Problems with runner=ptrace in docker about go-sandbox

[criyle]

The seccomp filter rules was developed with kernel 4.19 and when libc updates, some of the function may be updated to use new syscalls (for example, use openat instead of open in newer libc). Exited with 38 (ENOSYS) means certain syscall not exists or blocked by seccomp filter. If you want to dive deep, you may use strace -f to find the syscall before the child process exits, add that syscall to the allowed list and try again.

The container executor runs the program in an isolated container namespace with trimmed readonly filesystem and no network access. You may also take a look at my other project go-judge which utilized container executor which can be customized via simple config file.

[ilusharulkov]

Yes, I have already research the go-judge project )
Come back to previous question, I thought that some syscalls is still restricted, and try this

FROM golang:1.19

RUN apt-get update; \
	apt-get install -y --no-install-recommends \
		strace

WORKDIR /app
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 GOOS=linux go build ./cmd/runprog
#CMD ./runprog -allow-proc -unsafe -runner ptrace -show-trace-details ls
CMD strace -c ls

And got the list of syscalls:

% time     seconds  usecs/call     calls    errors syscall
------ ----------- ----------- --------- --------- ----------------
  0.00    0.000000           0         5           read
  0.00    0.000000           0         1           write
  0.00    0.000000           0         8           close
  0.00    0.000000           0        17           mmap
  0.00    0.000000           0         5           mprotect
  0.00    0.000000           0         1           munmap
  0.00    0.000000           0         3           brk
  0.00    0.000000           0         1         1 ioctl
  0.00    0.000000           0         2           pread64
  0.00    0.000000           0         2         2 access
  0.00    0.000000           0         1           execve
  0.00    0.000000           0         2         2 statfs
  0.00    0.000000           0         1           arch_prctl
  0.00    0.000000           0         2           getdents64
  0.00    0.000000           0         1           set_tid_address
  0.00    0.000000           0         6           openat
  0.00    0.000000           0         7           newfstatat
  0.00    0.000000           0         1           set_robust_list
  0.00    0.000000           0         1           prlimit64
  0.00    0.000000           0         1           getrandom
  0.00    0.000000           0         1           rseq

add all of them to cmd/runprog/config/config.go defaultSyscallAllows. And empty defaultSyscallTraces var.
After that run such dockerfile:

FROM golang:1.19

RUN apt-get update; \
	apt-get install -y --no-install-recommends \
		strace

WORKDIR /app
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 GOOS=linux go build ./cmd/runprog
CMD ./runprog -allow-proc -unsafe -runner ptrace -show-trace-details ls

The result is:

rlimit:  RLimits[CPU[1 s:3 s],Data[250.0 MiB:250.0 MiB],File[2.0 MiB:2.0 MiB],Stack[250.0 MiB:250.0 MiB],OpenFile[256:256],Core[0 B:0 B]]
tracer started:  13 <nil>
------  13  ------ 13
process exited:  13 38
results: Result[RunnerFailed(child process exit before execve)][329µs 1.6 MiB][50.035µs 605.382µs] <nil>
setupTime:  50.035µs
runningTime:  605.382µs
Runner Error
7 0 1672 0

As you see, flags -allow-proc and -unsafe is passed to.

[ilusharulkov]

Yes, you are right, there are some missed sys calls. After populate list with a few missed - all works like a charm. Great thanks!