diff --git a/scripts/debian/prerm.in b/scripts/debian/prerm.in index 6d27a72d..0b576a17 100755 --- a/scripts/debian/prerm.in +++ b/scripts/debian/prerm.in @@ -22,16 +22,18 @@ set -e # Currently running falco service uses the driver, so stop it before driver cleanup if [ -d /run/systemd/system ] && [ "$1" = remove ]; then - echo "[POST-REMOVE] Stop all Falco services:" + echo "[PRE-REMOVE] Stop all Falco services:" systemctl --system stop 'falco-kmod.service' || true systemctl --system stop 'falco-bpf.service' || true systemctl --system stop 'falco-modern-bpf.service' || true systemctl --system stop 'falco-plugin.service' || true + # this should be stopped after 'falco-kmod.service' + systemctl --system stop 'falco-kmod-inject.service' || true fi case "$1" in remove|upgrade|deconfigure) - echo "[POST-REMOVE] Call 'falco-driver-loader --clean:'" + echo "[PRE-REMOVE] Call 'falco-driver-loader --clean:'" falco-driver-loader --clean ;; esac diff --git a/scripts/rpm/preuninstall.in b/scripts/rpm/preuninstall.in index e96b2cff..c5553aa8 100755 --- a/scripts/rpm/preuninstall.in +++ b/scripts/rpm/preuninstall.in @@ -19,14 +19,16 @@ set -e # pre uninstall mirrored from .deb # Currently running falco service uses the driver, so stop it before driver cleanup if [ -d /run/systemd/system ] && [ $1 -eq 0 ]; then - echo "[POST-REMOVE] Stop all Falco services:" + echo "[PRE-REMOVE] Stop all Falco services:" systemctl --system stop 'falco-kmod.service' || true systemctl --system stop 'falco-bpf.service' || true systemctl --system stop 'falco-modern-bpf.service' || true systemctl --system stop 'falco-plugin.service' || true + # this should be stopped after 'falco-kmod.service' + systemctl --system stop 'falco-kmod-inject.service' || true fi -echo "[POST-REMOVE] Call 'falco-driver-loader --clean:'" +echo "[PRE-REMOVE] Call 'falco-driver-loader --clean:'" falco-driver-loader --clean # validate rpm macros by `rpm -qp --scripts ` diff --git a/scripts/systemd/falco-kmod-inject.service b/scripts/systemd/falco-kmod-inject.service index 579ee3bf..480b6afc 100644 --- a/scripts/systemd/falco-kmod-inject.service +++ b/scripts/systemd/falco-kmod-inject.service @@ -4,7 +4,5 @@ Documentation=https://falco.org/docs/ [Service] Type=oneshot -RemainAfterExit=yes User=root ExecStart=/sbin/modprobe falco -ExecStop=/sbin/rmmod falco diff --git a/scripts/systemd/falco-kmod.service b/scripts/systemd/falco-kmod.service index f6251638..88f7720b 100644 --- a/scripts/systemd/falco-kmod.service +++ b/scripts/systemd/falco-kmod.service @@ -11,6 +11,7 @@ Conflicts=falco-plugin.service Type=simple User=root ExecStart=/usr/bin/falco --pidfile=/var/run/falco.pid +ExecStopPost=/sbin/rmmod falco UMask=0077 TimeoutSec=30 RestartSec=15s