8p8c
03/03/2021, 4:02 AMI0303 03:03:34.795771 169479 bpfeventpublisher.cpp:310] Initialized BPF probe for syscall open (87)
I0303 03:03:34.800343 169479 bpfeventpublisher.cpp:310] Initialized BPF probe for syscall openat (93)
I0303 03:03:34.800472 169479 bpfeventpublisher.cpp:297] Failed to load the BPF probe for syscall openat2: Failed to open the tracepoint descriptor file: /sys/kernel/debug/tracing/events/syscalls/sys_enter_openat2/id. This syscall may not be available on this system, continuing despite the error
I0303 03:03:34.806805 169479 bpfeventpublisher.cpp:310] Initialized BPF probe for syscall socket (101)
...
I0303 03:03:34.884102 169479 bpfeventpublisher.cpp:310] Initialized BPF probe for syscall open_by_handle_at (163)
I0303 03:03:34.982189 169479 bpfeventpublisher.cpp:297] Failed to load the BPF probe for syscall __x64_sys_execve: The 'enter' program could not be loaded: Failed to open the Linux kernel version header: /usr/include/linux/version.h
I0303 03:03:34.982226 169479 eventfactory.cpp:156] Event publisher not enabled: BPFEventPublisher: Failed to create the function tracer: The 'enter' program could not be loaded: Failed to open the Linux kernel version header: /usr/include/linux/version.h
on kernel 5.4 with Ubuntu 20.04. Probably expected since it's not built from release tag, but the table used to work at 4.6.alessandrogario
sudo apt-get install linux-headers-$(uname -r)
The execve, execveat probes were converted from tracepoints to kprobes to improve accuracy; more info can be found on this comment: https://github.com/osquery/osquery/pull/6802#issuecomment-744650811
TLDR: execve tracepoints miss events sometimes, both on x86 and AArch64 (but it's worse on this arch)8p8c
03/03/2021, 5:53 PMalessandrogario
$ apt-file search /usr/include/linux/version.h
linux-libc-dev: /usr/include/linux/version.h
#define LINUX_VERSION_CODE 328790
#define KERNEL_VERSION(a,b,c) (((a) << 16) + ((b) << 8) + (c))
8p8c
03/03/2021, 6:20 PMalessandrogario
8p8c
03/03/2021, 6:45 PMalessandrogario
8p8c
03/03/2021, 7:21 PM