Kernel requirements
Which kernels Falak Neo supports, what BTF and BPF LSM change, and what degrades gracefully on older systems.
Falak Neo uses CO-RE (Compile Once — Run Everywhere) eBPF, so there is no per-kernel rebuild and no compiler on your production hosts. What varies by kernel is how much the sensor can see.
Support matrix
| Kernel | Status | Notes |
|---|---|---|
| 6.1+ | Recommended | Everything. BTF, ring buffer, BPF LSM, fentry/fexit |
| 5.15 – 6.0 | Fully supported | All probes attach; fentry available on most builds |
| 5.8 – 5.14 | Supported | Ring buffer available; BPF LSM depends on the build |
| 5.4 – 5.7 | Degraded | Perf buffer fallback, higher overhead, no LSM hooks |
| < 5.4 | Unsupported | No ring buffer, insufficient verifier capability |
What each capability buys
BTF — /sys/kernel/btf/vmlinux
The one that matters most. BTF gives the sensor kernel type information at runtime, which is what makes CO-RE relocation possible.
Without BTF the sensor falls back to a bundled BTF archive for known distribution kernels. If your kernel is not in the archive, the bpf probe fails to attach and kernel-activity detections are unavailable. Check with:
ls -la /sys/kernel/btf/vmlinux
# or
grep CONFIG_DEBUG_INFO_BTF /boot/config-$(uname -r)Ring buffer — BPF_MAP_TYPE_RINGBUF
Kernel 5.8+. Lower overhead and better ordering than the perf buffer, with a single shared buffer rather than one per CPU.
Without it the sensor uses a perf buffer. It works, but expect roughly 20–30% higher CPU on high event rates and per-CPU ordering rather than global.
BPF LSM — CONFIG_BPF_LSM=y
Kernel 5.7+, and it must also be in lsm= on the kernel command line.
With it, file_open attaches to security_file_open, which is a stable interface and gives clean path resolution.
Without it, the sensor uses a kprobe on do_sys_openat2. It attaches and works, but is noisier and slightly more expensive.
Enforcement hooks — blocking rather than observing — require BPF LSM. On kernels without it, LocalRule.action_id = 3 (block) degrades to alert, and the sensor reports the degradation rather than silently doing nothing.
Check your command line
CONFIG_BPF_LSM=y is not sufficient on its own. The LSM must be enabled at boot:
cat /sys/kernel/security/lsm
# want to see: ...,bpfIf bpf is absent, add lsm=lockdown,capability,landlock,yama,apparmor,bpf to the kernel command line and reboot.
fentry / fexit
Kernel 5.5+ on x86_64, 6.0+ on aarch64. Lower-overhead attachment than kprobes with direct argument access. The sensor prefers it where available and falls back to kprobes transparently.
Distributions
| Distribution | Default kernel | BTF | BPF LSM |
|---|---|---|---|
| Ubuntu 24.04 | 6.8 | yes | yes |
| Ubuntu 22.04 | 5.15 | yes | yes |
| Debian 12 | 6.1 | yes | yes |
| RHEL / Rocky 9 | 5.14 | yes | yes |
| RHEL / Rocky 8 | 4.18 | backported | no |
| Amazon Linux 2023 | 6.1 | yes | yes |
| Amazon Linux 2 | 5.10 | no | no |
| Container-Optimized OS | 6.6 | yes | yes |
| Bottlerocket | 6.1 | yes | yes |
| Talos | 6.6 | yes | yes |
RHEL 8
The 4.18 kernel carries substantial eBPF backports, and Falak attaches most probes successfully. bpf and ptrace kernel-activity probes are unavailable, so rootkit and injection detections are reduced. We flag these hosts in the fleet view rather than pretending coverage is complete.
Required capabilities
The sensor needs less than people expect. It does not need full privilege.
| Capability | Why |
|---|---|
CAP_BPF | Load and attach eBPF programs (kernel 5.8+) |
CAP_PERFMON | Attach to tracepoints and kprobes |
CAP_SYS_ADMIN | Only on kernels before 5.8, where CAP_BPF does not exist |
hostPID | Resolve cgroup and namespace ids to containers |
| CRI socket, read-only | Map cgroup ids to container and pod identity |
Also required: kernel.unprivileged_bpf_disabled may be set to 1 (recommended); the sensor runs privileged enough not to be affected.
Verifying before you deploy
falakctl preflightkernel 6.8.0-45-generic ok
btf /sys/kernel/btf/vmlinux present
ringbuf BPF_MAP_TYPE_RINGBUF supported
bpf_lsm security_file_open available
fentry fentry/fexit available
cgroup v2 unified ok
cri containerd (unix:///run/containerd/…) reachable
9/9 probes attachable. Full coverage available.falakctl preflight is a static binary with no dependencies and it loads nothing into the kernel — safe to run on a production host during evaluation.
Something wrong or missing? Edit this page