Falco: Falco can't load BPF probe in GKE

[degilq]

/kind @gnosek #1130
Im using falcosecurity/falco:latest and the env

• name: BPF_PROBE
  value: ""
  - name: FALCO_BPF_PROBE
  value: "/root/.falco/falco-probe-bpf.o"

the pods crash with the errors:
Found kernel config at /proc/config.gz

• Trying to download precompiled module from https://s3.amazonaws.com/download.draios.com/stable/sysdig-probe-binaries/falco-probe-latest-x86_64-4.19.102%2B-e0d915406c87215c571075f54ded2193.ko
  curl: (22) The requested URL returned error: 404 Not Found
  Download failed, consider compiling your own falco-probe and loading it or getting in touch with the Falco community
  Mon Apr 6 16:27:03 2020: Falco initialized with configuration file /etc/falco/falco.yaml
  Mon Apr 6 16:27:03 2020: Loading rules from file /etc/falco/falco_rules.yaml:
  Mon Apr 6 16:27:04 2020: Loading rules from file /etc/falco/falco_rules.local.yaml:
  Mon Apr 6 16:27:05 2020: Unable to load the driver. Exiting.
  Mon Apr 6 16:27:05 2020: Runtime error: error opening device /dev/falco0. Make sure you have root credentials and that the falco-probe module is loaded.. Exiting.

[degilq]

/area kernel-module

[DrPhil]

I'm on GKE and using the helm stable charts. I can't run falco 0.19, 0.20 or 0.21. Running 0.18 seems to work.

My error looks very similar.

* Setting up /usr/src links from host
* Mounting debugfs
Found kernel config at /proc/config.gz
* COS detected (build 12371.183.0), using cos kernel headers...
* Downloading https://storage.googleapis.com/cos-tools/12371.183.0/kernel-headers.tgz
* Extracting kernel sources
* Configuring kernel
* Trying to compile BPF probe falco-probe-bpf (falco-probe-bpf-latest-x86_64-4.19.104+-5ca6046631d128fd348208cbca9c777a.o)
make: *** /usr/src/falco-latest/bpf: No such file or directory.  Stop.
mv: cannot stat '/usr/src/falco-latest/bpf/probe.o': No such file or directory
* Trying to download precompiled BPF probe from https://s3.amazonaws.com/download.draios.com/stable/sysdig-probe-binaries/falco-probe-bpf-latest-x86_64-4.19.104%2B-5ca6046631d128fd348208cbca9c777a.o
curl: (22) The requested URL returned error: 404 Not Found
* Failure to find a BPF probe
Wed Apr  8 15:24:28 2020: Falco initialized with configuration file /etc/falco/falco.yaml
Wed Apr  8 15:24:28 2020: Loading rules from file /etc/falco/falco_rules.yaml:
Wed Apr  8 15:24:29 2020: Loading rules from file /etc/falco/falco_rules.local.yaml:
Wed Apr  8 15:24:30 2020: Unable to load the driver. Exiting.
Wed Apr  8 15:24:30 2020: Runtime error: can't open BPF probe '/root/.falco/falco-probe-bpf.o': Errno 2. Exiting.

Using an older version works.
helm install falco stable/falco --set ebpf.enabled=true --version 1.1.0

I also tried using the falco-daemonset-configmap-slim hoping that it would build the probe, but no such luck.

[eihwaz-kob]

For me worked using master instead of 0.19/0.20/0.21.
I hope it helps

[leodido]

Yup, @degilq can you please try running it using the Falco master?

[jakewins]

@leodido dunno about @degilq but can confirm swapping to the master that was just pushed to dockerhub solved this issue for me

[leodido]

So I'll call it a day and close this issue, thanks for reporting falcosecurity/falco:master is working!

In ~2 weeks we'll release a stable version (0.22.0) from the master, too.

@degilq feel free to file new issues if you have other problems. Thanks :)

/close

[poiana]

@leodido: Closing this issue.

In response to this:

So I'll call it a day and close this issue, thanks for reporting falcosecurity/falco:master is working!

In ~2 weeks we'll release a stable version (0.22.0) from the master, too.

@degilq feel free to file new issues if you have other problems. Thanks :)

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[robsonke]

I faced the same issue, I can confirm that master works, but only the full version, the minimal one doesn't.