microsoft / microsoft/SysinternalsEBPF
Ubuntu dev container is broken
@MarioHewardt is already working on this.
Since Feb 26, 2025.
- Dominant language
- C
- Stars
- 288
- Forks
- 38
- Avg merge
- 21d 13h
- Merged PRs (30d)
- 1
Description
Describe the bug
Ubuntu dev container is broken.
I'm guessing the mcr.microsoft.com/mirror/docker/library/ubuntu:20.04 image has changed.
The .devcontainer/install-ubuntu-dependencies.sh fails whilst making the image.
There are multiple issues with the script. The first one is that sudo is missing from the image, so it has to be installed right after apt-get update.
The following packages will also need to be added to the apt install section:
wget liblocale-gettext-perl fakeroot libncurses-dev
The build will still fail due to missing bpf_helpers.h
In file included from /workspaces/ProcMon-for-Linux/src/tracer/ebpf/kern/procmonEBPFkern5.6-.c:25:
/workspaces/ProcMon-for-Linux/src/tracer/ebpf/kern/procmonGenericEntry_rawtp.c:39:10: fatal error: 'bpf_helpers.h' file not found
I'm guessing that's due to missing https://github.com/microsoft/SysinternalsEBPF, which should probably be installed in CMakeList.txt
To Reproduce
Start with a clean repo and open in vscode dev container. You might need to delete an existing dev container image.
Sysmon version
N/A
Distro/kernel version
Ubuntu 22.04.5/6.8.0-52-generic
Logs
Output of log with enough log entries to cover the timespan of the issue.
Expected behavior
A successful build after opening the dev container and following the instructions in BUILD.md
Additional context
Add any other context about the problem here.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.