mirrors/opensnitch
1
0
Fork 0
mirror of https://github.com/evilsocket/opensnitch.git synced 2025-03-04 08:34:40 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Updated ebpf compilation instructions

Browse source 
kudos to @planetoryd for reporting it (#1080).
This commit is contained in:
Gustavo Iñiguez Goia 2024-02-06 00:30:44 +01:00
parent 51779e8b8d
commit c3ec54efaf
Failed to generate hash of commit
1 changed files with 11 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
ebpf_prog/README
View file

@ -3,20 +3,22 @@ Compilation requires getting kernel sources for now.
There's a helper script to automate this process: There's a helper script to automate this process:
https://github.com/evilsocket/opensnitch/blob/master/utils/packaging/build_modules.sh https://github.com/evilsocket/opensnitch/blob/master/utils/packaging/build_modules.sh
The basic steps to compile the modules are: (example to compile the modules for kernel 6.0: bash build_modules.sh 6.0)
sudo apt install clang llvm libelf-dev libzip-dev flex bison libssl-dev bc rsync python3 ---
The basic steps to manually compile the modules are:
sudo apt install -y wget flex bison ca-certificates wget python3 rsync bc libssl-dev clang llvm libelf-dev libzip-dev git libpcap-dev
cd opensnitch cd opensnitch
wget https://github.com/torvalds/linux/archive/v5.8.tar.gz wget https://github.com/torvalds/linux/archive/v6.0.tar.gz
tar -xf v5.8.tar.gz tar -xf v6.0.tar.gz
cp ebpf_prog/opensnitch*.c ebpf_prog/common* ebpf_prog/Makefile linux-5.8/samples/bpf/ cd linux-6.0 && yes "" | make oldconfig && make prepare && make headers_install # (1 min)
cp -r ebpf_prog/bpf_headers/ linux-5.8/samples/bpf/ cd ../ebpf_prog/
cd linux-5.8 && yes "" | make oldconfig && make prepare && make headers_install # (1 min) make KERNEL_DIR=../linux-6.0/ KERNEL_HEADERS=../linux-6.0/
cd samples/bpf && make KERNEL_DIR=../../linux-5.8/
objdump -h opensnitch.o # you should see many sections, number 1 should be called kprobe/tcp_v4_connect objdump -h opensnitch.o # you should see many sections, number 1 should be called kprobe/tcp_v4_connect
llvm-strip -g opensnitch*.o # remove debug info llvm-strip -g opensnitch*.o # remove debug info
sudo cp opensnitch*.o /usr/lib/opensnitchd/ebpf/ # or /etc/opensnitchd for < v1.6.x sudo cp opensnitch*.o /usr/lib/opensnitchd/ebpf/ # or /etc/opensnitchd for < v1.6.x
cd ../../../daemon
Since v1.6.0, opensnitchd expects to find the opensnitch*.o modules under: Since v1.6.0, opensnitchd expects to find the opensnitch*.o modules under:
/usr/local/lib/opensnitchd/ebpf/ /usr/local/lib/opensnitchd/ebpf/