4

I need the kernel headers but there is no /lib/modules/[kernel version]/build or /usr/src/[kernel version]. I'm assuming they ripped those out to trim down the image.

My use case: I am using bpftrace to trace the kernel using kprobes and tracepoints and it needs to know certain struct definitions in order to know the memory layout of args/ret values.

Is there an easy way to download the headers for the kernel I am running? I am running 1.10.7-gke.6 ALPHA (linux 4.14.65+).

Jason Keene
  • 193
  • 6

2 Answers2

5

Looks like:

https://chromium.googlesource.com/chromiumos/third_party/kernel/+/linux/v4.14.65

have been led there via:

https://cloud.google.com/container-optimized-os/docs/resources/sources

hargut
  • 3,848
  • 6
  • 10
  • Awesome, I will try and clone these down and see if they work. – Jason Keene Oct 31 '18 at 23:28
  • It appears `/lib/modules` is mounted as read only. There doesn't appear to be a way to symlink or bind mount these into `/lib/modlues/[kernel version]/build` which is where bpftrace looks for them by default. Luckily they allow you to specify `BPFTRACE_KERNEL_SOURCE` to point to where you want. – Jason Keene Nov 01 '18 at 01:57
4

Here is the script I used to download the source for the current kernel, extract it, and print out the environment variable export to get bpftrace to read from that location. This was needed since /lib/modules is read only.

#!/bin/bash

set -Eeuo pipefail

kversion=v"$(uname -r | sed -E 's/\+*$//')"
wget "https://chromium.googlesource.com/chromiumos/third_party/kernel/+archive/$kversion.tar.gz"
mkdir kernel
tar xzf "$kversion.tar.gz" -C kernel
echo "export BPFTRACE_KERNEL_SOURCE=$PWD/kernel"
Jason Keene
  • 193
  • 6