Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Unable to find the rebuild driver for kernel 5.10.217-205.860.amzn2.x86_64 on AWS EKS version 1.26 #3244

Open
kg-ops opened this issue Jun 11, 2024 · 2 comments

Comments

@kg-ops
Copy link

kg-ops commented Jun 11, 2024

Describe the bug

Unable to find the rebuild driver for kernel 5.10.217-205.860.amzn2.x86_64 on AWS EKS version 1.26.
Download link : https://download.falco.org/driver/5.0.1%2Bdriver/x86_64/falco_amazonlinux2_5.10.217-205.860.amzn2.x86_64_1.ko

* Looking for a falco module locally (kernel 5.10.217-205.860.amzn2.x86_64)
* Filename 'falco_amazonlinux2_5.10.217-205.860.amzn2.x86_64_1.ko' is composed of:
 - driver name: falco
 - target identifier: amazonlinux2
 - kernel release: 5.10.217-205.860.amzn2.x86_64
 - kernel version: 1
* Trying to download a prebuilt falco module from https://download.falco.org/driver/5.0.1%2Bdriver/x86_64/falco_amazonlinux2_5.10.217-205.860.amzn2.x86_64_1.ko
curl: (22) The requested URL returned error: 404 
Unable to find a prebuilt falco module

How to reproduce it

  • Use the community published AMI for K8s 1.26 cluster.
  • Initialize falco.

Expected behaviour

falco should come up healthy, instead

bin/sh: 1: gcc10-ld.bfd: not found
make[3]: *** [scripts/Makefile.build:437: /var/lib/dkms/falco/5.0.1+driver/build/falco.o] Error 127
make[2]: *** [Makefile.kernel:1829: /var/lib/dkms/falco/5.0.1+driver/build] Error 2
make[2]: Leaving directory '/host/usr/src/kernels/5.10.217-205.860.amzn2.x86_64'
make[1]: *** [Makefile:9: modules] Error 2
make[1]: Leaving directory '/host/usr/src/kernels/5.10.217-205.860.amzn2.x86_64'
make: *** [Makefile:16: all] Error 2
* Trying to load a system falco module, if present
Consider compiling your own falco driver and loading it or getting in touch with the Falco community

Screenshots
Missing .217 driver.
image

Environment

  • Falco version: 0.35.1 (x86_64)
  • System info:
{
  "machine": "x86_64",
  "nodename": "falco-pt7ch",
  "release": "5.10.216-204.855.amzn2.x86_64",  --> previous working version 
  "sysname": "Linux",
  "version": "#1 SMP Sat May 4 16:53:27 UTC 2024"
}
  • Cloud provider or hardware configuration:
    EKS, K8s 1.26, x86 Machines

  • OS:

PRETTY_NAME="Debian GNU/Linux 11 (bullseye)"
NAME="Debian GNU/Linux"
VERSION_ID="11"
VERSION="11 (bullseye)"
VERSION_CODENAME=bullseye
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"
  • Kernel:
Previous working version  - 
Linux falco-pt7ch 5.10.216-204.855.amzn2.x86_64 #1 SMP Sat May 4 16:53:27 UTC 2024 x86_64 GNU/Linux
  • Installation method: Kubernetes

Additional context

@FedeDP
Copy link
Contributor

FedeDP commented Jun 12, 2024

Hi! Thanks for opening this issue!
So, first of all, we are no more publishing drivers for 5.0.1+driver driver version since it is now unsupported (since we tagged Falco 0.38.0 with its 7.2.0+driver version).
I see that the driver is instead present for 6.0.1+driver and 7.0.0+driver, but not 7.2.0+driver; indeed it seems it is failing to build for latest driver version; i will dig deeper.

Anyway, since this is a recent enough kernel release, you can also just use the modern-bpf probe that does not require any external artifact!

@poiana
Copy link

poiana commented Sep 10, 2024

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants