* Steve Grubb:
> We certainly do not support building eBPF programs against glibc
> headers. There is no eBPF port of glibc, after all.
Suricata made it through the Debian/Ubuntu build systems. So, that
leaves me trying to figure out how push this through ours since other
distros did it.
It merely appears to work. There will be other things which are broken.
Any “#ifdef __x86_64__” in the headers will lead to incorrect
preprocessing, for example. That definitely affects kernel UAPI
headers, too.
A reasonably quick way to fix this needs to focus on the eBPF toolchain.
They need to preprocess and analyze the headers as if they were
extracting information for an FFI library, i.e., precisely follow the
compiler behavior for the host and its ABI. This includes having the
correct set of preprocessor defines, the right type sizes and
alignments, and the exact same structure layout rules.
Thanks,
Florian