sysak/unity构建镜像时报错

### 1. 问题描述
内核版本：5.10.92-23.xc.cy8.x86_64
OS版本：CY-Security-x86_64-V3.0-B20
平台架构：x86_64

### 2. 复现方法
## 2.1. 修改Dockerfile，解决sysak项目中没有third目录的问题，修改后的Dockerfile如下
FROM registry.cn-hangzhou.aliyuncs.com/sysom/lcc
LABEL maintainer="liaozhaoyan <zhaoyan.lzy@alibaba-inc.com>"
WORKDIR /root/
COPY ./soft.tar.gz /root/
RUN yum update -y
RUN source /opt/rh/devtoolset-9/enable && \
    yum install -y make wget lua-devel unzip git numactl-devel m4 autoconf automake libtool libyaml libyaml-devel bpftool kernel-devel kernel-headers elfutils-devel gcc clang llvm llvm llvm-devel llvm-static llvm-libs llvm11 llvm11-devel glibc glibc-static glibc-utils --nogpgcheck && \
    yum clean all && \
    bpftool btf dump file /sys/kernel/btf/vmlinux format c > /usr/include/vmlinux.h
ENV CFLAGS="-I/usr/local/include/coolbpf/"
RUN source /opt/rh/devtoolset-9/enable && \
    bpftool btf dump file /sys/kernel/btf/vmlinux format c > /usr/include/vmlinux.h
RUN mkdir /root/build
COPY ./sysak.tar.gz /root/build
RUN cd /root/build && tar zxvf sysak.tar.gz
ENV C_INCLUDE_PATH=/usr/local/include/coolbpf/:$C_INCLUDE_PATH
ENV CPLUS_INCLUDE_PATH=/usr/local/include/coolbpf/:$CPLUS_INCLUDE_PATH
ENV C_INCLUDE_PATH=/usr/local/include/coolbpf/:/root/build/sysak/source/lib/uapi/include:$C_INCLUDE_PATH
WORKDIR /root/build/
RUN cp /root/soft.tar.gz . && \
    tar zxvf soft.tar.gz && ls soft/ && \
    cd soft && \
    tar zxvf coolbpf.tar.gz && \
    cd coolbpf && \
    ./install.sh && \
    cd .. && \
    rm -rf coolbpf && \
    rm -rf coolbpf.tar.gz
ENV CFLAGS="-I/usr/local/include/coolbpf/"
WORKDIR /root/build/soft/
RUN chmod +x bpftool && \
    cp bpftool /usr/local/bin && \
    cp bpftool /root/build/sysak/source/lib/internal/ebpf/tools/ && \
    mkdir -p /lib/internal/ebpf/tools/ && \
    cp bpftool /lib/internal/ebpf/tools/ && \
    chmod +x /root/build/sysak/source/lib/internal/ebpf/tools/bpftool
RUN tar zxvf libbpf.tar.gz && \
    cd libbpf/src && \
    make && make install && \
    cd ../.. && rm -rf libbpf && rm -rf libbpf.tar.gz
ENV PATH="/root/build/sysak/source/lib/internal/ebpf/tools:${PATH}"
RUN tar zxvf curl-7.87.0.tar.gz && \
    cd curl-7.87.0 && \
    ./configure --with-openssl && \
    make && \
    make install && \
    cd .. && \
    rm -rf curl-7.87.0.tar.gz && \
    rm -rf curl-7.87.0
RUN tar zxvf yaml-0.2.5.tar.gz && \
    cd yaml-0.2.5 && \
    ./configure && \
    make && make install && \
    cd .. && \
    rm -rf yaml-0.2.5 && \
    rm -rf yaml-0.2.5.tar.gz
RUN tar zxvf luajit.tar.gz && \
    cd luajit && \
    make && \
    make install && \
    cd .. && \
    rm -rf luajit && \
    rm -rf luajit.tar.gz
RUN tar zxvf luarocks-3.9.1.tar.gz && \
    cd luarocks-3.9.1 && \
    ./configure && \
    make && \
    make install && \
    cd .. && \
    rm -rf luarocks-3.9.1 && \
    rm -rf luarocks-3.9.1.tar.gz
RUN cd /root/build/soft && \
    luarocks install luasec && \
    luarocks install lua-cjson && \
    luarocks install luasocket && \
    luarocks install lyaml && \
    luarocks install lbase64 && \
    luarocks install lua-csnappy && \
    luarocks install lua-protobuf && \
    luarocks install sha1 && \
    luarocks install md5 && \
    luarocks install luaposix 35.1-1 && \
    luarocks install http && \
    luarocks install inotify && \
    echo luarocks success!!
ENV LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/usr/local/lib
ENV CFLAGS="-I/usr/local/include/coolbpf/"

RUN sed -i 's/char\* tmp_member_name;/const char\* tmp_member_name;/g' /root/build/sysak/source/lib/internal/ebpf/coolbpf/src/btfparse.c

RUN cd /root/build/sysak/source/tools/monitor/unity/beeQ/ && \
    make
其中因为项目缺失third目录，所以临时使用自备的第三方包安装

## 2.2. 构建镜像
执行ReadMe.md给出的构建命令
docker build -c 2 -t sysak-unity-devel:v1.0 .

### 3. 实际效果
主要报错如下
In file included from unity_nosched.bpf.c:1:
/usr/local/include/coolbpf/vmlinux.h:5:15: error: attribute 'preserve_access_index' is not supported by '#pragma clang attribute'
#pragma clang attribute push (__attribute__((preserve_access_index)), apply_to = record)
              ^
/usr/local/include/coolbpf/vmlinux.h:6297:20: error: expected member name or ';' after declaration specifiers
        struct cgroup_bpf bpf;
                          ^
<built-in>:314:13: note: expanded from here
#define bpf 1
            ^
In file included from unity_nosched.bpf.c:1:
/usr/local/include/coolbpf/vmlinux.h:6297:19: error: expected ';' at end of declaration list
        struct cgroup_bpf bpf;
                         ^
/usr/local/include/coolbpf/vmlinux.h:10386:19: error: expected member name or ';' after declaration specifiers
        struct netns_bpf bpf;
                         ^
<built-in>:314:13: note: expanded from here
#define bpf 1
            ^
In file included from unity_nosched.bpf.c:1:
/usr/local/include/coolbpf/vmlinux.h:10386:18: error: expected ';' at end of declaration list
        struct netns_bpf bpf;
                        ^
/usr/local/include/coolbpf/vmlinux.h:55705:8: error: expected member name or ';' after declaration specifiers
        int (*bpf)(int, union bpf_attr *, unsigned int);
        ~~~   ^
<built-in>:314:13: note: expanded from here
#define bpf 1
            ^
In file included from unity_nosched.bpf.c:1:
/usr/local/include/coolbpf/vmlinux.h:55705:8: error: expected ')'
<built-in>:314:13: note: expanded from here
#define bpf 1
            ^
/usr/local/include/coolbpf/vmlinux.h:55705:6: note: to match this '('
        int (*bpf)(int, union bpf_attr *, unsigned int);
            ^
/usr/local/include/coolbpf/vmlinux.h:55946:20: error: expected member name or ';' after declaration specifiers
        struct hlist_head bpf;
                          ^
<built-in>:314:13: note: expanded from here
#define bpf 1
            ^
In file included from unity_nosched.bpf.c:1:
/usr/local/include/coolbpf/vmlinux.h:55946:19: error: expected ';' at end of declaration list
        struct hlist_head bpf;
                         ^
/usr/local/include/coolbpf/vmlinux.h:120446:22: error: expected member name or ';' after declaration specifiers
        struct bpf_lwt_prog bpf;
                            ^
<built-in>:314:13: note: expanded from here
#define bpf 1
            ^
In file included from unity_nosched.bpf.c:1:
/usr/local/include/coolbpf/vmlinux.h:120446:21: error: expected ';' at end of declaration list
        struct bpf_lwt_prog bpf;
                           ^
/usr/local/include/coolbpf/vmlinux.h:124061:15: error: '#pragma clang attribute pop' with no matching '#pragma clang attribute push'
#pragma clang attribute pop
              ^
unity_nosched.bpf.c:65:31: error: use of unknown builtin '__builtin_preserve_access_index' [-Wimplicit-function-declaration]
        tfp = (struct thread_info *)(BPF_CORE_READ(tsk, stack));
                                     ^
/usr/local/include/coolbpf/bpf/bpf_core_read.h:404:2: note: expanded from macro 'BPF_CORE_READ'
        BPF_CORE_READ_INTO(&__r, (src), a, ##__VA_ARGS__);                  \
        ^
/usr/local/include/coolbpf/bpf/bpf_core_read.h:311:15: note: expanded from macro 'BPF_CORE_READ_INTO'
        ___core_read(bpf_core_read, bpf_core_read,                          \
                     ^
unity_nosched.bpf.c:65:31: warning: cast to 'const void *' from smaller integer type 'int' [-Wint-to-void-pointer-cast]
/usr/local/include/coolbpf/bpf/bpf_core_read.h:404:2: note: expanded from macro 'BPF_CORE_READ'
        BPF_CORE_READ_INTO(&__r, (src), a, ##__VA_ARGS__);                  \
        ^
/usr/local/include/coolbpf/bpf/bpf_core_read.h:311:15: note: expanded from macro 'BPF_CORE_READ_INTO'
        ___core_read(bpf_core_read, bpf_core_read,                          \
                     ^
1 warning and 13 errors generated.
make[2]: *** [unity_nosched.bpf.o] Error 1
make[2]: Leaving directory `/root/build/sysak/source/tools/monitor/unity/collector/plugin/unity_nosched'
make[1]: Leaving directory `/root/build/sysak/source/tools/monitor/unity/collector/plugin'
make[1]: *** [unity_nosched] Error 2
make: *** [../collector/plugin] Error 2
The command '/bin/sh -c cd /root/build/sysak/source/tools/monitor/unity/beeQ/ &&     make' returned a non-zero code: 2
目前推测可能为原镜像环境问题，但不知道如何解决

### 4. 期望效果
能够成功构建docker镜像

anolis/SysAK

内容风险标识

评论 (0)

anolis/SysAK .gitee-modal { width: 500px !important; }

内容风险标识