docker strace ptrace 报错 Operation not permitted 解决方法

╰半夏微凉° 2021-07-28 16:58 1806阅读 0赞

docker中gdb在进行进程debug时，会报错：

(gdb) attach 30721  
Attaching to process 30721

ptrace: Operation not permitted.

原因就是因为ptrace被Docker默认禁止的问题。考虑到应用分析的需要，可以有以下几种方法解决：

1、关闭seccomp

docker run --security-opt seccomp=unconfined

2、采用超级权限模式

docker run --privileged

3、仅开放ptrace限制

docker run --cap-add sys\_ptrace

当然从安全角度考虑，如只是想使用gdb进行debug的话，建议使用第三种。

安全计算模式（secure computing mode，`seccomp`）是 Linux 内核功能，可以使用它来限制容器内可用的操作。

Docker 的默认 `seccomp` 配置文件是一个白名单，它指定了允许的调用。

下表列出了由于不在白名单而被有效阻止的重要（但不是全部）系统调用。该表包含每个系统调用被阻止的原因。

<table> 
 <thead> 
  <tr> 
   <th>Syscall</th> 
   <th>Description</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>acct</td> 
   <td>Accounting syscall which could let containers disable their own resource limits or process accounting. Also gated by CAP_SYS_PACCT.</td> 
  </tr> 
  <tr> 
   <td>add_key</td> 
   <td>Prevent containers from using the kernel keyring, which is not namespaced.</td> 
  </tr> 
  <tr> 
   <td>adjtimex</td> 
   <td>Similar to clock_settime and settimeofday, time/date is not namespaced. Also gated by CAP_SYS_TIME.</td> 
  </tr> 
  <tr> 
   <td>bpf</td> 
   <td>Deny loading potentially persistent bpf programs into kernel, already gated by CAP_SYS_ADMIN.</td> 
  </tr> 
  <tr> 
   <td>clock_adjtime</td> 
   <td>Time/date is not namespaced. Also gated by CAP_SYS_TIME.</td> 
  </tr> 
  <tr> 
   <td>clock_settime</td> 
   <td>Time/date is not namespaced. Also gated by CAP_SYS_TIME.</td> 
  </tr> 
  <tr> 
   <td>clone</td> 
   <td>Deny cloning new namespaces. Also gated by CAP_SYS_ADMIN for CLONE_* flags, except CLONE_USERNS.</td> 
  </tr> 
  <tr> 
   <td>create_module</td> 
   <td>Deny manipulation and functions on kernel modules. Obsolete. Also gated by CAP_SYS_MODULE.</td> 
  </tr> 
  <tr> 
   <td>delete_module</td> 
   <td>Deny manipulation and functions on kernel modules. Also gated by CAP_SYS_MODULE.</td> 
  </tr> 
  <tr> 
   <td>finit_module</td> 
   <td>Deny manipulation and functions on kernel modules. Also gated by CAP_SYS_MODULE.</td> 
  </tr> 
  <tr> 
   <td>get_kernel_syms</td> 
   <td>Deny retrieval of exported kernel and module symbols. Obsolete.</td> 
  </tr> 
  <tr> 
   <td>get_mempolicy</td> 
   <td>Syscall that modifies kernel memory and NUMA settings. Already gated by CAP_SYS_NICE.</td> 
  </tr> 
  <tr> 
   <td>init_module</td> 
   <td>Deny manipulation and functions on kernel modules. Also gated by CAP_SYS_MODULE.</td> 
  </tr> 
  <tr> 
   <td>ioperm</td> 
   <td>Prevent containers from modifying kernel I/O privilege levels. Already gated by CAP_SYS_RAWIO.</td> 
  </tr> 
  <tr> 
   <td>iopl</td> 
   <td>Prevent containers from modifying kernel I/O privilege levels. Already gated by CAP_SYS_RAWIO.</td> 
  </tr> 
  <tr> 
   <td>kcmp</td> 
   <td>Restrict process inspection capabilities, already blocked by dropping CAP_PTRACE.</td> 
  </tr> 
  <tr> 
   <td>kexec_file_load</td> 
   <td>Sister syscall of kexec_load that does the same thing, slightly different arguments. Also gated by CAP_SYS_BOOT.</td> 
  </tr> 
  <tr> 
   <td>kexec_load</td> 
   <td>Deny loading a new kernel for later execution. Also gated by CAP_SYS_BOOT.</td> 
  </tr> 
  <tr> 
   <td>keyctl</td> 
   <td>Prevent containers from using the kernel keyring, which is not namespaced.</td> 
  </tr> 
  <tr> 
   <td>lookup_dcookie</td> 
   <td>Tracing/profiling syscall, which could leak a lot of information on the host. Also gated by CAP_SYS_ADMIN.</td> 
  </tr> 
  <tr> 
   <td>mbind</td> 
   <td>Syscall that modifies kernel memory and NUMA settings. Already gated by CAP_SYS_NICE.</td> 
  </tr> 
  <tr> 
   <td>mount</td> 
   <td>Deny mounting, already gated by CAP_SYS_ADMIN.</td> 
  </tr> 
  <tr> 
   <td>move_pages</td> 
   <td>Syscall that modifies kernel memory and NUMA settings.</td> 
  </tr> 
  <tr> 
   <td>name_to_handle_at</td> 
   <td>Sister syscall to open_by_handle_at. Already gated by CAP_SYS_NICE.</td> 
  </tr> 
  <tr> 
   <td>nfsservctl</td> 
   <td>Deny interaction with the kernel nfs daemon. Obsolete since Linux 3.1.</td> 
  </tr> 
  <tr> 
   <td>open_by_handle_at</td> 
   <td>Cause of an old container breakout. Also gated by CAP_DAC_READ_SEARCH.</td> 
  </tr> 
  <tr> 
   <td>perf_event_open</td> 
   <td>Tracing/profiling syscall, which could leak a lot of information on the host.</td> 
  </tr> 
  <tr> 
   <td>personality</td> 
   <td>Prevent container from enabling BSD emulation. Not inherently dangerous, but poorly tested, potential for a lot of kernel vulns.</td> 
  </tr> 
  <tr> 
   <td>pivot_root</td> 
   <td>Deny pivot_root, should be privileged operation.</td> 
  </tr> 
  <tr> 
   <td>process_vm_readv</td> 
   <td>Restrict process inspection capabilities, already blocked by dropping CAP_PTRACE.</td> 
  </tr> 
  <tr> 
   <td>process_vm_writev</td> 
   <td>Restrict process inspection capabilities, already blocked by dropping CAP_PTRACE.</td> 
  </tr> 
  <tr> 
   <td>ptrace</td> 
   <td>Tracing/profiling syscall, which could leak a lot of information on the host. Already blocked by dropping CAP_PTRACE.</td> 
  </tr> 
  <tr> 
   <td>query_module</td> 
   <td>Deny manipulation and functions on kernel modules. Obsolete.</td> 
  </tr> 
  <tr> 
   <td>quotactl</td> 
   <td>Quota syscall which could let containers disable their own resource limits or process accounting. Also gated by CAP_SYS_ADMIN.</td> 
  </tr> 
  <tr> 
   <td>reboot</td> 
   <td>Don’t let containers reboot the host. Also gated by CAP_SYS_BOOT.</td> 
  </tr> 
  <tr> 
   <td>request_key</td> 
   <td>Prevent containers from using the kernel keyring, which is not namespaced.</td> 
  </tr> 
  <tr> 
   <td>set_mempolicy</td> 
   <td>Syscall that modifies kernel memory and NUMA settings. Already gated by CAP_SYS_NICE.</td> 
  </tr> 
  <tr> 
   <td>setns</td> 
   <td>Deny associating a thread with a namespace. Also gated by CAP_SYS_ADMIN.</td> 
  </tr> 
  <tr> 
   <td>settimeofday</td> 
   <td>Time/date is not namespaced. Also gated by CAP_SYS_TIME.</td> 
  </tr> 
  <tr> 
   <td>socket, socketcall</td> 
   <td>Used to send or receive packets and for other socket operations. All socket and socketcall calls are blocked except communication domains AF_UNIX, AF_INET, AF_INET6, AF_NETLINK, and AF_PACKET.</td> 
  </tr> 
  <tr> 
   <td>stime</td> 
   <td>Time/date is not namespaced. Also gated by CAP_SYS_TIME.</td> 
  </tr> 
  <tr> 
   <td>swapon</td> 
   <td>Deny start/stop swapping to file/device. Also gated by CAP_SYS_ADMIN.</td> 
  </tr> 
  <tr> 
   <td>swapoff</td> 
   <td>Deny start/stop swapping to file/device. Also gated by CAP_SYS_ADMIN.</td> 
  </tr> 
  <tr> 
   <td>sysfs</td> 
   <td>Obsolete syscall.</td> 
  </tr> 
  <tr> 
   <td>_sysctl</td> 
   <td>Obsolete, replaced by /proc/sys.</td> 
  </tr> 
  <tr> 
   <td>umount</td> 
   <td>Should be a privileged operation. Also gated by CAP_SYS_ADMIN.</td> 
  </tr> 
  <tr> 
   <td>umount2</td> 
   <td>Should be a privileged operation. Also gated by CAP_SYS_ADMIN.</td> 
  </tr> 
  <tr> 
   <td>unshare</td> 
   <td>Deny cloning new namespaces for processes. Also gated by CAP_SYS_ADMIN, with the exception of unshare –user.</td> 
  </tr> 
  <tr> 
   <td>uselib</td> 
   <td>Older syscall related to shared libraries, unused for a long time.</td> 
  </tr> 
  <tr> 
   <td>userfaultfd</td> 
   <td>Userspace page fault handling, largely needed for process migration.</td> 
  </tr> 
  <tr> 
   <td>ustat</td> 
   <td>Obsolete syscall.</td> 
  </tr> 
  <tr> 
   <td>vm86</td> 
   <td>In kernel x86 real mode virtual machine. Also gated by CAP_SYS_ADMIN.</td> 
  </tr> 
  <tr> 
   <td>vm86old</td> 
   <td>In kernel x86 real mode virtual machine. Also gated by CAP_SYS_ADMIN.</td> 
  </tr> 
 </tbody> 
</table>