@@ -19,11 +19,11 @@ limitations under the License.
19
19
package testfalcodriverloader
20
20
21
21
import (
22
+ "github.com/falcosecurity/testing/pkg/falcoctl"
22
23
"testing"
23
24
"time"
24
25
25
26
"github.com/falcosecurity/testing/pkg/falco"
26
- "github.com/falcosecurity/testing/pkg/falcodriverloader"
27
27
"github.com/falcosecurity/testing/tests"
28
28
"github.com/stretchr/testify/assert"
29
29
)
@@ -40,20 +40,29 @@ import (
40
40
//
41
41
// We need to use the `--compile` flag because we test against dev versions
42
42
func TestFalcoLegacyBPF (t * testing.T ) {
43
- loaderRes := falcodriverloader .Test (
44
- tests .NewFalcoDriverLoaderExecutableRunner (t ),
45
- falcodriverloader .WithArgs ("bpf" , "--compile" ),
43
+ // First, configure falcoctl driver
44
+ configRes := falcoctl .Test (
45
+ tests .NewFalcoctlExecutableRunner (t ),
46
+ falcoctl .WithArgs ("driver" , "config" , "--type" , "ebpf" ),
47
+ )
48
+ assert .NoError (t , configRes .Err (), "%s" , configRes .Stderr ())
49
+ assert .Equal (t , 0 , configRes .ExitCode ())
50
+
51
+ loaderRes := falcoctl .Test (
52
+ tests .NewFalcoctlExecutableRunner (t ),
53
+ falcoctl .WithArgs ("driver" , "install" , "--download=false" ),
46
54
)
47
55
assert .NoError (t , loaderRes .Err (), "%s" , loaderRes .Stderr ())
48
56
assert .Equal (t , 0 , loaderRes .ExitCode ())
49
- // We expect the probe to be symlinked in ' /root/.falco/falco-bpf.o'
50
- assert .Regexp (t , `Success: eBPF probe symlinked ` , loaderRes .Stdout ())
57
+ // We expect the probe to be succesfully built and copied to /root/.falco/falco-bpf.o
58
+ assert .Regexp (t , `Probe successfully built. ` , loaderRes .Stdout ())
51
59
52
60
// Now running Falco with `FALCO_BPF_PROBE=/root/.falco/falco-bpf.o` we should be able to run the bpf driver
53
61
falcoRes := falco .Test (
54
62
tests .NewFalcoExecutableRunner (t ),
55
63
falco .WithStopAfter (3 * time .Second ),
56
- falco .WithEnvVars (map [string ]string {"FALCO_BPF_PROBE" : "/root/.falco/falco-bpf.o" }),
64
+ falco .WithArgs ("-o" , "engine.kind=ebpf" ),
65
+ falco .WithArgs ("-o" , "engine.ebpf.probe=/root/.falco/falco-bpf.o" ),
57
66
)
58
67
assert .NoError (t , falcoRes .Err (), "%s" , falcoRes .Stderr ())
59
68
assert .Equal (t , 0 , falcoRes .ExitCode ())
@@ -75,19 +84,28 @@ func TestFalcoLegacyBPF(t *testing.T) {
75
84
//
76
85
// We need to use the `--compile` flag because we test against dev versions
77
86
func TestFalcoKmod (t * testing.T ) {
78
- loaderRes := falcodriverloader .Test (
79
- tests .NewFalcoDriverLoaderExecutableRunner (t ),
80
- falcodriverloader .WithArgs ("module" , "--compile" ),
87
+ // First, configure falcoctl driver
88
+ configRes := falcoctl .Test (
89
+ tests .NewFalcoctlExecutableRunner (t ),
90
+ falcoctl .WithArgs ("driver" , "config" , "--type" , "kmod" ),
91
+ )
92
+ assert .NoError (t , configRes .Err (), "%s" , configRes .Stderr ())
93
+ assert .Equal (t , 0 , configRes .ExitCode ())
94
+
95
+ loaderRes := falcoctl .Test (
96
+ tests .NewFalcoctlExecutableRunner (t ),
97
+ falcoctl .WithArgs ("driver" , "install" , "--download=false" ),
81
98
)
82
99
assert .NoError (t , loaderRes .Err (), "%s" , loaderRes .Stderr ())
83
100
assert .Equal (t , 0 , loaderRes .ExitCode ())
84
101
// We expect the module to be loaded in dkms
85
- assert .Regexp (t , `Success: falco module found and loaded in dkms` , loaderRes .Stdout ())
102
+ assert .Regexp (t , `Module installed in dkms. ` , loaderRes .Stdout ())
86
103
87
104
// Now running Falco we should be able to run the kernel module
88
105
falcoRes := falco .Test (
89
106
tests .NewFalcoExecutableRunner (t ),
90
107
falco .WithStopAfter (3 * time .Second ),
108
+ falco .WithArgs ("-o" , "engine.kind=kmod" ),
91
109
)
92
110
assert .NoError (t , falcoRes .Err (), "%s" , falcoRes .Stderr ())
93
111
assert .Equal (t , 0 , falcoRes .ExitCode ())
0 commit comments