Hi everyone I am not sure where to put this I built Osquery

Question

Hi everyone I am not sure where to put this I built Osquery from a Ubuntu arm64 machine in order to run it on arm64 devices When the Linux kernel version is equal to 4 9 the binary runs fine But when the kernel is older then I get FATAL kernel too old I gess I have to indicate the kernel version to CMake but I don t know how It this normal And if it is normal how can we make a binary run with old Linux kernel

alessandrogario · Answer

Hey Nico Can you show us the full output of osquery with verbose

Nico · Answer

Hello Alessandro Unfortunately it happens just as I run the binary I get FATAL kernel too old and Segmentation fault core dumped

Nico · Answer

And verbose doesn t bring more info

alessandrogario · Answer

What kind of distros are you using I think we relied on whatever was available from AWS for Graviton instances

Nico · Answer

For instance I want to run it on Ubuntu 16 04 server on ARM64 machine The Linux kernel is v4 4 0 It brings the error message I showed above But when I run it on my Android 10 smartphone with v4 9 190 Linux kernel it runs fine

Nico · Answer

And the funny part I build Osquery from the ARM64 Ubuntu16 04server machine But the binary genereted does not work on this machine It works on my Android device but not on my ubuntu16 04 machine

Nico · Answer

Is there specific modification to build the binary for graviton 2 What is needed to buid the code A arm64 Linux machine There is an option to add

alessandrogario · Answer

Probably in the osquery toolchain then you would have to update all the pre generated config files for all libraries

alessandrogario · Answer

I don t think it makes sense for upstream to support distributions that are no longer supported and marked as end of life

alessandrogario · Answer

The reason that the x64 version supports old but still supported distributions is for backward compatibility

alessandrogario · Answer

given that osquery was never deployed on Ubuntu 16 ARM before I think it s not a regression

alessandrogario · Answer

but it should work on ARM distributions that are still supported so this is a bug

alessandrogario · Answer

the reference distributions are what AWS + Graviton supports though at least for now

alessandrogario · Answer

The reason is that it was the only development environment most of us could get access to

Nico · Answer

Ok I understand

Nico · Answer

I thought I could get through with CMake that should indicate the options to the compiler And I added enable kernel=3 3 0 in the file flags cmake for the compiler options But it is useless

Nico · Answer

I will try to build the code from a different machine

Stefano Bonicatti · Answer

By the way it s not a matter of where the code is compiled from but the fact that the osquery toolchain uses kernel headers for the version 4 9 and most importantly which is the cause of the error targets glibc version 2 23

Nico · Answer

Hi Stefano Thank you very much for your answer