falco-driver-loader and stable docker images need /etc to be mounted

[leogr]

What to document

Since falco-driver-loader from current master tries to infer the driver target from various files in /etc, falcosecurity/falco:lastest and falcosecurity/falco-driver-loader images need the host /etc to be mounted to /host/etc inside the container (e.g -v /etc:/host/etc:ro).

We have to document this.

There's already another issue related to this: https://github.com/falcosecurity/falco/issues/1188#issuecomment-627312495

Furthermore, many installations and third-party integrations may be affected (eg. the helm chart).
helm chart? cc @nestorsalceda @bencer @nibalizer
contrib? cc @maxgio92

TODOs:

• website 👉 https://falco.org/docs/running/#docker
• former helm chart 👉 [stable/falco] fix falco host-etc mount helm/charts#22474
• new helm chart 👉 fix: /etc mount, --cri flag path, and bump Falco to 0.23.0 charts#10
• contrib daemonset privileged 👉 https://github.com/falcosecurity/contrib/blob/3ca3b9c6f45f6a1d57db51afd38b395c96816c84/deploy/kubernetes/kernel-and-k8s-audit/daemonset.yaml#L53
• contrib daemonset least privileged 👉 https://github.com/falcosecurity/contrib/blob/master/deploy/kubernetes/kernel-and-k8s-audit/daemonset-least-privilege.yaml#L68

[maxgio92]

Thanks @leogr. In the contrib part, I think the manifests are already up to date (except for the driver loader image which must be updated).

Details here.

[leogr]

I believe the current helm chart is really affected by this issue, see referenced issues above.

[usamaahmadkhan]

@leogr yes the /etc is mounted on /etc/host with helm value Values.ebpf.settings.mountEtcVolume = true and i'm still seeing this error

[leogr]

@leogr yes the /etc is mounted on /etc/host with helm value Values.ebpf.settings.mountEtcVolume = true and i'm still seeing this error

Note that ebpf.settings.mountEtcVolume is not enough. Both .Values.ebpf.enabled and .Values.ebpf.settings.mountEtcVolume have to be enabled (see https://github.com/helm/charts/blob/11465c8be7ad5bee3b08553038aa5695d444cafd/stable/falco/templates/daemonset.yaml#L118). But by doing so, `falco-driver-loader will load the eBPF probe instead of the kernel module.
Have you tried with both enabled?

[usamaahmadkhan]

yes both enabled.

[leogr]

yes both enabled.

Hey @usamaahmadkhan
at this point I'm not sure your issue is related to this. I will investigate more.

[leogr]

It seems to me all TODOs have been done