Linux Mint 20.3: "unable to load eBPF module"

[mariomadproductions]

[eBPF events]:
unable to load eBPF module (opensnitch-procs.o). Your kernel version (5.4.0-164-generic) might not be compatible. If this error persists, change process monitor method to 'proc'

I get that error on startup, although opensnitch still seems to work (maybe its fallen back to the proc method?). Should I follow the instructions here, or is this an error, and it should be working already?

[gustavo-iniguez-goya]

Hi @mariomadproductions ,

The connections are being intercepted via eBPF, but the module that intercepts new processes execution is not working for your kernel. It's only available for >= 5.8. In this case it's using proc for this task in particular.

Luckily, we've added an alternative method for when this problem happens, more reliable than proc. It'll be available on next releases.

[mariomadproductions]

Ah I see. It seems like I may be able to update to >5.8 in Linux Mint, but I'm not sure its well supported.

That's good to hear, thanks.

[BetweenTheKeyboardAndChair]

I just spent a bunch of time trying to debug the same "issue". I went as far as doing an OS upgrade/reboot trying to resolve it (now Ubuntu 20.4 5.4.0-165-generic.) Can the notification please be made more verbose to explain the above nuance?

If the new method will obsolete (remove) the notification, then never mind.

Thanks for the work as always.

[hashbi]

Im using proc method on v1.6.3, Arch linux and get this error on startup:

[eBPF DNS]: Module not found (opensnitch-dns.o) in any of the paths.
You may need to install the corresponding package

Is this something to worry about or just generic error?

[gustavo-iniguez-goya]

hi @hashbi ,

It seems that you don't have installed the ebpf modules.
See if any of these packages helps (depending on what package you installed): https://aur.archlinux.org/packages/opensnitch-ebpf-module or https://aur.archlinux.org/packages/opensnitch-ebpf-module-git