Question 39372 in Ubuntu Question posted in
The official Ubuntu documentation can be found here.

Issue installing Falco on K3s (PopOS)

I am trying to install Falco on my home lab (K3s v1.23.6+k3s1 on Pop!_OS v20.04). For work I need to create a response engine, for that I have chosen FalcoSidekick and OpenFAAS – before taking this to EKS I want to test it locally.

I am using the standard Helm chart:

kubectl create ns falco
helm upgrade --install falco 
  --set falco.jsonOutput=true --set auditLog.enabled=true 
  --set image.repository=falcosecurity/falco-no-driver 
  --set falcosidekick.enabled=true 
  --set falcosidekick.config.openfaas.functionname="falco-pod-delete" 
  --namespace falco 
  falcosecurity/falco

The issue occurs as the falco-driver-load InitContainer is unable to download the driver fom my OS (from here, so it tries to build the driver and fails.

* Looking for a falco module locally (kernel 5.17.5-76051705-generic)
* Trying to download a prebuilt falco module from https://download.falco.org/driver/2.0.0%2Bdriver/x86_64/falco_pop_5.17.5-76051705-generic_202204271406.ko
curl: (22) The requested URL returned error: 404 
Unable to find a prebuilt falco module
* Trying to dkms install falco module with GCC /usr/bin/gcc
warning: the compiler differs from the one used to build the kernel
  The kernel was built by: gcc (Ubuntu 11.2.0-19ubuntu1) 11.2.0
  You are using:           gcc (Debian 5.5.0-12) 5.5.0 20171010
  CC [M]  /var/lib/dkms/falco/2.0.0+driver/build/main.o
gcc: error: unrecognized command line option '-mharden-sls=all'
gcc: error: unrecognized command line option '-Wimplicit-fallthrough=5'
make[2]: *** [scripts/Makefile.build:288: /var/lib/dkms/falco/2.0.0+driver/build/main.o] Error 1

I was wondering if I would be able to use the Ubuntu driver, and if so how can I override this?

Tags:

2

Answers


  1. Chosen as BEST ANSWER
    0

    I needed to install the kernel headers for my system, as well as increase some fx.inotify sysctl parameters.


  2. 0

    It seems that the compiler you are trying to use (GCC 5.5) doesn’t support certain options. The Kernel has been compiled with 5.11 so I’d recommend using that one.

    The tool to compile a Falco driver in an easy way is Falco Driverkit. It uses Docker/Kubernetes to spin up a container including the necessary tools and receives a configuration with the Kernel version for which the driver has to be generated.

    I wrote a blog post a while ago about how to use it. I’d also like to invite you to the Falco Slack channel where you can get a much faster response from the community.

    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search