github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-08-16 05:13:50 +00:00
Code Issues Projects Releases Wiki Activity

update(scripts): changes to falco-driver-loader to support the Falco

Browse Source 
eBPF probes coming from the drivers build grid

Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
This commit is contained in:
Leonardo Di Donato 2020-04-23 11:56:56 +00:00 committed by poiana
parent 9baa3707dc
commit 207f74b17c
1 changed files with 44 additions and 60 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

104
scripts/falco-driver-loader
View File

@ -102,16 +102,16 @@ get_kernel_config() {
} }
get_target_id() { get_target_id() {
if [ -f /etc/os-release ]; then if [ -f "${HOST_ROOT}/etc/os-release" ]; then
# freedesktop.org and systemd # freedesktop.org and systemd
# shellcheck source=/dev/null # shellcheck source=/dev/null
source "/etc/os-release" source "/etc/os-release"
OS_ID=$ID OS_ID=$ID
elif [ -f /etc/debian_version ]; then elif [ -f "${HOST_ROOT}/etc/debian_version" ]; then
# Older Debian # Older Debian
# fixme > can this happen on older Ubuntu? # fixme > can this happen on older Ubuntu?
OS_ID=debian OS_ID=debian
elif [ -f /etc/centos-release ]; then elif [ -f "${HOST_ROOT}/etc/centos-release" ]; then
# Older CentOS # Older CentOS
OS_ID=centos OS_ID=centos
else else
@ -156,24 +156,24 @@ load_kernel_module() {
exit 1 exit 1
fi fi
echo "* Unloading ${PROBE_NAME}, if present" echo "* Unloading ${DRIVER_NAME}, if present"
rmmod "${PROBE_NAME}" 2>/dev/null rmmod "${DRIVER_NAME}" 2>/dev/null
WAIT_TIME=0 WAIT_TIME=0
KMOD_NAME=$(echo "${PROBE_NAME}" | tr "-" "_") KMOD_NAME=$(echo "${DRIVER_NAME}" | tr "-" "_")
while lsmod | grep "${KMOD_NAME}" > /dev/null 2>&1 && [ $WAIT_TIME -lt "${MAX_RMMOD_WAIT}" ]; do while lsmod | grep "${KMOD_NAME}" > /dev/null 2>&1 && [ $WAIT_TIME -lt "${MAX_RMMOD_WAIT}" ]; do
if rmmod "${PROBE_NAME}" 2>/dev/null; then if rmmod "${DRIVER_NAME}" 2>/dev/null; then
echo "* Unloading ${PROBE_NAME} succeeded after ${WAIT_TIME}s" echo "* Unloading ${DRIVER_NAME} succeeded after ${WAIT_TIME}s"
break break
fi fi
((++WAIT_TIME)) ((++WAIT_TIME))
if (( WAIT_TIME % 5 == 0 )); then if (( WAIT_TIME % 5 == 0 )); then
echo "* ${PROBE_NAME} still loaded, waited ${WAIT_TIME}s (max wait ${MAX_RMMOD_WAIT}s)" echo "* ${DRIVER_NAME} still loaded, waited ${WAIT_TIME}s (max wait ${MAX_RMMOD_WAIT}s)"
fi fi
sleep 1 sleep 1
done done
if lsmod | grep "${KMOD_NAME}" > /dev/null 2>&1; then if lsmod | grep "${KMOD_NAME}" > /dev/null 2>&1; then
echo "* ${PROBE_NAME} seems to still be loaded, hoping the best" echo "* ${DRIVER_NAME} seems to still be loaded, hoping the best"
exit 0 exit 0
fi fi
@ -181,20 +181,20 @@ load_kernel_module() {
if [[ $(uname -r) == *uek* ]]; then if [[ $(uname -r) == *uek* ]]; then
echo "* Skipping dkms install for UEK host" echo "* Skipping dkms install for UEK host"
else else
if hash dkms &>/dev/null && dkms install -m "${PACKAGE_NAME}" -v "${DRIVER_VERSION}" -k "${KERNEL_RELEASE}" 2>/dev/null; then if hash dkms &>/dev/null && dkms install -m "${DRIVER_NAME}" -v "${DRIVER_VERSION}" -k "${KERNEL_RELEASE}" 2>/dev/null; then
echo "* Trying to load a dkms ${PROBE_NAME}, if present" echo "* Trying to load a dkms ${DRIVER_NAME}, if present"
if insmod "/var/lib/dkms/${PACKAGE_NAME}/${DRIVER_VERSION}/${KERNEL_RELEASE}/${ARCH}/module/${PROBE_NAME}.ko" > /dev/null 2>&1; then if insmod "/var/lib/dkms/${DRIVER_NAME}/${DRIVER_VERSION}/${KERNEL_RELEASE}/${ARCH}/module/${DRIVER_NAME}.ko" > /dev/null 2>&1; then
echo "${PROBE_NAME} found and loaded in dkms" echo "${DRIVER_NAME} found and loaded in dkms"
exit 0 exit 0
elif insmod "/var/lib/dkms/${PACKAGE_NAME}/${DRIVER_VERSION}/${KERNEL_RELEASE}/${ARCH}/module/${PROBE_NAME}.ko.xz" > /dev/null 2>&1; then elif insmod "/var/lib/dkms/${DRIVER_NAME}/${DRIVER_VERSION}/${KERNEL_RELEASE}/${ARCH}/module/${DRIVER_NAME}.ko.xz" > /dev/null 2>&1; then
echo "${PROBE_NAME} found and loaded in dkms (xz)" echo "${DRIVER_NAME} found and loaded in dkms (xz)"
exit 0 exit 0
else else
echo "* Unable to insmod" echo "* Unable to insmod"
fi fi
else else
DKMS_LOG="/var/lib/dkms/${PACKAGE_NAME}/${DRIVER_VERSION}/build/make.log" DKMS_LOG="/var/lib/dkms/${DRIVER_NAME}/${DRIVER_VERSION}/build/make.log"
if [ -f "${DKMS_LOG}" ]; then if [ -f "${DKMS_LOG}" ]; then
echo "* Running dkms build failed, dumping ${DKMS_LOG}" echo "* Running dkms build failed, dumping ${DKMS_LOG}"
cat "${DKMS_LOG}" cat "${DKMS_LOG}"
@ -204,18 +204,18 @@ load_kernel_module() {
fi fi
fi fi
echo "* Trying to load a system ${PROBE_NAME}, if present" echo "* Trying to load a system ${DRIVER_NAME}, if present"
if modprobe "${PROBE_NAME}" > /dev/null 2>&1; then if modprobe "${DRIVER_NAME}" > /dev/null 2>&1; then
echo "${PROBE_NAME} found and loaded with modprobe" echo "${DRIVER_NAME} found and loaded with modprobe"
exit 0 exit 0
fi fi
echo "* Trying to find precompiled ${PROBE_NAME} for ${KERNEL_RELEASE}" echo "* Trying to find precompiled ${DRIVER_NAME} for ${KERNEL_RELEASE}"
get_target_id get_target_id
local FALCO_KERNEL_MODULE_FILENAME="${PROBE_NAME}_${TARGET_ID}_${KERNEL_RELEASE}_${KERNEL_VERSION}.ko" local FALCO_KERNEL_MODULE_FILENAME="${DRIVER_NAME}_${TARGET_ID}_${KERNEL_RELEASE}_${KERNEL_VERSION}.ko"
if [ -f "${HOME}/.falco/${FALCO_KERNEL_MODULE_FILENAME}" ]; then if [ -f "${HOME}/.falco/${FALCO_KERNEL_MODULE_FILENAME}" ]; then
echo "Found precompiled module at ~/.falco/${FALCO_KERNEL_MODULE_FILENAME}, loading module" echo "Found precompiled module at ~/.falco/${FALCO_KERNEL_MODULE_FILENAME}, loading module"
@ -224,15 +224,15 @@ load_kernel_module() {
fi fi
local URL local URL
URL=$(echo "${PROBE_URL}/kernel-module/${DRIVER_VERSION}/${FALCO_KERNEL_MODULE_FILENAME}" | sed s/+/%2B/g) URL=$(echo "${DRIVERS_REPO}/kernel-module/${DRIVER_VERSION}/${FALCO_KERNEL_MODULE_FILENAME}" | sed s/+/%2B/g)
echo "* Trying to download precompiled module from ${URL}" echo "* Trying to download precompiled module from ${URL}"
if curl --create-dirs "${FALCO_PROBE_CURL_OPTIONS}" -o "${HOME}/.falco/${FALCO_KERNEL_MODULE_FILENAME}" "${URL}"; then if curl --create-dirs "${FALCO_DRIVER_CURL_OPTIONS}" -o "${HOME}/.falco/${FALCO_KERNEL_MODULE_FILENAME}" "${URL}"; then
echo "Download succeeded, loading module" echo "Download succeeded, loading module"
insmod "${HOME}/.falco/${FALCO_KERNEL_MODULE_FILENAME}" insmod "${HOME}/.falco/${FALCO_KERNEL_MODULE_FILENAME}"
exit $? exit $?
else else
>&2 echo "Download failed, consider compiling your own ${PROBE_NAME} and loading it or getting in touch with the Falco community" >&2 echo "Download failed, consider compiling your own ${DRIVER_NAME} and loading it or getting in touch with the Falco community"
exit 1 exit 1
fi fi
} }
@ -260,7 +260,9 @@ load_bpf_probe() {
MINIKUBE_VERSION="$(cat "${HOST_ROOT}/etc/VERSION")" MINIKUBE_VERSION="$(cat "${HOST_ROOT}/etc/VERSION")"
fi fi
local BPF_PROBE_FILENAME="${BPF_PROBE_NAME}-${DRIVER_VERSION}-${ARCH}-${KERNEL_RELEASE}-${HASH}.o" get_target_id
local BPF_PROBE_FILENAME="${DRIVER_NAME}_${TARGET_ID}_${KERNEL_RELEASE}_${KERNEL_VERSION}.o"
if [ ! -f "${HOME}/.falco/${BPF_PROBE_FILENAME}" ]; then if [ ! -f "${HOME}/.falco/${BPF_PROBE_FILENAME}" ]; then
@ -304,7 +306,7 @@ load_bpf_probe() {
if [[ greater_ret -eq 1 ]]; then if [[ greater_ret -eq 1 ]]; then
export KBUILD_EXTRA_CPPFLAGS=-DCOS_73_WORKAROUND export KBUILD_EXTRA_CPPFLAGS=-DCOS_73_WORKAROUND
fi fi
} }
fi fi
if [ -n "${MINIKUBE}" ]; then if [ -n "${MINIKUBE}" ]; then
@ -338,7 +340,7 @@ load_bpf_probe() {
mkdir -p /tmp/kernel mkdir -p /tmp/kernel
cd /tmp/kernel || exit cd /tmp/kernel || exit
cd "$(mktemp -d -p /tmp/kernel)" || exit cd "$(mktemp -d -p /tmp/kernel)" || exit
if ! curl -o kernel-sources.tgz --create-dirs "${FALCO_PROBE_CURL_OPTIONS}" "${BPF_KERNEL_SOURCES_URL}"; then if ! curl -o kernel-sources.tgz --create-dirs "${FALCO_DRIVER_CURL_OPTIONS}" "${BPF_KERNEL_SOURCES_URL}"; then
exit 1; exit 1;
fi fi
@ -360,12 +362,12 @@ load_bpf_probe() {
customize_kernel_build customize_kernel_build
fi fi
echo "* Trying to compile BPF probe ${BPF_PROBE_NAME} (${BPF_PROBE_FILENAME})" echo "* Trying to compile BPF probe (${BPF_PROBE_FILENAME})"
make -C "/usr/src/${PACKAGE_NAME}-${DRIVER_VERSION}/bpf" > /dev/null make -C "/usr/src/${DRIVER_NAME}-${DRIVER_VERSION}/bpf" > /dev/null
mkdir -p ~/.falco mkdir -p "${HOME}/.falco"
mv "/usr/src/${PACKAGE_NAME}-${DRIVER_VERSION}/bpf/probe.o" "${HOME}/.falco/${BPF_PROBE_FILENAME}" mv "/usr/src/${DRIVER_NAME}-${DRIVER_VERSION}/bpf/probe.o" "${HOME}/.falco/${BPF_PROBE_FILENAME}"
if [ -n "${BPF_KERNEL_SOURCES_URL}" ]; then if [ -n "${BPF_KERNEL_SOURCES_URL}" ]; then
rm -r /tmp/kernel rm -r /tmp/kernel
@ -374,11 +376,11 @@ load_bpf_probe() {
if [ ! -f "${HOME}/.falco/${BPF_PROBE_FILENAME}" ]; then if [ ! -f "${HOME}/.falco/${BPF_PROBE_FILENAME}" ]; then
local URL local URL
URL=$(echo "${PROBE_URL}/ebpf-probe/${DRIVER_VERSION}/${BPF_PROBE_FILENAME}" | sed s/+/%2B/g) URL=$(echo "${DRIVERS_REPO}/ebpf-probe/${DRIVER_VERSION}/${BPF_PROBE_FILENAME}" | sed s/+/%2B/g)
echo "* Trying to download precompiled BPF probe from ${URL}" echo "* Trying to download precompiled BPF probe from ${URL}"
curl --create-dirs "${FALCO_PROBE_CURL_OPTIONS}" -o "${HOME}/.falco/${BPF_PROBE_FILENAME}" "${URL}" curl --create-dirs "${FALCO_DRIVER_CURL_OPTIONS}" -o "${HOME}/.falco/${BPF_PROBE_FILENAME}" "${URL}"
fi fi
if [ -f "${HOME}/.falco/${BPF_PROBE_FILENAME}" ]; then if [ -f "${HOME}/.falco/${BPF_PROBE_FILENAME}" ]; then
@ -393,7 +395,7 @@ load_bpf_probe() {
echo "* BPF probe located, it's now possible to start falco" echo "* BPF probe located, it's now possible to start falco"
ln -sf "${HOME}/.falco/${BPF_PROBE_FILENAME}" "${HOME}/.falco/${BPF_PROBE_NAME}.o" ln -sf "${HOME}/.falco/${BPF_PROBE_FILENAME}" "${HOME}/.falco/${DRIVER_NAME}-bpf.o"
exit $? exit $?
else else
echo "* Failure to find a BPF probe" echo "* Failure to find a BPF probe"
@ -404,13 +406,12 @@ load_bpf_probe() {
ARCH=$(uname -m) ARCH=$(uname -m)
KERNEL_RELEASE=$(uname -r) KERNEL_RELEASE=$(uname -r)
KERNEL_VERSION=$(uname -v | sed 's/#\([[:digit:]]\+\).*/\1/') KERNEL_VERSION=$(uname -v | sed 's/#\([[:digit:]]\+\).*/\1/')
SCRIPT_NAME=$(basename "${0}") DRIVERS_REPO=${DRIVERS_REPO:-"@DRIVERS_REPO@"}
PROBE_URL=${PROBE_URL:-"@DRIVER_LOOKUP_URL@"} if [ -n "$DRIVER_INSECURE_DOWNLOAD" ]
if [ -n "$PROBE_INSECURE_DOWNLOAD" ]
then then
FALCO_PROBE_CURL_OPTIONS=-fsSk FALCO_DRIVER_CURL_OPTIONS=-fsSk
else else
FALCO_PROBE_CURL_OPTIONS=-fsS FALCO_DRIVER_CURL_OPTIONS=-fsS
fi fi
MAX_RMMOD_WAIT=60 MAX_RMMOD_WAIT=60
@ -418,15 +419,8 @@ if [[ $# -ge 1 ]]; then
MAX_RMMOD_WAIT=$1 MAX_RMMOD_WAIT=$1
fi fi
if [ "${SCRIPT_NAME}" = "falco-driver-loader" ]; then DRIVER_VERSION="@PROBE_VERSION@"
DRIVER_VERSION="@PROBE_VERSION@" DRIVER_NAME="@PROBE_NAME@"
PROBE_NAME="@PROBE_NAME@"
BPF_PROBE_NAME="@PROBE_NAME@-bpf"
PACKAGE_NAME="@PACKAGE_NAME@"
else
echo "This script must be called as falco-driver-loader"
exit 1
fi
if [ "$(id -u)" != 0 ]; then if [ "$(id -u)" != 0 ]; then
echo "Installer must be run as root (or with sudo)." echo "Installer must be run as root (or with sudo)."
@ -442,14 +436,4 @@ if [ -v FALCO_BPF_PROBE ] || [ "${1}" = "bpf" ]; then
load_bpf_probe load_bpf_probe
else else
load_kernel_module load_kernel_module
fi fi
# sudo falco-driver-loader
#
# env variables:
# PROBE_URL="..."
# PROBE_INSECURE_DOWNLOAD=true
# RENAMES
# PROBE_URL
# FALCO_PROBE_CURL_OPTIONS