falco-driver-loader 0.40.0 dkms install module failed on Ubuntu 24.04 (kernel release: 6.11.0-19-generic)

[shengxpa]

Describe the bug

Due to "unable to find a prebuilt driver" and "kernel headers not found," the falco-driver-loader attempted to dkms install the module but failed. The machine running the falco pod is Ubuntu 24.04, with the kernel version 6.11.0-19-generic.

There are some error logs:

[configure-kmod] make: Entering directory '/var/lib/dkms/falco/8.0.0+driver/build/configure/CLASS_CREATE_1' make -C /host/usr/src/linux-headers-6.11.0-19-generic M=/var/lib/dkms/falco/8.0.0+driver/build/configure/CLASS_CREATE_1 modules make[1]: Entering directory '/host/usr/src/linux-headers-6.11.0-19-generic' warning: the compiler differs from the one used to build the kernel The kernel was built by: x86_64-linux-gnu-gcc-13 (Ubuntu 13.3.0-6ubuntu2~24.04) 13.3.0 You are using: gcc-12 (Debian 12.2.0-14) 12.2.0 CC [M] /var/lib/dkms/falco/8.0.0+driver/build/configure/CLASS_CREATE_1/test.o ./tools/objtool/objtool: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.38' not found (required by ./tools/objtool/objtool) make[3]: *** [scripts/Makefile.build:244: /var/lib/dkms/falco/8.0.0+driver/build/configure/CLASS_CREATE_1/test.o] Error 1 make[3]: *** Deleting file '/var/lib/dkms/falco/8.0.0+driver/build/configure/CLASS_CREATE_1/test.o' make[2]: *** [/host/usr/src/linux-headers-6.11.0-19-generic/Makefile:1931: /var/lib/dkms/falco/8.0.0+driver/build/configure/CLASS_CREATE_1] Error 2 make[1]: *** [Makefile:224: __sub-make] Error 2 make[1]: Leaving directory '/host/usr/src/linux-headers-6.11.0-19-generic' make: *** [Makefile:15: all] Error 2 make: Leaving directory '/var/lib/dkms/falco/8.0.0+driver/build/configure/CLASS_CREATE_1'

How to reproduce it

Runing falco pods using kmod method on Ubuntu 24.04

falco-driver-loader container log
kubed-falco-master-pk9dg.log

Environment

• Falco version:
  0.40.0
• System info:

Linux version 6.11.0-19-generic (buildd@lcy02-amd64-014) (x86_64-linux-gnu-gcc-13 (Ubuntu 13.3.0-6ubuntu2~24.04) 13.3.0, GNU ld (GNU Binutils for Ubuntu) 2.42) #19~24.04.1-Ubuntu SMP PREEMPT_DYNAMIC Mon Feb 17 11:51:52 UTC 2

• Cloud provider or hardware configuration:
• OS:
  Ubuntu 24.04.2 LTS
• Kernel:
  6.11.0-19-generic x86_64
• Installation method:
  Kubernetes

[FedeDP]

Hi @shengxpa ! Thanks for opening this issue.
Normally, on ubuntu 24.04 (and on that recent kernel) you should be able to go with the modern_ebpf driver that does not require any external artifact.
Indeed, it should be the default deployment method on it. Can you share your deployment steps?

[FedeDP]

Also, thanks for pointing it out, but we are not able to build drivers for ubuntu 6.11+.
Opened the PR to fix driverkit side: falcosecurity/driverkit#383

[shengxpa]

@FedeDP, we add kmod arg in the kubed-falco-driver-loader initContainer of falco DaemonSet to enable kmod mod, so it will download or build a driver in the initialize stage.
What' the plan to release a new falco-driver-loader docker image version to support ubuntu 24.04 (kernel release: 6.11.0-19-generic) since I see your PR for driverkit has been merged?

[FedeDP]

@shengxpa is there a reason why you don't want to use the modern ebpf driver?
Anyway, our driver pipeline is already catching up, but we are using the cluster to make some tests about the new container plugin (see #3403) .

[shengxpa]

@FedeDP We have always used kmod mode, so we have not thought about changing to ebpf mode. We will consider using it later.

[FedeDP]

Hi! The build has started, you should see the driver come up "soon ™" (likely in 7-8hrs); you can follow the process here: https://prow.falco.org/view/s3/falco-prow-logs/logs/build-new-drivers-ubuntu-generic-6-postsubmit/1913141984067850240

[FedeDP]

They are now available:

2025-04-18T08:37:37.000Z 1.1 MB falco_ubuntu-generic_6.11.0-19-generic_19.ko
2025-04-18T08:37:37.000Z 5.4 MB falco_ubuntu-generic_6.11.0-19-generic_19.o

[FedeDP]

/close
/milestone 0.41.0

[poiana]

@FedeDP: Closing this issue.

Details

In response to this:

/close
/milestone 0.41.0

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[ader1990]

Hello, using the 0.41.0 release, we still have the same issue on Flatcar Container Linux using Linux Kernel 6.12, see: flatcar/mantle#604, when running:

docker run --rm --privileged -v /root/.falco:/root/.falco -v /proc:/host/proc:ro \
  -v /boot:/host/boot:ro -v /lib/modules:/host/lib/modules:ro \
  -v /usr:/host/usr:ro -v /etc:/host/etc:ro \
  falcosecurity/falco-driver-loader:0.41.0 kmod

Error:

warning: the compiler differs from the one used to build the kernel   The kernel was built by: x86_64-cros-linux-gnu-gcc (Gentoo Hardened 14.2.1_p20241221 p7) 14.2.1 20241221

  You are using:           gcc-12 (Debian 12.2.0-14+deb12u1) 12.2.0   CC [M]  /var/lib/dkms/falco/8.1.0+driver/build/configure/0__SANITY/test.o

Is there a way to build the Docker image falco-driver-loader to use the fix from the driverkit?

Thanks.

[FedeDP]

Hi! You just shared a warning! :)
Can you share the full output? Also, feel free to open a new issue.

Is there a way to build the Docker image falco-driver-loader to use the fix from the driverkit?

Latest falco-driver-loader is already using latest falcoctl that itself is built using latest driverkit libraries.