Falcosecurity kernel-crawler

It is a tool used to crawl supported kernels by multiple distros, and generate a driverkit-like config json.
Output json can be found, for each supported architecture, on gh pages: https://falcosecurity.github.io/kernel-crawler/:

• aarch64
• x86_64

A weekly github action workflow will open a PR on this repo to update the json.
As soon as the PR is merged and the json updated, a prow job will create a PR on test-infra to generate the new Driverkit configs from the updated json.

Helper text and options:

Main:

Usage: kernel-crawler [OPTIONS] COMMAND [ARGS]...

Options:
    --debug / --no-debug
    --help                Show this message and exit.

Commands:
    crawl

Crawl command:

Usage: kernel-crawler crawl [OPTIONS]

Options:
    --distro [AmazonLinux|AmazonLinux2|AmazonLinux2022|AmazonLinux2023|BottleRocket|CentOS|Debian|Fedora|Flatcar|Minikube|OracleLinux|PhotonOS|Redhat|Talos|Ubuntu|*]
    --version TEXT
    --arch [x86_64|aarch64]
    --image TEXT                    Option is required when distro is Redhat.
    --help                          Show this message and exit.

Docker image

A docker image is provided for releases, by a GitHub Actions workflow: falcosecurity/kernel-crawler:latest. You can also build it yourself, by issuing:

docker build -t falcosecurity/kernel_crawler -f docker/Dockerfile .

from project root.

Install

To install the project, a simple pip3 install . from project root is enough.

Examples

• Crawl amazonlinux2 kernels:

kernel-crawler crawl --distro=AmazonLinux2

• Crawl all supported distros kernels:

kernel-crawler crawl --distro=*

❗ Note: Passing --image argument is supported with --distro=*

• Crawl Redhat kernels (specific to the container supplied), with no-formatted output:

kernel-crawler crawl --distro=Redhat --image=redhat/ubi8:registered