I’m using OpenSnitch from the official repository and I always get a warning on startup that the eBPF module couldn’t be loaded.
The opensnitch-ebpf-module package from the AUR that solves this doesn’t work out of the box in Manjaro, because Manjaro has no /usr/src/linux symlink this package depends on (Manjaro discussion, AUR discussion).
I was wondering, if there is an official OpenSnitch package, why isn’t there a corresponding “OpenSnitch eBPF module” package to go along with it that’s compatible with Manjaro’s multi-kernel philosophy? Would it be possible to add one?
I’m aware of these reasons. But they relate to why the AUR package doesn’t work. My question was, why is there no official Manjaro package to replace the AUR one?
(EDIT): To underline my argument:
OpenSnitch is in the official repository of Manjaro, but no eBPF module package is provided
Expecting users to use and manually alter an AUR package to make an officially provided app work, seems contradictory
Using AUR in Manjaro isn’t recommended by Manjaro’s own philosphy
There is no MUR (Manjaro User Repository) for the community to provide a Manjaro compatible package themselves
It’s a KDE Plasma notification popup that appears when you first run opensnitch. To retrigger it once opensnitch is already running, you can just restart the opensnitchd.service unit.
Following message will appear:
[eBPF]: Module not found (opensnitch.o) in any of the paths.
You may need to install the corresponding package
Unable to set new process monitor (ebpf) method from disk: [eBPF] Error loading opensnitch.o: Module not found (opensnitch.o) in any of the paths.
You may need to install the corresponding package
I have a KDE Plasma VM as well
and will also update it
and then install opensnitch
just to see if I can replicate …
I didn’t start any service (in the Xfce4 example above)
I just typed opensnitch-ui
in a Terminal and the GUI started up with the messages I posted
and without errors
perhaps I’ll see something about that
… I didn’t start any service, as I said
Without eBPF it works, partially. That’s why it’s just a warning. Kernel space initiated connections aren’t monitored.
If the UI starts but shows nothing, you’re not running the service and the UI is just sitting there doing nothing. You need to run systemctl start opensnitchd.
opensnitch is an interactive firewall with popups where you actively accept or reject connections that are being initiated and for which there are no explicit rules yet. It uses an eBPF module for kernel-level monitoring (instead of just user-level monitoring). Without it, it falls back to using ProcFS (/proc/).
With iptables you can set firewall rules (opensnitch can use iptables and nftables), but you don’t get an interactive window asking you if you want to allow or reject a new kind of connection being established from your machine (think Anti-Virus firewall popups in Windows).
One could set opensnitch to always use proc by default instead of ebpf. The warning would go away, but then, you won’t have kernel level monitoring (you won’t see if a rootkit is trying to open a connection).
I think he explained it already, without eBPF he can not have kernel level monitoring, he could only have user level monitoring which monitors less. He doesn’t want only half monitoring, he wants full monitoring.
I believe you are missing the OP’s point, that they would prefer the ‘full user experience’ that only the inclusion of the eBPF module would provide:
This particular module seems to be only available via the AUR, and it requires maintenance. If someone could fix it, maintain it, and perhaps add it to Manjaro’s arsenal, that could make OpenSnitch available as the ‘full-featured’ option that the OP desires.
I dare say, it’s fair wish to want OpenSnitch to be as effective as possible, but just how practical that is, I can’t say. Unless someone steps up to maintain the module along with OpenSnitch itself, I’m guessing it’s unlikely.
fixed it. Thanks
