falcosecurity · poiana · Dec 13, 2024 · Nov 28, 2024 · Dec 10, 2024 · LucaGuerra
diff --git a/cmake/modules/libbpf.cmake b/cmake/modules/libbpf.cmake
@@ -15,12 +15,19 @@
 
 option(USE_BUNDLED_LIBBPF "Enable building of the bundled libbpf" ${USE_BUNDLED_DEPS})
 
-if(LIBBPF_INCLUDE)
+if(TARGET lbpf)
 	# we already have libbpf
 elseif(NOT USE_BUNDLED_LIBBPF)
+	include(zlib)
+	include(libelf)
 	find_path(LIBBPF_INCLUDE bpf/libbpf.h)
 	find_library(LIBBPF_LIB NAMES bpf)
 	if(LIBBPF_INCLUDE AND LIBBPF_LIB)
+		add_library(lbpf STATIC IMPORTED)
+		set_target_properties(lbpf PROPERTIES IMPORTED_LOCATION ${LIBBPF_LIB})
+		target_include_directories(lbpf INTERFACE $<BUILD_INTERFACE:${LIBBPF_INCLUDE}>)
+		target_link_libraries(lbpf INTERFACE elf ${ZLIB_LIB})
+
 		message(STATUS "Found libbpf: include: ${LIBBPF_INCLUDE}, lib: ${LIBBPF_LIB}")
 	else()
 		message(FATAL_ERROR "Couldn't find system libbpf")
@@ -32,33 +39,42 @@ else()
 	set(LIBBPF_BUILD_DIR "${LIBBPF_SRC}/libbpf-build")
 	set(LIBBPF_INCLUDE "${LIBBPF_BUILD_DIR}/root/usr/include")
 	set(LIBBPF_LIB "${LIBBPF_BUILD_DIR}/root/usr/lib64/libbpf.a")
+
+	get_target_property(LIBELF_INCLUDE_DIR elf INCLUDE_DIRECTORIES)
+
+	foreach(dir ${LIBELF_INCLUDE_DIR})
+		string(APPEND LIBELF_COMPILER_STRING "-I${dir} ")
+	endforeach()
+
 	ExternalProject_Add(
 		libbpf
 		PREFIX "${PROJECT_BINARY_DIR}/libbpf-prefix"
-		DEPENDS zlib libelf
+		DEPENDS zlib elf
 		URL "https://github.com/libbpf/libbpf/archive/refs/tags/v1.3.0.tar.gz"
 		URL_HASH "SHA256=11db86acd627e468bc48b7258c1130aba41a12c4d364f78e184fd2f5a913d861"
 		CONFIGURE_COMMAND mkdir -p build root
 		BUILD_COMMAND
 			make BUILD_STATIC_ONLY=y OBJDIR=${LIBBPF_BUILD_DIR}/build
 			DESTDIR=${LIBBPF_BUILD_DIR}/root NO_PKG_CONFIG=1
-			"EXTRA_CFLAGS=-fPIC -I${LIBELF_INCLUDE} -I${ZLIB_INCLUDE}" "LDFLAGS=-Wl,-Bstatic"
+			"EXTRA_CFLAGS=-fPIC ${LIBELF_COMPILER_STRING} -I${ZLIB_INCLUDE}" "LDFLAGS=-Wl,-Bstatic"
 			"EXTRA_LDFLAGS=-L${LIBELF_SRC}/libelf/libelf -L${ZLIB_SRC}" -C ${LIBBPF_SRC}/libbpf/src
 			install install_uapi_headers
 		INSTALL_COMMAND ""
 		UPDATE_COMMAND ""
 		BUILD_BYPRODUCTS ${LIBBPF_LIB}
 	)
+
+	add_library(lbpf STATIC IMPORTED)
+	set_target_properties(lbpf PROPERTIES IMPORTED_LOCATION ${LIBBPF_LIB})
+	file(MAKE_DIRECTORY ${LIBBPF_INCLUDE}) # necessary to make target_include_directories() work
+	target_include_directories(lbpf INTERFACE $<BUILD_INTERFACE:${LIBBPF_INCLUDE}>)
+	add_dependencies(lbpf libbpf)
+	target_link_libraries(lbpf INTERFACE elf ${ZLIB_LIB})
+
 	message(STATUS "Using bundled libbpf: include'${LIBBPF_INCLUDE}', lib: ${LIBBPF_LIB}")
 	install(
 		FILES "${LIBBPF_LIB}"
 		DESTINATION "${CMAKE_INSTALL_LIBDIR}/${LIBS_PACKAGE_NAME}"
 		COMPONENT "libs-deps"
 	)
 endif()
-
-if(NOT TARGET libbpf)
-	add_custom_target(libbpf)
-endif()
-
-include_directories(${LIBBPF_INCLUDE})
diff --git a/cmake/modules/libelf.cmake b/cmake/modules/libelf.cmake
@@ -13,11 +13,13 @@
 # the License.
 #
 
+include_guard()
+
 option(USE_BUNDLED_LIBELF "Enable building of the bundled libelf" ${USE_BUNDLED_DEPS})
 option(USE_SHARED_LIBELF "When not using bundled libelf, link it dynamically" ON)
 
-if(LIBELF_INCLUDE)
-	# we already have LIBELF
+if(TARGET elf)
+	# we already have libelf
 elseif(NOT USE_BUNDLED_LIBELF)
 	find_path(LIBELF_INCLUDE elf.h PATH_SUFFIXES elf)
 	if(BUILD_SHARED_LIBS OR USE_SHARED_LIBELF)
@@ -50,49 +52,24 @@ elseif(NOT USE_BUNDLED_LIBELF)
 	else()
 		message(FATAL_ERROR "Couldn't find system libelf")
 	endif()
-else()
-	if(BUILD_SHARED_LIBS)
-		set(LIBELF_LIB_SUFFIX ${CMAKE_SHARED_LIBRARY_SUFFIX})
+
+	if(BUILD_SHARED_LIBS OR USE_SHARED_LIBELF)
+		add_library(elf SHARED IMPORTED)
 	else()
-		set(LIBELF_LIB_SUFFIX ${CMAKE_STATIC_LIBRARY_SUFFIX})
+		add_library(elf STATIC IMPORTED)
 	endif()
-	set(LIBELF_CFLAGS "-I${ZLIB_INCLUDE}")
-	if(ENABLE_PIC)
-		set(LIBELF_CFLAGS "${LIBELF_CFLAGS} -fPIC")
-	endif()
-	get_filename_component(ZLIB_SRC ${ZLIB_LIB} DIRECTORY)
-	set(LIBELF_SRC "${PROJECT_BINARY_DIR}/libelf-prefix/src")
-	set(LIBELF_INCLUDE "${LIBELF_SRC}/libelf/libelf")
-	set(LIBELF_LIB "${LIBELF_SRC}/libelf/libelf/libelf${LIBELF_LIB_SUFFIX}")
-	ExternalProject_Add(
-		libelf
-		PREFIX "${PROJECT_BINARY_DIR}/libelf-prefix"
-		DEPENDS zlib
-		URL "https://sourceware.org/elfutils/ftp/0.189/elfutils-0.189.tar.bz2"
-		URL_HASH "SHA256=39bd8f1a338e2b7cd4abc3ff11a0eddc6e690f69578a57478d8179b4148708c8"
-		CONFIGURE_COMMAND
-			./configure LDFLAGS=-L${ZLIB_SRC} "CFLAGS=${LIBELF_CFLAGS}"
-			--enable-deterministic-archives --disable-debuginfod --disable-libdebuginfod
-			--without-zstd
-		BUILD_IN_SOURCE 1
-		BUILD_COMMAND make -C lib libeu.a
-		COMMAND make -C libelf libelf${LIBELF_LIB_SUFFIX}
-		INSTALL_COMMAND ""
-		UPDATE_COMMAND ""
-		BUILD_BYPRODUCTS ${LIBELF_LIB}
-	)
-	message(STATUS "Using bundled libelf: include'${LIBELF_INCLUDE}', lib: ${LIBELF_LIB}")
-	install(
-		FILES "${LIBELF_LIB}"
-		DESTINATION "${CMAKE_INSTALL_LIBDIR}/${LIBS_PACKAGE_NAME}"
-		COMPONENT "libs-deps"
+
+	set_target_properties(elf PROPERTIES IMPORTED_LOCATION ${LIBELF_LIB})
+	target_include_directories(elf INTERFACE ${LIBELF_INCLUDE})
+else()
+	include(FetchContent)
+	FetchContent_Declare(
+		libelf_elftoolchain
+		URL https://github.com/LucaGuerra/elftoolchain/releases/download/libelf-r4053-0/libelf-r4053-0.tar.gz
+		URL_HASH SHA256=1861e6332d97f9cdc15a0c03b7b478b87abb47408ab41c50bebd9a384937e44e
 	)
-endif()
+	FetchContent_MakeAvailable(libelf_elftoolchain)
+	get_target_property(LIBELF_INCLUDE elf INCLUDE_DIRECTORIES)
 
-# We add a custom target, in this way we can always depend on `libelf` without distinguishing
-# between "bundled" and "not-bundled" case
-if(NOT TARGET libelf)
-	add_custom_target(libelf)
+	message(STATUS "Using bundled libelf: include'${LIBELF_INCLUDE}'")
 endif()
-
-include_directories(${LIBELF_INCLUDE})
diff --git a/driver/modern_bpf/CMakeLists.txt b/driver/modern_bpf/CMakeLists.txt
@@ -222,6 +222,14 @@ list(APPEND MODERN_PROBE_INCLUDE "-I${CMAKE_CURRENT_SOURCE_DIR}")
 # inside `driver` and the `libbpf` includes.
 set(PPM_INCLUDE ${LIBS_DIR})
 
+include(libbpf)
+
+# Get libbpf include
+get_target_property(LIBBPF_INTERFACE_INCLUDE_DIRS lbpf INTERFACE_INCLUDE_DIRECTORIES)
+foreach(dir ${LIBBPF_INTERFACE_INCLUDE_DIRS})
+	list(APPEND LIBBPF_INTERFACE_INCLUDE "-I${dir}")
+endforeach()
+
 # Set CLANG FLAGS
 set(CLANG_FLAGS "")
 list(
@@ -234,7 +242,7 @@ list(
 	-D__${DEBUG}__
 	-D__TARGET_ARCH_${ARCH} # Match libbpf usage in `/libbpf/src/bpf_tracing.h`
 	-D__USE_VMLINUX__ # Used to compile without kernel headers.
-	-I${LIBBPF_INCLUDE}
+	${LIBBPF_INTERFACE_INCLUDE}
 	${MODERN_PROBE_INCLUDE}
 	-I${PPM_INCLUDE}
 	-isystem
@@ -269,7 +277,7 @@ foreach(BPF_C_FILE ${BPF_C_FILES})
 		COMMAND ${MODERN_CLANG_EXE} ${CLANG_FLAGS} ${CLANG_SYSTEM_INCLUDES} -c ${BPF_C_FILE} -o
 				${BPF_O_FILE}
 		VERBATIM
-		DEPENDS libbpf
+		DEPENDS lbpf
 		DEPENDS ${BPF_C_FILE} ${BPF_H_FILES}
 		COMMENT "${MODERN_BPF_LOG_PREFIX} Building BPF object: ${BPF_O_FILE}"
 	)

diff --git a/userspace/libpman/CMakeLists.txt b/userspace/libpman/CMakeLists.txt
@@ -15,6 +15,7 @@
 
 add_compile_options(${FALCOSECURITY_LIBS_USERSPACE_COMPILE_FLAGS})
 add_link_options(${FALCOSECURITY_LIBS_USERSPACE_LINK_FLAGS})
+include(libbpf)
 
 add_library(
 	pman
@@ -35,23 +36,15 @@ target_include_directories(
 			$<BUILD_INTERFACE:${LIBS_DIR}> # ppm_enum and tables
 			$<BUILD_INTERFACE:${LIBS_DIR}/userspace> # scap-stats struct
 			${ZLIB_INCLUDE}
-			${LIBBPF_INCLUDE}
 			${MODERN_BPF_SKEL_DIR}
-			${LIBELF_INCLUDE}
 )
 
-target_link_libraries(
-	pman PUBLIC scap_event_schema scap_platform ${LIBBPF_LIB} ${LIBELF_LIB} ${ZLIB_LIB}
-)
+target_link_libraries(pman PUBLIC scap_event_schema scap_platform lbpf ${ZLIB_LIB})
 
 if(TARGET ProbeSkeleton)
 	add_dependencies(pman ProbeSkeleton)
 endif()
 
-if(USE_BUNDLED_LIBBPF)
-	add_dependencies(pman libbpf)
-endif()
-
 install(
 	TARGETS pman
 	ARCHIVE DESTINATION "${CMAKE_INSTALL_LIBDIR}"

diff --git a/userspace/libscap/CMakeLists.txt b/userspace/libscap/CMakeLists.txt
@@ -171,14 +171,12 @@ if(HAS_ENGINE_KMOD)
 endif()
 
 if(HAS_ENGINE_BPF)
-	include(libelf)
 	add_subdirectory(engine/bpf)
 	target_link_libraries(scap PUBLIC scap_engine_bpf)
 	target_include_directories(scap_engine_bpf PRIVATE ${PROJECT_BINARY_DIR}/driver/src)
 endif()
 
 if(HAS_ENGINE_MODERN_BPF)
-	include(libelf)
 	add_subdirectory(engine/modern_bpf)
 	target_link_libraries(scap PUBLIC scap_engine_modern_bpf)
 	target_include_directories(scap_engine_modern_bpf PRIVATE ${PROJECT_BINARY_DIR}/driver/src)

diff --git a/userspace/libscap/engine/bpf/CMakeLists.txt b/userspace/libscap/engine/bpf/CMakeLists.txt
@@ -13,11 +13,11 @@
 # the License.
 #
 add_library(scap_engine_bpf scap_bpf.c attached_prog.c)
-add_dependencies(scap_engine_bpf libelf zlib)
+add_dependencies(scap_engine_bpf zlib)
+include(libelf)
 target_link_libraries(
-	scap_engine_bpf PRIVATE scap_event_schema scap_platform scap_engine_util scap_error
-							${LIBELF_LIB} ${ZLIB_LIB}
+	scap_engine_bpf PRIVATE scap_event_schema scap_platform scap_engine_util scap_error elf
+							${ZLIB_LIB}
 )
-target_include_directories(scap_engine_bpf PRIVATE ${LIBELF_INCLUDE})
 
 set_scap_target_properties(scap_engine_bpf)
diff --git a/userspace/libscap/engine/bpf/scap_bpf.c b/userspace/libscap/engine/bpf/scap_bpf.c
@@ -49,6 +49,11 @@ limitations under the License.
 #include <libscap/strl.h>
 #include <libscap/strerror.h>
 
+/* some libelf implementations do not have the ELF_C_READ_MMAP_PRIVATE extension */
+#ifndef ELF_C_READ_MMAP_PRIVATE
+#define ELF_C_READ_MMAP_PRIVATE ELF_C_READ
+#endif
+
 static const char *const bpf_kernel_counters_stats_names[] = {
         [BPF_N_EVTS] = N_EVENTS_PREFIX,
         [BPF_N_DROPS_BUFFER_TOTAL] = "n_drops_buffer_total",