Skip to content

Building Falco

Jump to bottom
linuxonz edited this page Feb 13, 2025 · 37 revisions

Building Falco

The instructions provided below specify the steps to build Falco version 0.39.2 on Linux on IBM Z for following distributions:

  • RHEL (8.8, 8.10, 9.2, 9.4, 9.5)
  • SLES 15 SP6
  • Ubuntu (20.04, 22.04, 24.04, 24.10)

Falco supports all three kernel drivers starting with 0.34.x releases on s390x: Kernel module, eBPF probe and Modern eBPF probe. Please check driver - kernel version support matrix for detailed information.

General Notes:

  • When following the steps below please use standard permission user unless otherwise specified.
  • A directory /<source_root>/ will be referred to in these instructions, this is a temporary writable directory anywhere you'd like to place it.

Step 1: Build using script

If you want to build Falco using manual steps, go to step 2.

Use the following commands to build Falco using the build script. Please make sure you have wget installed.

wget https://raw.githubusercontent.com/linux-on-ibm-z/scripts/master/Falco/0.39.2/build_falco.sh

# Run bash build_falco.sh -h to see all available options
bash build_falco.sh

In case of error, check logs for more details or go to Step 2 to follow manual build steps.

Step 2: Install dependencies

export SOURCE_ROOT=/<source_root>/

  • RHEL (8.8, 8.10)

    sudo yum install -y gcc gcc-c++ git make cmake autoconf automake pkg-config patch libtool elfutils-libelf-devel diffutils which createrepo libarchive wget curl rpm-build kmod kernel-devel-$(uname -r) perl-IPC-Cmd perl-bignum perl-core clang llvm bpftool

  • RHEL (9.2, 9.4, 9.5)

    sudo yum install --allowerasing -y gcc gcc-c++ git make cmake autoconf automake pkg-config patch perl-IPC-Cmd perl-bignum perl-core perl-FindBin libtool elfutils-libelf-devel diffutils which createrepo libarchive wget curl rpm-build kmod kernel-devel-$(uname -r) go clang llvm bpftool

  • SLES 15 SP6

    SLES_KERNEL_VERSION=$(uname -r | sed 's/-default//')
SLES_KERNEL_PKG_VERSION=$(sudo zypper se -s 'kernel-default-devel' | grep ${SLES_KERNEL_VERSION} | head -n 1 | cut -d "|" -f 4 - | tr -d '[:space:]')

sudo zypper install -y gcc gcc-c++ gcc9 gcc9-c++ git-core cmake patch which automake autoconf libtool libelf-devel gawk tar curl vim wget pkg-config glibc-devel-static go1.21 "kernel-default-devel=${SLES_KERNEL_PKG_VERSION}" kmod clang17 llvm17 bpftool

sudo update-alternatives --install /usr/bin/g++ g++ /usr/bin/g++-9 50
export CC=$(which gcc)
export CXX=$(which g++)

  • Ubuntu 20.04

    sudo apt-get update
sudo apt-get install -y git cmake build-essential pkg-config autoconf wget curl patch libtool libelf-dev gcc rpm linux-headers-$(uname -r) linux-tools-$(uname -r) kmod

#Install clang 14
cd $SOURCE_ROOT
sudo apt install -y lsb-release wget software-properties-common gnupg
wget https://apt.llvm.org/llvm.sh
sed -i 's,add-apt-repository "${REPO_NAME}",add-apt-repository "${REPO_NAME}" -y,g' llvm.sh
chmod +x llvm.sh
sudo ./llvm.sh 14
rm ./llvm.sh

export CC=clang-14
export CXX=clang++-14
sudo ln -sf /usr/bin/clang-14 /usr/bin/clang
sudo ln -sf /usr/bin/clang++-14 /usr/bin/clang++

  • Ubuntu 22.04

    sudo apt-get update
sudo apt-get install -y git cmake build-essential pkg-config autoconf wget curl patch libtool libelf-dev gcc rpm linux-headers-$(uname -r) linux-tools-$(uname -r) kmod clang llvm

  • Ubuntu (24.04, 24.10)

    sudo apt-get update
sudo apt-get install -y git cmake build-essential pkg-config autoconf wget curl patch libtool libelf-dev gcc gcc-12 g++-12 rpm linux-headers-$(uname -r) linux-tools-$(uname -r) kmod clang llvm

sudo update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-12 100 --slave /usr/bin/g++ g++ /usr/bin/g++-12
export CC=$(which gcc)
export CXX=$(which g++)

  • Install Go v1.22.4 (Only for RHEL 8.x and Ubuntu)

    cd $SOURCE_ROOT
export GO_VERSION="1.22.4"
wget -q https://storage.googleapis.com/golang/go"$GO_VERSION".linux-s390x.tar.gz
chmod ugo+r go"$GO_VERSION".linux-s390x.tar.gz
sudo tar -C /usr/local -xzf go"$GO_VERSION".linux-s390x.tar.gz
sudo ln -sf /usr/local/go/bin/go /usr/bin/
sudo ln -sf /usr/local/go/bin/gofmt /usr/bin/
sudo ln -sf /usr/bin/gcc /usr/bin/s390x-linux-gnu-gcc # (Only on RHEL and SLES)
export GOPATH=$SOURCE_ROOT
export PATH=$GOPATH/bin:$PATH
export CC=$(which gcc)
export CXX=$(which g++)
go version

  • Install bpftool (Only for Ubuntu 22.04)

    cd $SOURCE_ROOT
git clone --depth 1 --recurse-submodules https://github.com/libbpf/bpftool.git
cd bpftool && cd src
CLANG=Nope make -j8
sudo make install

Step 3: Download, configure and build Falco

3.1. Download Falco

cd $SOURCE_ROOT
git clone --depth 1 -b 0.39.2 https://github.com/falcosecurity/falco.git
cd falco

3.2. Apply patch to turn off modern BPF support (Ubuntu 20.04)

curl -sSL https://raw.githubusercontent.com/linux-on-ibm-z/scripts/master/Falco/0.39.2/patch/modern_bpf.patch | git apply -

3.3. Build Falco

mkdir -p $SOURCE_ROOT/falco/build
cd $SOURCE_ROOT/falco/build

  • Configure Falco

    CMAKE_TEST_FLAG="-DBUILD_FALCO_UNIT_TESTS=On"   # Only when unit tests are expected to be run after building Falco
CMAKE_TEST_FLAG=""  # Only when unit tests are not needed
CMAKE_FLAGS="-DFALCO_ETC_DIR=/etc/falco -DUSE_BUNDLED_DEPS=On -DCMAKE_BUILD_TYPE=Release -DBUILD_DRIVER=On ${CMAKE_TEST_FLAG}"  # Only for RHEL 8.x and Ubuntu 20.04
CMAKE_FLAGS="-DFALCO_ETC_DIR=/etc/falco -DUSE_BUNDLED_DEPS=On -DCMAKE_BUILD_TYPE=Release -DBUILD_DRIVER=On -DBUILD_BPF=On -DBUILD_FALCO_MODERN_BPF=ON ${CMAKE_TEST_FLAG}"   # Only for RHEL 9.x, SLES 15.6 and Ubuntu (22.04, 24.04, 24.10)
cmake $CMAKE_FLAGS ../

  • Build and Install

    cd $SOURCE_ROOT/falco/build
# Fix c-ares download link (Only for RHEL, SLES 15.6, Ubuntu (20.04, 24.x))
sed -i 's,c-ares.haxx.se/download/,github.com/c-ares/c-ares/releases/download/cares-1_19_1/,g' ./falcosecurity-libs-repo/falcosecurity-libs-prefix/src/falcosecurity-libs/cmake/modules/cares.cmake
sed -i 's,c-ares.haxx.se/download/,github.com/c-ares/c-ares/releases/download/cares-1_19_1/,g' ./c-ares-prefix/src/c-ares-stamp/c-ares-urlinfo.txt
sed -i 's,c-ares.haxx.se/download/,github.com/c-ares/c-ares/releases/download/cares-1_19_1/,g' ./c-ares-prefix/src/c-ares-stamp/download-c-ares.cmake
make -j$(nproc)
make package            # build deb/rpm packages (optional and only on Ubuntu and RHEL)
sudo make install

3.4. Load kernel module

  • Unload any existing module using

    sudo rmmod falco

  • Insert locally built version

    cd $SOURCE_ROOT/falco/build
sudo insmod driver/falco.ko

3.5. Copy eBPF driver object file to the default location (Only on RHEL 9.x, SLES 15.6 and Ubuntu (22.04, 24.04, 24.10))

sudo mkdir /root/.falco
sudo cp -f $SOURCE_ROOT/falco/build/driver/bpf/probe.o /root/.falco/falco-bpf.o

Step 4: Testing (optional)

cd $SOURCE_ROOT/falco/build
sudo ./unit_tests/falco_unit_tests 

A separate falco project https://github.com/falcosecurity/event-generator can be used to run further tests.

Step 5: Validate installation (optional)

  • Run Falco with Kernel module (default driver)

    sudo falco

    Note: Run sudo falco --help to see available options to run falco. By default, falco logs events to standard error.

    Output similar to following will be seen

    Thu Feb  6 10:56:40 2025: Falco version: 0.39.2 (s390x)
Thu Feb  6 10:56:40 2025: Falco initialized with configuration files:
Thu Feb  6 10:56:40 2025:    /etc/falco/falco.yaml | schema validation: ok
Thu Feb  6 10:56:40 2025: System info: Linux version 6.11.0-14-generic (buildd@bos03-s390x-020) (s390x-linux-gnu-gcc-14  (Ubuntu 14.2.0-4ubuntu2) 14.2.0, GNU ld (GNU Binutils for Ubuntu) 2.43.1) #15-Ubuntu SMP Fri Jan 10 22:15:44 UTC 2025
Thu Feb  6 10:56:40 2025: Loading rules from:
Thu Feb  6 10:56:40 2025:    /etc/falco/falco_rules.yaml | schema validation: ok
Thu Feb  6 10:56:40 2025:    /etc/falco/falco_rules.local.yaml | schema validation: none
Thu Feb  6 10:56:40 2025: The chosen syscall buffer dimension is: 8388608 bytes (8 MBs)
Thu Feb  6 10:56:40 2025: Starting health webserver with threadiness 8, listening on 0.0.0.0:8765
Thu Feb  6 10:56:40 2025: Loaded event sources: syscall
Thu Feb  6 10:56:40 2025: Enabled event sources: syscall
Thu Feb  6 10:56:40 2025: Opening 'syscall' source with modern BPF probe.
Thu Feb  6 10:56:40 2025: One ring buffer every '2' CPUs.

  • Run Falco with eBPF probe driver (Only on RHEL 9.x, SLES 15.6 and Ubuntu (22.04, 24.04, 24.10))

    sudo FALCO_BPF_PROBE="" falco

    Output similar to following will be seen

    Thu Feb  6 11:00:41 2025: Falco version: 0.39.2 (s390x)
Thu Feb  6 11:00:41 2025: Falco initialized with configuration files:
Thu Feb  6 11:00:41 2025:    /etc/falco/falco.yaml | schema validation: ok
Thu Feb  6 11:00:41 2025: System info: Linux version 6.11.0-14-generic (buildd@bos03-s390x-020) (s390x-linux-gnu-gcc-14 (Ubuntu 14.2.0-4ubuntu2) 14.2.0, GNU ld (GNU Binutils for Ubuntu) 2.43.1) #15-Ubuntu SMP Fri Jan 10 22:15:44 UTC 2025
Thu Feb  6 11:00:41 2025: Loading rules from:
Thu Feb  6 11:00:41 2025:    /etc/falco/falco_rules.yaml | schema validation: ok
Thu Feb  6 11:00:41 2025:    /etc/falco/falco_rules.local.yaml | schema validation: none
Thu Feb  6 11:00:41 2025: The chosen syscall buffer dimension is: 8388608 bytes (8 MBs)
Thu Feb  6 11:00:41 2025: Starting health webserver with threadiness 8, listening on 0.0.0.0:8765
Thu Feb  6 11:00:41 2025: Loaded event sources: syscall
Thu Feb  6 11:00:41 2025: Enabled event sources: syscall
Thu Feb  6 11:00:41 2025: Opening 'syscall' source with modern BPF probe.
Thu Feb  6 11:00:41 2025: One ring buffer every '2' CPUs.

Reference:

The information provided in this article is accurate at the time of writing, but on-going development in the open-source projects involved may make the information incorrect or obsolete. Please open issue or contact us on IBM Z Community if you have any questions or feedback.

Clone this wiki locally