Skip to content

Commit

Permalink
update(falco_scripts): support pre-built module/probe on Flatcar
Browse files Browse the repository at this point in the history
Pre-built kernel modules/eBPF probes for Flatcar use the value of the OS
VERSION_ID field as KERNEL_RELEASE in the filename. A specific kernel release
version does not uniquely identify a Flatcar configuration, because Flatcar is
image-based instead of package-based. Here's a more specific example: the same
kernel version can be part of various Flatcar releases (across channels
alpha/beta/stable) with differences in configuration. This is why we use the
VERSION_ID value during offline builds with driverkit. Flatcar version numbers
are all higher than 1500.0.0, so there is no risk of collision with kernel
version numbers.

When locally building the kernel module on the system, we have access to the
correct kernel build directory at /lib/modules/$(uname -r)/build with the right
configuration and so for that branch, we need to reset KERNEL_RELEASE=$(uname -r).

See also the driverkit PR that introduces a builder for Flatcar:
falcosecurity/driverkit#131

Signed-off-by: Jeremi Piotrowski <jpiotrowski@microsoft.com>
  • Loading branch information
jepio committed Jun 7, 2022
1 parent 9cfc814 commit 715bdc7
Showing 1 changed file with 5 additions and 0 deletions.
5 changes: 5 additions & 0 deletions scripts/falco-driver-loader
Original file line number Diff line number Diff line change
Expand Up @@ -135,6 +135,10 @@ get_target_id() {
TARGET_ID="ubuntu-generic"
fi
;;
("flatcar")
KERNEL_RELEASE="${VERSION_ID}"
TARGET_ID=$(echo "${OS_ID}" | tr '[:upper:]' '[:lower:]')
;;
(*)
TARGET_ID=$(echo "${OS_ID}" | tr '[:upper:]' '[:lower:]')
;;
Expand Down Expand Up @@ -180,6 +184,7 @@ load_kernel_module_compile() {
fi

if [ "${TARGET_ID}" == "flatcar" ]; then
KERNEL_RELEASE=$(uname -r)
echo "* Flatcar detected (version ${VERSION_ID}); relocating kernel tools"
flatcar_relocate_tools
fi
Expand Down

0 comments on commit 715bdc7

Please sign in to comment.