From b6e65a161aeb63b48fca1752e5b53c2def379c06 Mon Sep 17 00:00:00 2001 From: Sebastian Sellmeier Date: Mon, 1 Apr 2024 09:49:11 +0200 Subject: [PATCH 1/3] sysdig: 0.35.3 -> 0.36.0 --- pkgs/os-specific/linux/sysdig/default.nix | 30 ++++++++++++++--------- 1 file changed, 18 insertions(+), 12 deletions(-) diff --git a/pkgs/os-specific/linux/sysdig/default.nix b/pkgs/os-specific/linux/sysdig/default.nix index 302404b38e12..97122a6388a3 100644 --- a/pkgs/os-specific/linux/sysdig/default.nix +++ b/pkgs/os-specific/linux/sysdig/default.nix @@ -4,35 +4,34 @@ }: let - # Compare with https://github.com/draios/sysdig/blob/0.35.1/cmake/modules/falcosecurity-libs.cmake - libsRev = "0.14.2"; - libsHash = "sha256-sWrniRB/vQd1BZnsiz+wLHugrF3LhuAr9e9gDMavLoo="; + # Compare with https://github.com/draios/sysdig/blob/0.36.0/cmake/modules/falcosecurity-libs.cmake + libsRev = "0.15.1"; + libsHash = "sha256-CsKa5ybRj7Mjb71xNwd8FtDprOMfpJMrm3mvkeqZE3o="; - # Compare with https://github.com/falcosecurity/libs/blob/0.14.2/cmake/modules/valijson.cmake + # Compare with https://github.com/falcosecurity/libs/blob/0.15.1/cmake/modules/valijson.cmake valijson = fetchFromGitHub { owner = "tristanpenman"; repo = "valijson"; - rev = "v0.6"; - hash = "sha256-ZD19Q2MxMQd3yEKbY90GFCrerie5/jzgO8do4JQDoKM="; + rev = "v1.0.2"; + hash = "sha256-wvFdjsDtKH7CpbEpQjzWtLC4RVOU9+D2rSK0Xo1cJqo="; }; - # https://github.com/draios/sysdig/blob/0.35.1/cmake/modules/driver.cmake + # https://github.com/draios/sysdig/blob/0.36.0/cmake/modules/driver.cmake driver = fetchFromGitHub { owner = "falcosecurity"; repo = "libs"; rev = "7.0.0+driver"; hash = "sha256-kXqvfM7HbGh2wEGaO4KBkFDW+m5gpOShJZKJLu9McKk="; }; -in -stdenv.mkDerivation rec { +in stdenv.mkDerivation rec { pname = "sysdig"; - version = "0.35.3"; + version = "0.36.0"; src = fetchFromGitHub { owner = "draios"; repo = "sysdig"; rev = version; - hash = "sha256-wvCnWzQbkkM8qEG93li22P67WX1bGX9orTk+2vsBHZY="; + hash = "sha256-EQnmtxByTsSawQPFmTe2pBMcv5rFaNtST+2KXZSFuoo="; }; nativeBuildInputs = [ cmake perl installShellFiles pkg-config ]; @@ -72,6 +71,13 @@ stdenv.mkDerivation rec { cp -r ${driver} driver-src chmod -R +w driver-src + + # Hacky but needed until https://github.com/draios/sysdig/issues/2077 is resolved for kernel >= 6.8 as strlcpy got removed and build fails + ${lib.optionalString + (kernel != null && lib.versionAtLeast kernel.version "6.8") '' + substituteInPlace libs/driver/ppm_events.c driver-src/driver/ppm_events.c --replace-fail "strlcpy" "strscpy" + ''} + cmakeFlagsArray+=( "-DFALCOSECURITY_LIBS_SOURCE_DIR=$(pwd)/libs" "-DDRIVER_SOURCE_DIR=$(pwd)/driver-src/driver" @@ -139,7 +145,7 @@ stdenv.mkDerivation rec { license = with licenses; [ asl20 gpl2 mit ]; maintainers = [maintainers.raskin]; platforms = ["x86_64-linux"] ++ platforms.darwin; - broken = kernel != null && versionOlder kernel.version "4.14"; + broken = kernel != null && ((versionOlder kernel.version "4.14") || (kernel.isHardened && lib.lists.findSingle (x: x == kernel.version) false true [ "4.19" "5.4" "lqx" ])); homepage = "https://sysdig.com/opensource/"; downloadPage = "https://github.com/draios/sysdig/releases"; }; From 50625bd0fb68aba3fc2187373ebba8eea2939562 Mon Sep 17 00:00:00 2001 From: Sebastian Sellmeier Date: Mon, 1 Apr 2024 09:50:07 +0200 Subject: [PATCH 2/3] sysdig: fix formattig --- pkgs/os-specific/linux/sysdig/default.nix | 83 +++++++++++------------ 1 file changed, 41 insertions(+), 42 deletions(-) diff --git a/pkgs/os-specific/linux/sysdig/default.nix b/pkgs/os-specific/linux/sysdig/default.nix index 97122a6388a3..08d11e3674ec 100644 --- a/pkgs/os-specific/linux/sysdig/default.nix +++ b/pkgs/os-specific/linux/sysdig/default.nix @@ -1,7 +1,6 @@ { lib, stdenv, fetchFromGitHub, cmake, kernel, installShellFiles, pkg-config -, luajit, ncurses, perl, jsoncpp, openssl, curl, jq, gcc, elfutils, tbb, protobuf, grpc -, yaml-cpp, nlohmann_json, re2, zstd, uthash -}: +, luajit, ncurses, perl, jsoncpp, openssl, curl, jq, gcc, elfutils, tbb +, protobuf, grpc, yaml-cpp, nlohmann_json, re2, zstd, uthash }: let # Compare with https://github.com/draios/sysdig/blob/0.36.0/cmake/modules/falcosecurity-libs.cmake @@ -57,12 +56,14 @@ in stdenv.mkDerivation rec { hardeningDisable = [ "pic" ]; postUnpack = '' - cp -r ${fetchFromGitHub { - owner = "falcosecurity"; - repo = "libs"; - rev = libsRev; - hash = libsHash; - }} libs + cp -r ${ + fetchFromGitHub { + owner = "falcosecurity"; + repo = "libs"; + rev = libsRev; + hash = libsHash; + } + } libs chmod -R +w libs substituteInPlace libs/userspace/libscap/libscap.pc.in libs/userspace/libsinsp/libsinsp.pc.in \ @@ -97,10 +98,10 @@ in stdenv.mkDerivation rec { ] ++ lib.optional (kernel == null) "-DBUILD_DRIVER=OFF"; env.NIX_CFLAGS_COMPILE = - # needed since luajit-2.1.0-beta3 - "-DluaL_reg=luaL_Reg -DluaL_getn(L,i)=((int)lua_objlen(L,i)) " + - # fix compiler warnings been treated as errors - "-Wno-error"; + # needed since luajit-2.1.0-beta3 + "-DluaL_reg=luaL_Reg -DluaL_getn(L,i)=((int)lua_objlen(L,i)) " + + # fix compiler warnings been treated as errors + "-Wno-error"; preConfigure = '' if ! grep -q "${libsRev}" cmake/modules/falcosecurity-libs.cmake; then @@ -113,38 +114,36 @@ in stdenv.mkDerivation rec { export KERNELDIR="${kernel.dev}/lib/modules/${kernel.modDirVersion}/build" ''; - postInstall = - '' - # Fix the bash completion location - installShellCompletion --bash $out/etc/bash_completion.d/sysdig - rm $out/etc/bash_completion.d/sysdig - rmdir $out/etc/bash_completion.d - rmdir $out/etc - '' - + lib.optionalString (kernel != null) '' - make install_driver - kernel_dev=${kernel.dev} - kernel_dev=''${kernel_dev#${builtins.storeDir}/} - kernel_dev=''${kernel_dev%%-linux*dev*} - if test -f "$out/lib/modules/${kernel.modDirVersion}/extra/scap.ko"; then - sed -i "s#$kernel_dev#................................#g" $out/lib/modules/${kernel.modDirVersion}/extra/scap.ko - else - for i in $out/lib/modules/${kernel.modDirVersion}/{extra,updates}/scap.ko.xz; do - if test -f "$i"; then - xz -d $i - sed -i "s#$kernel_dev#................................#g" ''${i%.xz} - xz -9 ''${i%.xz} - fi - done - fi - ''; - + postInstall = '' + # Fix the bash completion location + installShellCompletion --bash $out/etc/bash_completion.d/sysdig + rm $out/etc/bash_completion.d/sysdig + rmdir $out/etc/bash_completion.d + rmdir $out/etc + '' + lib.optionalString (kernel != null) '' + make install_driver + kernel_dev=${kernel.dev} + kernel_dev=''${kernel_dev#${builtins.storeDir}/} + kernel_dev=''${kernel_dev%%-linux*dev*} + if test -f "$out/lib/modules/${kernel.modDirVersion}/extra/scap.ko"; then + sed -i "s#$kernel_dev#................................#g" $out/lib/modules/${kernel.modDirVersion}/extra/scap.ko + else + for i in $out/lib/modules/${kernel.modDirVersion}/{extra,updates}/scap.ko.xz; do + if test -f "$i"; then + xz -d $i + sed -i "s#$kernel_dev#................................#g" ''${i%.xz} + xz -9 ''${i%.xz} + fi + done + fi + ''; meta = with lib; { - description = "A tracepoint-based system tracing tool for Linux (with clients for other OSes)"; + description = + "A tracepoint-based system tracing tool for Linux (with clients for other OSes)"; license = with licenses; [ asl20 gpl2 mit ]; - maintainers = [maintainers.raskin]; - platforms = ["x86_64-linux"] ++ platforms.darwin; + maintainers = [ maintainers.raskin ]; + platforms = [ "x86_64-linux" ] ++ platforms.darwin; broken = kernel != null && ((versionOlder kernel.version "4.14") || (kernel.isHardened && lib.lists.findSingle (x: x == kernel.version) false true [ "4.19" "5.4" "lqx" ])); homepage = "https://sysdig.com/opensource/"; downloadPage = "https://github.com/draios/sysdig/releases"; From 1a92639f290e05d823282ed9a0145d2b82b3c1f6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= Date: Mon, 1 Apr 2024 10:31:15 +0000 Subject: [PATCH 3/3] sysdig: disable hardened and zen kernels Also it currently compiles with zen kernels, it doesn't with lqx. Since we currently don't have a mechanism of lqx only, we can re-add, if one of the lqx/zen maintainers steps up and also help maintaining and testing sysdig. --- pkgs/os-specific/linux/sysdig/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/os-specific/linux/sysdig/default.nix b/pkgs/os-specific/linux/sysdig/default.nix index 08d11e3674ec..25b788104a4c 100644 --- a/pkgs/os-specific/linux/sysdig/default.nix +++ b/pkgs/os-specific/linux/sysdig/default.nix @@ -144,7 +144,7 @@ in stdenv.mkDerivation rec { license = with licenses; [ asl20 gpl2 mit ]; maintainers = [ maintainers.raskin ]; platforms = [ "x86_64-linux" ] ++ platforms.darwin; - broken = kernel != null && ((versionOlder kernel.version "4.14") || (kernel.isHardened && lib.lists.findSingle (x: x == kernel.version) false true [ "4.19" "5.4" "lqx" ])); + broken = kernel != null && ((versionOlder kernel.version "4.14") || kernel.isHardened || kernel.isZen); homepage = "https://sysdig.com/opensource/"; downloadPage = "https://github.com/draios/sysdig/releases"; };