Skip to content

Commit

Permalink
update(scripts): changes to falco-driver-loader to support the Falco
Browse files Browse the repository at this point in the history
eBPF probes coming from the drivers build grid

Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
  • Loading branch information
leodido and fntlnz committed Apr 23, 2020
1 parent 4b8177a commit 58958bf
Showing 1 changed file with 44 additions and 60 deletions.
104 changes: 44 additions & 60 deletions scripts/falco-driver-loader
Original file line number Diff line number Diff line change
Expand Up @@ -102,16 +102,16 @@ get_kernel_config() {
}

get_target_id() {
if [ -f /etc/os-release ]; then
if [ -f "${HOST_ROOT}/etc/os-release" ]; then
# freedesktop.org and systemd
# shellcheck source=/dev/null
source "/etc/os-release"
OS_ID=$ID
elif [ -f /etc/debian_version ]; then
elif [ -f "${HOST_ROOT}/etc/debian_version" ]; then
# Older Debian
# fixme > can this happen on older Ubuntu?
OS_ID=debian
elif [ -f /etc/centos-release ]; then
elif [ -f "${HOST_ROOT}/etc/centos-release" ]; then
# Older CentOS
OS_ID=centos
else
Expand Down Expand Up @@ -156,45 +156,45 @@ load_kernel_module() {
exit 1
fi

echo "* Unloading ${PROBE_NAME}, if present"
rmmod "${PROBE_NAME}" 2>/dev/null
echo "* Unloading ${DRIVER_NAME}, if present"
rmmod "${DRIVER_NAME}" 2>/dev/null
WAIT_TIME=0
KMOD_NAME=$(echo "${PROBE_NAME}" | tr "-" "_")
KMOD_NAME=$(echo "${DRIVER_NAME}" | tr "-" "_")
while lsmod | grep "${KMOD_NAME}" > /dev/null 2>&1 && [ $WAIT_TIME -lt "${MAX_RMMOD_WAIT}" ]; do
if rmmod "${PROBE_NAME}" 2>/dev/null; then
echo "* Unloading ${PROBE_NAME} succeeded after ${WAIT_TIME}s"
if rmmod "${DRIVER_NAME}" 2>/dev/null; then
echo "* Unloading ${DRIVER_NAME} succeeded after ${WAIT_TIME}s"
break
fi
((++WAIT_TIME))
if (( WAIT_TIME % 5 == 0 )); then
echo "* ${PROBE_NAME} still loaded, waited ${WAIT_TIME}s (max wait ${MAX_RMMOD_WAIT}s)"
echo "* ${DRIVER_NAME} still loaded, waited ${WAIT_TIME}s (max wait ${MAX_RMMOD_WAIT}s)"
fi
sleep 1
done

if lsmod | grep "${KMOD_NAME}" > /dev/null 2>&1; then
echo "* ${PROBE_NAME} seems to still be loaded, hoping the best"
echo "* ${DRIVER_NAME} seems to still be loaded, hoping the best"
exit 0
fi

# skip dkms on UEK hosts because it will always fail`
if [[ $(uname -r) == *uek* ]]; then
echo "* Skipping dkms install for UEK host"
else
if hash dkms &>/dev/null && dkms install -m "${PACKAGE_NAME}" -v "${DRIVER_VERSION}" -k "${KERNEL_RELEASE}" 2>/dev/null; then
echo "* Trying to load a dkms ${PROBE_NAME}, if present"
if hash dkms &>/dev/null && dkms install -m "${DRIVER_NAME}" -v "${DRIVER_VERSION}" -k "${KERNEL_RELEASE}" 2>/dev/null; then
echo "* Trying to load a dkms ${DRIVER_NAME}, if present"

if insmod "/var/lib/dkms/${PACKAGE_NAME}/${DRIVER_VERSION}/${KERNEL_RELEASE}/${ARCH}/module/${PROBE_NAME}.ko" > /dev/null 2>&1; then
echo "${PROBE_NAME} found and loaded in dkms"
if insmod "/var/lib/dkms/${DRIVER_NAME}/${DRIVER_VERSION}/${KERNEL_RELEASE}/${ARCH}/module/${DRIVER_NAME}.ko" > /dev/null 2>&1; then
echo "${DRIVER_NAME} found and loaded in dkms"
exit 0
elif insmod "/var/lib/dkms/${PACKAGE_NAME}/${DRIVER_VERSION}/${KERNEL_RELEASE}/${ARCH}/module/${PROBE_NAME}.ko.xz" > /dev/null 2>&1; then
echo "${PROBE_NAME} found and loaded in dkms (xz)"
elif insmod "/var/lib/dkms/${DRIVER_NAME}/${DRIVER_VERSION}/${KERNEL_RELEASE}/${ARCH}/module/${DRIVER_NAME}.ko.xz" > /dev/null 2>&1; then
echo "${DRIVER_NAME} found and loaded in dkms (xz)"
exit 0
else
echo "* Unable to insmod"
fi
else
DKMS_LOG="/var/lib/dkms/${PACKAGE_NAME}/${DRIVER_VERSION}/build/make.log"
DKMS_LOG="/var/lib/dkms/${DRIVER_NAME}/${DRIVER_VERSION}/build/make.log"
if [ -f "${DKMS_LOG}" ]; then
echo "* Running dkms build failed, dumping ${DKMS_LOG}"
cat "${DKMS_LOG}"
Expand All @@ -204,18 +204,18 @@ load_kernel_module() {
fi
fi

echo "* Trying to load a system ${PROBE_NAME}, if present"
echo "* Trying to load a system ${DRIVER_NAME}, if present"

if modprobe "${PROBE_NAME}" > /dev/null 2>&1; then
echo "${PROBE_NAME} found and loaded with modprobe"
if modprobe "${DRIVER_NAME}" > /dev/null 2>&1; then
echo "${DRIVER_NAME} found and loaded with modprobe"
exit 0
fi

echo "* Trying to find precompiled ${PROBE_NAME} for ${KERNEL_RELEASE}"
echo "* Trying to find precompiled ${DRIVER_NAME} for ${KERNEL_RELEASE}"

get_target_id

local FALCO_KERNEL_MODULE_FILENAME="${PROBE_NAME}_${TARGET_ID}_${KERNEL_RELEASE}_${KERNEL_VERSION}.ko"
local FALCO_KERNEL_MODULE_FILENAME="${DRIVER_NAME}_${TARGET_ID}_${KERNEL_RELEASE}_${KERNEL_VERSION}.ko"

if [ -f "${HOME}/.falco/${FALCO_KERNEL_MODULE_FILENAME}" ]; then
echo "Found precompiled module at ~/.falco/${FALCO_KERNEL_MODULE_FILENAME}, loading module"
Expand All @@ -224,15 +224,15 @@ load_kernel_module() {
fi

local URL
URL=$(echo "${PROBE_URL}/kernel-module/${DRIVER_VERSION}/${FALCO_KERNEL_MODULE_FILENAME}" | sed s/+/%2B/g)
URL=$(echo "${DRIVERS_REPO}/kernel-module/${DRIVER_VERSION}/${FALCO_KERNEL_MODULE_FILENAME}" | sed s/+/%2B/g)

echo "* Trying to download precompiled module from ${URL}"
if curl --create-dirs "${FALCO_PROBE_CURL_OPTIONS}" -o "${HOME}/.falco/${FALCO_KERNEL_MODULE_FILENAME}" "${URL}"; then
if curl --create-dirs "${FALCO_DRIVER_CURL_OPTIONS}" -o "${HOME}/.falco/${FALCO_KERNEL_MODULE_FILENAME}" "${URL}"; then
echo "Download succeeded, loading module"
insmod "${HOME}/.falco/${FALCO_KERNEL_MODULE_FILENAME}"
exit $?
else
>&2 echo "Download failed, consider compiling your own ${PROBE_NAME} and loading it or getting in touch with the Falco community"
>&2 echo "Download failed, consider compiling your own ${DRIVER_NAME} and loading it or getting in touch with the Falco community"
exit 1
fi
}
Expand Down Expand Up @@ -260,7 +260,9 @@ load_bpf_probe() {
MINIKUBE_VERSION="$(cat "${HOST_ROOT}/etc/VERSION")"
fi

local BPF_PROBE_FILENAME="${BPF_PROBE_NAME}-${DRIVER_VERSION}-${ARCH}-${KERNEL_RELEASE}-${HASH}.o"
get_target_id

local BPF_PROBE_FILENAME="${DRIVER_NAME}_${TARGET_ID}_${KERNEL_RELEASE}_${KERNEL_VERSION}.o"

if [ ! -f "${HOME}/.falco/${BPF_PROBE_FILENAME}" ]; then

Expand Down Expand Up @@ -304,7 +306,7 @@ load_bpf_probe() {
if [[ greater_ret -eq 1 ]]; then
export KBUILD_EXTRA_CPPFLAGS=-DCOS_73_WORKAROUND
fi
}
}
fi

if [ -n "${MINIKUBE}" ]; then
Expand Down Expand Up @@ -338,7 +340,7 @@ load_bpf_probe() {
mkdir -p /tmp/kernel
cd /tmp/kernel || exit
cd "$(mktemp -d -p /tmp/kernel)" || exit
if ! curl -o kernel-sources.tgz --create-dirs "${FALCO_PROBE_CURL_OPTIONS}" "${BPF_KERNEL_SOURCES_URL}"; then
if ! curl -o kernel-sources.tgz --create-dirs "${FALCO_DRIVER_CURL_OPTIONS}" "${BPF_KERNEL_SOURCES_URL}"; then
exit 1;
fi

Expand All @@ -360,12 +362,12 @@ load_bpf_probe() {
customize_kernel_build
fi

echo "* Trying to compile BPF probe ${BPF_PROBE_NAME} (${BPF_PROBE_FILENAME})"
echo "* Trying to compile BPF probe (${BPF_PROBE_FILENAME})"

make -C "/usr/src/${PACKAGE_NAME}-${DRIVER_VERSION}/bpf" > /dev/null
make -C "/usr/src/${DRIVER_NAME}-${DRIVER_VERSION}/bpf" > /dev/null

mkdir -p ~/.falco
mv "/usr/src/${PACKAGE_NAME}-${DRIVER_VERSION}/bpf/probe.o" "${HOME}/.falco/${BPF_PROBE_FILENAME}"
mkdir -p "${HOME}/.falco"
mv "/usr/src/${DRIVER_NAME}-${DRIVER_VERSION}/bpf/probe.o" "${HOME}/.falco/${BPF_PROBE_FILENAME}"

if [ -n "${BPF_KERNEL_SOURCES_URL}" ]; then
rm -r /tmp/kernel
Expand All @@ -374,11 +376,11 @@ load_bpf_probe() {

if [ ! -f "${HOME}/.falco/${BPF_PROBE_FILENAME}" ]; then
local URL
URL=$(echo "${PROBE_URL}/ebpf-probe/${DRIVER_VERSION}/${BPF_PROBE_FILENAME}" | sed s/+/%2B/g)
URL=$(echo "${DRIVERS_REPO}/ebpf-probe/${DRIVER_VERSION}/${BPF_PROBE_FILENAME}" | sed s/+/%2B/g)

echo "* Trying to download precompiled BPF probe from ${URL}"

curl --create-dirs "${FALCO_PROBE_CURL_OPTIONS}" -o "${HOME}/.falco/${BPF_PROBE_FILENAME}" "${URL}"
curl --create-dirs "${FALCO_DRIVER_CURL_OPTIONS}" -o "${HOME}/.falco/${BPF_PROBE_FILENAME}" "${URL}"
fi

if [ -f "${HOME}/.falco/${BPF_PROBE_FILENAME}" ]; then
Expand All @@ -393,7 +395,7 @@ load_bpf_probe() {

echo "* BPF probe located, it's now possible to start falco"

ln -sf "${HOME}/.falco/${BPF_PROBE_FILENAME}" "${HOME}/.falco/${BPF_PROBE_NAME}.o"
ln -sf "${HOME}/.falco/${BPF_PROBE_FILENAME}" "${HOME}/.falco/${DRIVER_NAME}-bpf.o"
exit $?
else
echo "* Failure to find a BPF probe"
Expand All @@ -404,29 +406,21 @@ load_bpf_probe() {
ARCH=$(uname -m)
KERNEL_RELEASE=$(uname -r)
KERNEL_VERSION=$(uname -v | sed 's/#\([[:digit:]]\+\).*/\1/')
SCRIPT_NAME=$(basename "${0}")
PROBE_URL=${PROBE_URL:-"@DRIVER_LOOKUP_URL@"}
if [ -n "$PROBE_INSECURE_DOWNLOAD" ]
DRIVERS_REPO=${DRIVERS_REPO:-"@DRIVERS_REPO@"}
if [ -n "$DRIVER_INSECURE_DOWNLOAD" ]
then
FALCO_PROBE_CURL_OPTIONS=-fsSk
FALCO_DRIVER_CURL_OPTIONS=-fsSk
else
FALCO_PROBE_CURL_OPTIONS=-fsS
FALCO_DRIVER_CURL_OPTIONS=-fsS
fi

MAX_RMMOD_WAIT=60
if [[ $# -ge 1 ]]; then
MAX_RMMOD_WAIT=$1
fi

if [ "${SCRIPT_NAME}" = "falco-driver-loader" ]; then
DRIVER_VERSION="@PROBE_VERSION@"
PROBE_NAME="@PROBE_NAME@"
BPF_PROBE_NAME="@PROBE_NAME@-bpf"
PACKAGE_NAME="@PACKAGE_NAME@"
else
echo "This script must be called as falco-driver-loader"
exit 1
fi
DRIVER_VERSION="@PROBE_VERSION@"
DRIVER_NAME="@PROBE_NAME@"

if [ "$(id -u)" != 0 ]; then
echo "Installer must be run as root (or with sudo)."
Expand All @@ -442,14 +436,4 @@ if [ -v FALCO_BPF_PROBE ] || [ "${1}" = "bpf" ]; then
load_bpf_probe
else
load_kernel_module
fi

# sudo falco-driver-loader
#
# env variables:
# PROBE_URL="..."
# PROBE_INSECURE_DOWNLOAD=true

# RENAMES
# PROBE_URL
# FALCO_PROBE_CURL_OPTIONS
fi

0 comments on commit 58958bf

Please sign in to comment.