llc compilation needed

[bret99]

Tested on Parrot OS. After run ./tracee --help - it's OK. After run ./tracee - llc compilation needed. What?..

[yanivagman]

@bret99 Can you please share the exact error message you get?

[bret99]

2021/01/27 21:24:15 missing compilation dependency: llc
I used direct access to ./tracee, not docker

[yanivagman]

@bret99 thanks,
One of the requirements of Tracee when using the executable directly is having clang (>=9) and llc is one of the components of clang/llvm (https://llvm.org/docs/CommandGuide/llc.html). This is required to compile the bpf code on the fly when executing tracee.

Possible solutions:

1. Install the llc binary on your system (should be installed as part of the clang package)
2. Another option is to compile the bpf code using our docker container which already includes clang and the other prerequisites. You can either use the container to run tracee, or just creating the bpf object file that can then be used directly by the executable.

For further setup options, have a look at https://github.com/aquasecurity/tracee/tree/main/tracee-ebpf#setup-options