falco: Unable to build kernel module with `--compile` flag on AKS (Ubuntu 18.04; Kubernetes 1.24)

Summary I’ve recently tried to switch a test cluster from the ebpf probe to the kernel module and have it compile the module with the driver loader as an init container using the --compile flag. This was done to provide thorough testing of a slimmed down custom falco-driver-loader image for our internal use without unnecessary extras. We wanted to be able to build the module or ebpf probe from source so that we could have a driver-loader-ebpf image and a driver-loader-dkms image with only the minimal necessary requirements to build the module/probe and load it.

Describe the bug The kernel module build errors out for me during container startup and I am not clear on what’s wrong.

How to reproduce it The module compilation fails

Expected behaviour Module compilation should succeed and the module should load into memory

aScreenshots

Environment

• Falco version: 0.34.1

• System info:

• Cloud provider or hardware configuration: Azure AKS 1.24
• OS: Ubuntu 18.04

• Kernel: 5.4.x

• Installation method: Kubernetes

Additional context

logs -n falco -c driver-loader po/falco-dktpt                                                                        3s ⎈ armedatk-centralus-dev-01
* Setting up /usr/src links from host
* Running falco-driver-loader for: falco version=0.34.1, driver version=4.0.0+driver, arch=x86_64, kernel release=5.4.0-1103-azure, kernel version=109
* Running falco-driver-loader with: driver=module, compile=yes, download=no

================ Cleaning phase ================

* 1. Check if kernel module 'falco' is still loaded:
- OK! There is no 'falco' module loaded.

* 2. Check all versions of kernel module 'falco' in dkms:
- OK! There are no 'falco' module versions in dkms.

[SUCCESS] Cleaning phase correctly terminated.

================ Cleaning phase ================

* Looking for a falco module locally (kernel 5.4.0-1103-azure)
* Filename 'falco_ubuntu-azure_5.4.0-1103-azure_109.ko' is composed of:
 - driver name: falco
 - target identifier: ubuntu-azure
 - kernel release: 5.4.0-1103-azure
 - kernel version: 109
install: /usr/lib/gcc/x86_64-linux-gnu/5/
* Trying to dkms install falco module with GCC /usr/bin/gcc
DIRECTIVE: MAKE="'/tmp/falco-dkms-make'"

Creating symlink /var/lib/dkms/falco/4.0.0+driver/source ->
                 /usr/src/falco-4.0.0+driver

DKMS: add completed.

Kernel preparation unnecessary for this kernel.  Skipping...

Building module:
cleaning build area...
'/tmp/falco-dkms-make'...(bad exit status: 2)
* Running dkms build failed, dumping /var/lib/dkms/falco/4.0.0+driver/build/make.log (with GCC /usr/bin/gcc)
DKMS make.log for falco-4.0.0+driver for kernel 5.4.0-1103-azure (x86_64)
Mon Apr  3 19:54:46 UTC 2023
'/tmp/falco-dkms-make' -C /lib/modules/5.4.0-1103-azure/build M=/var/lib/dkms/falco/4.0.0+driver/build modules
make[1]: Entering directory '/host/usr/src/linux-headers-5.4.0-1103-azure'
  CC [M]  /var/lib/dkms/falco/4.0.0+driver/build/main.o
In file included from <command-line>:0:0:
./arch/x86/include/asm/page_64.h: In function 'clear_page':
././include/linux/compiler_types.h:214:24: error: expected '(' before '__inline'
 #define asm_inline asm __inline
                        ^
./arch/x86/include/asm/alternative.h:256:2: note: in expansion of macro 'asm_inline'
  asm_inline volatile (ALTERNATIVE_2("call %P[old]", "call %P[new1]", feature1,\
  ^
./arch/x86/include/asm/page_64.h:49:2: note: in expansion of macro 'alternative_call_2'
  alternative_call_2(clear_page_orig,
  ^
In file included from ./arch/x86/include/asm/barrier.h:5:0,
                 from ./include/linux/compiler.h:325,
                 from ./include/linux/export.h:42,
                 from ./include/linux/linkage.h:7,
                 from ./include/linux/kernel.h:8,
                 from ./include/linux/list.h:9,
                 from ./include/linux/smp.h:12,
                 from ./include/linux/tracepoint.h:15,
                 from ./include/trace/syscall.h:5,
                 from /var/lib/dkms/falco/4.0.0+driver/build/main.c:13:
./arch/x86/include/asm/alternative.h:128:2: error: expected identifier or '(' before string constant
  "# ALT: oldinstr2\n"         \
  ^
./arch/x86/include/asm/alternative.h:168:2: note: in expansion of macro 'OLDINSTR_2'
  OLDINSTR_2(oldinstr, 1, 2)     \
  ^
./arch/x86/include/asm/alternative.h:256:23: note: in expansion of macro 'ALTERNATIVE_2'
  asm_inline volatile (ALTERNATIVE_2("call %P[old]", "call %P[new1]", feature1,\
                       ^
./arch/x86/include/asm/page_64.h:49:2: note: in expansion of macro 'alternative_call_2'
  alternative_call_2(clear_page_orig,
  ^
In file included from <command-line>:0:0:
././include/linux/compiler_types.h:214:24: warning: ISO C90 forbids mixed declarations and code [-Wdeclaration-after-statement]
 #define asm_inline asm __inline
                        ^
./arch/x86/include/asm/alternative.h:256:2: note: in expansion of macro 'asm_inline'
  asm_inline volatile (ALTERNATIVE_2("call %P[old]", "call %P[new1]", feature1,\
  ^
./arch/x86/include/asm/page_64.h:49:2: note: in expansion of macro 'alternative_call_2'
  alternative_call_2(clear_page_orig,
  ^

These logs repeat numerous times with different files calling into the same headers