BPF_PROG_LOAD of "sys_exit" fails with EINVAL

[dcoppa]

Describe the bug

Running Falco fails with:

[libs]: libbpf: prog 'sys_exit': BPF program load failed: Invalid argument
[libs]: libbpf: prog 'sys_exit': failed to load: -22
[libs]: libbpf: failed to load object 'bpf_probe'
[libs]: libbpf: failed to load BPF skeleton 'bpf_probe': -22
[libs]: libpman: failed to load BPF object (errno: 22 | message: Invalid argument)
An error occurred in an event source, forcing termination...
Stopping capture for event source 'syscall'

How to reproduce it

Running Falco, both as a pod on Kubernetes and from command line (falco -c ./falco.yaml -r ./falco_rules.yaml) on one of the worker nodes.

Expected behaviour

Falco works.

Screenshots

Environment

• Falco version:

Falco version: 0.39.2
Libs version: 0.18.2
Plugin API: 3.7.0
Engine: 0.43.0
Driver:
API version: 8.0.0
Schema version: 2.0.0
Default driver: 7.3.0+driver

• System info:

{
"machine": "x86_64",
"nodename": "kcoplane",
"release": "6.12.8-artix1-1",
"sysname": "Linux",
"version": "#1 SMP PREEMPT_DYNAMIC Fri, 03 Jan 2025 16:31:28 +0000"
}

• Cloud provider or hardware configuration:

QEMU/KVM virtual hardware

• OS:

NAME="Artix Linux"
PRETTY_NAME="Artix Linux"
ID=artix
BUILD_ID=rolling
ANSI_COLOR="38;2;23;147;209"
HOME_URL="https://artixlinux.org/"
DOCUMENTATION_URL="https://wiki.artixlinux.org/"
SUPPORT_URL="https://forum.artixlinux.org/"
BUG_REPORT_URL="https://bugs.artixlinux.org/"
PRIVACY_POLICY_URL="https://terms.artixlinux.org/docs/privacy-policy/"
LOGO=artixlinux-logo

• Kernel:

Linux kcoplane 6.12.8-artix1-1 #1 SMP PREEMPT_DYNAMIC Fri, 03 Jan 2025 16:31:28 +0000 x86_64 GNU/Linux

• Installation method:

Kubernetes and from source

Additional context

I've Attached the debug log and the output of strace.
falco-strace.log
falco-debug.log

[Andreagit97]

Ei @dcoppa this will be solved by Falco 0.40.0, and should already be solved in Falco master branch. See the fix here falcosecurity/libs#2172

[dcoppa]

Indeed, compiling from master produces a working binary.
Thanks a lot for your answer!

[FedeDP]

/milestone 0.40.0
/close

[poiana]

@FedeDP: Closing this issue.

In response to this:

/milestone 0.40.0
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.