tracee-0.4.0 run error after recompilation #540

transparentdata243 · 2021-02-10T15:28:46Z

transparentdata243
Feb 10, 2021

After I downloaded tracee 0.4.0, the initial compiled tracee binary can run fine. But if I run compile again, it seems to pull some additional packages/containers. Then the compiled tracee binary would not run and emit the error below. What is the supported kernel version for this tracee version? See system info at the end of the code section.

$ make build DOCKER=1
fatal: No names found, cannot describe anything.
docker build -f Dockerfile.builder -t tracee-builder --iidfile dist/tracee-builder --target builder .
Sending build context to Docker daemon  1.396MB
Step 1/3 : FROM golang:1.15-buster as builder
 ---> eba5d0436b0b
Step 2/3 : RUN echo "deb http://apt.llvm.org/buster/ llvm-toolchain-buster-9 main" >> /etc/apt/sources.list && apt-key adv --keyserver hkps://keyserver.ubuntu.com --recv-keys 15CF4D18AF4F7421 &&     DEBIAN_FRONTEND=noninteractive apt-get update -y && apt-get install -y --no-install-recommends libelf-dev llvm-9-dev clang-9 &&     (for tool in "clang" "llc" "llvm-strip"; do path=$(which $tool-9) && ln -s $path ${path%-*}; done)
 ---> Using cache
 ---> 7051c9876f46
Step 3/3 : WORKDIR /tracee
 ---> Using cache
 ---> 12b52a9f3ec2
Successfully built 12b52a9f3ec2
Successfully tagged tracee-builder:latest
docker run --rm -v /usr/src:/usr/src/ -v /home/tracee/opt/tracee-0.4.0:/tracee --entrypoint make tracee-builder KERN_BLD_PATH=/usr/src/linux-headers-5.8.0-41-generic KERN_SRC_PATH=/usr/src/linux-headers-5.8.0-41-generic 
fatal: No names found, cannot describe anything.
mkdir -p dist/tracee.bpf
cp $(find tracee/tracee.bpf.c dist/libbpf/usr/include/bpf 3rdparty/include -type f) dist/tracee.bpf
tar -czf dist/tracee.bpf.tar.gz dist/tracee.bpf
fatal: No names found, cannot describe anything.
GOOS=linux GOARCH=amd64 CC=clang CGO_CFLAGS="-I /tracee/dist/libbpf/usr/include" CGO_LDFLAGS="/tracee/dist/libbpf/libbpf.a" go build -v -o dist/tracee \
-ldflags "-X main.bpfBundleInjected=$(base64 -w 0 dist/tracee.bpf.tar.gz) -X main.version="	
go: downloading github.com/syndtr/gocapability v0.0.0-20180916011248-d98352740cb2
go: downloading github.com/urfave/cli/v2 v2.1.1
go: downloading github.com/aquasecurity/tracee/libbpfgo v0.0.0-20210115081842-487d1e44fcda
go: downloading github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d
go: downloading github.com/russross/blackfriday/v2 v2.0.1
go: downloading github.com/shurcooL/sanitized_anchor_name v1.0.0
runtime/cgo
github.com/aquasecurity/tracee/tracee/external
github.com/syndtr/gocapability/capability
github.com/shurcooL/sanitized_anchor_name
github.com/russross/blackfriday/v2
github.com/cpuguy83/go-md2man/v2/md2man
github.com/urfave/cli/v2
os/user
github.com/aquasecurity/tracee/libbpfgo
net
archive/tar
github.com/aquasecurity/tracee/tracee
github.com/aquasecurity/tracee
clang -S \
	-D__BPF_TRACING__ \
	-D__KERNEL__ \
	-D__TARGET_ARCH_x86 \
	-I dist/libbpf/usr/include/bpf \
	-include /usr/src/linux-headers-5.8.0-41-generic/include/linux/kconfig.h \
	-I /usr/src/linux-headers-5.8.0-41-generic/arch/x86/include \
	-I /usr/src/linux-headers-5.8.0-41-generic/arch/x86/include/uapi \
	-I /usr/src/linux-headers-5.8.0-41-generic/arch/x86/include/generated \
	-I /usr/src/linux-headers-5.8.0-41-generic/arch/x86/include/generated/uapi \
	-I /usr/src/linux-headers-5.8.0-41-generic/include \
	-I /usr/src/linux-headers-5.8.0-41-generic/include \
	-I /usr/src/linux-headers-5.8.0-41-generic/include/uapi \
	-I /usr/src/linux-headers-5.8.0-41-generic/include/generated \
	-I /usr/src/linux-headers-5.8.0-41-generic/include/generated/uapi \
	-I 3rdparty/include \
	-Wno-address-of-packed-member \
	-Wno-compare-distinct-pointer-types \
	-Wno-deprecated-declarations \
	-Wno-gnu-variable-sized-type-not-at-end \
	-Wno-pointer-sign \
	-Wno-pragma-once-outside-heade \
	-Wno-unknown-warning-option \
	-Wno-unused-value \
	-Wunused \
	-Wall \
	-fno-stack-protector \
	-fno-jump-tables \
	-fno-unwind-tables \
	-fno-asynchronous-unwind-tables \
	-xc \
	-nostdinc \
	-O2 -emit-llvm -c -g tracee/tracee.bpf.c -o dist/tracee.bpf.5_8_0-41-generic..ll
llc -march=bpf -filetype=obj -o dist/tracee.bpf.5_8_0-41-generic..o dist/tracee.bpf.5_8_0-41-generic..ll
llvm-strip -g dist/tracee.bpf.5_8_0-41-generic..o
rm dist/tracee.bpf.5_8_0-41-generic..ll
$ sudo ./tracee 
libbpf: prog 'syscall__execve': bad map relo against '.L.str' in section '.rodata.str1.1'
fatal error: unexpected signal during runtime execution
[signal SIGSEGV: segmentation violation code=0x1 addr=0xfffffffffffff0bb pc=0x6642e4]

runtime stack:
runtime.throw(0x6f7fdd, 0x2a)
	/usr/local/go/src/runtime/panic.go:1116 +0x72
runtime.sigpanic()
	/usr/local/go/src/runtime/signal_unix.go:726 +0x4ac

goroutine 1 [syscall]:
runtime.cgocall(0x657fa0, 0xc00019f308, 0xc00019f300)
	/usr/local/go/src/runtime/cgocall.go:133 +0x5b fp=0xc00019f2d8 sp=0xc00019f2a0 pc=0x40c33b
github.com/aquasecurity/tracee/libbpfgo._Cfunc_bpf_object__find_program_by_name(0xfffffffffffff05b, 0x1dfa310, 0x0)
	_cgo_gotypes.go:220 +0x4e fp=0xc00019f308 sp=0xc00019f2d8 pc=0x597f2e
github.com/aquasecurity/tracee/libbpfgo.(*Module).GetProgram.func1(0xc00015ff80, 0x1dfa310, 0x1dfa310)
	/go/pkg/mod/github.com/aquasecurity/tracee/libbpfgo@v0.0.0-20210115081842-487d1e44fcda/libbpfgo.go:380 +0x65 fp=0xc00019f340 sp=0xc00019f308 pc=0x59bca5
github.com/aquasecurity/tracee/libbpfgo.(*Module).GetProgram(0xc00015ff80, 0x6e96b7, 0x8, 0x0, 0x0, 0xc00019f410)
	/go/pkg/mod/github.com/aquasecurity/tracee/libbpfgo@v0.0.0-20210115081842-487d1e44fcda/libbpfgo.go:380 +0x56 fp=0xc00019f3a8 sp=0xc00019f340 pc=0x599cf6
github.com/aquasecurity/tracee/tracee.(*Tracee).initBPF(0xc000014700, 0xc00001e140, 0x41, 0xc00010af03, 0xc000010018)
	/tracee/tracee/tracee.go:777 +0x1a5 fp=0xc00019f718 sp=0xc00019f3a8 pc=0x5aa9c5
github.com/aquasecurity/tracee/tracee.New(0xc000165c80, 0xc00015fec0, 0xc00015fe80, 0x400, 0x400, 0x0, 0x0, 0xc00001e140, 0x41, 0xc000062410, ...)
	/tracee/tracee/tracee.go:297 +0x6ad fp=0xc00019fb50 sp=0xc00019f718 pc=0x5a58ed
main.main.func1(0xc00015fe40, 0xc0001c0200, 0x14)
	/tracee/main.go:75 +0x5ad fp=0xc00019fd80 sp=0xc00019fb50 pc=0x65674d
github.com/urfave/cli/v2.(*App).RunContext(0xc000001980, 0x73f7c0, 0xc00001a098, 0xc0000121e0, 0x1, 0x1, 0x0, 0x0)
	/go/pkg/mod/github.com/urfave/cli/v2@v2.1.1/app.go:311 +0x70d fp=0xc00019fea8 sp=0xc00019fd80 pc=0x633b2d
github.com/urfave/cli/v2.(*App).Run(...)
	/go/pkg/mod/github.com/urfave/cli/v2@v2.1.1/app.go:211
main.main()
	/tracee/main.go:144 +0x832 fp=0xc00019ff88 sp=0xc00019fea8 pc=0x64bdb2
runtime.main()
	/usr/local/go/src/runtime/proc.go:204 +0x209 fp=0xc00019ffe0 sp=0xc00019ff88 pc=0x4405c9
runtime.goexit()
	/usr/local/go/src/runtime/asm_amd64.s:1374 +0x1 fp=0xc00019ffe8 sp=0xc00019ffe0 pc=0x472561


$ uname -a
Linux ubuntu 5.8.0-41-generic #46-Ubuntu SMP Mon Jan 18 16:48:44 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux
$ cat /etc/issue
Ubuntu 20.10 \n \l

Answered by yanivagman

Feb 13, 2021

@transparentdata243 in the original post you wrote:

After I downloaded tracee 0.4.0, the initial compiled tracee binary can run fine. But if I run compile again, it seems to pull some additional packages/containers. Then the compiled tracee binary would not run and emit the error below.

And then you wrote:

There might be some confusion here. I haven't tried 0.3.0. I was able to compile 0.4.0 earlier, but I am not even able to compile it.

Let's first try to resolve the compilation problem, then the runtime problem.
If you choose to compile from source (other options are: https://github.com/aquasecurity/tracee/tree/main/tracee-ebpf#getting-tracee-ebpf), you will first need to make sure …

View full answer

itaysk · 2021-02-11T17:49:22Z

itaysk
Feb 11, 2021
Maintainer

@transparentdata243 thanks for trying Tracee and opening the issue. I've converted it into a discussion since that is where we collaborate on troubleshooting and support.
we'll look into your issue and post a response here

5 replies

transparentdata243 Feb 12, 2021
Author

Can someone tell me what is the correct machine set up to get it compiled while I am waiting for this? I assume spining a fresh ubuntu machine with a few apt install and get the libbpf will be sufficient for me to make compilation work. But I would appreciate the OS version and package install details.

itaysk Feb 12, 2021
Maintainer

there's no "correct" setup, each of the contributors that I know of that are working on Tracee happens to use a different setup, based on personal preference. Personally I use Ubuntu 19.10 with kernel 5.3.0.

The dependencies are listed in the readme: https://github.com/aquasecurity/tracee#prerequisites how to obtain them differ based on distro. If you want an easy way to compile Tracee, try adding DOCKER=1 to the make command: that will build everything inside of a docker container with all the dependencies installed. If you want to see how the dockerfile is setup (which will help you understand how to setup dependencies on your machine), see here: https://github.com/aquasecurity/tracee/blob/main/tracee-ebpf/Dockerfile.builder

transparentdata243 Feb 12, 2021
Author

Yes. A proven "working" set up is what I am looking for. I am able to compile. The issue here is really the tracee run error if you see my post. I can give a try on the set up you mentioned.

yanivagman Feb 12, 2021
Maintainer

Hi @transparentdata243

Can you please try running make clean before the make build DOCKER=1?
If the problem persist after doing that, please try to run without the execve event and tell us if anything changed:
sudo ./tracee -t e!=execve

If you say that previous versions of tracee (e.g. 0.3.0) worked for you - there is no reason that 0.4.0 will not work as well

transparentdata243 Feb 13, 2021
Author

There might be some confusion here. I haven't tried 0.3.0. I was able to compile 0.4.0 earlier, but I am not even able to compile it.

Here are the details from a clean unzip of the trace-0.4.0. It first failed and cannot find the libbpf source. I copy the libbpf-0.3 src in the 3rdparty/libbpf directory, and rerun compilation. Then it gives me errors on bpf.h not found. All details of the shell transcript is below (Still on ubuntu 20.10 box):

tracee@ubuntu:/opt/tracee-0.4.0$ make bpf DOCKER=1
fatal: not a git repository (or any of the parent directories): .git
docker build -f Dockerfile.builder -t tracee-builder --iidfile dist/tracee-builder --target builder .
Sending build context to Docker daemon 507.9kB
Step 1/3 : FROM golang:1.15-buster as builder
---> eba5d0436b0b
Step 2/3 : RUN echo "deb http://apt.llvm.org/buster/ llvm-toolchain-buster-9 main" >> /etc/apt/sources.list && apt-key adv --keyserver hkps://keyserver.ubuntu.com --recv-keys 15CF4D18AF4F7421 && DEBIAN_FRONTEND=noninteractive apt-get update -y && apt-get install -y --no-install-recommends libelf-dev llvm-9-dev clang-9 && (for tool in "clang" "llc" "llvm-strip"; do path=$(which $tool-9) && ln -s $path ${path%-*}; done)
---> Running in c854a987011a
Warning: apt-key output should not be parsed (stdout is not a terminal)
Executing: /tmp/apt-key-gpghome.d6xX5PXpfe/gpg.1.sh --keyserver hkps://keyserver.ubuntu.com --recv-keys 15CF4D18AF4F7421
gpg: key 15CF4D18AF4F7421: public key "Sylvestre Ledru - Debian LLVM packages sylvestre@debian.org" imported
gpg: Total number processed: 1
gpg: imported: 1
Get:1 http://security.debian.org/debian-security buster/updates InRelease [65.4 kB]
Get:2 http://deb.debian.org/debian buster InRelease [122 kB]
Get:3 http://deb.debian.org/debian buster-updates InRelease [51.9 kB]
Get:4 http://security.debian.org/debian-security buster/updates/main amd64 Packages [267 kB]
Get:5 http://deb.debian.org/debian buster/main amd64 Packages [7907 kB]
Get:6 https://apt.llvm.org/buster llvm-toolchain-buster-9 InRelease [4240 B]
Get:7 https://apt.llvm.org/buster llvm-toolchain-buster-9/main amd64 Packages [14.6 kB]
Get:8 http://deb.debian.org/debian buster-updates/main amd64 Packages [9504 B]
Fetched 8441 kB in 3s (3137 kB/s)
Reading package lists...
Reading package lists...
Building dependency tree...
Reading state information...
The following additional packages will be installed:
binfmt-support lib32gcc1 lib32stdc++6 libc6-i386 libclang-common-9-dev
libclang-cpp9 libffi-dev libgc1c2 libllvm9 libmpdec2 libncurses-dev
libobjc-8-dev libobjc4 libpfm4 libpipeline1 libpython3-stdlib
libpython3.7-minimal libpython3.7-stdlib libtinfo-dev libyaml-0-2 libz3-4
libz3-dev llvm-9 llvm-9-runtime llvm-9-tools python-pygments python-yaml
python3 python3-minimal python3-pygments python3-yaml python3.7
python3.7-minimal zlib1g-dev
Suggested packages:
clang-9-doc ncurses-doc llvm-9-doc python-pygments-doc ttf-bitstream-vera
python3-doc python3-tk python3-venv python3.7-venv python3.7-doc
Recommended packages:
libomp-9-dev python-chardet python-pkg-resources python3-pkg-resources
The following NEW packages will be installed:
binfmt-support clang-9 lib32gcc1 lib32stdc++6 libc6-i386
libclang-common-9-dev libclang-cpp9 libelf-dev libffi-dev libgc1c2 libllvm9
libmpdec2 libncurses-dev libobjc-8-dev libobjc4 libpfm4 libpipeline1
libpython3-stdlib libpython3.7-minimal libpython3.7-stdlib libtinfo-dev
libyaml-0-2 libz3-4 libz3-dev llvm-9 llvm-9-dev llvm-9-runtime llvm-9-tools
python-pygments python-yaml python3 python3-minimal python3-pygments
python3-yaml python3.7 python3.7-minimal zlib1g-dev
0 upgraded, 37 newly installed, 0 to remove and 11 not upgraded.
Need to get 74.5 MB of archives.
After this operation, 440 MB of additional disk space will be used.
Get:2 http://deb.debian.org/debian buster/main amd64 libpython3.7-minimal amd64 3.7.3-2+deb10u2 [589 kB]
Get:9 http://deb.debian.org/debian buster/main amd64 python3.7-minimal amd64 3.7.3-2+deb10u2 [1731 kB]
Get:1 https://apt.llvm.org/buster llvm-toolchain-buster-9/main amd64 libllvm9 amd64 1:9+20191211082622+c1a0a213378-1~~exp1~~20191211193200.102 [15.0 MB]
Get:3 https://apt.llvm.org/buster llvm-toolchain-buster-9/main amd64 libclang-cpp9 amd64 1:9~+20191211082622+c1a0a213378-1~~exp1~~20191211193200.102 [8428 kB]
Get:4 https://apt.llvm.org/buster llvm-toolchain-buster-9/main amd64 libclang-common-9-dev amd64 1:9~+20191211082622+c1a0a213378-1~~exp1~~20191211193200.102 [3729 kB]
Get:11 http://deb.debian.org/debian buster/main amd64 python3-minimal amd64 3.7.3-1 [36.6 kB]
Get:12 http://deb.debian.org/debian buster/main amd64 libmpdec2 amd64 2.4.2-2 [87.2 kB]
Get:5 https://apt.llvm.org/buster llvm-toolchain-buster-9/main amd64 clang-9 amd64 1:9~+20191211082622+c1a0a213378-1~~exp1~~20191211193200.102 [1155 kB]
Get:13 http://deb.debian.org/debian buster/main amd64 libpython3.7-stdlib amd64 3.7.3-2+deb10u2 [1732 kB]
Get:6 https://apt.llvm.org/buster llvm-toolchain-buster-9/main amd64 llvm-9-runtime amd64 1:9~+20191211082622+c1a0a213378-1~~exp1~~20191211193200.102 [210 kB]
Get:7 https://apt.llvm.org/buster llvm-toolchain-buster-9/main amd64 llvm-9 amd64 1:9~+20191211082622+c1a0a213378-1~~exp1~~20191211193200.102 [4857 kB]
Get:8 https://apt.llvm.org/buster llvm-toolchain-buster-9/main amd64 llvm-9-tools amd64 1:9~+20191211082622+c1a0a213378-1~~exp1~~20191211193200.102 [327 kB]
Get:10 https://apt.llvm.org/buster llvm-toolchain-buster-9/main amd64 llvm-9-dev amd64 1:9~+20191211082622+c1a0a213378-1~~exp1~~20191211193200.102 [24.4 MB]
Get:14 http://deb.debian.org/debian buster/main amd64 python3.7 amd64 3.7.3-2+deb10u2 [330 kB]
Get:15 http://deb.debian.org/debian buster/main amd64 libpython3-stdlib amd64 3.7.3-1 [20.0 kB]
Get:16 http://deb.debian.org/debian buster/main amd64 python3 amd64 3.7.3-1 [61.5 kB]
Get:17 http://deb.debian.org/debian buster/main amd64 libpipeline1 amd64 1.5.1-2 [31.2 kB]
Get:18 http://deb.debian.org/debian buster/main amd64 binfmt-support amd64 2.2.0-2 [70.0 kB]
Get:19 http://deb.debian.org/debian buster/main amd64 libgc1c2 amd64 1:7.6.4-0.4 [224 kB]
Get:20 http://deb.debian.org/debian buster/main amd64 libobjc4 amd64 8.3.0-6 [50.3 kB]
Get:21 http://deb.debian.org/debian buster/main amd64 libobjc-8-dev amd64 8.3.0-6 [226 kB]
Get:22 http://deb.debian.org/debian buster/main amd64 libc6-i386 amd64 2.28-10 [2872 kB]
Get:23 http://deb.debian.org/debian buster/main amd64 lib32gcc1 amd64 1:8.3.0-6 [47.9 kB]
Get:24 http://deb.debian.org/debian buster/main amd64 lib32stdc++6 amd64 8.3.0-6 [407 kB]
Get:25 http://deb.debian.org/debian buster/main amd64 zlib1g-dev amd64 1:1.2.11.dfsg-1 [214 kB]
Get:26 http://deb.debian.org/debian buster/main amd64 libelf-dev amd64 0.176-1.1 [72.1 kB]
Get:27 http://deb.debian.org/debian buster/main amd64 libffi-dev amd64 3.2.1-9 [156 kB]
Get:28 http://deb.debian.org/debian buster/main amd64 libncurses-dev amd64 6.1+20181013-2+deb10u2 [333 kB]
Get:29 http://deb.debian.org/debian buster/main amd64 libpfm4 amd64 4.10.1+git10-gd2a5b56-1 [268 kB]
Get:30 http://deb.debian.org/debian buster/main amd64 libtinfo-dev amd64 6.1+20181013-2+deb10u2 [940 B]
Get:31 http://deb.debian.org/debian buster/main amd64 libyaml-0-2 amd64 0.2.1-1 [47.2 kB]
Get:32 http://deb.debian.org/debian buster/main amd64 libz3-4 amd64 4.4.1-1deb10u1 [5251 kB]
Get:33 http://deb.debian.org/debian buster/main amd64 libz3-dev amd64 4.4.1-1deb10u1 [79.6 kB]
Get:34 http://deb.debian.org/debian buster/main amd64 python-pygments all 2.3.1+dfsg-1 [596 kB]
Get:35 http://deb.debian.org/debian buster/main amd64 python-yaml amd64 3.13-2 [127 kB]
Get:36 http://deb.debian.org/debian buster/main amd64 python3-pygments all 2.3.1+dfsg-1 [594 kB]
Get:37 http://deb.debian.org/debian buster/main amd64 python3-yaml amd64 3.13-2 [121 kB]
debconf: delaying package configuration, since apt-utils is not installed
Fetched 74.5 MB in 7s (10.8 MB/s)
Selecting previously unselected package libpython3.7-minimal:amd64.
(Reading database ... 15410 files and directories currently installed.)
Preparing to unpack .../libpython3.7-minimal_3.7.3-2+deb10u2_amd64.deb ...
Unpacking libpython3.7-minimal:amd64 (3.7.3-2+deb10u2) ...
Selecting previously unselected package python3.7-minimal.
Preparing to unpack .../python3.7-minimal_3.7.3-2+deb10u2_amd64.deb ...
Unpacking python3.7-minimal (3.7.3-2+deb10u2) ...
Setting up libpython3.7-minimal:amd64 (3.7.3-2+deb10u2) ...
Setting up python3.7-minimal (3.7.3-2+deb10u2) ...
Selecting previously unselected package python3-minimal.
(Reading database ... 15650 files and directories currently installed.)
Preparing to unpack .../python3-minimal_3.7.3-1_amd64.deb ...
Unpacking python3-minimal (3.7.3-1) ...
Selecting previously unselected package libmpdec2:amd64.
Preparing to unpack .../libmpdec2_2.4.2-2_amd64.deb ...
Unpacking libmpdec2:amd64 (2.4.2-2) ...
Selecting previously unselected package libpython3.7-stdlib:amd64.
Preparing to unpack .../libpython3.7-stdlib_3.7.3-2+deb10u2_amd64.deb ...
Unpacking libpython3.7-stdlib:amd64 (3.7.3-2+deb10u2) ...
Selecting previously unselected package python3.7.
Preparing to unpack .../python3.7_3.7.3-2+deb10u2_amd64.deb ...
Unpacking python3.7 (3.7.3-2+deb10u2) ...
Selecting previously unselected package libpython3-stdlib:amd64.
Preparing to unpack .../libpython3-stdlib_3.7.3-1_amd64.deb ...
Unpacking libpython3-stdlib:amd64 (3.7.3-1) ...
Setting up python3-minimal (3.7.3-1) ...
Selecting previously unselected package python3.
(Reading database ... 16062 files and directories currently installed.)
Preparing to unpack .../00-python3_3.7.3-1_amd64.deb ...
Unpacking python3 (3.7.3-1) ...
Selecting previously unselected package libpipeline1:amd64.
Preparing to unpack .../01-libpipeline1_1.5.1-2_amd64.deb ...
Unpacking libpipeline1:amd64 (1.5.1-2) ...
Selecting previously unselected package binfmt-support.
Preparing to unpack .../02-binfmt-support_2.2.0-2_amd64.deb ...
Unpacking binfmt-support (2.2.0-2) ...
Selecting previously unselected package libllvm9:amd64.
Preparing to unpack .../03-libllvm9_1%3a9~+20191211082622+c1a0a213378-1~~exp1~~20191211193200.102_amd64.deb ...
Unpacking libllvm9:amd64 (1:9~+20191211082622+c1a0a213378-1~~exp1~~20191211193200.102) ...
Selecting previously unselected package libclang-cpp9.
Preparing to unpack .../04-libclang-cpp9_1%3a9~+20191211082622+c1a0a213378-1~~exp1~~20191211193200.102_amd64.deb ...
Unpacking libclang-cpp9 (1:9~+20191211082622+c1a0a213378-1~~exp1~~20191211193200.102) ...
Selecting previously unselected package libgc1c2:amd64.
Preparing to unpack .../05-libgc1c2_1%3a7.6.4-0.4_amd64.deb ...
Unpacking libgc1c2:amd64 (1:7.6.4-0.4) ...
Selecting previously unselected package libobjc4:amd64.
Preparing to unpack .../06-libobjc4_8.3.0-6_amd64.deb ...
Unpacking libobjc4:amd64 (8.3.0-6) ...
Selecting previously unselected package libobjc-8-dev:amd64.
Preparing to unpack .../07-libobjc-8-dev_8.3.0-6_amd64.deb ...
Unpacking libobjc-8-dev:amd64 (8.3.0-6) ...
Selecting previously unselected package libc6-i386.
Preparing to unpack .../08-libc6-i386_2.28-10_amd64.deb ...
Unpacking libc6-i386 (2.28-10) ...
Selecting previously unselected package lib32gcc1.
Preparing to unpack .../09-lib32gcc1_1%3a8.3.0-6_amd64.deb ...
Unpacking lib32gcc1 (1:8.3.0-6) ...
Selecting previously unselected package lib32stdc++6.
Preparing to unpack .../10-lib32stdc++6_8.3.0-6_amd64.deb ...
Unpacking lib32stdc++6 (8.3.0-6) ...
Selecting previously unselected package libclang-common-9-dev.
Preparing to unpack .../11-libclang-common-9-dev_1%3a9~+20191211082622+c1a0a213378-1~~exp1~~20191211193200.102_amd64.deb ...
Unpacking libclang-common-9-dev (1:9~+20191211082622+c1a0a213378-1~~exp1~~20191211193200.102) ...
Selecting previously unselected package clang-9.
Preparing to unpack .../12-clang-9_1%3a9~+20191211082622+c1a0a213378-1~~exp1~~20191211193200.102_amd64.deb ...
Unpacking clang-9 (1:9~+20191211082622+c1a0a213378-1~~exp1~~20191211193200.102) ...
Selecting previously unselected package zlib1g-dev:amd64.
Preparing to unpack .../13-zlib1g-dev_1%3a1.2.11.dfsg-1_amd64.deb ...
Unpacking zlib1g-dev:amd64 (1:1.2.11.dfsg-1) ...
Selecting previously unselected package libelf-dev:amd64.
Preparing to unpack .../14-libelf-dev_0.176-1.1_amd64.deb ...
Unpacking libelf-dev:amd64 (0.176-1.1) ...
Selecting previously unselected package libffi-dev:amd64.
Preparing to unpack .../15-libffi-dev_3.2.1-9_amd64.deb ...
Unpacking libffi-dev:amd64 (3.2.1-9) ...
Selecting previously unselected package libncurses-dev:amd64.
Preparing to unpack .../16-libncurses-dev_6.1+20181013-2+deb10u2_amd64.deb ...
Unpacking libncurses-dev:amd64 (6.1+20181013-2+deb10u2) ...
Selecting previously unselected package libpfm4:amd64.
Preparing to unpack .../17-libpfm4_4.10.1+git10-gd2a5b56-1_amd64.deb ...
Unpacking libpfm4:amd64 (4.10.1+git10-gd2a5b56-1) ...
Selecting previously unselected package libtinfo-dev:amd64.
Preparing to unpack .../18-libtinfo-dev_6.1+20181013-2+deb10u2_amd64.deb ...
Unpacking libtinfo-dev:amd64 (6.1+20181013-2+deb10u2) ...
Selecting previously unselected package libyaml-0-2:amd64.
Preparing to unpack .../19-libyaml-0-2_0.2.1-1_amd64.deb ...
Unpacking libyaml-0-2:amd64 (0.2.1-1) ...
Selecting previously unselected package libz3-4:amd64.
Preparing to unpack .../20-libz3-4_4.4.1-1deb10u1_amd64.deb ...
Unpacking libz3-4:amd64 (4.4.1-1deb10u1) ...
Selecting previously unselected package libz3-dev:amd64.
Preparing to unpack .../21-libz3-dev_4.4.1-1deb10u1_amd64.deb ...
Unpacking libz3-dev:amd64 (4.4.1-1deb10u1) ...
Selecting previously unselected package llvm-9-runtime.
Preparing to unpack .../22-llvm-9-runtime_1%3a9~+20191211082622+c1a0a213378-1~~exp1~~20191211193200.102_amd64.deb ...
Unpacking llvm-9-runtime (1:9~+20191211082622+c1a0a213378-1~~exp1~~20191211193200.102) ...
Selecting previously unselected package llvm-9.
Preparing to unpack .../23-llvm-9_1%3a9~+20191211082622+c1a0a213378-1~~exp1~~20191211193200.102_amd64.deb ...
Unpacking llvm-9 (1:9~+20191211082622+c1a0a213378-1~~exp1~~20191211193200.102) ...
Selecting previously unselected package python-pygments.
Preparing to unpack .../24-python-pygments_2.3.1+dfsg-1_all.deb ...
Unpacking python-pygments (2.3.1+dfsg-1) ...
Selecting previously unselected package python-yaml.
Preparing to unpack .../25-python-yaml_3.13-2_amd64.deb ...
Unpacking python-yaml (3.13-2) ...
Selecting previously unselected package python3-pygments.
Preparing to unpack .../26-python3-pygments_2.3.1+dfsg-1_all.deb ...
Unpacking python3-pygments (2.3.1+dfsg-1) ...
Selecting previously unselected package python3-yaml.
Preparing to unpack .../27-python3-yaml_3.13-2_amd64.deb ...
Unpacking python3-yaml (3.13-2) ...
Selecting previously unselected package llvm-9-tools.
Preparing to unpack .../28-llvm-9-tools_1%3a9~+20191211082622+c1a0a213378-1~~exp1~~20191211193200.102_amd64.deb ...
Unpacking llvm-9-tools (1:9~+20191211082622+c1a0a213378-1~~exp1~~20191211193200.102) ...
Selecting previously unselected package llvm-9-dev.
Preparing to unpack .../29-llvm-9-dev_1%3a9~+20191211082622+c1a0a213378-1~~exp1~~20191211193200.102_amd64.deb ...
Unpacking llvm-9-dev (1:9~+20191211082622+c1a0a213378-1~~exp1~~20191211193200.102) ...
Setting up libpipeline1:amd64 (1.5.1-2) ...
Setting up libncurses-dev:amd64 (6.1+20181013-2+deb10u2) ...
Setting up libgc1c2:amd64 (1:7.6.4-0.4) ...
Setting up libyaml-0-2:amd64 (0.2.1-1) ...
Setting up libobjc4:amd64 (8.3.0-6) ...
Setting up libffi-dev:amd64 (3.2.1-9) ...
Setting up python-pygments (2.3.1+dfsg-1) ...
Setting up libobjc-8-dev:amd64 (8.3.0-6) ...
Setting up libz3-4:amd64 (4.4.1-1deb10u1) ...
Setting up libpfm4:amd64 (4.10.1+git10-gd2a5b56-1) ...
Setting up binfmt-support (2.2.0-2) ...
invoke-rc.d: could not determine current runlevel
invoke-rc.d: policy-rc.d denied execution of start.
Setting up zlib1g-dev:amd64 (1:1.2.11.dfsg-1) ...
Setting up libc6-i386 (2.28-10) ...
Setting up python-yaml (3.13-2) ...
Setting up libmpdec2:amd64 (2.4.2-2) ...
Setting up libllvm9:amd64 (1:9+20191211082622+c1a0a213378-1~~exp1~~20191211193200.102) ...
Setting up libtinfo-dev:amd64 (6.1+20181013-2+deb10u2) ...
Setting up libz3-dev:amd64 (4.4.1-1deb10u1) ...
Setting up libpython3.7-stdlib:amd64 (3.7.3-2+deb10u2) ...
Setting up libclang-cpp9 (1:9+20191211082622+c1a0a213378-1~~exp1~~20191211193200.102) ...
Setting up lib32gcc1 (1:8.3.0-6) ...
Setting up lib32stdc++6 (8.3.0-6) ...
Setting up libelf-dev:amd64 (0.176-1.1) ...
Setting up llvm-9-runtime (1:9~+20191211082622+c1a0a213378-1~~exp1~~20191211193200.102) ...
Setting up libclang-common-9-dev (1:9~+20191211082622+c1a0a213378-1~~exp1~~20191211193200.102) ...
Setting up libpython3-stdlib:amd64 (3.7.3-1) ...
Setting up python3.7 (3.7.3-2+deb10u2) ...
Setting up clang-9 (1:9~+20191211082622+c1a0a213378-1~~exp1~~20191211193200.102) ...
Setting up python3 (3.7.3-1) ...
running python rtupdate hooks for python3.7...
running python post-rtupdate hooks for python3.7...
Setting up python3-pygments (2.3.1+dfsg-1) ...
Setting up llvm-9 (1:9~+20191211082622+c1a0a213378-1~~exp1~~20191211193200.102) ...
Setting up python3-yaml (3.13-2) ...
Setting up llvm-9-tools (1:9~+20191211082622+c1a0a213378-1~~exp1~~20191211193200.102) ...
Setting up llvm-9-dev (1:9~+20191211082622+c1a0a213378-1~~exp1~~20191211193200.102) ...
Processing triggers for mime-support (3.62) ...
Processing triggers for libc-bin (2.28-10) ...
Removing intermediate container c854a987011a
---> 25cec7c97b9a
Step 3/3 : WORKDIR /tracee
---> Running in adc67ec17743
Removing intermediate container adc67ec17743
---> dbb60b33226d
Successfully built dbb60b33226d
Successfully tagged tracee-builder:latest
docker run --rm -v /usr/src:/usr/src/ -v /home/tracee/opt/tracee-0.4.0:/tracee --entrypoint make tracee-builder KERN_BLD_PATH=/usr/src/linux-headers-5.8.0-41-generic KERN_SRC_PATH=/usr/src/linux-headers-5.8.0-41-generic
fatal: not a git repository (or any parent up to mount point /)
Stopping at filesystem boundary (GIT_DISCOVERY_ACROSS_FILESYSTEM not set).
test -d 3rdparty/libbpf/src || git submodule update --init || (echo "missing libbpf source" ; false)
fatal: not a git repository (or any parent up to mount point /)
Stopping at filesystem boundary (GIT_DISCOVERY_ACROSS_FILESYSTEM not set).
missing libbpf source
make: *** [Makefile:63: 3rdparty/libbpf/src] Error 1
make: *** [Makefile:122: dist/tracee.bpf.5_8_0-41-generic..o] Error 2
tracee@ubuntu:/opt/tracee-0.4.0$ cp ../libbpf-0.3/
BPF-CHECKPOINT-COMMIT .lgtm.yml LICENSE.LPGL-2.1 src/
CHECKPOINT-COMMIT LICENSE README.md travis-ci/
include/ LICENSE.BSD-2-Clause scripts/ .travis.yml
tracee@ubuntu:/opt/tracee-0.4.0$ cp ../libbpf-0.3/src/ -fr 3rdparty/libbpf/
tracee@ubuntu:~/opt/tracee-0.4.0$ make bpf DOCKER=1
fatal: not a git repository (or any of the parent directories): .git
docker run --rm -v /usr/src:/usr/src/ -v /home/tracee/opt/tracee-0.4.0:/tracee --entrypoint make tracee-builder KERN_BLD_PATH=/usr/src/linux-headers-5.8.0-41-generic KERN_SRC_PATH=/usr/src/linux-headers-5.8.0-41-generic
fatal: not a git repository (or any parent up to mount point /)
Stopping at filesystem boundary (GIT_DISCOVERY_ACROSS_FILESYSTEM not set).
cd 3rdparty/libbpf/src && make install_headers install_uapi_headers DESTDIR=/tracee/dist/libbpf
make[1]: Entering directory '/tracee/3rdparty/libbpf/src'
INSTALL bpf.h libbpf.h btf.h xsk.h libbpf_util.h bpf_helpers.h bpf_helper_defs.h bpf_tracing.h bpf_endian.h bpf_core_read.h libbpf_common.h
INSTALL bpf.h bpf_common.h btf.h
install: cannot stat '../include/uapi/linux/bpf.h': No such file or directory
install: cannot stat '../include/uapi/linux/bpf_common.h': No such file or directory
install: cannot stat '../include/uapi/linux/btf.h': No such file or directory
make[1]: *** [Makefile:145: install_uapi_headers] Error 1
make[1]: Leaving directory '/tracee/3rdparty/libbpf/src'
make: *** [Makefile:66: dist/libbpf/usr/include] Error 2
make: *** [Makefile:122: dist/tracee.bpf.5_8_0-41-generic..o] Error 2

yanivagman · 2021-02-13T11:05:48Z

yanivagman
Feb 13, 2021
Maintainer

@transparentdata243 in the original post you wrote:

After I downloaded tracee 0.4.0, the initial compiled tracee binary can run fine. But if I run compile again, it seems to pull some additional packages/containers. Then the compiled tracee binary would not run and emit the error below.

And then you wrote:

There might be some confusion here. I haven't tried 0.3.0. I was able to compile 0.4.0 earlier, but I am not even able to compile it.

Let's first try to resolve the compilation problem, then the runtime problem.
If you choose to compile from source (other options are: https://github.com/aquasecurity/tracee/tree/main/tracee-ebpf#getting-tracee-ebpf), you will first need to make sure that the libbpf submodule is fetched correctly. To do that, first use a fresh clone, and run the following from the root dir:
git submodule update --init
Doing that, you will not need to copy it from any other location like you did:

I copy the libbpf-0.3 src in the 3rdparty/libbpf directory, and rerun compilation

You can then verify that libbpf sources were fetched correctly to the 3rdparty/libbpf directory.
Running make from the root dir should then compile the libbpf code, and install the missing bpf.h file from the error you had.

Please try the above first. If there will be other compilation or runtime issues - you can post them here and we will try to help.

1 reply

transparentdata243 Feb 13, 2021
Author

Thank you! The following steps works for me:

$ git clone git@github.com:aquasecurity/tracee.git
$ cd tracee-ebpf/
$ git submodule update --init
$ cd ..
$ make

After that, there is no runtime issue either.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

tracee-0.4.0 run error after recompilation #540

{{title}}

Replies: 2 comments 6 replies

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Select a reply

tracee-0.4.0 run error after recompilation #540

transparentdata243 Feb 10, 2021

Replies: 2 comments · 6 replies

itaysk Feb 11, 2021 Maintainer

transparentdata243 Feb 12, 2021 Author

itaysk Feb 12, 2021 Maintainer

transparentdata243 Feb 12, 2021 Author

yanivagman Feb 12, 2021 Maintainer

transparentdata243 Feb 13, 2021 Author

yanivagman Feb 13, 2021 Maintainer

transparentdata243 Feb 13, 2021 Author

transparentdata243
Feb 10, 2021

Replies: 2 comments 6 replies

itaysk
Feb 11, 2021
Maintainer

transparentdata243 Feb 12, 2021
Author

itaysk Feb 12, 2021
Maintainer

transparentdata243 Feb 12, 2021
Author

yanivagman Feb 12, 2021
Maintainer

transparentdata243 Feb 13, 2021
Author

yanivagman
Feb 13, 2021
Maintainer

transparentdata243 Feb 13, 2021
Author