arm-architecture
  • theopolis

    theopolis

    08/27/2020, 1:16 AM
    I think 14.04 is closer to 2.12 than 16.04
  • a

    alessandrogario

    08/27/2020, 1:17 AM
    I think it's not that important for AArch64 specifically, it's more something we have to careful with for x86
  • b

    Benjamin Herrenschmidt

    08/31/2020, 8:48 AM
    @alessandrogario so .. flags.cmake or glbals.cmake ? 🙂
  • a

    alessandrogario

    09/05/2020, 7:09 AM
    I copied the packages generated from the a1.metal instance to my rpi3! Terminal output in the reply
  • b

    Benjamin Herrenschmidt

    09/07/2020, 8:15 AM
    BTW. Is it worth doing a "release" with the aarch64 support ?
  • a

    alessandrogario

    09/11/2020, 9:32 PM
  • b

    Benjamin Herrenschmidt

    10/11/2020, 8:18 AM
    There's a request in place to give you AWS creds, @seph what's the status ?
  • a

    alessandrogario

    02/27/2021, 3:42 PM
    I have re-built the 4.6.0 packages from scratch; they were initially uploaded in #core but it appears they never ended up linked in the osquery.io page. I'll take a look at how to upload them there so we can update them
  • a

    alessandrogario

    02/27/2021, 3:44 PM
    BPF-based eventing will however not be perfect 😞 I'm sure there's something wrong in the kernel, as the problem can be easily reproduced with BCC
  • a

    Ali Saidi

    03/04/2021, 8:07 PM
    @alessandrogario were you able to figure out how to upload 4.6?
  • s

    seph

    03/14/2021, 2:04 AM
    I feel like I’m jousting at windmills. but https://github.com/directionless/osquery/runs/2104618800?check_suite_focus=true ran on a self hosted arm64 machine. (no where near automated, very manual in my terminal windows)
  • l

    Luqi Pan

    03/17/2021, 11:16 PM
    Hey folks, my name is Luqi and I work at Apple with several other folks on osquery efforts. We're very interested in seeing official support of osquery on ARM become a reality and my understanding is that you folks are very much interested in it as well. We recently learned that folks at AWS are willing to provide engineering resources and compute credits to help with this goal, specifically CI for osquery on ARM. (Thank you AWS for the generous offer!) Would you all be interested in a meeting to discuss how do we make this a reality? I'm in no way familiar with the development process in osquery land but maybe we can target official support of osquery on ARM for 4.8.0 release?
  • theopolis

    theopolis

    03/18/2021, 4:07 AM
    I should have gone to bed an hour ago, but I got an example
    ec2-github-runner
    integration working with a test-fork of osquery: https://github.com/theopolis/osquery-ci-test/runs/2136674997?check_suite_focus=true this approach wont work for pull requests because of GitHub properly limiting access to secrets from non-collaborators. We might be able to get up and running with this by having these workflow jobs run on the main branch and tags. And we can find a solution for pull requests in the future. To have this work for master is a matter of copying and pasting that PR into
    osquery/osquery
    and setting the proper secrets.
  • s

    seph

    03/23/2021, 2:12 AM
    Hi folks! I know there’s been a lot of interest in the arm64 CI work, and I wanted to give y’all an update on what @theopolis and I have been working on. (In thread)
  • Paul Roberts

    Paul Roberts

    03/30/2021, 5:54 PM
    @theopolis have you all been able to make any progress regarding the first option? I see you are waiting to add secrets here: https://github.com/osquery/osquery/pull/7014
  • theopolis

    theopolis

    04/11/2021, 1:26 AM
    It looks like my original CI workflow had an error causing it to only build the project, and not actually run the tests. I've corrected this in a branch and it looks like some tests are failing. https://github.com/osquery/osquery/runs/2283618080
  • a

    alessandrogario

    04/23/2021, 5:50 PM
    this looks handy, we can maybe turn it on
  • Paul Roberts

    Paul Roberts

    04/26/2021, 3:46 PM
    @alessandrogario @seph, @David Gibb, and I had a discussion recently and due to security concerns with GitHub Actions we believe the current model will persist. Additionally, the lack of broader control (job start, job queue, etc) via GH APIs is another challenge today. However, based on the above change we can take another look at this.
  • theopolis

    theopolis

    05/02/2021, 2:39 PM
    @alessandrogario had been keeping that initial blog post updated with packages for each release. I can try to find the packages for 4.8.0 and make an update shortly. The plan is to have automation handle this for 4.9.0. One other thing we could use help with is support for the website. I created https://github.com/osquery/osquery-site/issues/207 to track moving from the small "hack" to find arm64 downloads.
  • Liz Fong-Jones

    Liz Fong-Jones

    05/05/2021, 9:26 PM
    but still would appreciate a SHA checksum from an osquery dev
  • theopolis

    theopolis

    05/24/2021, 7:56 PM
    This sounds like a bug
  • Mike Myers

    Mike Myers

    06/02/2021, 8:00 PM
    @Nico this has been asked about before (not recently) so there might be some discussion in the Slack history. But, porting to a platform like Android would be almost as big as rewriting osquery. It's not only compiling all of the library dependencies for Android, it also requires rewritten or new virtual tables to collect from platform-specific APIs, and whether it has the permissions necessary to provide useful collection. Then there's the question of how it would run as a daemon on Android. If someone had the time (really, the funding because time is money) to contribute such a large contribution to osquery, it should probably be done incrementally, with a roadmap. It's too early to estimate a timeline, without a roadmap and some dedicated people. But it's definitely more than several months of work.
  • Mike Myers

    Mike Myers

    06/08/2021, 8:39 PM
    what about accepting modifications that make Android compilation possible, as long as they don't interfere with things, and we don't make any claim yet that Android is a supported platform?
  • Mike Myers

    Mike Myers

    08/04/2021, 6:20 PM
    https://github.com/osquery/osquery/issues/6285 I think this is ready to be closed?
  • Liz Fong-Jones

    Liz Fong-Jones

    08/24/2021, 6:48 PM
    Just wanted to update and say we're on the apt repo and all is well
  • Nico

    Nico

    09/01/2021, 11:34 AM
    Hi everyone! I am not sure where to put this. I built Osquery from a Ubuntu/arm64 machine in order to run it on arm64 devices. When the Linux kernel version is equal to 4.9, the binary runs fine. But when the kernel is older, then I get : "FATAL : kernel too old". I gess I have to indicate the kernel version to CMake, but I don't know how. It this normal? And if it is normal, how can we make a binary run with old Linux kernel?