异常：执行 sudo opensnoop-bpfcc 时无法将 BPF 附加到 kprobe答案

【问题标题】：Exception: Failed to attach BPF to kprobe when executing sudo opensnoop-bpfcc异常：执行 sudo opensnoop-bpfcc 时无法将 BPF 附加到 kprobe
【发布时间】：2019-11-30 16:23:34
【问题描述】：

当我尝试执行 sudo opensnoop-bpfcc 时，我收到以下消息：

In file included from /virtual/main.c:4:
In file included from include/linux/sched.h:14:
In file included from include/linux/pid.h:5:
In file included from include/linux/rculist.h:11:
In file included from include/linux/rcupdate.h:40:
In file included from include/linux/preempt.h:81:
In file included from ./arch/x86/include/asm/preempt.h:7:
In file included from include/linux/thread_info.h:38:
In file included from ./arch/x86/include/asm/thread_info.h:53:
./arch/x86/include/asm/cpufeature.h:150:2: warning: "Compiler lacks ASM_GOTO support. Add -D __BPF_TRACING__ to your compiler arguments"
      [-W#warnings]
#warning "Compiler lacks ASM_GOTO support. Add -D __BPF_TRACING__ to your compiler arguments"
 ^
1 warning generated.
Traceback (most recent call last):
  File "/usr/sbin/opensnoop-bpfcc", line 127, in <module>
    b.attach_kprobe(event="sys_open", fn_name="trace_entry")
  File "/usr/lib/python2.7/dist-packages/bcc/__init__.py", line 526, in attach_kprobe
    raise Exception("Failed to attach BPF to kprobe")
Exception: Failed to attach BPF to kprobe

我不明白如何解决它。我刚刚使用此命令安装了密件抄送工具

sudo apt-get install bpfcc-tools linux-headers-$(uname -r)

正如github页面上的建议https://github.com/iovisor/bcc/blob/master/INSTALL.md#ubuntu---binary

运行的操作系统是 18.04.2 LTS（仿生海狸）。

【问题讨论】：

我相信this bcc issue 是相关的（并提出了解决方法）。
他们正在使用大约 5.0 内核版本，您认为 4.18 版本相同吗？
是的。 Yonghong 提供了更多详细信息in this commit log for kernel samples，该问题自 4.17 以来一直存在。
再次感谢，所以我必须从源代码构建它，因为包可能没有更新。
您的系统上是否安装了内核模块？这听起来像你没有。 (sudo apt install linux-headers-$(uname -r))

标签： ebpf kprobe bcc-bpf

【解决方案1】：

我不得不从源代码编译 bcc，而不是使用包安装它。

1) 安装 linux 内核头文件

sudo apt install linux-headers-$(uname -r)

2) 安装所需的依赖项

sudo apt-get -y install bison build-essential cmake flex git libedit-dev \ libllvm6.0 llvm-6.0-dev libclang-6.0-dev python zlib1g-dev libelf-dev

3) 从源代码编译 bcc

 git clone github.com/iovisor/bcc.git
 mkdir bcc/build; cd bcc/build 
 cmake .. -DCMAKE_INSTALL_PREFIX=/usr 
 make 
 sudo make install

【讨论】：

在 Ubuntu 18.04 和其他一些基于 Debian 的发行版上，您还需要安装 libfl-dev