content/en/docs/concepts/event-sources/kernel/_index.md
Falco uses different instrumentations to analyze the system workload and pass security events to {{< glossary_tooltip text="userspace" term_id="user-space" >}}. We usually refer to these instrumentations as {{< glossary_tooltip text="drivers" term_id="drivers" >}} since a driver runs in {{< glossary_tooltip text="kernelspace" term_id="kernel-space" >}}. The driver provides the syscall event source since the monitored events are strictly related to the {{< glossary_tooltip text="syscall" term_id="syscalls" >}} context.
There are several supported drivers:
| Kernel module | Legacy eBPF probe (deprecated) | Modern eBPF probe | |
|---|---|---|---|
| x86_64 | >= 3.10 | >= 4.14 | Minimal set of features |
| aarch64 | >= 3.10 | >= 4.17 | Minimal set of features |
By default, the {{< glossary_tooltip text="kernel module" term_id="kernel-module" >}} will be installed when installing the Falco debian/rpm package, when running the falcoctl driver tool shipped within the binary package, or when running the falcosecurity/falco-driver-loader docker image (that just wraps the aforementioned tool).
To install the kernel module, please refer to the installation page.
The kernel module requires full privileges and cannot run with Linux capabilities
The {{< glossary_tooltip text="modern eBPF probe" term_id="modern-ebpf-probe" >}} is an alternative driver for Falco. The main advantage it brings to the table is that it is embedded into Falco, which means that you don't have to download or build anything, if your kernel is recent enough Falco will automatically inject it!
The new probe is highly customizable, you are not obliged to use one buffer for each CPU you can also use just one huge buffer for all your CPUs! And obviously, also the buffer size is customizable! All this is possible thanks to new outstanding features like the CO-RE paradigm, the BPF ring buffer and many others, if you are curious you can read more about them in this blog post.
The modern eBPF probe doesn't require a specific kernel version. Usually, all versions >=5.8 are enough but there are cases in which the required features could also be backported into older kernels, so it wouldn't be completely fair to define 5.8 as the first supported version. The 2 main required features are:
Falco can automatically detect if these features are available on the running machine and can notify you if something is missing. As an alternative, you could always use bpftool, you just need to type the following commands:
sudo bpftool feature probe kernel | grep -q "map_type ringbuf is available" && echo "true" || echo "false"
sudo bpftool feature probe kernel | grep -q "program_type tracing is available" && echo "true" || echo "false"
Modern eBPF probe is bundled into the userspace binary and works out of the box, regardless of the kernel release, thanks to the eBPF feature called 'Compile Once Run Everywhere' (CO-RE). To enable it in Falco, just set the engine.kind configuration key to modern_ebpf.
It is supported in all the installation methods of other drivers:
The minimal set of capabilities required by Falco to run the modern eBPF probe is the following:
CAP_SYS_BPFCAP_SYS_PERFMONCAP_SYS_RESOURCECAP_SYS_PTRACELet's see them in detail:
setrlimit syscall. The setrlimit syscall is used together with the RLIMIT_MEMLOCK flag to change the amount of memory that can be mlocked into RAM. The default value for this memory limit is very low, so even a very simple eBPF program would fail. The workaround is to increase the default value to something acceptable so eBPF maps can be correctly mlocked in memory./proc/<pid>/environ. From the userspace standpoint, the permission to do so is mapped to the CAP_SYS_PTRACE capability. For the curious reader, see environ_open implementation in the kernel.bpf syscall.This set of capabilities should work most of the time but under some conditions, it is possible to replace the CAP_SYS_ADMIN with two more granular capabilities: CAP_SYS_BPF and CAP_SYS_PERFMON.
The only condition needed is a kernel version that supports these capabilities. The Linux Kernel version 5.8 is the first one that officially supports them but they could have been backported on older versions on some distributions.
Please note: we will try to do our best to keep this as the minimum required set but due to some issues with CO-RE relocations it is possible that this changes in the future.
{{% pageinfo color=warning %}}
The Legacy eBPF probe has been deprecated in Falco 0.43.0 and will be removed in a future release. Until removal and
since Falco 0.43.0, using it will result in a warning informing the user about the deprecation. Users are encouraged
to switch to another engine, such as the modern eBPF probe, as the usage will result in an error after the removal.
{{% /pageinfo %}}
The legacy {{< glossary_tooltip text="eBPF probe" term_id="ebpf-probe" >}} is an alternative source to the ones described above, leveraging greater compatibility than the modern eBPF one, since it requires older kernel versions.
To install the eBPF probe, please refer to the installation page.
To enable the eBPF support in Falco set the engine.kind configuration key to ebpf and eventually customize engine.ebpf.probe to the path where the eBPF probe resides; the default path is the location used by falcoctl driver tool to install the eBPF probe, ie: ${HOME}/.falco/falco-bpf.o, where ${HOME} will expand to the home dir of the user running Falco.
The minimal set of capabilities required by Falco to run the legacy eBPF probe is the following:
CAP_SYS_ADMINCAP_SYS_RESOURCECAP_SYS_PTRACEThe mentioned capabilities require no further explanation since they were already discussed in detail in the modern eBPF probe section. Moreover, for legacy eBPF probe the kernel.perf_event_paranoid sysctl value must also be double checked: reading the manual it is stated that perf_event_paranoid influences only the behavior of unprivileged users, but under the hood, some distributions like Debian or Ubuntu introduce additional perf_event_paranoid levels. Consider Ubuntu as an example:
if (perf_paranoid_any() && !capable(CAP_SYS_ADMIN))
return -EACCES;
// where perf_paranoid_any is defined as:
static inline bool perf_paranoid_any(void) {
return sysctl_perf_event_paranoid > 2;
}
As you can notice, when your kernel.perf_event_paranoid is >2 the capability CAP_PERFMON won't suffice, you would still need CAP_SYS_ADMIN.
So before disabling CAP_SYS_ADMIN check your perf_event_paranoid value with sysctl kernel.perf_event_paranoid and make sure their values are compatible with your distribution enforcement.