* Steve Grubb:
I am in the process of building a new version of suricata, and IDS
program
that watches network traffic. It has a new module that uses eBPF for high speed
network packet categorization. When building, it uses the following command:
/usr/bin/clang -Wall -Iinclude -O2 \
-I/usr/include/x86_64-linux-gnu/ \
-D__KERNEL__ -D__ASM_SYSREG_H \
-target bpf -S -emit-llvm xdp_lb.c -o xdp_lb.ll
It eventually includes /usr/include/features.h which in turn includes
/usr/include/gnu/stubs.h. That file has this code:
#if !defined __x86_64__
# include <gnu/stubs-32.h>
#endif
I don't think __x86_64__ is defined as the program is aimed at eBPF in the
kernel. In rawhide, we no longer have glibc-devel(x86-32) to allow this to
resolve. However, I think that the assumption of not having __x86_64__
defined means we are targeting i686 is wrong. What should I do? Do we not
support eBPF programs on Fedora?
We certainly do not support building eBPF programs against glibc
headers. There is no eBPF port of glibc, after all.
You need to figure out why the program includes glibc headers, and avoid
doing that. It's like any other cross-compilation in this regard.
Thanks,
Florian