Title
#general
t

Tor Houghton

02/17/2022, 8:25 AM
Linux so.home.bogus.net 3.10.0-1160.53.1.el7.x86_64 #1 SMP Fri Jan 14 13:59:45 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
a

alessandrogario

02/17/2022, 9:51 AM
Just noticed the kernel version is here, sorry! Can you try the auto-generated package from the CI on my PR? https://github.com/osquery/osquery/pull/7378
9:52 AM
linux_unsigned_release_rpm
9:52 AM
Alternatively: you can disable BPF from your current installation
t

Tor Houghton

02/17/2022, 1:26 PM
Heh. Well, I want to test eBPF on this kernel šŸ™‚ .
1:33 PM
Unsure where I am to get the rpm?
a

alessandrogario

02/17/2022, 1:59 PM
You can find them in the following page, scrolling down: https://github.com/osquery/osquery/actions/runs/1814621224
1:59 PM
If they are not visible, you probably have to log into your GitHub account
t

Tor Houghton

02/17/2022, 2:58 PM
Ah duh. My mouse was captured in the hosted_runners.yml area of the page and didn't want to scroll down. I blame covid.
3:03 PM
Same result; Feb 17 15:01:28 so osqueryd: osqueryd started [version=5.2.2-4-g9f7dcb4ee] Feb 17 15:01:30 so osqueryd: terminating with uncaught exception of type std::runtime_error: Failed to create the perf event array: Failed to create the map Feb 17 15:01:32 so osqueryd: W0217 15:01:32.013586 23935 watcher.cpp:601] osqueryd worker respawning too quickly: 1 times Feb 17 15:01:40 so osqueryd: terminating with uncaught exception of type std::runtime_error: Failed to create the perf event array: Failed to create the map Feb 17 15:01:42 so osqueryd: W0217 15:01:42.018976 23935 watcher.cpp:601] osqueryd worker respawning too quickly: 2 times Feb 17 15:01:51 so osqueryd: terminating with uncaught exception of type std::runtime_error: Failed to create the perf event array: Failed to create the map Feb 17 15:01:54 so osqueryd: W0217 15:01:54.022825 23935 watcher.cpp:601] osqueryd worker respawning too quickly: 3 times Feb 17 15:02:08 so osqueryd: terminating with uncaught exception of type std::runtime_error: Failed to create the perf event array: Failed to create the map Feb 17 15:02:10 so osqueryd: W0217 15:02:10.026259 23935 watcher.cpp:601] osqueryd worker respawning too quickly: 4 times Feb 17 15:02:31 so osqueryd: terminating with uncaught exception of type std::runtime_error: Failed to create the perf event array: Failed to create the map Feb 17 15:02:34 so osqueryd: Too many worker restarts Feb 17 15:02:34 so osqueryd: E0217 15:02:34.030128 23935 shutdown.cpp:79] Too many worker restarts
3:03 PM
šŸ˜•
a

alessandrogario

02/17/2022, 3:03 PM
Ok so this build should actually work there; is it being run as root?
3:03 PM
There's also a chance that the memory settings are too high
t

Tor Houghton

02/17/2022, 3:04 PM
I did a systemctl restart osqueryd (as root). I can increase the memory of the VM and see if that helps? 64G?
3:05 PM
There's also a small note about VMware Fusion, if that's the hypervisor being used
t

Tor Houghton

02/17/2022, 3:06 PM
Yeah, I have it running on hosts with newer kernels just fine. I am just interested in having it run on this 3.10 kernel as I have some prod hosts running that.
3:06 PM
I am using proxmox here at home.
a

alessandrogario

02/17/2022, 3:07 PM
How are the following flags set? ā€¢ bpf_perf_event_array_exp ā€¢ bpf_buffer_storage_size
3:07 PM
How many possible CPUs are reported?
cat /sys/devices/system/cpu/possible
3:08 PM
And, do they match the number of CPUs that are currently online?
cat /sys/devices/system/cpu/online
t

Tor Houghton

02/17/2022, 3:17 PM
cat /sys/devices/system/cpu/online 0-5 cat /sys/devices/system/cpu/possible 0-5
3:19 PM
i've not made specific references to either bpf_perf_event_array_exp or bpf_buffer_storage_size in the flags file (on any of my hosts).
3:19 PM
i.e. these options are not set and i presume defaults when --enable_bpf_events=true is passed
a

alessandrogario

02/17/2022, 3:21 PM
how much memory is available on the VM?
t

Tor Houghton

02/17/2022, 3:26 PM
KiB Mem : 65807732 total, 44042236 free, 13285972 used, 8479524 buff/cache KiB Swap: 0 total, 0 free, 0 used. 51979476 avail Mem
a

alessandrogario

02/17/2022, 3:31 PM
uhm any chance it could be SELinux related?
t

Tor Houghton

02/17/2022, 3:44 PM
Good question. This is SecurityOnion, so not a wild guess. I've temporarilty put it into Permissive mode.
3:45 PM
I got the following now: Feb 17 15:43:18 so osqueryd: osqueryd started [version=5.2.2-4-g9f7dcb4ee] Feb 17 15:43:41 so kernel: Could not insert probe at sys_execveat+0: -2 But no shutdown message so far.
3:46 PM
I also got these: Feb 17 15:43:43 so osqueryd: I0217 15:43:43.824308 17125 eventfactory.cpp:156] Event publisher not enabled: auditeventpublisher: Publisher disabled via configuration Feb 17 15:43:43 so osqueryd: I0217 15:43:43.827373 17125 eventfactory.cpp:156] Event publisher not enabled: inotify: Publisher disabled via configuration Feb 17 15:43:43 so osqueryd: I0217 15:43:43.827664 17125 eventfactory.cpp:156] Event publisher not enabled: syslog: Publisher disabled via configuration
3:48 PM
Yep. I can query the table via fleetdm.
3:49 PM
"the table" == bpf_process_events
3:50 PM
Thanks for your help! Wonder where I can find out how to have SELinux enabled as well as a functioning osqueryd+ebpf.
a

alessandrogario

02/17/2022, 4:37 PM
if you enable auditd (and disable the audit publisher in osquery)
4:38 PM
it will log the errors in the auditd.log file under /var/log
4:38 PM
the SELinux tools can then scan it to create the rules required to fix it
t

Tor Houghton

02/17/2022, 6:14 PM
Works, thanks šŸ™‚
6:14 PM
$ cat osqueryd_unconfined_service.te module osqueryd_unconfined_service 1.0; require { type unconfined_service_t; class bpf { map_create map_read map_write prog_load prog_run }; } #============= unconfined_service_t ============== allow unconfined_service_t self:bpf { map_create map_read map_write prog_load prog_run };
6:14 PM
appears to be enough šŸ™‚