Falco: 403 when fetching prebuilt driver

[flipstone42]

Describe the bug

Falco gets a 403 error when trying to fetch the pre-built driver on EKS running on Amazon Linux.

How to reproduce it

Attempt to run Falco via the Helm chart on EKS with ami-0c504dda1302b182f.

Expected behaviour

I expected Falco to successfully start. The same version of Falco, on the same cluster and nodes, started successfully yesterday (2020-10-21).

Output

* Setting up /usr/src links from host
* Running falco-driver-loader with: driver=module, compile=yes, download=yes
* Unloading falco module, if present
* Trying to dkms install falco module with GCC /usr/bin/gcc
DIRECTIVE: MAKE="'/tmp/falco-dkms-make'"
* Running dkms build failed, couldn't find /var/lib/dkms/falco/2aa88dcf6243982697811df4c1b484bcbe9488a2/build/make.log (with GCC /usr/bin/gcc)
* Trying to dkms install falco module with GCC /usr/bin/gcc-8
DIRECTIVE: MAKE="'/tmp/falco-dkms-make'"
* Running dkms build failed, couldn't find /var/lib/dkms/falco/2aa88dcf6243982697811df4c1b484bcbe9488a2/build/make.log (with GCC /usr/bin/gcc-8)
* Trying to dkms install falco module with GCC /usr/bin/gcc-6
DIRECTIVE: MAKE="'/tmp/falco-dkms-make'"
* Running dkms build failed, couldn't find /var/lib/dkms/falco/2aa88dcf6243982697811df4c1b484bcbe9488a2/build/make.log (with GCC /usr/bin/gcc-6)
* Trying to dkms install falco module with GCC /usr/bin/gcc-5
DIRECTIVE: MAKE="'/tmp/falco-dkms-make'"
* Running dkms build failed, couldn't find /var/lib/dkms/falco/2aa88dcf6243982697811df4c1b484bcbe9488a2/build/make.log (with GCC /usr/bin/gcc-5)
* Trying to load a system falco driver, if present
* Trying to find locally a prebuilt falco module for kernel 4.14.198-152.320.amzn2.x86_64, if present
* Trying to download prebuilt module from https://dl.bintray.com/falcosecurity/driver/2aa88dcf6243982697811df4c1b484bcbe9488a2/falco_amazonlinux2_4.14.198-152.320.amzn2.x86_64_1.ko
curl: (22) The requested URL returned error: 403 Forbidden
Download failed, consider compiling your own falco module and loading it or getting in touch with the Falco community
2020-10-21T07:45:40+0000: Falco version 0.26.1 (driver version 2aa88dcf6243982697811df4c1b484bcbe9488a2)
2020-10-21T07:45:40+0000: Falco initialized with configuration file /etc/falco/falco.yaml
2020-10-21T07:45:40+0000: Loading rules from file /etc/falco/falco_rules.yaml:
2020-10-21T07:45:40+0000: Loading rules from file /etc/falco/falco_rules.local.yaml:
2020-10-21T07:45:41+0000: Loading rules from file /etc/falco/rules.d/rules-attenuation.yaml:
2020-10-21T07:45:41+0000: Unable to load the driver.
2020-10-21T07:45:41+0000: Runtime error: error opening device /host/dev/falco0. Make sure you have root credentials and that the falco module is loaded.. Exiting.

Environment

• Falco version:
  0.26.1
• System info:

{
  "machine": "x86_64",
  "nodename": "falcotest",
  "release": "4.14.198-152.320.amzn2.x86_64",
  "sysname": "Linux",
  "version": "#1 SMP Wed Sep 23 23:57:28 UTC 2020"
}

• Cloud provider or hardware configuration:
• OS:
  Amazon Linux 2
• Kernel:
  4.14.198-152.320.amzn2.x86_64
• Installation method:
  Kubernetes (Official Helm chart version 1.5.1

[mobouchardcoveo]

Hi! I have the same issue, we can see the forbidden if we go directly to https://dl.bintray.com/falcosecurity/driver/2aa88dcf6243982697811df4c1b484bcbe9488a2/falco_ubuntu-aws_5.4.0-1024-aws_24.ko

[jepperson2]

Seeing similar issues on Ubuntu 18.04 when running apt update.

$ apt update
...
Ign:6 https://dl.bintray.com/falcosecurity/deb stable InRelease
Err:7 https://dl.bintray.com/falcosecurity/deb stable Release
  403  Forbidden [IP: 52.43.200.1 443]
...
Reading package lists... Done
E: The repository 'https://dl.bintray.com/falcosecurity/deb stable Release' no longer has a Release file.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.

As per the install instructions these are the contents of /etc/apt/sources.list.d/falcosecurity.list when this was run:

deb https://dl.bintray.com/falcosecurity/deb stable main

[vanjohnson879]

I think that the issue is with bintray (perhaps rate-limiting) because the same is happening with yum as well as apt.

$ sudo yum install falco
Loaded plugins: dkms-build-requires, priorities, update-motd
...

https://dl.bintray.com/falcosecurity/rpm/repodata/repomd.xml: [Errno 14] HTTPS Error 403 - Forbidden
Trying other mirror.
...

failure: repodata/repomd.xml from falcosecurity-rpm: [Errno 256] No more mirrors to try.
https://dl.bintray.com/falcosecurity/rpm/repodata/repomd.xml: [Errno 14] HTTPS Error 403 - Forbidden

[fntlnz]

More context on this
https://lists.cncf.io/g/cncf-falco-dev/message/190

On Thu, 22 Oct 2020 at 15:03 vanjohnson879 [e-mail] wrote:

I think that the issue is with bintray (perhaps rate-limiting) because the
same is happening with yum as well as apt.

$ sudo yum install falco
Loaded plugins: dkms-build-requires, priorities, update-motd
...
https://dl.bintray.com/falcosecurity/rpm/repodata/repomd.xml: [Errno 14] HTTPS Error 403 - Forbidden
Trying other mirror.
...

failure: repodata/repomd.xml from falcosecurity-rpm: [Errno 256] No more mirrors to try.https://dl.bintray.com/falcosecurity/rpm/repodata/repomd.xml: [Errno 14] HTTPS Error 403 - Forbidden

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
https://github.com/falcosecurity/falco/issues/1455#issuecomment-714478625,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AAXQ24OYCJDQOF54BCZUCOLSMAUQXANCNFSM4SZNCARQ
.