aquasecurity · rafaeldtinoco · Jan 17, 2022 · Dec 16, 2021 · Dec 20, 2021 · Dec 21, 2021
diff --git a/.dockerignore b/.dockerignore
@@ -1,3 +1,7 @@
    ./dist/*
 ./tracee-ebpf/dist/*
-./tracee-rules/dist/*
+./tracee-rules/dist/*
+./3rdparty/btfhub
+./3rdparty/btfhub/*
+./3rdparty/btfhub-archive
+./3rdparty/btfhub-archive/*
diff --git a/3rdparty/btfhub.sh b/3rdparty/btfhub.sh
@@ -77,6 +77,7 @@ cd ${BTFHUB_DIR}
 # remove BTFs for:
 # - centos7 & v4.15 kernels: unsupported eBPF features
 # - fedora 29 & 30 (from 5.3 and on) and newer: already have BTF embedded
+# - amzn2: older than 4.19
 #
 
 rsync -avz \
@@ -91,6 +92,7 @@ rsync -avz \
     --exclude="fedora/33*"              \
     --exclude="fedora/34*"              \
     --exclude="4.15*"                   \
+    --exclude="amzn*"			\
     ./archive/
 
 # cleanup unneeded architectures

diff --git a/Makefile.one b/Makefile.one
@@ -213,6 +213,11 @@ help:
 	@echo "$ make tracee-rules         # build ./dist/tracee-rules"
 	@echo "$ make rules                # build ./dist/rules"
 	@echo ""
+	@echo "# install"
+	@echo ""
+	@echo "$ make install-bpf-nocore   # install BPF no CO-RE obj into /tmp/tracee"
+	@echo "$ make uninstall-bpf-nocore # uninstall BPF no CO-RE obj from /tmp/tracee"
+	@echo ""
 	@echo "# clean"
 	@echo ""
 	@echo "$ make clean                # wipe ./dist/"
@@ -284,10 +289,9 @@ LIBBPF_LDLAGS =
 LIBBPF_SRC = ./3rdparty/libbpf/src
 
 $(OUTPUT_DIR)/libbpf/libbpf.a: \
-	.checkver_$(CMD_CLANG) \
 	$(LIBBPF_SRC) \
 	$(wildcard $(LIBBPF_SRC)/*.[ch]) \
-	| $(OUTPUT_DIR)
+	| .checkver_$(CMD_CLANG) $(OUTPUT_DIR)
 #
 	CC="$(CMD_CLANG)" \
 		CFLAGS="$(LIBBPF_CFLAGS)" \
@@ -372,6 +376,26 @@ clean-bpf-nocore:
 #
 	$(CMD_RM) -rf $(OUTPUT_DIR)/tracee.bpf.$(BPF_NOCORE_TAG).o
 
+TMP_DIR = /tmp/tracee
+
+.PHONY: install-bpf-nocore
+.ONESHELL:
+install-bpf-nocore: \
+	$(OUTPUT_DIR)/tracee.bpf.$(BPF_NOCORE_TAG).o \
+	| .check_$(CMD_INSTALL) \
+	.check_$(CMD_RM) \
+	.check_$(CMD_MKDIR) \
+#
+	@$(CMD_MKDIR) -p $(TMP_DIR)
+	$(CMD_RM) -f $(TMP_DIR)/tracee.bpf.$(BPF_NOCORE_TAG).o
+	$(CMD_INSTALL) -m 0640 $(OUTPUT_DIR)/tracee.bpf.$(BPF_NOCORE_TAG).o $(TMP_DIR)
+
+.PHONY: uninstall-bpf-nocore
+uninstall-bpf-nocore: \
+	| .check_$(CMD_RM)
+#
+	$(CMD_RM) -f $(TMP_DIR)/tracee.bpf.$(BPF_NOCORE_TAG).o
+
 #
 # co-re ebpf
 #
@@ -540,7 +564,7 @@ clean-tracee-rules:
 	$(CMD_RM) -rf $(OUTPUT_DIR)/tracee-rules
 
 .PHONY: test-tracee-rules
-test-tracee-rules:
+test-tracee-rules: \
 	.checkver_$(CMD_GO)
 #
 	$(GO_ENV_RULES) $(CMD_GO) test \

diff --git a/builder/Dockerfile.alpine-tracee b/builder/Dockerfile.alpine-tracee
@@ -0,0 +1,145 @@
+################################################################################
+# INSTRUCTIONS
+################################################################################
+#
+# This Dockerfile is meant to build the official tracee containers.
+#
+# 1. BUILDING tracee container:
+#
+#   $ docker build -f builder/Dockerfile.alpine-tracee \
+#           --build-arg=BTFHUB=[0|1] \
+#           --build-arg=FLAVOR=[tracee-core|tracee-nocore] \
+#           -t alpine-tracee:latest \
+#           .
+#
+# 2. RUNNING tracee container:
+#
+#   2.1 tracee-core:
+#
+#   $ docker run --privileged --pid=host \
+#           -v /etc/os-release:/etc/os-release-host:ro \
+#           -e LIBBPFGO_OSRELEASE_FILE=/etc/os-release-host \
+#           -e TRACEE_EBPF_ONLY=0 \
+#           --rm -it alpine-tracee [arguments | --help]
+#
+#   2.2 tracee-nocore:
+#
+#   $ docker run --privileged --pid=host \
+#           -v /etc/os-release:/etc/os-release-host:ro \
+#           -e LIBBPFGO_OSRELEASE_FILE=/etc/os-release-host \
+#           -v /usr/src:/usr/src:ro \
+#           -v /lib/modules:/lib/modules:ro \
+#           -e TRACEE_EBPF_ONLY=0 \
+#           -e FORCE_CORE=0 \
+#           --rm -it alpine-tracee [arguments | --help]
+#
+#   Notes:
+#
+#   - TRACEE_EBPF_ONLY=1 will execute "tracee-ebpf" instead of "tracee".
+#   - FORCE_CORE=1 will force CORE obj loading in a tracee-nocore container.
+#
+################################################################################
+
+# FLAVOR(s):
+#
+# tracee-core           entrypoint: tracee-ebpf + tracee-rules
+# tracee-nocore         entrypoint: install-bpf-nocore + tracee-ebpf + tracee-rules
+
+ARG BTFHUB=0
+ARG FLAVOR=tracee-ebpf-core
+
+#
+# tracee-base
+#
+
+FROM alpine:3.15 as tracee-base
+USER root
+
+# install base environment
+
+RUN apk --no-cache update && \
+    apk --no-cache add sudo curl && \
+    apk --no-cache add libelf zlib && \
+    apk --no-cache add libc6-compat && \
+    curl -L -o /usr/bin/opa https://github.com/open-policy-agent/opa/releases/download/v0.33.1/opa_linux_amd64_static && \
+    chmod 755 /usr/bin/opa
+
+#
+# tracee-make-base
+#
+
+FROM tracee-base as tracee-make-base
+USER root
+
+# install needed environment
+
+RUN apk --no-cache update && \
+    apk --no-cache add bash git rsync && \
+    apk --no-cache add coreutils findutils && \
+    apk --no-cache add llvm clang go make gcc && \
+    apk --no-cache add musl-dev && \
+    apk --no-cache add linux-headers && \
+    apk --no-cache add elfutils-dev && \
+    apk --no-cache add libelf-static && \
+    apk --no-cache add zlib-static
+
+#
+# tracee-make
+#
+
+FROM tracee-make-base as tracee-make
+ARG BTFHUB
+USER root
+ENV HOME /tracee
+WORKDIR /tracee
+
+COPY . /tracee
+
+RUN make -f Makefile.one clean && \
+    BTFHUB=$BTFHUB make -f Makefile.one tracee-ebpf && \
+    make -f Makefile.one tracee-rules && \
+    make -f Makefile.one rules
+
+#
+# tracee-core (tracee-base as base)
+#
+
+FROM tracee-base as tracee-core
+USER root
+ENV HOME /tracee
+WORKDIR /tracee
+
+COPY --from=tracee-make /tracee/dist/tracee-ebpf /tracee
+COPY --from=tracee-make /tracee/dist/tracee-rules /tracee
+COPY --from=tracee-make /tracee/dist/rules/ /tracee/rules/
+COPY --from=tracee-make /tracee/builder/tracee.sh /tracee/entrypoint.sh
+
+ENTRYPOINT ["/tracee/entrypoint.sh"]
+
+#
+# tracee-nocore (tracee-make as base)
+#
+
+FROM tracee-make-base as tracee-nocore
+USER root
+ENV HOME /tracee
+WORKDIR /tracee
+
+COPY --from=tracee-make /tracee /tracee/src
+COPY --from=tracee-make /tracee/dist/tracee-ebpf /tracee
+COPY --from=tracee-make /tracee/dist/tracee-rules /tracee
+COPY --from=tracee-make /tracee/dist/rules/ /tracee/rules
+COPY --from=tracee-make /tracee/builder/tracee.sh /tracee/entrypoint.sh
+
+ENTRYPOINT ["/tracee/entrypoint.sh"]
+
+#
+# tracee
+#
+
+FROM $FLAVOR
+USER root
+ENV HOME /tracee
+WORKDIR /tracee
+
+# vi:syntax=dockerfile:expandtab:tabstop=4:shiftwidth=4:softtabstop=4
diff --git a/builder/Dockerfile.alpine-tracee-make b/builder/Dockerfile.alpine-tracee-make
@@ -1,3 +1,11 @@
+################################################################################
+# INSTRUCTIONS
+################################################################################
+#
+# This Dockerfile is meant to create a building/exec environment for tracee.
+#
+################################################################################
+
 FROM alpine:3.15
 
 ARG uid=1000

diff --git a/builder/Dockerfile.ubuntu-tracee-make b/builder/Dockerfile.ubuntu-tracee-make
@@ -1,4 +1,12 @@
-FROM ubuntu:hirsute
+################################################################################
+# INSTRUCTIONS
+################################################################################
+#
+# This Dockerfile is meant to create a building/exec environment for tracee.
+#
+################################################################################
+
+FROM ubuntu:impish
 
 ARG uid=1000
 ARG gid=1000

diff --git a/builder/Makefile.mkdocs b/builder/Makefile.mkdocs
@@ -36,15 +36,15 @@ help:
 	@echo ""
 	@echo "To build the mkdocs docker container:"
 	@echo ""
-	@echo "    $ make -f builder/Makefile.mkdocs mkdocs-build"
+	@echo "    $$ make -f builder/Makefile.mkdocs mkdocs-build"
 	@echo ""
 	@echo "To serve mkdocs through mkdocks container:"
 	@echo ""
-	@echo "    $ make -f builder/Makefile.mkdocs mkdocs-serve"
+	@echo "    $$ make -f builder/Makefile.mkdocs mkdocs-serve"
 	@echo ""
 	@echo "Or simply:"
 	@echo ""
-	@echo "    $ make -f builder/Makefile.mkdocs"
+	@echo "    $$ make -f builder/Makefile.mkdocs"
 	@echo ""
 
 #