Community Packages

Please read this before reporting a bug:
https://wiki.archlinux.org/title/Bug_reporting_guidelines

Do NOT report bugs when a package is just outdated, or it is in the AUR. Use the 'flag out of date' link on the package page, or the Mailing List.

REPEAT: Do NOT report bugs for outdated packages!
Tasklist

FS#54743 - [sysdig] error creating the process list. Make sure you have root credentials

Attached to Project: Community Packages
Opened by Vladimir G. Ivanovic (vgivanovic0) - Sunday, 09 July 2017, 01:13 GMT
Last edited by Massimiliano Torromeo (mtorromeo) - Monday, 10 July 2017, 12:42 GMT
Task Type Bug Report
Category Packages
Status Closed
Assigned To Massimiliano Torromeo (mtorromeo)
Architecture x86_64
Severity High
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 0
Private No

Details

Description:
Executing `sysdig` or `csysdig` as root yields:
```error creating the process list. Make sure you have root credentials.```

Additional info:
* package version(s): 0.16.0-1
* kernels: `linux-4.11.9-1`, `linux-lts 4.9.36-1`, and `linux-hardened-4.12.b-1`


Steps to reproduce:

1. Install the `sysdig` package.
2. Execute `[c]sysdig`.

I can't get```[c]sysdig``` from the stock Arch package to work. I've tried the Arch package `sysdig-0.16.0-1` with three different kernels: `linux-4.11.9-1`, `linux-lts 4.9.36-1`, and `linux-hardened-4.12.b-1`. `[c]sysdig` doesn't work under any of them. (Note: It doesn't make a difference if I'm running with or without the kernel command line parameter `hidepid=1` or not.)

Dmesg is unhelpful:
```
[ 131.648919] sysdig_probe: loading out-of-tree module taints kernel.
[ 131.649496] sysdig_probe: driver loading, sysdig-probe 0.16.0
[ 131.650621] sysdig_probe: adding new consumer ffff9af3e1ad5700
[ 131.650640] sysdig_probe: initializing ring buffer for CPU 0
[ 131.655441] sysdig_probe: CPU buffer initialized, size=8388608
[ 131.655443] sysdig_probe: initializing ring buffer for CPU 1
[ 131.659461] sysdig_probe: CPU buffer initialized, size=8388608
[ 131.659462] sysdig_probe: initializing ring buffer for CPU 2
[ 131.663512] sysdig_probe: CPU buffer initialized, size=8388608
[ 131.663513] sysdig_probe: initializing ring buffer for CPU 3
[ 131.667713] sysdig_probe: CPU buffer initialized, size=8388608
[ 131.667715] sysdig_probe: starting capture
[ 131.670630] sysdig_probe: deallocating consumer ffff9af3e1ad5700
[ 131.695771] sysdig_probe: no more consumers, stopping capture
```
The kernel module seems to be loaded properly:
```
# modinfo sysdig_probe
filename: /lib/modules/4.12.0-1-hardened/kernel/extra/sysdig-probe.ko
author: sysdig inc
license: GPL
depends:
vermagic: 4.12.0-1-hardened SMP preempt mod_unload modversions
parm: max_consumers:Maximum number of consumers that can simultaneously open the devices (uint)
parm: verbose:Enable verbose logging (bool)
```

The kernel modules have been correctly installed
```
# dkms sysdig status
sysdig, 0.16.0, 4.11.9-1-ARCH, x86_64: installed
sysdig, 0.16.0, 4.12.0-1-hardened, x86_64: installed
sysdig, 0.16.0, 4.9.36-1-lts, x86_64: installed
```
and the probe module is correctly loaded:
```
# sysdig-probe-loader
* Unloading sysdig-probe, if present
* Running dkms autoinstall
* Trying to load a system sysdig-probe, if present
sysdig-probe found and loaded with modprobe
```

The `sysdig` devices exist:
```
cr-------- 1 root root 244, 0 2017-07-08 17:04 /dev/sysdig0
cr-------- 1 root root 244, 1 2017-07-08 17:04 /dev/sysdig1
cr-------- 1 root root 244, 2 2017-07-08 17:04 /dev/sysdig2
cr-------- 1 root root 244, 3 2017-07-08 17:04 /dev/sysdig3
```
I tried to build `sysdig` from sources, and I was ultimately I was successful using
```
cmake .. \
-DCMAKE_BUILD_TYPE=Release \
-DCMAKE_INSTALL_PREFIX=/usr/local \
-DUSE_BUNDLED_DEPS=OFF \
-DBUILD_DRIVER=OFF
```
followed by
```
make \
make install \
make install_driver
```
(Does "-DBUILD_DRIVER=OFF" work? `sysdig_probe` was still built.)

Although my particular issue has been worked around, I think there is a problem with the Arch package. Normally, a simple install should work out of the box.
This task depends upon

Closed by  Massimiliano Torromeo (mtorromeo)
Monday, 10 July 2017, 12:42 GMT
Reason for closing:  Fixed
Comment by Vladimir G. Ivanovic (vgivanovic0) - Sunday, 09 July 2017, 05:50 GMT
I would have though that "unable to use at all" would qualify as critial, no?
Comment by Doug Newgard (Scimmia) - Sunday, 09 July 2017, 06:00 GMT Comment by Massimiliano Torromeo (mtorromeo) - Monday, 10 July 2017, 12:42 GMT
I backported a patch from upstream. It is fixed in sysdig-0.16.0-2

Loading...