Tracee for CentOS 7

[chansgt]

Does Tracee support CentOS 7?

[itaysk]

Hi, Since v0.3.1 Tracee was tested with CentOS 8. We haven't tested with all versions thought. Are you having any issues? if so, please share the error message / output and we can troubleshoot.

[chansgt]

HI Itaysk,

Yes i have an issue, i tried tracee (container) using ubuntu 18.04 with kernel 5.4.0-51-generic it is work. But when i tried using tracee (container) using CentOs 7 with upgraded kernel to version 5.4.86-1.el7.elrepo.x86_64, Tracee didn't work with log like below:

libbpf: Error in bpf_object__probe_loading():Permission denied(13). Couldn't load trivial BPF program. Make sure your kernel supports BPF (CONFIG_BPF_SYSCALL=y) and/or that RLIMIT_MEMLOCK is set to big enough value. libbpf: failed to load object '/tmp/tracee/tracee.bpf.5_4_86-1_el7_elrepo_x86_64.v0_3_1.o' 2021/01/03 11:06:31 error creating Tracee: failed to load BPF object

Do i need something else to configure to make tracee work?

[yanivagman]

Hi @chansgt,

Can you please check if kernel lockdown is enabled on your machine?
sudo cat /sys/kernel/security/lockdown

Also, can you please verify if another trivial bpf program works on you machine?
For example, you can try to run execsnoop from bcc (requires bcc to be installed on your machine):
https://github.com/iovisor/bcc/blob/master/tools/execsnoop.py

Thanks

[chansgt]

Hi Yanivagman,

Thanks for your help, I have tried your suggestion and below is the result:

1. sudo cat /sys/kernel/security/lockdown
   Result:
   

2. ./execsnoop.py
   Result:
   Success
   

I tried again execute this command:

docker run --name tracee --rm --privileged --pid=host -v /lib/modules/:/lib/modules/:ro -v /usr/src:/usr/src:ro -v /tmp/tracee:/tmp/tracee aquasec/tracee

and still fail.

[yanivagman]

Thanks @chansgt,

The error message given by libbpf indicates it may be an rlimit issue.
We set this value to 512MB in tracee, which I thought shuold be enough, but maybe I was wrong:
https://github.com/aquasecurity/tracee/blob/main/libbpfgo/libbpfgo.go#L217
BCC sets this value to "unlimited", and that may be the difference.

If you can compile from source, this can be done by changing the lines (in the above link):
rLimit.Max = 512 << 20 /* 512 MBs /
rLimit.Cur = 512 << 20 / 512 MBs */

To something bigger, for example:
rLimit.Max = 4096 << 20 /* 4096 MBs /
rLimit.Cur = 4096 << 20 / 4096 MBs */

[wenzhenparent]

Hi @chansgt,

Can you please check if kernel lockdown is enabled on your machine? sudo cat /sys/kernel/security/lockdown

Also, can you please verify if another trivial bpf program works on you machine? For example, you can try to run execsnoop from bcc (requires bcc to be installed on your machine): https://github.com/iovisor/bcc/blob/master/tools/execsnoop.py

Thanks

Hi, I encounter the same error, and my lockdown is on. Is this lockdown the root cause? How should I change it to make my BPF program working? Thanks a lot!

[wenzhenparent]

Hi @chansgt,

Can you please check if kernel lockdown is enabled on your machine? sudo cat /sys/kernel/security/lockdown

Also, can you please verify if another trivial bpf program works on you machine? For example, you can try to run execsnoop from bcc (requires bcc to be installed on your machine): https://github.com/iovisor/bcc/blob/master/tools/execsnoop.py

Thanks

When I use
sudo cat /sys/kernel/security/lockdown
I got this:
[none] integrity confidentiality

What's the next step I should do? Thanks.

[chansgt]

No problem @yanivagman.

I already change the parameter, but when i build the image using Dockerfile it show error like the image bellow.

[chansgt]

HI @yanivagman

The result still same.

[yanivagman]

@chansgt, In this case, I would have to reproduce this locally and check. Thanks for raising this issue and eliminating some options (kernel lockdown, rlimit, bpf not supported)

[chansgt]

sure, no problem.

[yanivagman]

Hi @chansgt,

Can you please open an issue for this? (you can link back to that discussion).

Thanks,
Yaniv

[chansgt]

HI @yanivagman ,

I have done open an issue for this problem. Thank you.