microsoft / microsoft/SysinternalsEBPF

Ubuntu dev container is broken

Open
#63 0 comments 0 reactions 1 assignee View on GitHub

@MarioHewardt is already working on this.

Since Feb 26, 2025.

investigate
Dominant language
C
Stars
288
Forks
38
Avg merge
21d 13h
Merged PRs (30d)
1

Description

Describe the bug
Ubuntu dev container is broken.

I'm guessing the mcr.microsoft.com/mirror/docker/library/ubuntu:20.04 image has changed.
The .devcontainer/install-ubuntu-dependencies.sh fails whilst making the image.

There are multiple issues with the script. The first one is that sudo is missing from the image, so it has to be installed right after apt-get update.

The following packages will also need to be added to the apt install section:
wget liblocale-gettext-perl fakeroot libncurses-dev

The build will still fail due to missing bpf_helpers.h

In file included from /workspaces/ProcMon-for-Linux/src/tracer/ebpf/kern/procmonEBPFkern5.6-.c:25:
/workspaces/ProcMon-for-Linux/src/tracer/ebpf/kern/procmonGenericEntry_rawtp.c:39:10: fatal error: 'bpf_helpers.h' file not found

I'm guessing that's due to missing https://github.com/microsoft/SysinternalsEBPF, which should probably be installed in CMakeList.txt

To Reproduce
Start with a clean repo and open in vscode dev container. You might need to delete an existing dev container image.

Sysmon version
N/A

Distro/kernel version
Ubuntu 22.04.5/6.8.0-52-generic

Logs
Output of log with enough log entries to cover the timespan of the issue.

Expected behavior
A successful build after opening the dev container and following the instructions in BUILD.md

Additional context
Add any other context about the problem here.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.