Error loading opensnitch.o on Debian Trixie with 6.14 kernel

[Fregf]

I'm running Debian Trixie AMD64 with the kernel from Experimental (6.14.5-1~exp1). I get these warnings:

[2025-05-04 12:45:58]  ERR  [eBPF DNS]: 
unable to load eBPF module (opensnitch-dns.o). Your kernel version (6.14-amd64) might not be compatible.
If this error persists, change process monitor method to 'proc'
[2025-05-04 12:45:58]  WAR  EBPF-DNS: Unable to attach ebpf listener: 
unable to load eBPF module (opensnitch-dns.o). Your kernel version (6.14-amd64) might not be compatible.

#  opensnitchd --check-requirements
	Checking system requirements for kernel version 6.14-amd64
------------------------------------------------------------------------------

	Checking => CONFIG_KPROBES=y
	Checking => CONFIG_KPROBES_ON_FTRACE=y
	Checking => CONFIG_HAVE_KPROBES=y
	Checking => CONFIG_HAVE_KPROBES_ON_FTRACE=y
	Checking => CONFIG_KPROBE_EVENTS=y

	* kprobes	 ✔

	Checking => CONFIG_UPROBES=y
	Checking => CONFIG_UPROBE_EVENTS=y

	* uprobes	 ✔

	Checking => CONFIG_FTRACE=y

	* ftrace	 ✔

	Checking => CONFIG_HAVE_SYSCALL_TRACEPOINTS=y
	Checking => CONFIG_FTRACE_SYSCALLS=y

	* syscalls	 ✔

	Checking => CONFIG_NETFILTER_NETLINK_QUEUE=[my]
	Checking => CONFIG_NFT_QUEUE=[my]
	Checking => CONFIG_NETFILTER_XT_TARGET_NFQUEUE=[my]

	* nfqueue	 ✔

	Checking => CONFIG_NETFILTER_NETLINK=[my]
	Checking => CONFIG_NETFILTER_NETLINK_QUEUE=[my]
	Checking => CONFIG_NETFILTER_NETLINK_ACCT=[my]

	* netlink	 ✔

	Checking => CONFIG_INET_DIAG=[my]
	Checking => CONFIG_INET_TCP_DIAG=[my]
	Checking => CONFIG_INET_UDP_DIAG=[my]
	Checking => CONFIG_INET_DIAG_DESTROY=[my]

	* net diagnostics	 ✔

I have these packages installed:

ii  opensnitch              1.6.9-2      amd64        GNU/Linux interactive application firewall
ii  opensnitch-ebpf-modules 1.6.9-2      amd64        GNU/Linux interactive application firewall eBPF modules

What could be wrong?

[gustavo-iniguez-goya]

hi @Fregf !

Could you post the output of objdump -h /.../opennsitch.dns.o ?

I'll try to reproduce it.

[gustavo-iniguez-goya]

@Fregf , I just installed the packages from experimental and worked fine on kernel 6.8.0. So the modules seems to be fine.

The following path should exist /sys/kernel/debug/tracing/uprobe_events, and be populated but since it's failing I guess that it'll be empty.

On the other hand, if you launch manually the daemon (/usr/bin/opensnitchd), you should see the message found /lib/.../libc.so.6.

[Fregf]

# objdump -h /usr/lib/opensnitchd/ebpf/opensnitch-dns.o

/usr/lib/opensnitchd/ebpf/opensnitch-dns.o:     file format elf64-little

Sections:
Idx Name          Size      VMA               LMA               File off  Algn
  0 .text         00000000  0000000000000000  0000000000000000  00000040  2**2
                  CONTENTS, ALLOC, LOAD, READONLY, CODE
  1 uretprobe/gethostbyname 00008830  0000000000000000  0000000000000000  00000040  2**3
                  CONTENTS, ALLOC, LOAD, RELOC, READONLY, CODE
  2 uprobe/getaddrinfo 000001c8  0000000000000000  0000000000000000  00008870  2**3
                  CONTENTS, ALLOC, LOAD, RELOC, READONLY, CODE
  3 uretprobe/getaddrinfo 00003ff0  0000000000000000  0000000000000000  00008a38  2**3
                  CONTENTS, ALLOC, LOAD, RELOC, READONLY, CODE
  4 maps/addrinfo_args_hash 00000118  0000000000000000  0000000000000000  0000ca28  2**2
                  CONTENTS, ALLOC, LOAD, DATA
  5 maps/events   00000118  0000000000000000  0000000000000000  0000cb40  2**2
                  CONTENTS, ALLOC, LOAD, DATA
  6 license       00000004  0000000000000000  0000000000000000  0000cc58  2**0
                  CONTENTS, ALLOC, LOAD, DATA
  7 version       00000004  0000000000000000  0000000000000000  0000cc5c  2**2
                  CONTENTS, ALLOC, LOAD, DATA
  8 .debug_loclists 00000a2e  0000000000000000  0000000000000000  0000cc60  2**0
                  CONTENTS, READONLY, DEBUGGING, OCTETS
  9 .debug_abbrev 000001b6  0000000000000000  0000000000000000  0000d68e  2**0
                  CONTENTS, READONLY, DEBUGGING, OCTETS
 10 .debug_info   00000788  0000000000000000  0000000000000000  0000d844  2**0
                  CONTENTS, RELOC, READONLY, DEBUGGING, OCTETS
 11 .debug_rnglists 000002f8  0000000000000000  0000000000000000  0000dfcc  2**0
                  CONTENTS, READONLY, DEBUGGING, OCTETS
 12 .debug_str_offsets 00000264  0000000000000000  0000000000000000  0000e2c4  2**0
                  CONTENTS, RELOC, READONLY, DEBUGGING, OCTETS
 13 .debug_str    000005c2  0000000000000000  0000000000000000  0000e528  2**0
                  CONTENTS, READONLY, DEBUGGING, OCTETS
 14 .debug_addr   00000050  0000000000000000  0000000000000000  0000eaea  2**0
                  CONTENTS, RELOC, READONLY, DEBUGGING, OCTETS
 15 .BTF          0000112b  0000000000000000  0000000000000000  0000eb3c  2**2
                  CONTENTS, RELOC, READONLY
 16 .BTF.ext      00009160  0000000000000000  0000000000000000  0000fc68  2**2
                  CONTENTS, RELOC, READONLY
 17 .eh_frame     00000070  0000000000000000  0000000000000000  00018dc8  2**3
                  CONTENTS, ALLOC, LOAD, RELOC, READONLY, DATA
 18 .debug_line   00002cfc  0000000000000000  0000000000000000  00018e38  2**0
                  CONTENTS, RELOC, READONLY, DEBUGGING, OCTETS
 19 .debug_line_str 000001c6  0000000000000000  0000000000000000  0001bb34  2**0
                  CONTENTS, READONLY, DEBUGGING, OCTETS

# ls -lh /sys/kernel/debug/tracing/uprobe_events
-rw-r----- 1 root root 0 May  5 08:15 /sys/kernel/debug/tracing/uprobe_events
# cat /sys/kernel/debug/tracing/uprobe_events
#

When running opensnitchd -debug, this is printed:

[2025-05-07 10:09:54]  DBG  [eBPF] trying to load /usr/local/lib/opensnitchd/ebpf/opensnitch-dns.o
[2025-05-07 10:09:54]  DBG  [eBPF] trying to load /usr/lib/opensnitchd/ebpf/opensnitch-dns.o
[2025-05-07 10:09:54]  INF  Running on netfilter queue #0 ...
[2025-05-07 10:09:54]  DBG  [eBPF] trying to load /etc/opensnitchd/opensnitch-dns.o
[2025-05-07 10:09:54]  ERR  [eBPF DNS]: 
unable to load eBPF module (opensnitch-dns.o). Your kernel version (6.14-amd64) might not be compatible.
If this error persists, change process monitor method to 'proc'
[2025-05-07 10:09:54]  WAR  EBPF-DNS: Unable to attach ebpf listener: 
unable to load eBPF module (opensnitch-dns.o). Your kernel version (6.14-amd64) might not be compatible.
If this error persists, change process monitor method to 'proc'

opensnitchd output does not mention libc.so.6:

# opensnitchd -debug 2>&1 | grep libc.so

[gustavo-iniguez-goya]

thank you @Fregf . It seems that we're not finding the libc lib.

This is the routine we're using to find the libc. Could you compile it and post the output?

It should print something like:

~ $ gcc -ldl lib.c -o lib
~ $ ./lib
map->l_name: 
map->l_name: linux-vdso.so.1
map->l_name: /lib/x86_64-linux-gnu/libc.so.6

	>> FOUND /lib/x86_64-linux-gnu/libc.so.6

map->l_name: /lib64/ld-linux-x86-64.so.2

lib.c:

#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <link.h>
#include <dlfcn.h>
#include <string.h>

int main() {
    void *handle;
    struct link_map * map;

    handle = dlopen(NULL, RTLD_NOW);
    if (handle == NULL) {
        fprintf(stderr, "EBPF-DNS dlopen() failed: %s\n", dlerror());
        return 1;
    }


    if (dlinfo(handle, RTLD_DI_LINKMAP, &map) == -1) {
        fprintf(stderr, "EBPF-DNS: dlinfo failed: %s\n", dlerror());
        return 1;
    }

    while(1){
        if(map == NULL){
            break;
        }

        printf("map->l_name: %s\n", map->l_name);
        if(strstr(map->l_name, "libc.so")){
            fprintf(stderr,"\n\t>> FOUND %s\n\n", map->l_name);
            //return map->l_name;
        }
        map = map->l_next;
    }

    return 0;
}

[Fregf]

$ ./lib
map->l_name: 
map->l_name: linux-vdso.so.1
map->l_name: /lib/x86_64-linux-gnu/libc.so.6

	>> FOUND /lib/x86_64-linux-gnu/libc.so.6

map->l_name: /lib64/ld-linux-x86-64.so.2