toolchains for aarch64, armv7, i686, x86-64, m68k, mips32el, powerpc64, powerpc64le, riscv32, riscv64, s390x and sh4, and libabseil-cpp, re2, protobuf, grpc and webrtc-audio-processing with the aarch64 and armv7 musl toolchains.
Signed-off-by Angelo Compagnucci <[email protected]>

Applied to master, thanks!

Best regards,

Thomas Petazzoni

Signature · 7 lines

Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

Angelo Compagnucci

author

2026-10-30 15:24 UTC #6 lore raw

PATCH 4/9 package/falcosecurity-libs: bump to version 0.21.0

In reply to Angelo Compagnucci

falcosecurity-libs is now a cmake package building and installing libscap and libsinsp as shared libraries, with all the bundled dependencies disabled. The pkg-config files are fixed up in staging, as they contain absolute staging paths.

The dependencies changed accordingly:
- grpc, protobuf, c-ares, libcurl, openssl, jq, libb64, gtest, elfutils and lua are not needed anymore
- re2 and uthash are new dependencies
The glibc dependency is replaced by the one of tbb, which also supports musl.
The new dependencies are propagated to sysdig.

Only the kernel module driver is built: to keep the build small, the eBPF engine (needing elfutils) and the gVisor engine (needing protobuf, x86_64 only) are disabled, and can be enabled in a following patch. The modern eBPF probe would also need clang and bpftool.

The kernel module is now built from the sources and Makefile prepared by the driver CMakeLists.txt, instead of generating driver_config.h by hand, which hard-coded the driver API and schema versions to 1.0.0. The kernel module needs CONFIG_IPV6.

falcosecurity-libs now only supports 64-bit architectures (x86_64, aarch64, s390x, riscv64, ppc64le and loongarch64), as the syscall tables only exist for them.

sysdig 0.29.3 can't be built with this version, it is bumped to 0.41.4, which needs falcosecurity-libs 0.21.0, in the following commit.

Release notes:
https://github.com/falcosecurity/libs/releases/tag/0.21.0

Signed-off-by Angelo Compagnucci <[email protected]>

---
 .checkpackageignore                           |  1 -
 ...cmake-Permit-setting-GRPC_CPP_PLUGIN.patch | 34 -------
 ...-pass-ARCH-and-CROSS_COMPILE-to-the-.patch | 38 +++++++
 ...ver-replace-removed-task_euid-helper.patch | 33 +++++++
 package/falcosecurity-libs/Config.in          | 39 ++++----
 .../falcosecurity-libs.hash                   |  4 +-
 .../falcosecurity-libs/falcosecurity-libs.mk  | 98 +++++++++----------
 package/sysdig/Config.in                      | 21 ++--
 8 files changed, 150 insertions(+), 118 deletions(-)
 delete mode 100644 package/falcosecurity-libs/0001-cmake-Permit-setting-GRPC_CPP_PLUGIN.patch
 create mode 100644 package/falcosecurity-libs/0001-driver-configure-pass-ARCH-and-CROSS_COMPILE-to-the-.patch
 create mode 100644 package/falcosecurity-libs/0002-fix-driver-replace-removed-task_euid-helper.patch

.checkpackageignore +0 -1

index a8c1baacbd..662d454f29 100644
@@ -310,7 +310,6 @@ package/exim/0003-Skip-version-check-and-symlink-installation.patch lib_patch.Up
 package/exim/S86exim lib_sysv.Indent lib_sysv.Variables
 package/fail2ban/S60fail2ban Shellcheck lib_sysv.Variables
 package/fakedate/fakedate Shellcheck
-package/falcosecurity-libs/0001-cmake-Permit-setting-GRPC_CPP_PLUGIN.patch lib_patch.Upstream
 package/fbgrab/0001-fix-static-build.patch lib_patch.Upstream
 package/fbset/0001-Fix-musl-compile.patch lib_patch.Upstream
 package/fbterm/0001-fbio.cpp-improxy.cpp-fbterm.cpp-fix-musl-compile.patch lib_patch.Upstream

package/falcosecurity-libs/0001-cmake-Permit-setting-GRPC_CPP_PLUGIN.patch deleted +0 ~~-34~~

deleted file mode 100644
index 6141d8ef72..0000000000
@@ -1,34 +0,0 @@
-From 2e8a50cd4975df3ab60ee07c9675831cd5ad397f Mon Sep 17 00:00:00 2001
-From: Francis Laniel <[email protected]>
-Date: Tue, 12 Apr 2022 19:54:11 +0100
-Subject: [PATCH] cmake: Permit setting GRPC_CPP_PLUGIN.
-
-This patch enables users to set GRPC_CPP_PLUGIN while calling cmake with:
-cmake -DGRPC_CPP_PLUGIN=/path
-
-Signed-off-by: Francis Laniel <[email protected]>
----
- cmake/modules/grpc.cmake | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/cmake/modules/grpc.cmake b/cmake/modules/grpc.cmake
-index e5fd16b8..9d8f5934 100644
---- a/cmake/modules/grpc.cmake
-+++ b/cmake/modules/grpc.cmake
-@@ -12,9 +12,11 @@ elseif(NOT USE_BUNDLED_GRPC)
- 		set(GRPCPP_LIB gRPC::grpc++)
- 
- 		# gRPC C++ plugin
--		get_target_property(GRPC_CPP_PLUGIN gRPC::grpc_cpp_plugin LOCATION)
- 		if(NOT GRPC_CPP_PLUGIN)
--			message(FATAL_ERROR "System grpc_cpp_plugin not found")
-+			get_target_property(GRPC_CPP_PLUGIN gRPC::grpc_cpp_plugin LOCATION)
-+			if(NOT GRPC_CPP_PLUGIN)
-+				message(FATAL_ERROR "System grpc_cpp_plugin not found")
-+			endif()
- 		endif()
- 
- 		# gRPC include dir + properly handle grpc{++,pp}
--- 
-2.25.1
-

package/falcosecurity-libs/0001-driver-configure-pass-ARCH-and-CROSS_COMPILE-to-the-.patch new file +38 -0

new file mode 100644
index 0000000000..13b68d5569
@@ -0,0 +1,38 @@
+From fef2154ea3ce5e95af90bf35f7f062762362a3a9 Mon Sep 17 00:00:00 2001
+From: Angelo Compagnucci <[email protected]>
+Date: Fri, 30 Oct 2026 14:18:02 +0100
+Subject: [PATCH] driver: configure: pass ARCH and CROSS_COMPILE to the
+ configure modules
+
+The configure modules are built with an empty environment, so when
+cross-compiling the kernel module, ARCH and CROSS_COMPILE are lost and
+the configure modules are built for the build machine architecture,
+which fails, also making the 0__SANITY check fail.
+
+Pass ARCH and CROSS_COMPILE as well, only if they are set: an empty ARCH
+in the environment would prevent the kernel Makefile from setting it.
+
+Upstream: https://github.com/falcosecurity/libs/pull/3153
+Signed-off-by: Angelo Compagnucci <[email protected]>
+---
+ driver/configure/Makefile.inc.in | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/driver/configure/Makefile.inc.in b/driver/configure/Makefile.inc.in
+index af4b1f5..54c852f 100644
+--- a/driver/configure/Makefile.inc.in
++++ b/driver/configure/Makefile.inc.in
+@@ -3,7 +3,9 @@ MODULE_MAKEFILE_DIR := $(shell dirname $(abspath $(lastword $(MAKEFILE_LIST))))
+ # Run the module build.sh (wrapper for make) script with an empty environment,
+ # but pass PATH, KERNELDIR and eventually (if set) CC and KBUILD_MODPOST_WARN.
+ # The latter ones are used by driverkit build templates.
+-HAS_@CONFIGURE_MODULE@ := $(shell env -i CC="$(CC)" KBUILD_MODPOST_WARN="$(KBUILD_MODPOST_WARN)" PATH="$(PATH)" KERNELDIR="$(KERNELDIR)" sh $(MODULE_MAKEFILE_DIR)/build.sh ; echo $$?)
++# ARCH and CROSS_COMPILE, used when cross-compiling, are only passed if set, as
++# an empty ARCH would prevent the kernel Makefile from setting it.
++HAS_@CONFIGURE_MODULE@ := $(shell env -i CC="$(CC)" $(if $(ARCH),ARCH="$(ARCH)") $(if $(CROSS_COMPILE),CROSS_COMPILE="$(CROSS_COMPILE)") KBUILD_MODPOST_WARN="$(KBUILD_MODPOST_WARN)" PATH="$(PATH)" KERNELDIR="$(KERNELDIR)" sh $(MODULE_MAKEFILE_DIR)/build.sh ; echo $$?)
+ 
+ ifeq ($(HAS_@CONFIGURE_MODULE@),0)
+ $(info [configure-kmod] Setting HAS_@CONFIGURE_MODULE@ flag)
+-- 
+2.34.1
+

package/falcosecurity-libs/0002-fix-driver-replace-removed-task_euid-helper.patch new file +33 -0

new file mode 100644
index 0000000000..179dd6f047
@@ -0,0 +1,33 @@
+From e85e268edef7fa6155ffb186f068f5c512fdf5b5 Mon Sep 17 00:00:00 2001
+From: Leonardo Grasso <[email protected]>
+Date: Mon, 7 Sep 2026 09:20:30 +0200
+Subject: [PATCH] fix(driver): replace removed task_euid helper
+
+Linux 7.3 removes task_euid(), breaking the kernel module build on architectures that capture sched_process_fork.
+
+Use task_cred_xxx(child, euid), matching the removed macro expansion and preserving the existing credential lookup and RCU protection. The helper is also available on older supported kernels.
+
+Signed-off-by: Leonardo Grasso <[email protected]>
+Upstream: https://github.com/falcosecurity/libs/commit/fd77846d4920bfea2211ac229d3b2a814d4835da
+[Angelo: backport to 0.21.0]
+Signed-off-by: Angelo Compagnucci <[email protected]>
+---
+ driver/ppm_fillers.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/driver/ppm_fillers.c b/driver/ppm_fillers.c
+index 7abc11d..f385a09 100644
+--- a/driver/ppm_fillers.c
++++ b/driver/ppm_fillers.c
+@@ -8001,7 +8001,7 @@ int f_sched_prog_fork(struct event_filler_arguments *args) {
+ 	long swap = 0;
+ 	int available = STR_STORAGE_SIZE;
+ 	uint32_t flags = 0;
+-	uint32_t euid = task_euid(child).val;
++	uint32_t euid = task_cred_xxx(child, euid).val;
+ 	uint32_t egid = child->cred->egid.val;
+ 	struct pid_namespace *pidns = task_active_pid_ns(child);
+ 	uint64_t pidns_init_start_time = 0;
+-- 
+2.34.1
+

package/falcosecurity-libs/Config.in +20 ~~-19~~

index 66ee55f101..c73b92d78f 100644
@@ -1,27 +1,28 @@
+config BR2_PACKAGE_FALCOSECURITY_LIBS_ARCH_SUPPORTS
+	bool
+	default y if BR2_aarch64
+	default y if BR2_loongarch64
+	default y if BR2_powerpc64le
+	default y if BR2_riscv && BR2_ARCH_IS_64
+	default y if BR2_s390x
+	default y if BR2_x86_64
+	depends on BR2_PACKAGE_LIBABSEIL_CPP_ARCH_SUPPORTS # re2
+
 config BR2_PACKAGE_FALCOSECURITY_LIBS
 	bool
-	depends on BR2_PACKAGE_LIBABSEIL_CPP_ARCH_SUPPORTS # grpc
-	depends on BR2_USE_WCHAR # grpc -> libabseil-cpp
-	depends on BR2_PACKAGE_PROTOBUF_ARCH_SUPPORTS # protobuf
+	depends on BR2_PACKAGE_FALCOSECURITY_LIBS_ARCH_SUPPORTS
+	depends on BR2_USE_WCHAR # re2 -> libabseil-cpp
 	depends on BR2_LINUX_KERNEL
-	depends on BR2_INSTALL_LIBSTDCPP # jsoncpp, protobuf, tbb
-	depends on BR2_TOOLCHAIN_GCC_AT_LEAST_10 # grpc -> libabseil-cpp
-	depends on BR2_TOOLCHAIN_HAS_THREADS # jq, protobuf, tbb
-	depends on !BR2_STATIC_LIBS # protobuf, tbb
-	depends on BR2_TOOLCHAIN_HAS_SYNC_4 || BR2_TOOLCHAIN_HAS_ATOMIC # grpc
-	depends on BR2_TOOLCHAIN_USES_GLIBC # tbb
-	depends on BR2_PACKAGE_LUAINTERPRETER_ABI_VERSION_5_1
-	select BR2_PACKAGE_C_ARES
-	select BR2_PACKAGE_ELFUTILS
-	select BR2_PACKAGE_GRPC
-	select BR2_PACKAGE_GTEST
-	select BR2_PACKAGE_JQ
+	depends on BR2_INSTALL_LIBSTDCPP # jsoncpp, re2, tbb, valijson
+	depends on BR2_TOOLCHAIN_GCC_AT_LEAST_10 # re2
+	depends on BR2_TOOLCHAIN_HAS_THREADS # re2, tbb
+	depends on !BR2_STATIC_LIBS # re2, tbb
+	depends on !BR2_TOOLCHAIN_USES_UCLIBC # tbb
+	depends on !BR2_TOOLCHAIN_HAS_GCC_BUG_64735 # tbb
 	select BR2_PACKAGE_JSONCPP
-	select BR2_PACKAGE_LIBB64
-	select BR2_PACKAGE_LIBCURL
-	select BR2_PACKAGE_OPENSSL
-	select BR2_PACKAGE_PROTOBUF
+	select BR2_PACKAGE_RE2
 	select BR2_PACKAGE_TBB
+	select BR2_PACKAGE_UTHASH
 	select BR2_PACKAGE_VALIJSON
 	select BR2_PACKAGE_ZLIB
 	help

package/falcosecurity-libs/falcosecurity-libs.hash +2 -2

index 2e239ca2fe..89b2100c32 100644
@@ -1,5 +1,5 @@
 # sha256 locally computed
-sha256  80903bc57b7f9c5f24298ecf1531cf66ef571681b4bd1e05f6e4db704ffb380b  falcosecurity-libs-e5c53d648f3c4694385bbe488e7d47eaa36c229a.tar.gz
+sha256  9e977001dd42586df42a5dc7e7a948c297124865a233402e44bdec68839d322a  falcosecurity-libs-0.21.0.tar.gz
 sha256  21ec9433a87459b3477faf542bacec419dc03af841309eac35edeffe481cf10b  COPYING
 sha256  8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643  driver/GPL2.txt
-sha256  f17d3f2c2d565a74a7d5bf96f880c43701e141897e8dff0c8aa13e5d07aaf226  driver/MIT.txt
+sha256  e852b60bd201c42bf7bb5a53129bdb90de033bf254e740ea8ba1cf92d096caf5  driver/MIT.txt

package/falcosecurity-libs/falcosecurity-libs.mk +48 ~~-50~~

125 lines not on this page · raw message

package/sysdig/Config.in +9 ~~-12~~

index 038a9734aa..3c96bda73e 100644
@@ -1,16 +1,15 @@
 config BR2_PACKAGE_SYSDIG
 	bool "sysdig"
-	depends on BR2_PACKAGE_LIBABSEIL_CPP_ARCH_SUPPORTS # falcosecurity-libs
-	depends on BR2_USE_WCHAR # falcosecurity-libs -> libabseil-cpp
-	depends on BR2_PACKAGE_PROTOBUF_ARCH_SUPPORTS # falcosecurity-libs
+	depends on BR2_PACKAGE_FALCOSECURITY_LIBS_ARCH_SUPPORTS
+	depends on BR2_USE_WCHAR # falcosecurity-libs, ncurses
 	depends on BR2_LINUX_KERNEL # falcosecurity-libs
-	depends on BR2_INSTALL_LIBSTDCPP
-	depends on BR2_TOOLCHAIN_GCC_AT_LEAST_10 # falcosecurity-libs -> grpc -> libabseil-cpp
+	depends on BR2_INSTALL_LIBSTDCPP # falcosecurity-libs
+	depends on BR2_TOOLCHAIN_GCC_AT_LEAST_10 # falcosecurity-libs
 	depends on BR2_TOOLCHAIN_HAS_THREADS # falcosecurity-libs
 	depends on !BR2_STATIC_LIBS # falcosecurity-libs
-	depends on BR2_TOOLCHAIN_USES_GLIBC # falcosecurity-libs
-	depends on BR2_PACKAGE_LUAINTERPRETER_ABI_VERSION_5_1 # falcosecurity-libs
-	depends on BR2_TOOLCHAIN_HAS_SYNC_4 || BR2_TOOLCHAIN_HAS_ATOMIC # falcosecurity-libs
+	depends on !BR2_TOOLCHAIN_USES_UCLIBC # falcosecurity-libs
+	depends on !BR2_TOOLCHAIN_HAS_GCC_BUG_64735 # falcosecurity-libs
+	depends on BR2_PACKAGE_LUAINTERPRETER_ABI_VERSION_5_1 # chisels
 	select BR2_PACKAGE_FALCOSECURITY_LIBS
 	select BR2_PACKAGE_NCURSES
 	select BR2_PACKAGE_JSON_FOR_MODERN_CPP

@@ -25,12 +24,10 @@ config BR2_PACKAGE_SYSDIG
 	  https://github.com/draios/sysdig/wiki
 
 comment "sysdig needs a glibc or musl toolchain w/ C++, threads, wchar, gcc >= 10, dynamic library, a Linux kernel, and luajit or lua 5.1 to be built"
-	depends on BR2_PACKAGE_LIBABSEIL_CPP_ARCH_SUPPORTS
-	depends on BR2_PACKAGE_PROTOBUF_ARCH_SUPPORTS
-	depends on BR2_TOOLCHAIN_HAS_SYNC_4 || BR2_TOOLCHAIN_HAS_ATOMIC
+	depends on BR2_PACKAGE_FALCOSECURITY_LIBS_ARCH_SUPPORTS
 	depends on !BR2_LINUX_KERNEL || !BR2_INSTALL_LIBSTDCPP \
 		|| !BR2_TOOLCHAIN_HAS_THREADS \
 		|| !BR2_TOOLCHAIN_GCC_AT_LEAST_10 || !BR2_USE_WCHAR \
 		|| BR2_STATIC_LIBS \
-		|| !BR2_TOOLCHAIN_USES_GLIBC \
+		|| BR2_TOOLCHAIN_USES_UCLIBC \
 		|| !BR2_PACKAGE_LUAINTERPRETER_ABI_VERSION_5_1

Signature · 6 lines

2.34.1

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

Thomas Petazzoni via buildroot

2026-11-01 22:27 UTC #7 lore raw

Re: [Buildroot] [PATCH 4/9] package/falcosecurity-libs: bump to version 0.21.0

Hello Angelo,

Quoted 15 lines · Angelo Compagnucci

package/sysdig/Config.in +2 -5

index 038a9734aa..3c96bda73e 100644
@@ -1,16 +1,15 @@
 config BR2_PACKAGE_SYSDIG
 	bool "sysdig"
-	depends on BR2_PACKAGE_LIBABSEIL_CPP_ARCH_SUPPORTS # falcosecurity-libs
-	depends on BR2_USE_WCHAR # falcosecurity-libs -> libabseil-cpp
-	depends on BR2_PACKAGE_PROTOBUF_ARCH_SUPPORTS # falcosecurity-libs
+	depends on BR2_PACKAGE_FALCOSECURITY_LIBS_ARCH_SUPPORTS
+	depends on BR2_USE_WCHAR # falcosecurity-libs, ncurses
 	depends on BR2_LINUX_KERNEL # falcosecurity-libs
-	depends on BR2_INSTALL_LIBSTDCPP
-	depends on BR2_TOOLCHAIN_GCC_AT_LEAST_10 # falcosecurity-libs -> grpc -> libabseil-cpp

package/sysdig/Config.in line 12

Quoted 10 lines

package/sysdig/Config.in +5 -3

+	depends on BR2_INSTALL_LIBSTDCPP # falcosecurity-libs
+	depends on BR2_TOOLCHAIN_GCC_AT_LEAST_10 # falcosecurity-libs
 	depends on BR2_TOOLCHAIN_HAS_THREADS # falcosecurity-libs
 	depends on !BR2_STATIC_LIBS # falcosecurity-libs
-	depends on BR2_TOOLCHAIN_USES_GLIBC # falcosecurity-libs
-	depends on BR2_PACKAGE_LUAINTERPRETER_ABI_VERSION_5_1 # falcosecurity-libs
-	depends on BR2_TOOLCHAIN_HAS_SYNC_4 || BR2_TOOLCHAIN_HAS_ATOMIC # falcosecurity-libs
+	depends on !BR2_TOOLCHAIN_USES_UCLIBC # falcosecurity-libs
+	depends on !BR2_TOOLCHAIN_HAS_GCC_BUG_64735 # falcosecurity-libs
+	depends on BR2_PACKAGE_LUAINTERPRETER_ABI_VERSION_5_1 # chisels

This line should have been part of the next patch technically, because it's the version bump of sysdig that requires this Lua 5.1.

I nevertheless wanted to apply, but unfortunately, it fails to build for me:

ppm_events.c: In function 'ppm_copy_from_user':
ppm_events.c:91:54: error: macro 'access_ok' passed 3 arguments, but takes just 2
91 | if(likely(ppm_access_ok(VERIFY_READ, from, n)))
| ^
In file included from /home/thomas/projets/buildroot/output/build/linux-6.18.60/include/linux/uaccess.h:12,

                 from /home/thomas/projets/buildroot/output/build/linux-6.18.60/include/linux/sched/task.h:13,
                 from /home/thomas/projets/buildroot/output/build/linux-6.18.60/include/linux/sched/signal.h:10,
                 from /home/thomas/projets/buildroot/output/build/linux-6.18.60/include/linux/rcuwait.h:6,
                 from /home/thomas/projets/buildroot/output/build/linux-6.18.60/include/linux/percpu-rwsem.h:7,
                 from /home/thomas/projets/buildroot/output/build/linux-6.18.60/include/linux/fs.h:34,
                 from /home/thomas/projets/buildroot/output/build/linux-6.18.60/include/linux/compat.h:17,
                 from ppm_events.c:13:
/home/thomas/projets/buildroot/output/build/linux-6.18.60/arch/riscv/include/asm/uaccess.h:42:9: note: macro 'access_ok' defined here
   42 | #define access_ok(addr, size) likely(__access_ok(untagged_addr(addr), size))
      |         ^~~~~~~~~
In file included from /home/thomas/projets/buildroot/output/build/linux-6.18.60/include/asm-generic/div64.h:27,
                 from /home/thomas/projets/buildroot/output/build/linux-6.18.60/arch/riscv/include/generated/asm/div64.h:1,
                 from /home/thomas/projets/buildroot/output/build/linux-6.18.60/include/linux/math.h:6,
                 from /home/thomas/projets/buildroot/output/build/linux-6.18.60/include/linux/math64.h:6,
                 from /home/thomas/projets/buildroot/output/build/linux-6.18.60/include/linux/time.h:6,
                 from /home/thomas/projets/buildroot/output/build/linux-6.18.60/include/linux/compat.h:10:

I initially tried with Linux 7.3, thought it was too new, so tried with Linux 6.18, which is the latest LTS. Is that also too new?

Defconfig tested:

BR2_riscv=y
BR2_TOOLCHAIN_EXTERNAL=y BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_RISCV64_LP64D_MUSL_STABLE=y BR2_INIT_NONE=y
BR2_SYSTEM_BIN_SH_NONE=y
BR2_LINUX_KERNEL=y
BR2_LINUX_KERNEL_LATEST_6_18=y BR2_LINUX_KERNEL_USE_ARCH_DEFAULT_CONFIG=y
# BR2_PACKAGE_BUSYBOX is not set BR2_PACKAGE_SYSDIG=y
BR2_PACKAGE_LUA=y
BR2_PACKAGE_LUA_5_1=y
# BR2_TARGET_ROOTFS_TAR is not set

Best regards,

Thomas

Signature · 7 lines

Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

Angelo Compagnucci

author

2026-10-30 15:24 UTC #8 lore raw

PATCH 5/9 package/sysdig: bump to version 0.41.4

In reply to Angelo Compagnucci

sysdig 0.41.4 needs falcosecurity-libs 0.21.0 (whose driver is the same as the 8.1.0+driver one sysdig requires), and links to libsinsp through pkg-config, as supported upstream since sysdig 0.40.0, with all the bundled dependencies disabled.

lua, which runs the chisels, is now a direct dependency.

Patches:
- allow to disable the container plugin, which is either downloaded as a prebuilt binary or built with Go; it can be provided by a separate package in a following patch
- only include the zlib CMake module with the bundled falcosecurity libs, as it comes from them

Release notes:
https://github.com/draios/sysdig/releases/tag/0.41.4

Signed-off-by Angelo Compagnucci <[email protected]>

---
 ...llow-to-disable-the-container-plugin.patch | 37 ++++++++++++++++
 ...-only-include-zlib-with-the-bundled-.patch | 43 +++++++++++++++++++
 package/sysdig/Config.in                      |  2 +-
 package/sysdig/sysdig.hash                    |  2 +-
 package/sysdig/sysdig.mk                      | 32 +++++++-------
 5 files changed, 97 insertions(+), 19 deletions(-)
 create mode 100644 package/sysdig/0001-CMakeLists.txt-allow-to-disable-the-container-plugin.patch
 create mode 100644 package/sysdig/0002-userspace-sysdig-only-include-zlib-with-the-bundled-.patch

package/sysdig/0001-CMakeLists.txt-allow-to-disable-the-container-plugin.patch new file +37 -0

new file mode 100644
index 0000000000..e13ed4bb65
@@ -0,0 +1,37 @@
+From 64f286b765da1335369c3d27fad298f0b3f525c5 Mon Sep 17 00:00:00 2001
+From: Angelo Compagnucci <[email protected]>
+Date: Fri, 30 Oct 2026 10:15:11 +0100
+Subject: [PATCH] CMakeLists.txt: allow to disable the container plugin
+
+The container plugin is either downloaded as a prebuilt binary, for the
+build host architecture, or built from sources using Go, and both can't
+be done when cross-compiling or without network access.
+
+As the container plugin is only loaded when available, add an option to
+not download nor build it.
+
+Upstream: https://github.com/draios/sysdig/pull/2191
+Signed-off-by: Angelo Compagnucci <[email protected]>
+---
+ CMakeLists.txt | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 68344a3..9ef0f9a 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -163,7 +163,10 @@ endif()
+ include(falcosecurity-libs)
+ include(yaml-cpp)
+ include(nlohmann-json)
+-include(container_plugin)
++option(BUILD_SYSDIG_CONTAINER_PLUGIN "Download or build the container plugin" ON)
++if(BUILD_SYSDIG_CONTAINER_PLUGIN)
++	include(container_plugin)
++endif()
+ 
+ if(CMAKE_SYSTEM_NAME MATCHES "Linux")
+ 	if(NOT DEFINED DRIVER_VERSION)
+-- 
+2.34.1
+

package/sysdig/0002-userspace-sysdig-only-include-zlib-with-the-bundled-.patch new file +43 -0

43 lines not on this page · raw message

package/sysdig/Config.in +1 -1

index 3c96bda73e..5dff37251a 100644
@@ -21,7 +21,7 @@ config BR2_PACKAGE_SYSDIG
 	  Think of it as strace + tcpdump + lsof + awesome sauce.
 	  With a little Lua cherry on top.
 
-	  https://github.com/draios/sysdig/wiki
+	  https://github.com/draios/sysdig
 
 comment "sysdig needs a glibc or musl toolchain w/ C++, threads, wchar, gcc >= 10, dynamic library, a Linux kernel, and luajit or lua 5.1 to be built"
 	depends on BR2_PACKAGE_FALCOSECURITY_LIBS_ARCH_SUPPORTS

package/sysdig/sysdig.hash +1 -1

index cda3de5e7c..4a55afe1da 100644
@@ -1,3 +1,3 @@
 # sha256 locally computed
-sha256  6b96797859002ab69a2bed4fdba1c7fe8064ecf8661621ae7d8fbf8599ffa636  sysdig-0.29.3.tar.gz
+sha256  36daa6a06705569fcc9b0579992e2457494003aea0065eabf54b3e16d67511f7  sysdig-0.41.4.tar.gz
 sha256  a88fbf820b38b1c7fabc6efe291b8259e02ae21326f56fe31c6c9adf374b2702  COPYING

package/sysdig/sysdig.mk +15 ~~-17~~

index bafe534a16..d04f67a97b 100644
@@ -4,35 +4,33 @@
 #
 ################################################################################
 
-SYSDIG_VERSION = 0.29.3
+SYSDIG_VERSION = 0.41.4
 SYSDIG_SITE = $(call github,draios,sysdig,$(SYSDIG_VERSION))
 SYSDIG_LICENSE = Apache-2.0
 SYSDIG_LICENSE_FILES = COPYING
 SYSDIG_CPE_ID_VENDOR = sysdig
-SYSDIG_CONF_OPTS = \
-	-DENABLE_DKMS=OFF \
-	-DUSE_BUNDLED_DEPS=OFF \
-	-DCREATE_TEST_TARGETS=OFF
 SYSDIG_SUPPORTS_IN_SOURCE_BUILD = NO
 
 SYSDIG_DEPENDENCIES = \
 	falcosecurity-libs \
-	ncurses \
+	host-pkgconf \
 	json-for-modern-cpp \
+	luainterpreter \
+	ncurses \
 	yaml-cpp
 
-# Don't build the driver as part of the 'standard' procedure, it has been built
-# by falcosecurity-libs.mk.
-# grpc_cpp_plugin is needed to build falcosecurity libs, so we give the host
-# one there.
-SYSDIG_CONF_OPTS += -DFALCOSECURITY_LIBS_SOURCE_DIR=$(FALCOSECURITY_LIBS_SRCDIR) \
-	-DBUILD_DRIVER=OFF \
-	-DGRPC_CPP_PLUGIN=$(HOST_DIR)/bin/grpc_cpp_plugin \
-	-DDRIVER_NAME=$(FALCOSECURITY_LIBS_DRIVER_NAME) \
-	-DENABLE_DKMS=OFF \
+# The driver is built by falcosecurity-libs, which only supports the
+# kernel module.
+SYSDIG_CONF_OPTS = \
 	-DUSE_BUNDLED_DEPS=OFF \
-	-DWITH_CHISEL=ON \
-	-DVALIJSON_INCLUDE=$(BUILD_DIR)/valijson-0.6/include/valijson \
+	-DCREATE_TEST_TARGETS=OFF \
+	-DBUILD_SYSDIG_MODERN_BPF=OFF \
 	-DSYSDIG_VERSION=$(SYSDIG_VERSION)
 
+# 0001-CMakeLists.txt-allow-to-disable-the-container-plugin.patch
+# The container plugin is either downloaded as a prebuilt binary or
+# built with Go, so it is disabled. It can be provided by a separate
+# package in a following patch.
+SYSDIG_CONF_OPTS += -DBUILD_SYSDIG_CONTAINER_PLUGIN=OFF
+
 $(eval $(cmake-package))

Signature · 6 lines

2.34.1

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

Angelo Compagnucci

author

2026-10-30 15:24 UTC #9 lore raw

PATCH 6/9 package/falcosecurity-libs: convert to a virtual package

In reply to Angelo Compagnucci

Since version 0.11.0, the falcosecurity-libs userspace libraries only support 64-bit architectures, as they get the system call numbers from tables which only exist for them.

In order to provide a different version for 32-bit architectures, convert falcosecurity-libs into a virtual package. For now, it is only provided by falcosecurity-libs-latest, which is the former falcosecurity-libs package, unchanged.

The license, the driver name, the kernel module make options and the Linux kernel configuration fixups, which will be shared by the providers, stay in the virtual package.

Signed-off-by Angelo Compagnucci <[email protected]>

---
 package/falcosecurity-libs/Config.in          | 16 +++--
 ...-pass-ARCH-and-CROSS_COMPILE-to-the-.patch |  0
 ...ver-replace-removed-task_euid-helper.patch |  0
 .../falcosecurity-libs-latest/Config.in       |  9 +++
 .../falcosecurity-libs-latest.hash}           |  0
 .../falcosecurity-libs-latest.mk              | 67 +++++++++++++++++++
 .../falcosecurity-libs/falcosecurity-libs.mk  | 59 ++--------------
 7 files changed, 91 insertions(+), 60 deletions(-)
 rename package/falcosecurity-libs/{ => falcosecurity-libs-latest}/0001-driver-configure-pass-ARCH-and-CROSS_COMPILE-to-the-.patch (100%)
 rename package/falcosecurity-libs/{ => falcosecurity-libs-latest}/0002-fix-driver-replace-removed-task_euid-helper.patch (100%)
 create mode 100644 package/falcosecurity-libs/falcosecurity-libs-latest/Config.in
 rename package/falcosecurity-libs/{falcosecurity-libs.hash => falcosecurity-libs-latest/falcosecurity-libs-latest.hash} (100%)
 create mode 100644 package/falcosecurity-libs/falcosecurity-libs-latest/falcosecurity-libs-latest.mk

package/falcosecurity-libs/Config.in +10 -6

index c73b92d78f..495dd2b8ca 100644
@@ -19,14 +19,18 @@ config BR2_PACKAGE_FALCOSECURITY_LIBS
 	depends on !BR2_STATIC_LIBS # re2, tbb
 	depends on !BR2_TOOLCHAIN_USES_UCLIBC # tbb
 	depends on !BR2_TOOLCHAIN_HAS_GCC_BUG_64735 # tbb
-	select BR2_PACKAGE_JSONCPP
-	select BR2_PACKAGE_RE2
-	select BR2_PACKAGE_TBB
-	select BR2_PACKAGE_UTHASH
-	select BR2_PACKAGE_VALIJSON
-	select BR2_PACKAGE_ZLIB
+	select BR2_PACKAGE_FALCOSECURITY_LIBS_LATEST
 	help
 	  falcosecurity/libs provides libsinsp, libscap, the kernel
 	  module driver and the eBPF driver sources.
 
 	  https://github.com/falcosecurity/libs
+
+config BR2_PACKAGE_HAS_FALCOSECURITY_LIBS
+	bool
+
+config BR2_PACKAGE_PROVIDES_FALCOSECURITY_LIBS
+	string
+	default "falcosecurity-libs-latest"
+
+source "package/falcosecurity-libs/falcosecurity-libs-latest/Config.in"

package/falcosecurity-libs/falcosecurity-libs-latest/0001-driver-configure-pass-ARCH-and-CROSS_COMPILE-to-the-.patch renamed from package/falcosecurity-libs/0001-driver-configure-pass-ARCH-and-CROSS_COMPILE-to-the-.patch +0 -0

similarity index 100%
rename from package/falcosecurity-libs/0001-driver-configure-pass-ARCH-and-CROSS_COMPILE-to-the-.patch
rename to package/falcosecurity-libs/falcosecurity-libs-latest/0001-driver-configure-pass-ARCH-and-CROSS_COMPILE-to-the-.patch

package/falcosecurity-libs/falcosecurity-libs-latest/0002-fix-driver-replace-removed-task_euid-helper.patch renamed from package/falcosecurity-libs/0002-fix-driver-replace-removed-task_euid-helper.patch +0 -0

similarity index 100%
rename from package/falcosecurity-libs/0002-fix-driver-replace-removed-task_euid-helper.patch
rename to package/falcosecurity-libs/falcosecurity-libs-latest/0002-fix-driver-replace-removed-task_euid-helper.patch

package/falcosecurity-libs/falcosecurity-libs-latest/Config.in new file +9 -0

new file mode 100644
index 0000000000..2115e9a928
@@ -0,0 +1,9 @@
+config BR2_PACKAGE_FALCOSECURITY_LIBS_LATEST
+	bool
+	select BR2_PACKAGE_HAS_FALCOSECURITY_LIBS
+	select BR2_PACKAGE_JSONCPP
+	select BR2_PACKAGE_RE2
+	select BR2_PACKAGE_TBB
+	select BR2_PACKAGE_UTHASH
+	select BR2_PACKAGE_VALIJSON
+	select BR2_PACKAGE_ZLIB

package/falcosecurity-libs/falcosecurity-libs-latest/falcosecurity-libs-latest.hash renamed from package/falcosecurity-libs/falcosecurity-libs.hash +0 -0

similarity index 100%
rename from package/falcosecurity-libs/falcosecurity-libs.hash
rename to package/falcosecurity-libs/falcosecurity-libs-latest/falcosecurity-libs-latest.hash

package/falcosecurity-libs/falcosecurity-libs-latest/falcosecurity-libs-latest.mk new file +67 -0

67 lines not on this page · raw message

package/falcosecurity-libs/falcosecurity-libs.mk +5 ~~-54~~

72 lines not on this page · raw message

Signature · 6 lines

2.34.1

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

Thomas Petazzoni via buildroot

2026-11-01 21:33 UTC #10 lore raw

Re: [Buildroot] [PATCH 6/9] package/falcosecurity-libs: convert to a virtual package

Hello Angelo,

Quoted 9 lines · Angelo Compagnucci

Since version 0.11.0, the falcosecurity-libs userspace libraries only support 64-bit architectures, as they get the system call numbers from tables which only exist for them.
In order to provide a different version for 32-bit architectures, convert falcosecurity-libs into a virtual package. For now, it is only provided by falcosecurity-libs-latest, which is the former falcosecurity-libs package, unchanged.

Quoted 5 lines

The license, the driver name, the kernel module make options and the Linux kernel configuration fixups, which will be shared by the providers, stay in the virtual package.
Signed-off-by Angelo Compagnucci <[email protected]>

I'm afraid but this is not really what virtual packages are for. Virtual packages are to support different implementations of the same API (OpenGL, OpenSSL, jpeg, etc.).

In addition, we don't want to support in Buildroot things that are no longer supported upstream, so your proposal to add falcosecurity-libs-legacy and sysdig-legacy will not fly in Buildroot. Those packages would no longer be updated, would no longer receive security updates, etc. This is not something that Buildroot can support.

If support for 32-bit architectures in sysdig is important for you, you need to work with upstream to get back support for these in the latest versions.

Best regards,

Thomas

Signature · 7 lines

Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

Angelo Compagnucci

author

2026-10-30 15:24 UTC #11 lore raw

PATCH 7/9 package/sysdig: convert to a virtual package

In reply to Angelo Compagnucci

sysdig 0.41.4 needs falcosecurity-libs 0.21.0, which only supports 64-bit architectures. In order to provide a different version for 32-bit architectures, convert sysdig into a virtual package, as done for falcosecurity-libs. For now, it is only provided by sysdig-latest, which is the former sysdig package, unchanged.

The license and the CPE vendor, which will be shared by the providers, stay in the virtual package.

Signed-off-by Angelo Compagnucci <[email protected]>

---
 package/sysdig/Config.in                      | 10 +++++
 ...llow-to-disable-the-container-plugin.patch |  0
 ...-only-include-zlib-with-the-bundled-.patch |  0
 package/sysdig/sysdig-latest/Config.in        |  3 ++
 .../sysdig-latest.hash}                       |  0
 package/sysdig/sysdig-latest/sysdig-latest.mk | 40 +++++++++++++++++++
 package/sysdig/sysdig.mk                      | 29 ++------------
 7 files changed, 57 insertions(+), 25 deletions(-)
 rename package/sysdig/{ => sysdig-latest}/0001-CMakeLists.txt-allow-to-disable-the-container-plugin.patch (100%)
 rename package/sysdig/{ => sysdig-latest}/0002-userspace-sysdig-only-include-zlib-with-the-bundled-.patch (100%)
 create mode 100644 package/sysdig/sysdig-latest/Config.in
 rename package/sysdig/{sysdig.hash => sysdig-latest/sysdig-latest.hash} (100%)
 create mode 100644 package/sysdig/sysdig-latest/sysdig-latest.mk

package/sysdig/Config.in +10 -0

index 5dff37251a..35f28bf6cd 100644
@@ -11,6 +11,7 @@ config BR2_PACKAGE_SYSDIG
 	depends on !BR2_TOOLCHAIN_HAS_GCC_BUG_64735 # falcosecurity-libs
 	depends on BR2_PACKAGE_LUAINTERPRETER_ABI_VERSION_5_1 # chisels
 	select BR2_PACKAGE_FALCOSECURITY_LIBS
+	select BR2_PACKAGE_SYSDIG_LATEST
 	select BR2_PACKAGE_NCURSES
 	select BR2_PACKAGE_JSON_FOR_MODERN_CPP
 	select BR2_PACKAGE_YAML_CPP

@@ -31,3 +32,12 @@ comment "sysdig needs a glibc or musl toolchain w/ C++, threads, wchar, gcc >= 1
 		|| BR2_STATIC_LIBS \
 		|| BR2_TOOLCHAIN_USES_UCLIBC \
 		|| !BR2_PACKAGE_LUAINTERPRETER_ABI_VERSION_5_1
+
+config BR2_PACKAGE_HAS_SYSDIG
+	bool
+
+config BR2_PACKAGE_PROVIDES_SYSDIG
+	string
+	default "sysdig-latest"
+
+source "package/sysdig/sysdig-latest/Config.in"

package/sysdig/sysdig-latest/0001-CMakeLists.txt-allow-to-disable-the-container-plugin.patch renamed from package/sysdig/0001-CMakeLists.txt-allow-to-disable-the-container-plugin.patch +0 -0

similarity index 100%
rename from package/sysdig/0001-CMakeLists.txt-allow-to-disable-the-container-plugin.patch
rename to package/sysdig/sysdig-latest/0001-CMakeLists.txt-allow-to-disable-the-container-plugin.patch

package/sysdig/sysdig-latest/0002-userspace-sysdig-only-include-zlib-with-the-bundled-.patch renamed from package/sysdig/0002-userspace-sysdig-only-include-zlib-with-the-bundled-.patch +0 -0

similarity index 100%
rename from package/sysdig/0002-userspace-sysdig-only-include-zlib-with-the-bundled-.patch
rename to package/sysdig/sysdig-latest/0002-userspace-sysdig-only-include-zlib-with-the-bundled-.patch

package/sysdig/sysdig-latest/Config.in new file +3 -0

new file mode 100644
index 0000000000..2af84e1917
@@ -0,0 +1,3 @@
+config BR2_PACKAGE_SYSDIG_LATEST
+	bool
+	select BR2_PACKAGE_HAS_SYSDIG

package/sysdig/sysdig-latest/sysdig-latest.hash renamed from package/sysdig/sysdig.hash +0 -0

similarity index 100%
rename from package/sysdig/sysdig.hash
rename to package/sysdig/sysdig-latest/sysdig-latest.hash

package/sysdig/sysdig-latest/sysdig-latest.mk new file +40 -0

new file mode 100644
index 0000000000..6e0499636c
@@ -0,0 +1,40 @@
+################################################################################
+#
+# sysdig-latest
+#
+################################################################################
+
+SYSDIG_LATEST_VERSION = 0.41.4
+SYSDIG_LATEST_SITE = $(call github,draios,sysdig,$(SYSDIG_LATEST_VERSION))
+SYSDIG_LATEST_SOURCE = sysdig-$(SYSDIG_LATEST_VERSION).tar.gz
+SYSDIG_LATEST_DL_SUBDIR = sysdig
+SYSDIG_LATEST_LICENSE = $(SYSDIG_LICENSE)
+SYSDIG_LATEST_LICENSE_FILES = $(SYSDIG_LICENSE_FILES)
+SYSDIG_LATEST_CPE_ID_VENDOR = $(SYSDIG_CPE_ID_VENDOR)
+SYSDIG_LATEST_CPE_ID_PRODUCT = sysdig
+SYSDIG_LATEST_PROVIDES = sysdig
+SYSDIG_LATEST_SUPPORTS_IN_SOURCE_BUILD = NO
+
+SYSDIG_LATEST_DEPENDENCIES = \
+	falcosecurity-libs \
+	host-pkgconf \
+	json-for-modern-cpp \
+	luainterpreter \
+	ncurses \
+	yaml-cpp
+
+# The driver is built by falcosecurity-libs, which only supports the
+# kernel module.
+SYSDIG_LATEST_CONF_OPTS = \
+	-DUSE_BUNDLED_DEPS=OFF \
+	-DCREATE_TEST_TARGETS=OFF \
+	-DBUILD_SYSDIG_MODERN_BPF=OFF \
+	-DSYSDIG_VERSION=$(SYSDIG_LATEST_VERSION)
+
+# 0001-CMakeLists.txt-allow-to-disable-the-container-plugin.patch
+# The container plugin is either downloaded as a prebuilt binary or
+# built with Go, so it is disabled. It can be provided by a separate
+# package in a following patch.
+SYSDIG_LATEST_CONF_OPTS += -DBUILD_SYSDIG_CONTAINER_PLUGIN=OFF
+
+$(eval $(cmake-package))

package/sysdig/sysdig.mk +4 ~~-25~~

index d04f67a97b..3ee54a556b 100644
@@ -4,33 +4,12 @@
 #
 ################################################################################
 
-SYSDIG_VERSION = 0.41.4
-SYSDIG_SITE = $(call github,draios,sysdig,$(SYSDIG_VERSION))
+# sysdig is provided by sysdig-latest.
+
 SYSDIG_LICENSE = Apache-2.0
 SYSDIG_LICENSE_FILES = COPYING
 SYSDIG_CPE_ID_VENDOR = sysdig
-SYSDIG_SUPPORTS_IN_SOURCE_BUILD = NO
-
-SYSDIG_DEPENDENCIES = \
-	falcosecurity-libs \
-	host-pkgconf \
-	json-for-modern-cpp \
-	luainterpreter \
-	ncurses \
-	yaml-cpp
-
-# The driver is built by falcosecurity-libs, which only supports the
-# kernel module.
-SYSDIG_CONF_OPTS = \
-	-DUSE_BUNDLED_DEPS=OFF \
-	-DCREATE_TEST_TARGETS=OFF \
-	-DBUILD_SYSDIG_MODERN_BPF=OFF \
-	-DSYSDIG_VERSION=$(SYSDIG_VERSION)
 
-# 0001-CMakeLists.txt-allow-to-disable-the-container-plugin.patch
-# The container plugin is either downloaded as a prebuilt binary or
-# built with Go, so it is disabled. It can be provided by a separate
-# package in a following patch.
-SYSDIG_CONF_OPTS += -DBUILD_SYSDIG_CONTAINER_PLUGIN=OFF
+$(eval $(virtual-package))
 
-$(eval $(cmake-package))
+include $(sort $(wildcard package/sysdig/*/*.mk))

Signature · 6 lines

2.34.1

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

Angelo Compagnucci

author

2026-10-30 15:25 UTC #12 lore raw

PATCH 8/9 package/falcosecurity-libs: add falcosecurity-libs-legacy

In reply to Angelo Compagnucci

Add falcosecurity-libs-legacy, providing falcosecurity-libs 0.10.5 on 32-bit architectures. It is the last version whose userspace libraries support them, as they get the system call numbers from the C library headers, instead of tables which only exist for 64-bit architectures.

Like the former falcosecurity-libs package, falcosecurity-libs-legacy only provides the sources of the userspace libraries, which are built by sysdig, with the dependencies listed here, and builds the kernel module, generating its Makefile and driver_config.h, as the driver CMakeLists.txt doesn't work well with the kernel-module infrastructure. The driver API and schema versions are read from driver/API_VERSION and driver/SCHEMA_VERSION.

The dependencies are the ones of the minimal build, which will be used by sysdig, so grpc, protobuf, c-ares, libcurl, openssl and elfutils are not needed.

Patches:
- backport the upstream fixes adding the missing <cstdint> includes, for gcc >= 13 and musl
- add the missing <cstdint> include to scap_open_exception.h, for musl

falcosecurity-libs-legacy can't be selected yet: the 32-bit architectures are enabled when adding sysdig-legacy, in the following commit.

Signed-off-by Angelo Compagnucci <[email protected]>

---
 package/falcosecurity-libs/Config.in          |  9 ++--
 .../falcosecurity-libs-latest/Config.in       |  2 +
 .../0001-Add-cstdint-for-uintXX_t-types.patch | 46 +++++++++++++++++
 ...bsinsp-explicitly-include-cstdint-to.patch | 31 ++++++++++++
 ...tdint-include-to-fix-build-on-Alpine.patch | 27 ++++++++++
 ...sp-scap_open_exception.h-include-cst.patch | 32 ++++++++++++
 .../falcosecurity-libs-legacy/Config.in       | 12 +++++
 .../falcosecurity-libs-legacy.hash            |  5 ++
 .../falcosecurity-libs-legacy.mk              | 50 +++++++++++++++++++
 .../falcosecurity-libs/falcosecurity-libs.mk  |  5 +-
 10 files changed, 215 insertions(+), 4 deletions(-)
 create mode 100644 package/falcosecurity-libs/falcosecurity-libs-legacy/0001-Add-cstdint-for-uintXX_t-types.patch
 create mode 100644 package/falcosecurity-libs/falcosecurity-libs-legacy/0002-fix-userspace-libsinsp-explicitly-include-cstdint-to.patch
 create mode 100644 package/falcosecurity-libs/falcosecurity-libs-legacy/0003-fix-missing-cstdint-include-to-fix-build-on-Alpine.patch
 create mode 100644 package/falcosecurity-libs/falcosecurity-libs-legacy/0004-userspace-libsinsp-scap_open_exception.h-include-cst.patch
 create mode 100644 package/falcosecurity-libs/falcosecurity-libs-legacy/Config.in
 create mode 100644 package/falcosecurity-libs/falcosecurity-libs-legacy/falcosecurity-libs-legacy.hash
 create mode 100644 package/falcosecurity-libs/falcosecurity-libs-legacy/falcosecurity-libs-legacy.mk

package/falcosecurity-libs/Config.in +6 -3

index 495dd2b8ca..079dc1f376 100644
@@ -15,11 +15,12 @@ config BR2_PACKAGE_FALCOSECURITY_LIBS
 	depends on BR2_LINUX_KERNEL
 	depends on BR2_INSTALL_LIBSTDCPP # jsoncpp, re2, tbb, valijson
 	depends on BR2_TOOLCHAIN_GCC_AT_LEAST_10 # re2
-	depends on BR2_TOOLCHAIN_HAS_THREADS # re2, tbb
+	depends on BR2_TOOLCHAIN_HAS_THREADS # jq, re2, tbb
 	depends on !BR2_STATIC_LIBS # re2, tbb
 	depends on !BR2_TOOLCHAIN_USES_UCLIBC # tbb
 	depends on !BR2_TOOLCHAIN_HAS_GCC_BUG_64735 # tbb
-	select BR2_PACKAGE_FALCOSECURITY_LIBS_LATEST
+	select BR2_PACKAGE_FALCOSECURITY_LIBS_LATEST if BR2_ARCH_IS_64
+	select BR2_PACKAGE_FALCOSECURITY_LIBS_LEGACY if !BR2_ARCH_IS_64
 	help
 	  falcosecurity/libs provides libsinsp, libscap, the kernel
 	  module driver and the eBPF driver sources.

@@ -31,6 +32,8 @@ config BR2_PACKAGE_HAS_FALCOSECURITY_LIBS
 
 config BR2_PACKAGE_PROVIDES_FALCOSECURITY_LIBS
 	string
-	default "falcosecurity-libs-latest"
+	default "falcosecurity-libs-latest" if BR2_PACKAGE_FALCOSECURITY_LIBS_LATEST
+	default "falcosecurity-libs-legacy" if BR2_PACKAGE_FALCOSECURITY_LIBS_LEGACY
 
 source "package/falcosecurity-libs/falcosecurity-libs-latest/Config.in"
+source "package/falcosecurity-libs/falcosecurity-libs-legacy/Config.in"

package/falcosecurity-libs/falcosecurity-libs-latest/Config.in +2 -0

index 2115e9a928..b020146107 100644
@@ -1,3 +1,5 @@
+# falcosecurity-libs for 64-bit architectures, selected by
+# BR2_PACKAGE_FALCOSECURITY_LIBS
 config BR2_PACKAGE_FALCOSECURITY_LIBS_LATEST
 	bool
 	select BR2_PACKAGE_HAS_FALCOSECURITY_LIBS

package/falcosecurity-libs/falcosecurity-libs-legacy/0001-Add-cstdint-for-uintXX_t-types.patch new file +46 -0

46 lines not on this page · raw message

package/falcosecurity-libs/falcosecurity-libs-legacy/0002-fix-userspace-libsinsp-explicitly-include-cstdint-to.patch new file +31 -0

new file mode 100644
index 0000000000..6cfd263853
@@ -0,0 +1,31 @@
+From 428a2cc72d8c0cc138808f019b834b69c3f54f06 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Holger=20Hoffst=C3=A4tte?= <[email protected]>
+Date: Tue, 20 Aug 2024 12:22:01 +0200
+Subject: [PATCH] fix(userspace/libsinsp): explicitly include <cstdint> to fix
+ build with gcc-15
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Holger Hoffstätte <[email protected]>
+Upstream: https://github.com/falcosecurity/libs/commit/9d76298020e9dbde6b5d8e4f36b17c1ad6a4a4c7
+Signed-off-by: Angelo Compagnucci <[email protected]>
+---
+ userspace/libsinsp/filter/ast.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/userspace/libsinsp/filter/ast.h b/userspace/libsinsp/filter/ast.h
+index ad9060e..73fce2e 100644
+--- a/userspace/libsinsp/filter/ast.h
++++ b/userspace/libsinsp/filter/ast.h
+@@ -17,6 +17,7 @@ limitations under the License.
+ 
+ #pragma once
+ 
++#include <cstdint>
+ #include <vector>
+ #include <string>
+ #include <algorithm>
+-- 
+2.34.1
+

package/falcosecurity-libs/falcosecurity-libs-legacy/0003-fix-missing-cstdint-include-to-fix-build-on-Alpine.patch new file +27 -0

new file mode 100644
index 0000000000..6cf29aa8df
@@ -0,0 +1,27 @@
+From 911bdda4f2ca69135b98dd11fdc40123ee83fb8f Mon Sep 17 00:00:00 2001
+From: Stefan Reimer <[email protected]>
+Date: Mon, 11 Mar 2024 16:45:55 +0000
+Subject: [PATCH] fix: missing cstdint include to fix build on Alpine
+
+Signed-off-by: Stefan Reimer <[email protected]>
+Upstream: https://github.com/falcosecurity/libs/commit/2514b509ac873102b9266586e458c2f732ca9485
+Signed-off-by: Angelo Compagnucci <[email protected]>
+---
+ userspace/libsinsp/procfs_utils.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/userspace/libsinsp/procfs_utils.h b/userspace/libsinsp/procfs_utils.h
+index 4059d4d..1df956e 100644
+--- a/userspace/libsinsp/procfs_utils.h
++++ b/userspace/libsinsp/procfs_utils.h
+@@ -1,6 +1,7 @@
+ #pragma once
+ 
+ #include <istream>
++#include <cstdint>
+ #include <string>
+ 
+ namespace libsinsp {
+-- 
+2.34.1
+

package/falcosecurity-libs/falcosecurity-libs-legacy/0004-userspace-libsinsp-scap_open_exception.h-include-cst.patch new file +32 -0

new file mode 100644
index 0000000000..291694bf33
@@ -0,0 +1,32 @@
+From c732d3db36a617d3a335cd42d94e78c5ac5cfcc9 Mon Sep 17 00:00:00 2001
+From: Angelo Compagnucci <[email protected]>
+Date: Fri, 30 Oct 2026 13:25:57 +0100
+Subject: [PATCH] userspace/libsinsp: scap_open_exception.h: include <cstdint>
+
+scap_open_exception.h uses int32_t without including <cstdint>, which
+fails to build with musl, where it isn't included by other headers:
+
+  scap_open_exception.h:28:65: error: 'int32_t' does not name a type
+
+Upstream: https://github.com/falcosecurity/libs/pull/3154
+Signed-off-by: Angelo Compagnucci <[email protected]>
+---
+ userspace/libsinsp/scap_open_exception.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/userspace/libsinsp/scap_open_exception.h b/userspace/libsinsp/scap_open_exception.h
+index 6877456..1614da9 100644
+--- a/userspace/libsinsp/scap_open_exception.h
++++ b/userspace/libsinsp/scap_open_exception.h
+@@ -16,6 +16,8 @@ limitations under the License.
+ */
+ #pragma once
+ 
++#include <cstdint>
++
+ #include "sinsp_exception.h"
+ 
+ /*!
+-- 
+2.34.1
+

package/falcosecurity-libs/falcosecurity-libs-legacy/Config.in new file +12 -0

new file mode 100644
index 0000000000..546e8183a8
@@ -0,0 +1,12 @@
+# falcosecurity-libs for 32-bit architectures, selected by
+# BR2_PACKAGE_FALCOSECURITY_LIBS
+config BR2_PACKAGE_FALCOSECURITY_LIBS_LEGACY
+	bool
+	select BR2_PACKAGE_HAS_FALCOSECURITY_LIBS
+	select BR2_PACKAGE_JQ
+	select BR2_PACKAGE_JSONCPP
+	select BR2_PACKAGE_LIBB64
+	select BR2_PACKAGE_RE2
+	select BR2_PACKAGE_TBB
+	select BR2_PACKAGE_VALIJSON
+	select BR2_PACKAGE_ZLIB

package/falcosecurity-libs/falcosecurity-libs-legacy/falcosecurity-libs-legacy.hash new file +5 -0

new file mode 100644
index 0000000000..ef805cbcf6
@@ -0,0 +1,5 @@
+# sha256 locally computed
+sha256  2a4b37c08bec4ba81326314831f341385aff267062e8d4483437958689662936  falcosecurity-libs-0.10.5.tar.gz
+sha256  21ec9433a87459b3477faf542bacec419dc03af841309eac35edeffe481cf10b  COPYING
+sha256  8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643  driver/GPL2.txt
+sha256  f17d3f2c2d565a74a7d5bf96f880c43701e141897e8dff0c8aa13e5d07aaf226  driver/MIT.txt

package/falcosecurity-libs/falcosecurity-libs-legacy/falcosecurity-libs-legacy.mk new file +50 -0

50 lines not on this page · raw message

package/falcosecurity-libs/falcosecurity-libs.mk +4 -1

index 0437648383..f4303a3cdd 100644
@@ -4,7 +4,10 @@
 #
 ################################################################################
 
-# falcosecurity-libs is provided by falcosecurity-libs-latest.
+# Since version 0.11.0, the userspace libraries only support 64-bit
+# architectures: falcosecurity-libs-latest provides falcosecurity-libs on
+# them, and falcosecurity-libs-legacy, the last version supporting
+# 32-bit architectures, on the others.
 
 FALCOSECURITY_LIBS_LICENSE = Apache-2.0 (userspace), MIT or GPL-2.0 (driver)
 FALCOSECURITY_LIBS_LICENSE_FILES = COPYING driver/MIT.txt driver/GPL2.txt

Signature · 6 lines

2.34.1

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

Angelo Compagnucci

author

2026-10-30 15:25 UTC #13 lore raw

PATCH 9/9 package/sysdig: add sysdig-legacy

In reply to Angelo Compagnucci

Add sysdig-legacy, providing sysdig 0.31.5 on 32-bit architectures. It is the last version using falcosecurity-libs 0.10.5, provided by falcosecurity-libs-legacy, and the 32-bit architectures are now enabled in falcosecurity-libs.

sysdig-legacy builds the userspace libraries from the falcosecurity-libs-legacy sources and links them statically, as it doesn't install them.

To keep the build small, it uses the minimal build, which doesn't support Kubernetes, Mesos, the container metadata and the eBPF probe, so it doesn't need grpc, protobuf, c-ares, libcurl, openssl and elfutils. The full build can be enabled in a following patch.

The libsinsp examples are not built, as they are not needed and fail to build with musl.

Patches: backport the upstream switch to C++17, as needed by the libabseil-cpp headers included by re2.

Signed-off-by Angelo Compagnucci <[email protected]>

---
 package/falcosecurity-libs/Config.in          |  3 +
 package/sysdig/Config.in                      |  7 ++-
 package/sysdig/sysdig-latest/Config.in        |  1 +
 .../0001-CMakeLists.txt-build-with-C-17.patch | 33 +++++++++++
 package/sysdig/sysdig-legacy/Config.in        |  4 ++
 .../sysdig/sysdig-legacy/sysdig-legacy.hash   |  3 +
 package/sysdig/sysdig-legacy/sysdig-legacy.mk | 56 +++++++++++++++++++
 package/sysdig/sysdig.mk                      |  4 +-
 8 files changed, 108 insertions(+), 3 deletions(-)
 create mode 100644 package/sysdig/sysdig-legacy/0001-CMakeLists.txt-build-with-C-17.patch
 create mode 100644 package/sysdig/sysdig-legacy/Config.in
 create mode 100644 package/sysdig/sysdig-legacy/sysdig-legacy.hash
 create mode 100644 package/sysdig/sysdig-legacy/sysdig-legacy.mk

package/falcosecurity-libs/Config.in +3 -0

index 079dc1f376..a897cadd90 100644
@@ -1,11 +1,14 @@
 config BR2_PACKAGE_FALCOSECURITY_LIBS_ARCH_SUPPORTS
 	bool
+	# falcosecurity-libs-latest
 	default y if BR2_aarch64
 	default y if BR2_loongarch64
 	default y if BR2_powerpc64le
 	default y if BR2_riscv && BR2_ARCH_IS_64
 	default y if BR2_s390x
 	default y if BR2_x86_64
+	# falcosecurity-libs-legacy
+	default y if !BR2_ARCH_IS_64
 	depends on BR2_PACKAGE_LIBABSEIL_CPP_ARCH_SUPPORTS # re2
 
 config BR2_PACKAGE_FALCOSECURITY_LIBS

package/sysdig/Config.in +5 -2

index 35f28bf6cd..f00f6c4762 100644
@@ -11,7 +11,8 @@ config BR2_PACKAGE_SYSDIG
 	depends on !BR2_TOOLCHAIN_HAS_GCC_BUG_64735 # falcosecurity-libs
 	depends on BR2_PACKAGE_LUAINTERPRETER_ABI_VERSION_5_1 # chisels
 	select BR2_PACKAGE_FALCOSECURITY_LIBS
-	select BR2_PACKAGE_SYSDIG_LATEST
+	select BR2_PACKAGE_SYSDIG_LATEST if BR2_ARCH_IS_64
+	select BR2_PACKAGE_SYSDIG_LEGACY if !BR2_ARCH_IS_64
 	select BR2_PACKAGE_NCURSES
 	select BR2_PACKAGE_JSON_FOR_MODERN_CPP
 	select BR2_PACKAGE_YAML_CPP

@@ -38,6 +39,8 @@ config BR2_PACKAGE_HAS_SYSDIG
 
 config BR2_PACKAGE_PROVIDES_SYSDIG
 	string
-	default "sysdig-latest"
+	default "sysdig-latest" if BR2_PACKAGE_SYSDIG_LATEST
+	default "sysdig-legacy" if BR2_PACKAGE_SYSDIG_LEGACY
 
 source "package/sysdig/sysdig-latest/Config.in"
+source "package/sysdig/sysdig-legacy/Config.in"

package/sysdig/sysdig-latest/Config.in +1 -0

index 2af84e1917..5cbb10f5fb 100644
@@ -1,3 +1,4 @@
+# sysdig for 64-bit architectures, selected by BR2_PACKAGE_SYSDIG
 config BR2_PACKAGE_SYSDIG_LATEST
 	bool
 	select BR2_PACKAGE_HAS_SYSDIG

package/sysdig/sysdig-legacy/0001-CMakeLists.txt-build-with-C-17.patch new file +33 -0

new file mode 100644
index 0000000000..d033e0eddb
@@ -0,0 +1,33 @@
+From 1b544d328d0afbde2f1443a3f4cb1ef332d65592 Mon Sep 17 00:00:00 2001
+From: Roberto Scolaro <[email protected]>
+Date: Mon, 5 Jun 2023 12:41:02 +0200
+Subject: [PATCH] CMakeLists.txt: build with C++17
+
+Abseil, used by re2, needs C++17.
+
+This is the C++ standard part of the upstream commit bumping the
+falcosecurity libs to version 0.11.0.
+
+Upstream: https://github.com/draios/sysdig/commit/954e6fc6238f21d4870a491395d68a7dd3062aa9
+[Angelo: only keep the C++ standard change]
+Signed-off-by: Angelo Compagnucci <[email protected]>
+---
+ CMakeLists.txt | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 0309d66..cadca83 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -90,7 +90,7 @@ if(NOT WIN32)
+ 	endif()
+ 
+ 	set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} ${CMAKE_COMMON_FLAGS}")
+-	set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} ${CMAKE_COMMON_FLAGS} -std=c++0x")
++	set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} ${CMAKE_COMMON_FLAGS} -std=c++17")
+ 
+ 	set(CMAKE_C_FLAGS_DEBUG "${SYSDIG_DEBUG_FLAGS}")
+ 	set(CMAKE_CXX_FLAGS_DEBUG "${SYSDIG_DEBUG_FLAGS}")
+-- 
+2.34.1
+

package/sysdig/sysdig-legacy/Config.in new file +4 -0

new file mode 100644
index 0000000000..dc485a0fba
@@ -0,0 +1,4 @@
+# sysdig for 32-bit architectures, selected by BR2_PACKAGE_SYSDIG
+config BR2_PACKAGE_SYSDIG_LEGACY
+	bool
+	select BR2_PACKAGE_HAS_SYSDIG

package/sysdig/sysdig-legacy/sysdig-legacy.hash new file +3 -0

new file mode 100644
index 0000000000..efdd73b201
@@ -0,0 +1,3 @@
+# sha256 locally computed
+sha256  9af98cae7c38273f7429ba0df628c9745bd92c949f444e180b9dd800af14c6dd  sysdig-0.31.5.tar.gz
+sha256  a88fbf820b38b1c7fabc6efe291b8259e02ae21326f56fe31c6c9adf374b2702  COPYING

package/sysdig/sysdig-legacy/sysdig-legacy.mk new file +56 -0

56 lines not on this page · raw message

package/sysdig/sysdig.mk +3 -1

index 3ee54a556b..4bd40f51a2 100644
@@ -4,7 +4,9 @@
 #
 ################################################################################
 
-# sysdig is provided by sysdig-latest.
+# sysdig-latest provides sysdig on 64-bit architectures, and
+# sysdig-legacy, the last version supporting 32-bit architectures, on
+# the others, see falcosecurity-libs.
 
 SYSDIG_LICENSE = Apache-2.0
 SYSDIG_LICENSE_FILES = COPYING

Signature · 6 lines

2.34.1

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

Fiona Klute via buildroot

2026-10-30 15:59 UTC #14 lore raw

In reply to Angelo Compagnucci

Hi Angleo,

when you send a new version of a patch (or series) you sent before, please make sure to set the version when generating the patches (git format-patch -v N), and note the changes between the two in the patch notes (and cover letter, if any). It's confusing if there are two (or more) patches with identical titles in the mailbox.

Best regards,
Fiona

Am 30.10.26 um 16:24 schrieb Angelo Compagnucci:

Quoted 94 lines

uthash is a set of C macros implementing hash tables, linked lists, dynamic arrays and other data structures, provided as headers only.

It is needed by falcosecurity-libs, which otherwise downloads uthash.h at build time.

Signed-off-by Angelo Compagnucci <[email protected]>

---
  DEVELOPERS                 |  1 +
  package/Config.in          |  1 +
  package/sysdig/Config.in   |  2 +-
  package/uthash/Config.in   |  8 ++++++++
  package/uthash/uthash.hash |  3 +++
  package/uthash/uthash.mk   | 19 +++++++++++++++++++
  6 files changed, 33 insertions(+), 1 deletion(-)

create mode 100644 package/uthash/Config.in
create mode 100644 package/uthash/uthash.hash
create mode 100644 package/uthash/uthash.mk

DEVELOPERS +1 -0

index b4ada4e1f9..8ca72bec84 100644
@@ -261,6 +261,7 @@ F:	package/sam-ba/
  F:	package/sshguard/
  F:	package/sunwait/
  F:	package/sysdig/
+F:	package/uthash/
 
  N:	Andy Shevchenko <[email protected]>
  F:	package/fb-test-app/

package/Config.in +1 -0

index 796c4f1ad6..02932e5ac1 100644
@@ -2323,6 +2323,7 @@ endif
  	source "package/tllist/Config.in"
  	source "package/tz/Config.in"
  	source "package/tzdata/Config.in"
+	source "package/uthash/Config.in"
  	source "package/uvw/Config.in"
  	source "package/volk/Config.in"
  	source "package/xapian/Config.in"

package/sysdig/Config.in +1 -1

index 73ac03e240..038a9734aa 100644
@@ -24,7 +24,7 @@ config BR2_PACKAGE_SYSDIG
 
  	  https://github.com/draios/sysdig/wiki
 
-comment "sysdig needs a glibc toolchain w/ C++, threads, wchar, gcc >= 10, dynamic library, a Linux kernel, and luajit or lua 5.1 to be built"
+comment "sysdig needs a glibc or musl toolchain w/ C++, threads, wchar, gcc >= 10, dynamic library, a Linux kernel, and luajit or lua 5.1 to be built"
  	depends on BR2_PACKAGE_LIBABSEIL_CPP_ARCH_SUPPORTS
  	depends on BR2_PACKAGE_PROTOBUF_ARCH_SUPPORTS
  	depends on BR2_TOOLCHAIN_HAS_SYNC_4 || BR2_TOOLCHAIN_HAS_ATOMIC

package/uthash/Config.in new file +8 -0

new file mode 100644
index 0000000000..e19c277abd
@@ -0,0 +1,8 @@
+config BR2_PACKAGE_UTHASH
+	bool "uthash"
+	help
+	  uthash is a set of C macros implementing hash tables, linked
+	  lists, dynamic arrays and other data structures, provided as
+	  headers only.
+
+	  https://troydhanson.github.io/uthash/

package/uthash/uthash.hash new file +3 -0

new file mode 100644
index 0000000000..37a5a66aba
@@ -0,0 +1,3 @@
+# Locally computed
+sha256  387ba027946d7c64e9aa19cc53b2edcd714f8f9dca9fa8e3aaef17e0e8e3d736  uthash-2.4.0.tar.gz
+sha256  40f48f89e1d0095bf1c5fb4d00affd74959c3ff77463b672cf7fac547d1d6465  LICENSE

package/uthash/uthash.mk new file +9 -0

new file mode 100644
index 0000000000..2107a90d56
@@ -0,0 +1,19 @@
+################################################################################
+#
+# uthash
+#
+################################################################################
+
+UTHASH_VERSION = 2.4.0
+UTHASH_SITE = $(call github,troydhanson,uthash,v$(UTHASH_VERSION))
+UTHASH_LICENSE = BSD-1-Clause

package/uthash/uthash.mk line 19

Quoted 10 lines

package/uthash/uthash.mk new file +10 -0

+UTHASH_LICENSE_FILES = LICENSE
+UTHASH_INSTALL_STAGING = YES
+UTHASH_INSTALL_TARGET = NO
+
+define UTHASH_INSTALL_STAGING_CMDS
+	$(INSTALL) -d $(STAGING_DIR)/usr/include
+	$(INSTALL) -m 0644 $(@D)/src/*.h $(STAGING_DIR)/usr/include
+endef
+
+$(eval $(generic-package))

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

Thomas Petazzoni via buildroot

Applied

2026-11-01 21:26 UTC #15 lore raw

In reply to Angelo Compagnucci

Quoted 11 lines · Angelo Compagnucci

uthash is a set of C macros implementing hash tables, linked lists, dynamic arrays and other data structures, provided as headers only.
It is needed by falcosecurity-libs, which otherwise downloads uthash.h at build time.
Signed-off-by Angelo Compagnucci <[email protected]>
---
 DEVELOPERS                 |  1 +
 package/Config.in          |  1 +
 package/sysdig/Config.in   |  2 +-

This change was not related to this patch, so I removed it.

Quoted 7 lines

 package/uthash/Config.in   |  8 ++++++++
 package/uthash/uthash.hash |  3 +++
 package/uthash/uthash.mk   | 19 +++++++++++++++++++
 6 files changed, 33 insertions(+), 1 deletion(-)
 create mode 100644 package/uthash/Config.in
 create mode 100644 package/uthash/uthash.hash
 create mode 100644 package/uthash/uthash.mk

Applied to master. Thanks!

Thomas

Signature · 7 lines

Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

Angelo Compagnucci

author

2026-11-02 08:54 UTC #16 lore raw

v2 cover Bump sysdig to version 0.41.4

In reply to Angelo Compagnucci

This series bumps sysdig to version 0.41.4 and falcosecurity-libs to version 0.21.0, which now only support 64-bit architectures and can be built with both glibc and musl.

The patches not merged upstream yet have been submitted:
- https://github.com/falcosecurity/libs/pull/3153
- https://github.com/draios/sysdig/pull/2190
- https://github.com/draios/sysdig/pull/2191

Changes v1 -> v2:
- drop the legacy support (falcosecurity-libs and sysdig as virtual

    packages, with the 0.10.5/0.31.5 providers for 32-bit
    architectures) [Thomas]

- uthash, the webrtc-audio-processing musl fix and the libabseil-cpp musl support are merged, so they are dropped from the series
- fix the kernel module build on riscv64 [Thomas]
- move the lua dependency change to the sysdig bump [Thomas]
- sysdig needs luajit or lua >= 5.3, lua 5.1 lacks luaL_setfuncs()

Build tested:
- aarch64 glibc, Linux 7.3
- riscv64 musl, Linux 6.18, lua 5.4
and run with qemu-user (sysdig --version, sysdig -cl).

Angelo Compagnucci (2):
package/falcosecurity-libs: bump to version 0.21.0 package/sysdig: bump to version 0.41.4

 .checkpackageignore                           |  1 -
 ...cmake-Permit-setting-GRPC_CPP_PLUGIN.patch | 34 -------
 ...-pass-ARCH-and-CROSS_COMPILE-to-the-.patch | 38 +++++++
 ...ver-replace-removed-task_euid-helper.patch | 33 +++++++
 ...gure-pass-a-user-pointer-to-access_o.patch | 43 ++++++++
 package/falcosecurity-libs/Config.in          | 39 ++++----
 .../falcosecurity-libs.hash                   |  4 +-
 .../falcosecurity-libs/falcosecurity-libs.mk  | 98 +++++++++----------
 ...llow-to-disable-the-container-plugin.patch | 37 +++++++
 ...-only-include-zlib-with-the-bundled-.patch | 43 ++++++++
 package/sysdig/Config.in                      | 28 +++---
 package/sysdig/sysdig.hash                    |  2 +-
 package/sysdig/sysdig.mk                      | 32 +++---
 13 files changed, 293 insertions(+), 139 deletions(-)
 delete mode 100644 package/falcosecurity-libs/0001-cmake-Permit-setting-GRPC_CPP_PLUGIN.patch
 create mode 100644 package/falcosecurity-libs/0001-driver-configure-pass-ARCH-and-CROSS_COMPILE-to-the-.patch
 create mode 100644 package/falcosecurity-libs/0002-fix-driver-replace-removed-task_euid-helper.patch
 create mode 100644 package/falcosecurity-libs/0003-fix-driver-configure-pass-a-user-pointer-to-access_o.patch
 create mode 100644 package/sysdig/0001-CMakeLists.txt-allow-to-disable-the-container-plugin.patch
 create mode 100644 package/sysdig/0002-userspace-sysdig-only-include-zlib-with-the-bundled-.patch

Signature · 6 lines

2.34.1

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

Angelo Compagnucci

author

2026-11-02 08:54 UTC #17 lore raw

PATCH v2 1/2 package/falcosecurity-libs: bump to version 0.21.0

falcosecurity-libs now only supports 64-bit architectures (x86_64, aarch64, s390x, riscv64, ppc64le and loongarch64), as the syscall tables only exist for them.

Patches:
- 0001 is dropped, as grpc is not used anymore
- pass ARCH and CROSS_COMPILE to the configure modules used to detect the kernel features, otherwise they are built for the build machine and the kernel module build fails
- backport the upstream fix for Linux 7.3
- fix the access_ok() configure test on riscv64, where access_ok() needs a pointer, otherwise the kernel module fails to build

sysdig 0.29.3 can't be built with this version, it is bumped to 0.41.4, which needs falcosecurity-libs 0.21.0, in the following commit.

Release notes:
https://github.com/falcosecurity/libs/releases/tag/0.21.0

Signed-off-by Angelo Compagnucci <[email protected]>

---
Changes v1 -> v2:
- add patch 0003, fixing the kernel module build on riscv64 [Thomas]
- leave the sysdig lua dependency to the sysdig bump [Thomas]
- also update the sysdig Config.in comment, previously done by mistake in the uthash patch

---
 .checkpackageignore                           |  1 -
 ...cmake-Permit-setting-GRPC_CPP_PLUGIN.patch | 34 -------
 ...-pass-ARCH-and-CROSS_COMPILE-to-the-.patch | 38 +++++++
 ...ver-replace-removed-task_euid-helper.patch | 33 +++++++
 ...gure-pass-a-user-pointer-to-access_o.patch | 43 ++++++++
 package/falcosecurity-libs/Config.in          | 39 ++++----
 .../falcosecurity-libs.hash                   |  4 +-
 .../falcosecurity-libs/falcosecurity-libs.mk  | 98 +++++++++----------
 package/sysdig/Config.in                      | 21 ++--
 9 files changed, 193 insertions(+), 118 deletions(-)
 delete mode 100644 package/falcosecurity-libs/0001-cmake-Permit-setting-GRPC_CPP_PLUGIN.patch
 create mode 100644 package/falcosecurity-libs/0001-driver-configure-pass-ARCH-and-CROSS_COMPILE-to-the-.patch
 create mode 100644 package/falcosecurity-libs/0002-fix-driver-replace-removed-task_euid-helper.patch
 create mode 100644 package/falcosecurity-libs/0003-fix-driver-configure-pass-a-user-pointer-to-access_o.patch

.checkpackageignore +0 -1

index a8c1baacbd..662d454f29 100644
@@ -310,7 +310,6 @@ package/exim/0003-Skip-version-check-and-symlink-installation.patch lib_patch.Up
 package/exim/S86exim lib_sysv.Indent lib_sysv.Variables
 package/fail2ban/S60fail2ban Shellcheck lib_sysv.Variables
 package/fakedate/fakedate Shellcheck
-package/falcosecurity-libs/0001-cmake-Permit-setting-GRPC_CPP_PLUGIN.patch lib_patch.Upstream
 package/fbgrab/0001-fix-static-build.patch lib_patch.Upstream
 package/fbset/0001-Fix-musl-compile.patch lib_patch.Upstream
 package/fbterm/0001-fbio.cpp-improxy.cpp-fbterm.cpp-fix-musl-compile.patch lib_patch.Upstream

package/falcosecurity-libs/0001-cmake-Permit-setting-GRPC_CPP_PLUGIN.patch deleted +0 ~~-34~~

deleted file mode 100644
index 6141d8ef72..0000000000
@@ -1,34 +0,0 @@
-From 2e8a50cd4975df3ab60ee07c9675831cd5ad397f Mon Sep 17 00:00:00 2001
-From: Francis Laniel <[email protected]>
-Date: Tue, 12 Apr 2022 19:54:11 +0100
-Subject: [PATCH] cmake: Permit setting GRPC_CPP_PLUGIN.
-
-This patch enables users to set GRPC_CPP_PLUGIN while calling cmake with:
-cmake -DGRPC_CPP_PLUGIN=/path
-
-Signed-off-by: Francis Laniel <[email protected]>
----
- cmake/modules/grpc.cmake | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/cmake/modules/grpc.cmake b/cmake/modules/grpc.cmake
-index e5fd16b8..9d8f5934 100644
---- a/cmake/modules/grpc.cmake
-+++ b/cmake/modules/grpc.cmake
-@@ -12,9 +12,11 @@ elseif(NOT USE_BUNDLED_GRPC)
- 		set(GRPCPP_LIB gRPC::grpc++)
- 
- 		# gRPC C++ plugin
--		get_target_property(GRPC_CPP_PLUGIN gRPC::grpc_cpp_plugin LOCATION)
- 		if(NOT GRPC_CPP_PLUGIN)
--			message(FATAL_ERROR "System grpc_cpp_plugin not found")
-+			get_target_property(GRPC_CPP_PLUGIN gRPC::grpc_cpp_plugin LOCATION)
-+			if(NOT GRPC_CPP_PLUGIN)
-+				message(FATAL_ERROR "System grpc_cpp_plugin not found")
-+			endif()
- 		endif()
- 
- 		# gRPC include dir + properly handle grpc{++,pp}
--- 
-2.25.1
-

package/falcosecurity-libs/0001-driver-configure-pass-ARCH-and-CROSS_COMPILE-to-the-.patch new file +38 -0

new file mode 100644
index 0000000000..13b68d5569
@@ -0,0 +1,38 @@
+From fef2154ea3ce5e95af90bf35f7f062762362a3a9 Mon Sep 17 00:00:00 2001
+From: Angelo Compagnucci <[email protected]>
+Date: Fri, 30 Oct 2026 14:18:02 +0100
+Subject: [PATCH] driver: configure: pass ARCH and CROSS_COMPILE to the
+ configure modules
+
+The configure modules are built with an empty environment, so when
+cross-compiling the kernel module, ARCH and CROSS_COMPILE are lost and
+the configure modules are built for the build machine architecture,
+which fails, also making the 0__SANITY check fail.
+
+Pass ARCH and CROSS_COMPILE as well, only if they are set: an empty ARCH
+in the environment would prevent the kernel Makefile from setting it.
+
+Upstream: https://github.com/falcosecurity/libs/pull/3153
+Signed-off-by: Angelo Compagnucci <[email protected]>
+---
+ driver/configure/Makefile.inc.in | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/driver/configure/Makefile.inc.in b/driver/configure/Makefile.inc.in
+index af4b1f5..54c852f 100644
+--- a/driver/configure/Makefile.inc.in
++++ b/driver/configure/Makefile.inc.in
+@@ -3,7 +3,9 @@ MODULE_MAKEFILE_DIR := $(shell dirname $(abspath $(lastword $(MAKEFILE_LIST))))
+ # Run the module build.sh (wrapper for make) script with an empty environment,
+ # but pass PATH, KERNELDIR and eventually (if set) CC and KBUILD_MODPOST_WARN.
+ # The latter ones are used by driverkit build templates.
+-HAS_@CONFIGURE_MODULE@ := $(shell env -i CC="$(CC)" KBUILD_MODPOST_WARN="$(KBUILD_MODPOST_WARN)" PATH="$(PATH)" KERNELDIR="$(KERNELDIR)" sh $(MODULE_MAKEFILE_DIR)/build.sh ; echo $$?)
++# ARCH and CROSS_COMPILE, used when cross-compiling, are only passed if set, as
++# an empty ARCH would prevent the kernel Makefile from setting it.
++HAS_@CONFIGURE_MODULE@ := $(shell env -i CC="$(CC)" $(if $(ARCH),ARCH="$(ARCH)") $(if $(CROSS_COMPILE),CROSS_COMPILE="$(CROSS_COMPILE)") KBUILD_MODPOST_WARN="$(KBUILD_MODPOST_WARN)" PATH="$(PATH)" KERNELDIR="$(KERNELDIR)" sh $(MODULE_MAKEFILE_DIR)/build.sh ; echo $$?)
+ 
+ ifeq ($(HAS_@CONFIGURE_MODULE@),0)
+ $(info [configure-kmod] Setting HAS_@CONFIGURE_MODULE@ flag)
+-- 
+2.34.1
+

package/falcosecurity-libs/0002-fix-driver-replace-removed-task_euid-helper.patch new file +33 -0

new file mode 100644
index 0000000000..179dd6f047
@@ -0,0 +1,33 @@
+From e85e268edef7fa6155ffb186f068f5c512fdf5b5 Mon Sep 17 00:00:00 2001
+From: Leonardo Grasso <[email protected]>
+Date: Mon, 7 Sep 2026 09:20:30 +0200
+Subject: [PATCH] fix(driver): replace removed task_euid helper
+
+Linux 7.3 removes task_euid(), breaking the kernel module build on architectures that capture sched_process_fork.
+
+Use task_cred_xxx(child, euid), matching the removed macro expansion and preserving the existing credential lookup and RCU protection. The helper is also available on older supported kernels.
+
+Signed-off-by: Leonardo Grasso <[email protected]>
+Upstream: https://github.com/falcosecurity/libs/commit/fd77846d4920bfea2211ac229d3b2a814d4835da
+[Angelo: backport to 0.21.0]
+Signed-off-by: Angelo Compagnucci <[email protected]>
+---
+ driver/ppm_fillers.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/driver/ppm_fillers.c b/driver/ppm_fillers.c
+index 7abc11d..f385a09 100644
+--- a/driver/ppm_fillers.c
++++ b/driver/ppm_fillers.c
+@@ -8001,7 +8001,7 @@ int f_sched_prog_fork(struct event_filler_arguments *args) {
+ 	long swap = 0;
+ 	int available = STR_STORAGE_SIZE;
+ 	uint32_t flags = 0;
+-	uint32_t euid = task_euid(child).val;
++	uint32_t euid = task_cred_xxx(child, euid).val;
+ 	uint32_t egid = child->cred->egid.val;
+ 	struct pid_namespace *pidns = task_active_pid_ns(child);
+ 	uint64_t pidns_init_start_time = 0;
+-- 
+2.34.1
+

package/falcosecurity-libs/0003-fix-driver-configure-pass-a-user-pointer-to-access_o.patch new file +43 -0

43 lines not on this page · raw message

package/falcosecurity-libs/Config.in +20 ~~-19~~

index 66ee55f101..c73b92d78f 100644
@@ -1,27 +1,28 @@
+config BR2_PACKAGE_FALCOSECURITY_LIBS_ARCH_SUPPORTS
+	bool
+	default y if BR2_aarch64
+	default y if BR2_loongarch64
+	default y if BR2_powerpc64le
+	default y if BR2_riscv && BR2_ARCH_IS_64
+	default y if BR2_s390x
+	default y if BR2_x86_64
+	depends on BR2_PACKAGE_LIBABSEIL_CPP_ARCH_SUPPORTS # re2
+
 config BR2_PACKAGE_FALCOSECURITY_LIBS
 	bool
-	depends on BR2_PACKAGE_LIBABSEIL_CPP_ARCH_SUPPORTS # grpc
-	depends on BR2_USE_WCHAR # grpc -> libabseil-cpp
-	depends on BR2_PACKAGE_PROTOBUF_ARCH_SUPPORTS # protobuf
+	depends on BR2_PACKAGE_FALCOSECURITY_LIBS_ARCH_SUPPORTS
+	depends on BR2_USE_WCHAR # re2 -> libabseil-cpp
 	depends on BR2_LINUX_KERNEL
-	depends on BR2_INSTALL_LIBSTDCPP # jsoncpp, protobuf, tbb
-	depends on BR2_TOOLCHAIN_GCC_AT_LEAST_10 # grpc -> libabseil-cpp
-	depends on BR2_TOOLCHAIN_HAS_THREADS # jq, protobuf, tbb
-	depends on !BR2_STATIC_LIBS # protobuf, tbb
-	depends on BR2_TOOLCHAIN_HAS_SYNC_4 || BR2_TOOLCHAIN_HAS_ATOMIC # grpc
-	depends on BR2_TOOLCHAIN_USES_GLIBC # tbb
-	depends on BR2_PACKAGE_LUAINTERPRETER_ABI_VERSION_5_1
-	select BR2_PACKAGE_C_ARES
-	select BR2_PACKAGE_ELFUTILS
-	select BR2_PACKAGE_GRPC
-	select BR2_PACKAGE_GTEST
-	select BR2_PACKAGE_JQ
+	depends on BR2_INSTALL_LIBSTDCPP # jsoncpp, re2, tbb, valijson
+	depends on BR2_TOOLCHAIN_GCC_AT_LEAST_10 # re2
+	depends on BR2_TOOLCHAIN_HAS_THREADS # re2, tbb
+	depends on !BR2_STATIC_LIBS # re2, tbb
+	depends on !BR2_TOOLCHAIN_USES_UCLIBC # tbb
+	depends on !BR2_TOOLCHAIN_HAS_GCC_BUG_64735 # tbb
 	select BR2_PACKAGE_JSONCPP
-	select BR2_PACKAGE_LIBB64
-	select BR2_PACKAGE_LIBCURL
-	select BR2_PACKAGE_OPENSSL
-	select BR2_PACKAGE_PROTOBUF
+	select BR2_PACKAGE_RE2
 	select BR2_PACKAGE_TBB
+	select BR2_PACKAGE_UTHASH
 	select BR2_PACKAGE_VALIJSON
 	select BR2_PACKAGE_ZLIB
 	help

package/falcosecurity-libs/falcosecurity-libs.hash +2 -2

index 2e239ca2fe..89b2100c32 100644
@@ -1,5 +1,5 @@
 # sha256 locally computed
-sha256  80903bc57b7f9c5f24298ecf1531cf66ef571681b4bd1e05f6e4db704ffb380b  falcosecurity-libs-e5c53d648f3c4694385bbe488e7d47eaa36c229a.tar.gz
+sha256  9e977001dd42586df42a5dc7e7a948c297124865a233402e44bdec68839d322a  falcosecurity-libs-0.21.0.tar.gz
 sha256  21ec9433a87459b3477faf542bacec419dc03af841309eac35edeffe481cf10b  COPYING
 sha256  8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643  driver/GPL2.txt
-sha256  f17d3f2c2d565a74a7d5bf96f880c43701e141897e8dff0c8aa13e5d07aaf226  driver/MIT.txt
+sha256  e852b60bd201c42bf7bb5a53129bdb90de033bf254e740ea8ba1cf92d096caf5  driver/MIT.txt

package/falcosecurity-libs/falcosecurity-libs.mk +48 ~~-50~~

125 lines not on this page · raw message

package/sysdig/Config.in +9 ~~-12~~

index 73ac03e240..2c72431d94 100644
@@ -1,16 +1,15 @@
 config BR2_PACKAGE_SYSDIG
 	bool "sysdig"
-	depends on BR2_PACKAGE_LIBABSEIL_CPP_ARCH_SUPPORTS # falcosecurity-libs
-	depends on BR2_USE_WCHAR # falcosecurity-libs -> libabseil-cpp
-	depends on BR2_PACKAGE_PROTOBUF_ARCH_SUPPORTS # falcosecurity-libs
+	depends on BR2_PACKAGE_FALCOSECURITY_LIBS_ARCH_SUPPORTS
+	depends on BR2_USE_WCHAR # falcosecurity-libs, ncurses
 	depends on BR2_LINUX_KERNEL # falcosecurity-libs
-	depends on BR2_INSTALL_LIBSTDCPP
-	depends on BR2_TOOLCHAIN_GCC_AT_LEAST_10 # falcosecurity-libs -> grpc -> libabseil-cpp
+	depends on BR2_INSTALL_LIBSTDCPP # falcosecurity-libs
+	depends on BR2_TOOLCHAIN_GCC_AT_LEAST_10 # falcosecurity-libs
 	depends on BR2_TOOLCHAIN_HAS_THREADS # falcosecurity-libs
 	depends on !BR2_STATIC_LIBS # falcosecurity-libs
-	depends on BR2_TOOLCHAIN_USES_GLIBC # falcosecurity-libs
+	depends on !BR2_TOOLCHAIN_USES_UCLIBC # falcosecurity-libs
+	depends on !BR2_TOOLCHAIN_HAS_GCC_BUG_64735 # falcosecurity-libs
 	depends on BR2_PACKAGE_LUAINTERPRETER_ABI_VERSION_5_1 # falcosecurity-libs
-	depends on BR2_TOOLCHAIN_HAS_SYNC_4 || BR2_TOOLCHAIN_HAS_ATOMIC # falcosecurity-libs
 	select BR2_PACKAGE_FALCOSECURITY_LIBS
 	select BR2_PACKAGE_NCURSES
 	select BR2_PACKAGE_JSON_FOR_MODERN_CPP

@@ -24,13 +23,11 @@ config BR2_PACKAGE_SYSDIG
 
 	  https://github.com/draios/sysdig/wiki
 
-comment "sysdig needs a glibc toolchain w/ C++, threads, wchar, gcc >= 10, dynamic library, a Linux kernel, and luajit or lua 5.1 to be built"
-	depends on BR2_PACKAGE_LIBABSEIL_CPP_ARCH_SUPPORTS
-	depends on BR2_PACKAGE_PROTOBUF_ARCH_SUPPORTS
-	depends on BR2_TOOLCHAIN_HAS_SYNC_4 || BR2_TOOLCHAIN_HAS_ATOMIC
+comment "sysdig needs a glibc or musl toolchain w/ C++, threads, wchar, gcc >= 10, dynamic library, a Linux kernel, and luajit or lua 5.1 to be built"
+	depends on BR2_PACKAGE_FALCOSECURITY_LIBS_ARCH_SUPPORTS
 	depends on !BR2_LINUX_KERNEL || !BR2_INSTALL_LIBSTDCPP \
 		|| !BR2_TOOLCHAIN_HAS_THREADS \
 		|| !BR2_TOOLCHAIN_GCC_AT_LEAST_10 || !BR2_USE_WCHAR \
 		|| BR2_STATIC_LIBS \
-		|| !BR2_TOOLCHAIN_USES_GLIBC \
+		|| BR2_TOOLCHAIN_USES_UCLIBC \
 		|| !BR2_PACKAGE_LUAINTERPRETER_ABI_VERSION_5_1

Signature · 6 lines

2.34.1

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

Angelo Compagnucci

author

2026-11-02 08:54 UTC #18 lore raw

PATCH v2 2/2 package/sysdig: bump to version 0.41.4

In reply to Angelo Compagnucci

lua, which runs the chisels, is now a direct dependency. The chisels use luaL_setfuncs(), so luajit or lua >= 5.3 is needed: lua 5.1 is not supported anymore.

Release notes:
https://github.com/draios/sysdig/releases/tag/0.41.4

Signed-off-by Angelo Compagnucci <[email protected]>

---
Changes v1 -> v2:
- move the lua dependency change here from the falcosecurity-libs bump [Thomas]
- require luajit or lua >= 5.3, lua 5.1 lacks luaL_setfuncs()

---
 ...llow-to-disable-the-container-plugin.patch | 37 ++++++++++++++++
 ...-only-include-zlib-with-the-bundled-.patch | 43 +++++++++++++++++++
 package/sysdig/Config.in                      |  9 ++--
 package/sysdig/sysdig.hash                    |  2 +-
 package/sysdig/sysdig.mk                      | 32 +++++++-------
 5 files changed, 101 insertions(+), 22 deletions(-)
 create mode 100644 package/sysdig/0001-CMakeLists.txt-allow-to-disable-the-container-plugin.patch
 create mode 100644 package/sysdig/0002-userspace-sysdig-only-include-zlib-with-the-bundled-.patch

package/sysdig/0001-CMakeLists.txt-allow-to-disable-the-container-plugin.patch new file +37 -0

new file mode 100644
index 0000000000..e13ed4bb65
@@ -0,0 +1,37 @@
+From 64f286b765da1335369c3d27fad298f0b3f525c5 Mon Sep 17 00:00:00 2001
+From: Angelo Compagnucci <[email protected]>
+Date: Fri, 30 Oct 2026 10:15:11 +0100
+Subject: [PATCH] CMakeLists.txt: allow to disable the container plugin
+
+The container plugin is either downloaded as a prebuilt binary, for the
+build host architecture, or built from sources using Go, and both can't
+be done when cross-compiling or without network access.
+
+As the container plugin is only loaded when available, add an option to
+not download nor build it.
+
+Upstream: https://github.com/draios/sysdig/pull/2191
+Signed-off-by: Angelo Compagnucci <[email protected]>
+---
+ CMakeLists.txt | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 68344a3..9ef0f9a 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -163,7 +163,10 @@ endif()
+ include(falcosecurity-libs)
+ include(yaml-cpp)
+ include(nlohmann-json)
+-include(container_plugin)
++option(BUILD_SYSDIG_CONTAINER_PLUGIN "Download or build the container plugin" ON)
++if(BUILD_SYSDIG_CONTAINER_PLUGIN)
++	include(container_plugin)
++endif()
+ 
+ if(CMAKE_SYSTEM_NAME MATCHES "Linux")
+ 	if(NOT DEFINED DRIVER_VERSION)
+-- 
+2.34.1
+

package/sysdig/0002-userspace-sysdig-only-include-zlib-with-the-bundled-.patch new file +43 -0

43 lines not on this page · raw message

package/sysdig/Config.in +5 -4

index 2c72431d94..b50741aeed 100644
@@ -9,7 +9,8 @@ config BR2_PACKAGE_SYSDIG
 	depends on !BR2_STATIC_LIBS # falcosecurity-libs
 	depends on !BR2_TOOLCHAIN_USES_UCLIBC # falcosecurity-libs
 	depends on !BR2_TOOLCHAIN_HAS_GCC_BUG_64735 # falcosecurity-libs
-	depends on BR2_PACKAGE_LUAINTERPRETER_ABI_VERSION_5_1 # falcosecurity-libs
+	# chisels, luaL_setfuncs() is not available in lua 5.1
+	depends on BR2_PACKAGE_LUAJIT || (BR2_PACKAGE_LUA && !BR2_PACKAGE_LUA_5_1)
 	select BR2_PACKAGE_FALCOSECURITY_LIBS
 	select BR2_PACKAGE_NCURSES
 	select BR2_PACKAGE_JSON_FOR_MODERN_CPP

@@ -21,13 +22,13 @@ config BR2_PACKAGE_SYSDIG
 	  Think of it as strace + tcpdump + lsof + awesome sauce.
 	  With a little Lua cherry on top.
 
-	  https://github.com/draios/sysdig/wiki
+	  https://github.com/draios/sysdig
 
-comment "sysdig needs a glibc or musl toolchain w/ C++, threads, wchar, gcc >= 10, dynamic library, a Linux kernel, and luajit or lua 5.1 to be built"
+comment "sysdig needs a glibc or musl toolchain w/ C++, threads, wchar, gcc >= 10, dynamic library, a Linux kernel, and luajit or lua >= 5.3 to be built"
 	depends on BR2_PACKAGE_FALCOSECURITY_LIBS_ARCH_SUPPORTS
 	depends on !BR2_LINUX_KERNEL || !BR2_INSTALL_LIBSTDCPP \
 		|| !BR2_TOOLCHAIN_HAS_THREADS \
 		|| !BR2_TOOLCHAIN_GCC_AT_LEAST_10 || !BR2_USE_WCHAR \
 		|| BR2_STATIC_LIBS \
 		|| BR2_TOOLCHAIN_USES_UCLIBC \
-		|| !BR2_PACKAGE_LUAINTERPRETER_ABI_VERSION_5_1
+		|| !(BR2_PACKAGE_LUAJIT || (BR2_PACKAGE_LUA && !BR2_PACKAGE_LUA_5_1))

package/sysdig/sysdig.hash +1 -1

index cda3de5e7c..4a55afe1da 100644
@@ -1,3 +1,3 @@
 # sha256 locally computed
-sha256  6b96797859002ab69a2bed4fdba1c7fe8064ecf8661621ae7d8fbf8599ffa636  sysdig-0.29.3.tar.gz
+sha256  36daa6a06705569fcc9b0579992e2457494003aea0065eabf54b3e16d67511f7  sysdig-0.41.4.tar.gz
 sha256  a88fbf820b38b1c7fabc6efe291b8259e02ae21326f56fe31c6c9adf374b2702  COPYING

package/sysdig/sysdig.mk +15 ~~-17~~

index bafe534a16..d04f67a97b 100644
@@ -4,35 +4,33 @@
 #
 ################################################################################
 
-SYSDIG_VERSION = 0.29.3
+SYSDIG_VERSION = 0.41.4
 SYSDIG_SITE = $(call github,draios,sysdig,$(SYSDIG_VERSION))
 SYSDIG_LICENSE = Apache-2.0
 SYSDIG_LICENSE_FILES = COPYING
 SYSDIG_CPE_ID_VENDOR = sysdig
-SYSDIG_CONF_OPTS = \
-	-DENABLE_DKMS=OFF \
-	-DUSE_BUNDLED_DEPS=OFF \
-	-DCREATE_TEST_TARGETS=OFF
 SYSDIG_SUPPORTS_IN_SOURCE_BUILD = NO
 
 SYSDIG_DEPENDENCIES = \
 	falcosecurity-libs \
-	ncurses \
+	host-pkgconf \
 	json-for-modern-cpp \
+	luainterpreter \
+	ncurses \
 	yaml-cpp
 
-# Don't build the driver as part of the 'standard' procedure, it has been built
-# by falcosecurity-libs.mk.
-# grpc_cpp_plugin is needed to build falcosecurity libs, so we give the host
-# one there.
-SYSDIG_CONF_OPTS += -DFALCOSECURITY_LIBS_SOURCE_DIR=$(FALCOSECURITY_LIBS_SRCDIR) \
-	-DBUILD_DRIVER=OFF \
-	-DGRPC_CPP_PLUGIN=$(HOST_DIR)/bin/grpc_cpp_plugin \
-	-DDRIVER_NAME=$(FALCOSECURITY_LIBS_DRIVER_NAME) \
-	-DENABLE_DKMS=OFF \
+# The driver is built by falcosecurity-libs, which only supports the
+# kernel module.
+SYSDIG_CONF_OPTS = \
 	-DUSE_BUNDLED_DEPS=OFF \
-	-DWITH_CHISEL=ON \
-	-DVALIJSON_INCLUDE=$(BUILD_DIR)/valijson-0.6/include/valijson \
+	-DCREATE_TEST_TARGETS=OFF \
+	-DBUILD_SYSDIG_MODERN_BPF=OFF \
 	-DSYSDIG_VERSION=$(SYSDIG_VERSION)
 
+# 0001-CMakeLists.txt-allow-to-disable-the-container-plugin.patch
+# The container plugin is either downloaded as a prebuilt binary or
+# built with Go, so it is disabled. It can be provided by a separate
+# package in a following patch.
+SYSDIG_CONF_OPTS += -DBUILD_SYSDIG_CONTAINER_PLUGIN=OFF
+
 $(eval $(cmake-package))

Signature · 6 lines

2.34.1

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot