Skip to content

Commit

Permalink
Added Aliyun Linux, Almalinux and Rockylinux, sorted all example in a…
Browse files Browse the repository at this point in the history 
…lphabetical order

Signed-off-by: Daniele De Lorenzi <daniele.delorenzi@fastnetserv.net>
  • Loading branch information
@dark-vex @poiana
dark-vex authored and poiana committed Mar 28, 2023
1 parent dd28403 commit 36f6d1f
Showing 1 changed file with 141 additions and 97 deletions.
238 changes: 141 additions & 97 deletions Example_configs.md
View file
Original file line number Diff line number Diff line change
@@ -1,135 +1,134 @@
# Example Configs

## ubuntu
Example configuration file to build both the Kernel module and eBPF probe for Ubuntu (works with any flavor!).
## aliyun linux 2 (Alibaba Cloud Linux 2)

```yaml
kernelrelease: 5.0.0-1021-aws-5.0
kernelversion: 24~18.04.1
target: ubuntu
kernelrelease: 4.19.91-26.al7.x86_64
target: alinux
output:
module: /tmp/falco-ubuntu-generic.ko
probe: /tmp/falco-ubuntu-generic.o
module: /tmp/falco_alinux_4.19.91-26.al7.x86_64.ko
probe: /tmp/falco_alinux_4.19.91-26.al7.x86_64.o
driverversion: master
```
## ubuntu-generic
Example configuration file to build both the Kernel module and eBPF probe for Ubuntu generic.
## aliyun linux 3 (Alibaba Cloud Linux 3)
```yaml
kernelrelease: 4.15.0-72-generic
kernelversion: 81
target: ubuntu-generic
kernelrelease: 5.10.84-10.4.al8.x86_64
target: alinux
output:
module: /tmp/falco-ubuntu-generic.ko
probe: /tmp/falco-ubuntu-generic.o
module: /tmp/falco_alinux_4.19.91-26.al7.x86_64.ko
probe: /tmp/falco_alinux_4.19.91-26.al7.x86_64.o
driverversion: master
```
> **NOTE:** ubuntu-generic exists to retain backward compatibility only,
> and should not be used in new configs.
## ubuntu-aws
Example configuration file to build both the Kernel module and eBPF probe for Ubuntu AWS.
## alma linux
```yaml
kernelrelease: 4.15.0-1057-aws
kernelversion: 59
target: ubuntu-aws
kernelrelease: 5.14.0-162.12.1.el9_1.x86_64
target: almalinux
output:
module: /tmp/falco-ubuntu-aws.ko
probe: /tmp/falco-ubuntu-aws.o
module: /tmp/falco_almalinux_5.14.0-162.12.1.el9_1.x86_64.ko
probe: /tmp/falco_almalinux_5.14.0-162.12.1.el9_1.x86_64.o
driverversion: master
```
> **NOTE:** ubuntu-aws exists to retain backward compatibility only,
> and should not be used in new configs.
## centos 6
## amazonlinux
```yaml
kernelrelease: 2.6.32-754.14.2.el6.x86_64
kernelversion: 1
target: centos
kernelrelease: 4.14.26-46.32.amzn1.x86_64
target: amazonlinux
output:
module: /tmp/falco-centos6.ko
module: /tmp/falco_amazonlinux_4.14.26-46.32.amzn1.x86_64.ko
driverversion: master
```
## centos 7
## amazonlinux 2
```yaml
kernelrelease: 3.10.0-957.12.2.el7.x86_64
kernelversion: 1
target: centos
kernelrelease: 4.14.171-136.231.amzn2.x86_64
target: amazonlinux2
output:
module: /tmp/falco-centos7.ko
module: /tmp/falco_amazonlinux2_4.14.171-136.231.amzn2.x86_64.ko
probe: /tmp/falco_amazonlinux2_4.14.171-136.231.amzn2.x86_64.o
driverversion: master
```
## centos 8
## amazonlinux 2022
```yaml
kernelrelease: 4.18.0-147.5.1.el8_1.x86_64
kernelversion: 1
target: centos
kernelrelease: 5.10.96-90.460.amzn2022.x86_64
target: amazonlinux2022
output:
module: /tmp/falco-centos8.ko
module: /tmp/falco_amazonlinux2022_5.10.96-90.460.amzn2022.x86_64.ko
probe: /tmp/falco_amazonlinux2022_5.10.96-90.460.amzn2022.x86_64.o
driverversion: master
```
## fedora
## archlinux
```yaml
kernelrelease: 5.19.16-200.fc36.x86_64
kernelversion: 1
target: fedora
output:
module: /tmp/falco-fedora.ko
driverversion: master
```
Example configuration file to build both the Kernel module and eBPF probe for Archlinux.
Note: archlinux target uses the [Arch Linux Archive](https://wiki.archlinux.org/title/Arch_Linux_Archive) to fetch
all ever supported kernel releases.
For arm64, it uses an user-provided mirror, as no official mirror is available: http://tardis.tiny-vps.com/aarm/.
The mirror has been up and updated since 2015.
## oracle linux 8
NOTE: ArchLinux has updated to Linux Kernel 6.0+, which appears to enforce generation of BTF for kmod too. The typical Debian container builders in the repo currently do not work for building ArchLinux drivers as a result. While an agreement is being reached on how to handle this upstream, using a custom `--builderimage` with ArchLinux drivers works for now. For example:
```Dockerfile
# archlinux builder example
# Note: ArchLinux is a rolling release, the gcc versions and such will change over time
# pinned for now for gcc 11/12
FROM archlinux:base-20221030.0.98412
RUN pacman -Sy && pacman -Sy --noconfirm \
make \
pahole \
gcc11 \
gcc && \
ln -s /usr/bin/gcc /usr/bin/gcc-12
```

```yaml
kernelrelease: 5.4.17-2011.3.2.1.el8uek.x86_64
kernelversion: 1
target: ol
kernelrelease: 6.0.6.arch1-1
target: arch
output:
module: /tmp/falco-ol8.ko
module: /tmp/falco-arch.ko
probe: /tmp/falco-arch.o
driverversion: master
builderimage: ${ARCH_BUILD_IMAGE_HERE}
```

## amazonlinux
## centos 6

```yaml
kernelrelease: 4.14.26-46.32.amzn1.x86_64
target: amazonlinux
kernelrelease: 2.6.32-754.14.2.el6.x86_64
kernelversion: 1
target: centos
output:
module: /tmp/falco_amazonlinux_4.14.26-46.32.amzn1.x86_64.ko
module: /tmp/falco-centos6.ko
driverversion: master
```

## amazonlinux 2
## centos 7

```yaml
kernelrelease: 4.14.171-136.231.amzn2.x86_64
target: amazonlinux2
kernelrelease: 3.10.0-957.12.2.el7.x86_64
kernelversion: 1
target: centos
output:
module: /tmp/falco_amazonlinux2_4.14.171-136.231.amzn2.x86_64.ko
probe: /tmp/falco_amazonlinux2_4.14.171-136.231.amzn2.x86_64.o
module: /tmp/falco-centos7.ko
driverversion: master
```

## amazonlinux 2022
## centos 8

```yaml
kernelrelease: 5.10.96-90.460.amzn2022.x86_64
target: amazonlinux2022
kernelrelease: 4.18.0-147.5.1.el8_1.x86_64
kernelversion: 1
target: centos
output:
module: /tmp/falco_amazonlinux2022_5.10.96-90.460.amzn2022.x86_64.ko
probe: /tmp/falco_amazonlinux2022_5.10.96-90.460.amzn2022.x86_64.o
module: /tmp/falco-centos8.ko
driverversion: master
```

Expand All @@ -147,6 +146,17 @@ target: debian
driverversion: master
```

## fedora

```yaml
kernelrelease: 5.19.16-200.fc36.x86_64
kernelversion: 1
target: fedora
output:
module: /tmp/falco-fedora.ko
driverversion: master
```

## flatcar

Example configuration file to build both the Kernel module and eBPF probe for Flatcar.
Expand Down Expand Up @@ -176,38 +186,15 @@ output:
kernelconfigdata: Q09ORklHX0ZBTk9USUZZPXkKQ09ORklHX0t...
```

## archlinux

Example configuration file to build both the Kernel module and eBPF probe for Archlinux.
Note: archlinux target uses the [Arch Linux Archive](https://wiki.archlinux.org/title/Arch_Linux_Archive) to fetch
all ever supported kernel releases.
For arm64, it uses an user-provided mirror, as no official mirror is available: http://tardis.tiny-vps.com/aarm/.
The mirror has been up and updated since 2015.

NOTE: ArchLinux has updated to Linux Kernel 6.0+, which appears to enforce generation of BTF for kmod too. The typical Debian container builders in the repo currently do not work for building ArchLinux drivers as a result. While an agreement is being reached on how to handle this upstream, using a custom `--builderimage` with ArchLinux drivers works for now. For example:
```Dockerfile
# archlinux builder example
# Note: ArchLinux is a rolling release, the gcc versions and such will change over time
# pinned for now for gcc 11/12
FROM archlinux:base-20221030.0.98412
RUN pacman -Sy && pacman -Sy --noconfirm \
make \
pahole \
gcc11 \
gcc && \
ln -s /usr/bin/gcc /usr/bin/gcc-12
```
## oracle linux 8

```yaml
kernelrelease: 5.4.17-2011.3.2.1.el8uek.x86_64
kernelversion: 1
kernelrelease: 6.0.6.arch1-1
target: arch
target: ol
output:
module: /tmp/falco-arch.ko
probe: /tmp/falco-arch.o
module: /tmp/falco-ol8.ko
driverversion: master
builderimage: ${ARCH_BUILD_IMAGE_HERE}
```

## redhat 7
Expand Down Expand Up @@ -301,6 +288,63 @@ RUN yum install gcc elfutils-libelf-devel kmod make cpio llvm-toolset -y
| :exclamation: **subscription-manager does not work on RHEL9 containers**: Host must have a valid RHEL subscription |
|--------------------------------------------------------------------------------------------------------------------|

## rocky linux

```yaml
kernelrelease: 5.14.0-162.18.1.el9_1.x86_64
target: rocky
output:
module: /tmp/falco_almalinux_5.14.0-162.18.1.el9_1.x86_64.ko
probe: /tmp/falco_almalinux_5.14.0-162.18.1.el9_1.x86_64.o
driverversion: master
```
## ubuntu
Example configuration file to build both the Kernel module and eBPF probe for Ubuntu (works with any flavor!).
```yaml
kernelrelease: 5.0.0-1021-aws-5.0
kernelversion: 24~18.04.1
target: ubuntu
output:
module: /tmp/falco-ubuntu-generic.ko
probe: /tmp/falco-ubuntu-generic.o
driverversion: master
```
## ubuntu-aws
Example configuration file to build both the Kernel module and eBPF probe for Ubuntu AWS.
```yaml
kernelrelease: 4.15.0-1057-aws
kernelversion: 59
target: ubuntu-aws
output:
module: /tmp/falco-ubuntu-aws.ko
probe: /tmp/falco-ubuntu-aws.o
driverversion: master
```
> **NOTE:** ubuntu-aws exists to retain backward compatibility only,
> and should not be used in new configs.
## ubuntu-generic
Example configuration file to build both the Kernel module and eBPF probe for Ubuntu generic.
```yaml
kernelrelease: 4.15.0-72-generic
kernelversion: 81
target: ubuntu-generic
output:
module: /tmp/falco-ubuntu-generic.ko
probe: /tmp/falco-ubuntu-generic.o
driverversion: master
```
> **NOTE:** ubuntu-generic exists to retain backward compatibility only,
> and should not be used in new configs.
## vanilla
In case of vanilla, you also need to pass the kernel config data in base64 format.
Expand Down

0 comments on commit 36f6d1f

Please sign in to comment.