Falco: Falco service "active (exited)" on Ubuntu 16.04 (systemd)

[JPLachance]

Hello!

I am currently running Falco 0.14.0 on production instances and I noticed Falco stopped running on multiple Ubuntu 16.04 hosts.

root@some-host:/var/run# service falco status
● falco.service - LSB: Falco syscall activity monitoring agent
   Loaded: loaded (/etc/init.d/falco; bad; vendor preset: enabled)
   Active: active (exited) since Mon 2019-05-27 05:58:49 UTC; 4 days ago
     Docs: man:systemd-sysv-generator(8)
    Tasks: 0
   Memory: 0B
      CPU: 0

After discussing with @fntlnz, the issue is most likely caused by the lack of systemd Unit definition and systemd doesn't know what he needs to do.

Issue #484 related to this one but in my case, Falco stopping and not restarting looks more like a bug. 🙂

Thanks for the help!

[JPLachance]

Hello again!

The current systemd falco.service file (/run/systemd/generator.late/falco.service) content is:

# Automatically generated by systemd-sysv-generator

[Unit]
Documentation=man:systemd-sysv-generator(8)
SourcePath=/etc/init.d/falco
Description=LSB: Falco syscall activity monitoring agent
Before=multi-user.target
Before=multi-user.target
Before=multi-user.target
Before=graphical.target
Before=shutdown.target
After=remote-fs.target
After=systemd-journald-dev-log.socket
Conflicts=shutdown.target

[Service]
Type=forking
Restart=no
TimeoutSec=5min
IgnoreSIGPIPE=no
KillMode=process
GuessMainPID=no
RemainAfterExit=yes
ExecStart=/etc/init.d/falco start
ExecStop=/etc/init.d/falco stop

The one suggested by @juju4 is:

[Unit]
Description=Falco: Container Native Runtime Security

[Service]
Type=simple
User=root
ExecStart=/usr/bin/falco --pidfile=/var/run/falco.pid
UMask=0077
TimeoutSec=30
RestartSec=15s
#Restart=always
Restart=on-failure
PrivateTmp=true
NoNewPrivileges=yes
PrivateTmp=true
ProtectHome=read-only
ProtectSystem=full
ProtectKernelTunables=true
RestrictRealtime=true
#RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
RestrictAddressFamilies=~AF_PACKET
SystemCallFilter=~@debug @mount @cpu-emulation @obsolete @privileged
# FIXME!
#   PANIC: unprotected error in call to Lua API (runtime code generation failed, restricted kernel?)
#   ?https://www.freelists.org/post/luajit/luajit-crashes-with-grsec-kernel,1
#MemoryDenyWriteExecute=true
#PrivateMounts=true

[Install]
WantedBy=multi-user.target

The Type change (from Type=forking to Type=simple) and the Restart=on-failure should help!

[fntlnz]

/area integrations

[fntlnz]

@JPLachance that seems like a good idea, would you like to contribute that change? Let me know otherwise I'll do it.

[JPLachance]

Unfortunately, I'm totally clueless about how we build, package and publish a DEB package 🙂 I could try something, but it won't be in the next few days. Can you handle it? I'll be happy to test it!

[fntlnz]

@mstemm to do this we just edit the files in the scripts folder? I see those there but I don’t understand where the actual build is done and when.

[mstemm]

We don't currently include a systemd unit file, so we'd have to figure out where it should be within the binary packages to get installed properly.

[mfdii]

Discussed on office hours. We will start shipping the systemd unit file.

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[mstemm]

We should keep this on the roadmap.

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[JPLachance]

That bot is a little bit annoying 😄

[leodido]

I planned to create a smarter one (with prow) time ago (see
https://github.com/falcosecurity/test-infra/issues/40) ..

I just need some spare time! :)

Or maybe someone implementing and
contributing it (I can give directions about it) :)
L.

On Tue, Oct 15, 2019 at 5:16 PM Jean-Philippe Lachance <
[email protected]> wrote:

That bot is a little bit annoying 😄

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
https://github.com/falcosecurity/falco/issues/640?email_source=notifications&email_token=AAA5J4ZZXHHLSXEBG3BWZGDQOXNFBA5CNFSM4HR5VJPKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEBJEZDA#issuecomment-542264460,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AAA5J43PP64ZZB7Y3FFFQQTQOXNFBANCNFSM4HR5VJPA
.

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[JPLachance]

Again, we should keep this on the roadmap :)

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[JPLachance]

This issue was not fixed. We should address it...

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[JPLachance]

Hello @mfdii,

Did we progress on this issue? Or is it just that bot again? :)

Thanks!

[leogr]

Hey @JPLachance

re-opening this as discussed

[leogr]

/kind bug

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions. Issues labeled "cncf", "roadmap" and "help wanted" will not be automatically closed. Please refer to a maintainer to get such label added if you think this should be kept open.

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[leogr]

Link here as ref https://github.com/falcosecurity/falco/pull/1448

[poiana]

Stale issues rot after 30d of inactivity.

Mark the issue as fresh with /remove-lifecycle rotten.

Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle rotten

[poiana]

Rotten issues close after 30d of inactivity.

Reopen the issue with /reopen.

Mark the issue as fresh with /remove-lifecycle rotten.

Provide feedback via https://github.com/falcosecurity/community.
/close

[poiana]

@poiana: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.

Reopen the issue with /reopen.

Mark the issue as fresh with /remove-lifecycle rotten.

Provide feedback via https://github.com/falcosecurity/community.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.