diff --git a/CMakeLists.txt b/CMakeLists.txt index e373966f..31cf9ca2 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -155,6 +155,7 @@ ExternalProject_Add(lpeg install(FILES falco.yaml DESTINATION "${DIR_ETC}") +add_subdirectory(${SYSDIG_DIR}/driver ${PROJECT_BINARY_DIR}/driver) add_subdirectory(${SYSDIG_DIR}/userspace/libscap ${PROJECT_BINARY_DIR}/userspace/libscap) add_subdirectory(${SYSDIG_DIR}/userspace/libsinsp ${PROJECT_BINARY_DIR}/userspace/libsinsp) diff --git a/README.md b/README.md index 1d8761d5..2b4a451e 100644 --- a/README.md +++ b/README.md @@ -69,11 +69,11 @@ Instructions for Centos and Ubuntu. -## Building Falco +## Building and running Falco locally from source Building Falco requires having `cmake` and `g++` installed. -### Building +### Building Falco Clone this repo in a directory that also contains the sysdig source repo. The result should be something like: ``` @@ -98,8 +98,13 @@ $ make as a result, you should have a falco executable in `build/userspace/falco/falco`. +### (Optional) Install sysdig kernel driver -### Running locally-built Falco +If you have a binary version of sysdig installed, the sysdig kernel module is already loaded and can be used by falco. Otherwise, you should load the kernel module from the sysdig source directory. Assuming you are in the `build` dir, you can install the kernel module via: + +`$ insmod driver/sysdig-probe.ko` + +### Running Falco Assuming you are in the `build` dir, you can run Falco as: