Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Warn about SYS_PTRACE when running in docker #459

Merged
merged 1 commit into from
Oct 21, 2021
Merged

Warn about SYS_PTRACE when running in docker #459

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 20 additions & 2 deletions src/main.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -415,8 +415,26 @@ fn main() {
#[cfg(unix)]
{
if permission_denied(&err) {
eprintln!("Permission Denied: Try running again with elevated permissions by going 'sudo env \"PATH=$PATH\" !!'");
std::process::exit(1);
// Got a permission denied error, if we're not running as root - ask to use sudo
if unsafe { libc::geteuid() } != 0 {
eprintln!("Permission Denied: Try running again with elevated permissions by going 'sudo env \"PATH=$PATH\" !!'");
std::process::exit(1);
}

// We got a permission denied error running as root, check to see if we're running
// as docker, and if so ask the user to check the SYS_PTRACE capability is added
// Otherwise, fall through to the generic error handling
#[cfg(target_os="linux")]
if let Ok(cgroups) = std::fs::read_to_string("/proc/self/cgroup") {
if cgroups.contains("/docker/") {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This works in Docker but not in all containerized environments. I think it's better to test for the SYS_PTRACE capability itself here?

Copy link
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thats a good point! We could test for the SYS_PTRACE cap directly using capget - or maybe using a crate like https://github.com/lucab/caps-rs

Copy link
Contributor

@Jongy Jongy Oct 24, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah I was thinking about caps-rs

eprintln!("Permission Denied");
eprintln!("\nIt looks like you are running in a docker container. Please make sure \
you started your container with the SYS_PTRACE capability. See \
https://github.com/benfred/py-spy#how-do-i-run-py-spy-in-docker for \
more details");
std::process::exit(1);
}
}
}
}

Expand Down