Lab 7.4 - unable to proceed from the very beginning.

mark.kharitonov

student@master:~/7$ sudo docker run --name tracee --rm --privileged --pid=host -v /lib/modules/:/lib/modules/:ro -v /usr/src:/usr/src:ro -v /tmp/tracee:/tmp/tracee aquasec/tracee:0.4.0 --trace container=new --debug
attempting to build the bpf object file
building bpf object in: /tmp/tracee-make734047223
/usr/bin/clang -S -D__BPF_TRACING__ -D__KERNEL__ -D__TARGET_ARCH_x86 -I/tmp/tracee-make734047223 -include/lib/modules/5.15.0-1025-gcp/build/include/linux/kconfig.h -I/lib/modules/5.15.0-1025-gcp/build/arch/x86/include -I/lib/modules/5.15.0-1025-gcp/build/arch/x86/include/uapi -I/lib/modules/5.15.0-1025-gcp/build/arch/x86/include/generated -I/lib/modules/5.15.0-1025-gcp/build/arch/x86/include/generated/uapi -I/lib/modules/5.15.0-1025-gcp/build/include -I/lib/modules/5.15.0-1025-gcp/build/include -I/lib/modules/5.15.0-1025-gcp/build/include/uapi -I/lib/modules/5.15.0-1025-gcp/build/include/generated -I/lib/modules/5.15.0-1025-gcp/build/include/generated/uapi -Wno-address-of-packed-member -Wno-compare-distinct-pointer-types -Wno-deprecated-declarations -Wno-gnu-variable-sized-type-not-at-end -Wno-pointer-sign -Wno-pragma-once-outside-heade -Wno-unknown-warning-option -Wno-unused-value -Wunused -Wall -fno-stack-protector -fno-jump-tables -fno-unwind-tables -fno-asynchronous-unwind-tables -xc -nostdinc -O2 -emit-llvm -c -g /tmp/tracee-make734047223/tracee.bpf.c -o/tmp/tracee-make734047223/tracee.bpf.ll
/tmp/tracee-make734047223/tracee.bpf.c:281:17: error: field has incomplete type 'struct kref'
    struct kref kref;
                ^
/tmp/tracee-make734047223/tracee.bpf.c:281:12: note: forward declaration of 'struct kref'
    struct kref kref;
           ^
1 error generated.
2023/01/17 01:58:09 Failed to make BPF object (clang): exit status 1. Try using --debug for more info
student@master:~/7$

Please, help.

rob2g2

it does not work with Ubuntus hwe (hardware enabled) kernel, which is currently 5.15. If you uninstall the hwe components and just install linux-image-generic and linux-headers-generic it works (kernel 5.4)

mark.kharitonov

Hi.
Would you be able to provide more detailed instructions or maybe relevant links? I have never done it and at this moment have no idea how this can even be done. I am using Google Cloud VMs, if it matters.
Thank you.

ojmendezz

I executed these commands to use an older kernel:

wget https://kernel.ubuntu.com/~kernel-ppa/mainline/v5.4.230/amd64/linux-modules-5.4.230-0504230-generic_5.4.230-0504230.202301240741_amd64.deb
wget https://kernel.ubuntu.com/~kernel-ppa/mainline/v5.4.230/amd64/linux-image-unsigned-5.4.230-0504230-generic_5.4.230-0504230.202301240741_amd64.deb
sudo dpkg -i linux-modules-5.4.230-0504230-generic_5.4.230-0504230.202301240741_amd64.deb
sudo dpkg -i linux-image-unsigned-5.4.230-0504230-generic_5.4.230-0504230.202301240741_amd64.deb

Hope it helps.

mark.kharitonov

Good to know, thanks.
Though I abandoned the LF course. I will do Udemy instead and only the certification with LF.