Falco: Falco bpf driver does not build from source on CentOS 8

[smijolovic]

Falco version: 0.21.0
CentOS 8.1
kernel version 4.18.0-147.5.1.el8_1.x86_64

cmake -DBUILD_BPF=ON ..
make bpf

In file included from /home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/probe.c:23:
/home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/fillers.h:1369:21: error: no member named 'pids' in 'struct task_struct'
return _READ(task->pids[PIDTYPE_PID].pid);
~~ ^
/home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/plumbing_helpers.h:18:28: note: expanded from macro '_READ'
#define _READ(P) ({ typeof(P) _val;
^
In file included from /home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/probe.c:23:
/home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/fillers.h:1369:21: error: no member named 'pids' in 'struct task_struct'
return _READ(task->pids[PIDTYPE_PID].pid);
~~ ^
/home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/plumbing_helpers.h:20:44: note: expanded from macro '_READ'
bpf_probe_read(&_val, sizeof(_val), &P);
^
In file included from /home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/probe.c:23:
/home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/fillers.h:1369:9: error: returning 'void' from a function with incompatible result type
'struct pid '
return _READ(task->pids[PIDTYPE_PID].pid);
^~~~~~~~
/home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/plumbing_helpers.h:18:18: note: expanded from macro '_READ'
#define _READ(P) ({ typeof(P) _val;
^~~~~~~~~~
In file included from /home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/probe.c:23:
/home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/fillers.h:1426:15: error: use of undeclared identifier '__PIDTYPE_TGID'; did you mean
'PIDTYPE_TGID'?
if (type == __PIDTYPE_TGID)
^~~~
PIDTYPE_TGID
./include/linux/pid.h:13:2: note: 'PIDTYPE_TGID' declared here
PIDTYPE_TGID,
^
In file included from /home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/probe.c:23:
/home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/fillers.h:1432:33: error: no member named 'pids' in 'struct task_struct'
nr = bpf_pid_nr_ns(_READ(task->pids[type].pid), ns);
~~ ^
/home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/plumbing_helpers.h:18:28: note: expanded from macro '_READ'
#define _READ(P) ({ typeof(P) _val;
^
In file included from /home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/probe.c:23:
/home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/fillers.h:1432:33: error: no member named 'pids' in 'struct task_struct'
nr = bpf_pid_nr_ns(_READ(task->pids[type].pid), ns);
~~ ^
/home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/plumbing_helpers.h:20:44: note: expanded from macro '_READ'
bpf_probe_read(&_val, sizeof(_val), &P);
^
In file included from /home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/probe.c:23:
/home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/fillers.h:1432:21: error: passing 'void' to parameter of incompatible type
'struct pid *'
nr = bpf_pid_nr_ns(_READ(task->pids[type].pid), ns);
^~~~~~~
/home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/plumbing_helpers.h:18:18: note: expanded from macro '_READ'
#define _READ(P) ({ typeof(P) _val;
^~~~~~~~~~
/home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/fillers.h:1389:56: note: passing argument to parameter 'pid' here
static __always_inline pid_t bpf_pid_nr_ns(struct pid *pid,
^
/home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/fillers.h:1448:34: error: use of undeclared identifier '__PIDTYPE_TGID'; did you mean
'PIDTYPE_TGID'?
return bpf_task_pid_nr_ns(task, __PIDTYPE_TGID, NULL);
^~~~~~
PIDTYPE_TGID
./include/linux/pid.h:13:2: note: 'PIDTYPE_TGID' declared here
PIDTYPE_TGID,
^
8 errors generated.
make[6]: [/home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/Makefile:33: /home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/probe.o] Error 1
make[5]: [Makefile:1547: _module_/home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf] Error 2
make[5]: Leaving directory '/usr/src/kernels/4.18.0-147.5.1.el8_1.x86_64'
make[4]: [Makefile:18: all] Error 2
make[4]: Leaving directory '/home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf'
make[3]: [driver/bpf/CMakeFiles/bpf.dir/build.make:60: driver/bpf/CMakeFiles/bpf] Error 2
make[3]: Leaving directory '/home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build'
make[2]: [CMakeFiles/Makefile2:623: driver/bpf/CMakeFiles/bpf.dir/all] Error 2
make[2]: Leaving directory '/home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build'
make[1]: [CMakeFiles/Makefile2:635: driver/bpf/CMakeFiles/bpf.dir/rule] Error 2
make[1]: Leaving directory '/home/rpmbuild/nimbus8/falco-build/falco-src/falco-0.21.0/build'
make: ** [Makefile:371: bpf] Error 2

Digging into the fillers.h file, I noticed the following 4 lines:
1368 #if LINUX_VERSION_CODE < KERNEL_VERSION(4, 19, 0)
1405 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 19, 0)
1424 #if LINUX_VERSION_CODE < KERNEL_VERSION(4, 19, 0)
1447 #if LINUX_VERSION_CODE < KERNEL_VERSION(4, 19, 0)

It appears as if the kernel versions might be too "forward". When those 4 lines were replaced with:
KERNEL_VERSION(4, 18, 0)

The driver compiled cleanly with no errors or warnings.

[smijolovic]

Looks like that fix would be here:

https://github.com/draios/sysdig/blob/dev/driver/bpf/fillers.h

[fntlnz]

Can you try again against the current master @smijolovic ?
Remember to delete the build folder because it is stateful when you update the driver version and might lead to problems.

[smijolovic]

I'll try that tomorrow for sure.

I bumped into this issue on 0.21.0 which was holding me up - https://github.com/falcosecurity/falco/issues/896 - that seems to be addressed for the next release as well (I hope)

[smijolovic]

Same issue on master:

Scanning dependencies of target bpf
make[3]: Leaving directory '/home/rpmbuild/nimbus8/falco-build/falco-src/falco/build'
make -f driver/bpf/CMakeFiles/bpf.dir/build.make driver/bpf/CMakeFiles/bpf.dir/build
make[3]: Entering directory '/home/rpmbuild/nimbus8/falco-build/falco-src/falco/build'
cd /home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf && make
make[4]: Entering directory '/home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf'
make -C /lib/modules/4.18.0-147.8.1.el8_1.x86_64/build M=$PWD
make[5]: Entering directory '/usr/src/kernels/4.18.0-147.8.1.el8_1.x86_64'
clang -I./arch/x86/include -I./arch/x86/include/generated -I./include/drm-backport -I./include -I./arch/x86/include/uapi -I./arch/x86/include/generated/uapi -I./include/uapi -I./include/generated/uapi -include ./include/linux/kconfig.h
-D__KERNEL__


-D__KERNEL__
-D__BPF_TRACING__
-Wno-gnu-variable-sized-type-not-at-end
-Wno-address-of-packed-member
-fno-jump-tables
-fno-stack-protector
-Wno-tautological-compare
-O2 -g -emit-llvm -c /home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/probe.c -o /home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/probe.ll
In file included from /home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/probe.c:23:
/home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/fillers.h:1369:21: error: no member named 'pids' in
'struct task_struct'
return _READ(task->pids[PIDTYPE_PID].pid);
~~ ^
/home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/plumbing_helpers.h:18:28: note: expanded from macro '_READ'
#define _READ(P) ({ typeof(P) _val;
^
In file included from /home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/probe.c:23:
/home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/fillers.h:1369:21: error: no member named 'pids' in
'struct task_struct'
return _READ(task->pids[PIDTYPE_PID].pid);
~~ ^
/home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/plumbing_helpers.h:20:44: note: expanded from macro '_READ'
bpf_probe_read(&_val, sizeof(_val), &P);
^
In file included from /home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/probe.c:23:
/home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/fillers.h:1369:9: error: returning 'void' from a function with
incompatible result type 'struct pid '
return _READ(task->pids[PIDTYPE_PID].pid);
^~~~~~~~
/home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/plumbing_helpers.h:18:18: note: expanded from macro '_READ'
#define _READ(P) ({ typeof(P) _val;
^~~~~~~~~~
In file included from /home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/probe.c:23:
/home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/fillers.h:1426:15: error: use of undeclared identifier
'__PIDTYPE_TGID'; did you mean 'PIDTYPE_TGID'?
if (type == __PIDTYPE_TGID)
^~~~
PIDTYPE_TGID
./include/linux/pid.h:13:2: note: 'PIDTYPE_TGID' declared here
PIDTYPE_TGID,
^
In file included from /home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/probe.c:23:
/home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/fillers.h:1432:33: error: no member named 'pids' in
'struct task_struct'
nr = bpf_pid_nr_ns(_READ(task->pids[type].pid), ns);
~~ ^
/home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/plumbing_helpers.h:18:28: note: expanded from macro '_READ'
#define _READ(P) ({ typeof(P) _val;
^
In file included from /home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/probe.c:23:
/home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/fillers.h:1432:33: error: no member named 'pids' in
'struct task_struct'
nr = bpf_pid_nr_ns(_READ(task->pids[type].pid), ns);
~~ ^
/home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/plumbing_helpers.h:20:44: note: expanded from macro '_READ'
bpf_probe_read(&_val, sizeof(_val), &P);
^
In file included from /home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/probe.c:23:
/home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/fillers.h:1432:21: error: passing 'void' to parameter of incompatible
type 'struct pid *'
nr = bpf_pid_nr_ns(_READ(task->pids[type].pid), ns);
^~~~~~~
/home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/plumbing_helpers.h:18:18: note: expanded from macro '_READ'
#define _READ(P) ({ typeof(P) _val;
^~~~~~~~~~
/home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/fillers.h:1389:56: note: passing argument to parameter 'pid' here
static __always_inline pid_t bpf_pid_nr_ns(struct pid *pid,
^
/home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/fillers.h:1448:34: error: use of undeclared identifier
'__PIDTYPE_TGID'; did you mean 'PIDTYPE_TGID'?
return bpf_task_pid_nr_ns(task, __PIDTYPE_TGID, NULL);
^~~~~~
PIDTYPE_TGID
./include/linux/pid.h:13:2: note: 'PIDTYPE_TGID' declared here
PIDTYPE_TGID,
^
8 errors generated.
make[6]: [/home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/Makefile:33: /home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/probe.o] Error 1
make[5]: [Makefile:1547: _module_/home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf] Error 2
make[5]: Leaving directory '/usr/src/kernels/4.18.0-147.8.1.el8_1.x86_64'
make[4]: [Makefile:18: all] Error 2
make[4]: Leaving directory '/home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf'
make[3]: [driver/bpf/CMakeFiles/bpf.dir/build.make:60: driver/bpf/CMakeFiles/bpf] Error 2
make[3]: Leaving directory '/home/rpmbuild/nimbus8/falco-build/falco-src/falco/build'
make[2]: [CMakeFiles/Makefile2:623: driver/bpf/CMakeFiles/bpf.dir/all] Error 2
make[2]: Leaving directory '/home/rpmbuild/nimbus8/falco-build/falco-src/falco/build'
make[1]: [CMakeFiles/Makefile2:635: driver/bpf/CMakeFiles/bpf.dir/rule] Error 2
make[1]: Leaving directory '/home/rpmbuild/nimbus8/falco-build/falco-src/falco/build'
make: ** [Makefile:371: bpf] Error 2

The same solution (sed -i "s/KERNEL_VERSION.*/KERNEL_VERSION(4, 18, 0)/g" fillers.h) allows the driver to compile.

[smijolovic]

Bump

Seeing the same exact issue on 0.22.1 as well.

Same fix (sed -i "s/KERNEL_VERSION.*/KERNEL_VERSION(4, 18, 0)/g" fillers.h) works.

[leodido]

/milestone 0.23.0

[leodido]

/assign @leodido

/assign @fntlnz

[leodido]

@smijolovic we investigated the issue you have reported and made some changes to the driver code about vpid (look here).

That code builds now, but we need some time to investigate it also works correctly at runtime!

It would be awesome if you could try it, debug it a bit and tell us what you discovered. It'd help us a lot! :)

[smijolovic]

I can pull from master and run it later today, assuming it's checked in.

[smijolovic]

Sorry for the delay.

Still seeing errors on the build of the driver:

Scanning dependencies of target bpf
make[3]: Leaving directory '/home/rpmbuild/nimbus8/falco-build/falco-src/falco/build'
make -f driver/bpf/CMakeFiles/bpf.dir/build.make driver/bpf/CMakeFiles/bpf.dir/build
make[3]: Entering directory '/home/rpmbuild/nimbus8/falco-build/falco-src/falco/build'
cd /home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf && make
make[4]: Entering directory '/home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf'
make -C /lib/modules/4.18.0-147.8.1.el8_1.x86_64/build M=$PWD
make[5]: Entering directory '/usr/src/kernels/4.18.0-147.8.1.el8_1.x86_64'
clang -I./arch/x86/include -I./arch/x86/include/generated -I./include/drm-backport -I./include -I./arch/x86/include/uapi -I./arch/x86/include/generated/uapi -I./include/uapi -I./include/generated/uapi -include ./include/linux/kconfig.h
-D__KERNEL__


-D__KERNEL__
-D__BPF_TRACING__
-Wno-gnu-variable-sized-type-not-at-end
-Wno-address-of-packed-member
-fno-jump-tables
-fno-stack-protector
-Wno-tautological-compare
-O2 -g -emit-llvm -c /home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/probe.c -o /home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/probe.ll
In file included from /home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/probe.c:23:
/home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/fillers.h:1393:21: error: no member named 'pids' in 'struct task_struct'
return _READ(task->pids[PIDTYPE_PID].pid);
~~ ^
/home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/plumbing_helpers.h:18:28: note: expanded from macro '_READ'
#define _READ(P) ({ typeof(P) _val;
^
In file included from /home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/probe.c:23:
/home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/fillers.h:1393:21: error: no member named 'pids' in 'struct task_struct'
return _READ(task->pids[PIDTYPE_PID].pid);
~~ ^
/home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/plumbing_helpers.h:20:44: note: expanded from macro '_READ'
bpf_probe_read(&_val, sizeof(_val), &P);
^
In file included from /home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/probe.c:23:
/home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/fillers.h:1393:9: error: returning 'void' from a function with incompatible result type
'struct pid '
return _READ(task->pids[PIDTYPE_PID].pid);
^~~~~~~~
/home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/plumbing_helpers.h:18:18: note: expanded from macro '_READ'
#define _READ(P) ({ typeof(P) _val;
^~~~~~~~~~
In file included from /home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/probe.c:23:
/home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/fillers.h:1450:15: error: use of undeclared identifier '__PIDTYPE_TGID'; did you mean
'PIDTYPE_TGID'?
if (type == __PIDTYPE_TGID)
^~~~
PIDTYPE_TGID
./include/linux/pid.h:13:2: note: 'PIDTYPE_TGID' declared here
PIDTYPE_TGID,
^
In file included from /home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/probe.c:23:
/home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/fillers.h:1456:33: error: no member named 'pids' in 'struct task_struct'
nr = bpf_pid_nr_ns(_READ(task->pids[type].pid), ns);
~~ ^
/home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/plumbing_helpers.h:18:28: note: expanded from macro '_READ'
#define _READ(P) ({ typeof(P) _val;
^
In file included from /home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/probe.c:23:
/home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/fillers.h:1456:33: error: no member named 'pids' in 'struct task_struct'
nr = bpf_pid_nr_ns(_READ(task->pids[type].pid), ns);
~~ ^
/home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/plumbing_helpers.h:20:44: note: expanded from macro '_READ'
bpf_probe_read(&_val, sizeof(_val), &P);
^
In file included from /home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/probe.c:23:
/home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/fillers.h:1456:21: error: passing 'void' to parameter of incompatible type 'struct pid *'
nr = bpf_pid_nr_ns(_READ(task->pids[type].pid), ns);
^~~~~~~
/home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/plumbing_helpers.h:18:18: note: expanded from macro '_READ'
#define _READ(P) ({ typeof(P) _val;
^~~~~~~~~~
/home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/fillers.h:1413:56: note: passing argument to parameter 'pid' here
static __always_inline pid_t bpf_pid_nr_ns(struct pid *pid,
^
/home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/fillers.h:1472:34: error: use of undeclared identifier '__PIDTYPE_TGID'; did you mean
'PIDTYPE_TGID'?
return bpf_task_pid_nr_ns(task, __PIDTYPE_TGID, NULL);
^~~~~~
PIDTYPE_TGID
./include/linux/pid.h:13:2: note: 'PIDTYPE_TGID' declared here
PIDTYPE_TGID,
^
8 errors generated.
make[6]: [/home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/Makefile:33: /home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf/probe.o] Error 1
make[5]: [Makefile:1547: _module_/home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf] Error 2
make[5]: Leaving directory '/usr/src/kernels/4.18.0-147.8.1.el8_1.x86_64'
make[4]: [Makefile:18: all] Error 2
make[4]: Leaving directory '/home/rpmbuild/nimbus8/falco-build/falco-src/falco/build/sysdig-repo/sysdig-prefix/src/sysdig/driver/bpf'
make[3]: [driver/bpf/CMakeFiles/bpf.dir/build.make:60: driver/bpf/CMakeFiles/bpf] Error 2
make[3]: Leaving directory '/home/rpmbuild/nimbus8/falco-build/falco-src/falco/build'
make[2]: [CMakeFiles/Makefile2:623: driver/bpf/CMakeFiles/bpf.dir/all] Error 2
make[2]: Leaving directory '/home/rpmbuild/nimbus8/falco-build/falco-src/falco/build'
make[1]: [CMakeFiles/Makefile2:635: driver/bpf/CMakeFiles/bpf.dir/rule] Error 2
make[1]: Leaving directory '/home/rpmbuild/nimbus8/falco-build/falco-src/falco/build'
make: ** [Makefile:371: bpf] Error 2

[fntlnz]

Still working on this, got a bit delayed but it's a priority.

[smijolovic]

no worries - the workaround is still addressing the short term issue.

[fntlnz]

We just pushed a fix for this https://github.com/draios/sysdig/pull/1650

Once it's merged there we can include it in Falco.