[python] gramine-manifest ldd IndexError: list index out of range - How to use {{ ldd() }} #1410
Replies: 2 comments 4 replies
-
|
You're probably the first person to use the @woju You introduced this @Jonas-Eppard By the way, your way of using this gramine/CI-Examples/python/python.manifest.template Lines 23 to 25 in fdd3417 |
Beta Was this translation helpful? Give feedback.
-
No, it's in parsing of line.
Nothing in Jinja, but the result is a list, so you'll get: sgx.trusted_files = [
"file:t"
"file:['lib1.so', 'lib2.so']"
]TOML will parse this fine (apart from missing comma after |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for the quick answer. You are right that it should follow the example you mentioned. I traced the error and took a look at the source. The error is during the evaluation of the ldd system command in this function: def ldd(*args):
'''
Args:
binaries for which to generate manifest trusted files list.
'''
# Be careful: We have to skip vdso, which doesn't have a corresponding file on the disk (we
# assume that such files have paths starting with '/', seems ldd always prints absolute paths).
# Also, old ldd (from Ubuntu 16.04) prints vdso differently than newer ones:
# old:
# linux-vdso.so.1 => (0x00007ffd31fee000)
# new:
# linux-vdso.so.1 (0x00007ffd31fee000)
ret = set()
for line in subprocess.check_output(['ldd', *(os.fspath(i) for i in args)]).decode('ascii'):
line = line.strip().split()
if line[1] == '=>' and line[2].startswith('/'):
ret.add(line[2])
elif line[0].startswith('/') and line[1].startswith('/'):
ret.add(line[0])
return sorted(ret)I went ahead and added some print statements: def ldd(*args):
'''
Args:
binaries for which to generate manifest trusted files list.
'''
# Be careful: We have to skip vdso, which doesn't have a corresponding file on the disk (we
# assume that such files have paths starting with '/', seems ldd always prints absolute paths).
# Also, old ldd (from Ubuntu 16.04) prints vdso differently than newer ones:
# old:
# linux-vdso.so.1 => (0x00007ffd31fee000)
# new:
# linux-vdso.so.1 (0x00007ffd31fee000)
ret = set()
print(['ldd', *(os.fspath(i) for i in args)])
print(subprocess.check_output(['ldd', *(os.fspath(i) for i in args)]).decode('ascii'))
for line in subprocess.check_output(['ldd', *(os.fspath(i) for i in args)]).decode('ascii'):
print("Line start of loop: '", line,"'", sep="")
line = line.strip().split()
print("Line after split: '", line, "'", sep="")
if line[1] == '=>' and line[2].startswith('/'):
ret.add(line[2])
elif line[0].startswith('/') and line[1].startswith('/'):
ret.add(line[0])
return sorted(ret)This gives inside into the problem. The invocation is correct but the iterator does not iterate correctly over the lines... If i add a But the last iteration still causes errors, because it will be an empty array... Therefore I added a This solves the error in Jinja2. This is still not solved because if multiple executables are provided as specified in the docs This would cause the lines A possible solution would be to add a branch if the length of the split line is to short to continue. This also catches the case with the trailing new line, so even the To sum up all my findings can be consolidated into the following diff: # new:
# linux-vdso.so.1 (0x00007ffd31fee000)
ret = set()
- for line in subprocess.check_output(['ldd', *(os.fspath(i) for i in args)]).decode('ascii'):
+ for line in subprocess.check_output(['ldd', *(os.fspath(i) for i in args)]).decode('ascii').split('\n'):
+ # print("Line before split: '", line, "'", sep="")
line = line.strip().split()
- if line[1] == '=>' and line[2].startswith('/'):
+ if len(line) < 2:
+ continue
+ elif line[1] == '=>' and line[2].startswith('/'):
ret.add(line[2])
elif line[0].startswith('/') and line[1].startswith('/'):
ret.add(line[0])This fixes the error I am getting in the previous mentioned docker file. I still have to apply the suggestion of @dimakuv but Jinji2 is working! TL;DR: There is a problem with Jinja2 but the above diff should resolve it |
Beta Was this translation helpful? Give feedback.
-
|
@Jonas-Eppard May I just say that this is an amazing write-up! Thanks. |
Beta Was this translation helpful? Give feedback.
-
|
I'm attempting a fix in #1411, it's now running CI. Can I ask for |
Beta Was this translation helpful? Give feedback.
-
|
Inside the docker container the result of |
Beta Was this translation helpful? Give feedback.
-
I want to run a C application inside gramine. The C application is linked against shared libraries. As described in the docs I should be able to use ldd to get all the needed libraries for the application. But gramine-manifest throws an error if {{ ldd(...) }} is specified.
Recreate
Dockerfile
Error
This Docker file fails on build with:
t.c
t.manifest.template
Output of ldd t
I know that the manifest.template is not sufficient for a full enclaved application but it is a minimal failing example.
Is the usage of ldd wrong or did I encounter a bug?
Furthermore will it be sufficient to specify ldd in the trusted_files or should this also be inside of the fs.mounts?
Beta Was this translation helpful? Give feedback.
All reactions