Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Installation of agent on same instance fails due to zeek-af_packet-plugin compilation error. #150

Closed
quantumpacket opened this issue Apr 5, 2022 · 0 comments

Comments

@quantumpacket
Copy link

quantumpacket commented Apr 5, 2022

Description: Agent installation fails due to zeek-af_packet-plugin not being able to find the correct kernel headers during compilation. This happens when running in a container (VM in my case under QubesOS), where the incorrect kernel may be returned by uname -r.

Error:

Could NOT find KernelHeaders (missing: KERNELHEADERS_ROOT_DIR)

Need a way to specify kernel path for ./configure and maybe option to compile using zeek-af_packet-plugin master branch (not sure if current release is compatible with Zeek 4.0?).

Expected Result: zeek-af_packet-plugin compiles correctly, allowing agent installation to complete without errors.

Steps to Reproduce:

  1. Install the dynamite python package in a container or VM.
  2. Attempt to install the agent on the same instance using sudo dynamite agent install --inspect-interfaces eth0 --targets https://dynamite-monitor:9200
  3. All steps succeed, except the compilation of zeek-af_packet-plugin

This is related to:

Btw, I was able to successfully manually compile the plugin from git source using these changes. However, the agent install command does not pickup that it is installed on the system and still tried to compile it from source itself, which errors. Is there any good workaround for this issue?

@JaminB JaminB pinned this issue Apr 12, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant