Running LLDB in a container

I have a project (GitHub - planetmarshall/lldb-qt-formatters: LLDB Formatters for Qt Core classes) where I am running lldb as part of CI to run some tests. Whilst it works fine on bare metal or a VM, it does not run in a container due to security restrictions.

Steps to Reproduce

Build the following container:

FROM gcc:latest

RUN wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key | tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc && \
    echo "deb http://apt.llvm.org/bookworm/ llvm-toolchain-bookworm-17 main" >> /etc/apt/sources.list && \
    echo "deb-src http://apt.llvm.org/bookworm/ llvm-toolchain-bookworm-17 main" >> /etc/apt/sources.list && \
    apt-get update -y && \
    apt-get install -y lldb-17

WORKDIR /tmp

RUN echo "int main() { int x = 42; return 0; }" > main.c && \
    gcc main.c

CMD ["lldb-17", "--one-line", "run", "a.out"]
docker build . -t lldb

Results in the error:

$ docker run lldb

 (lldb) target create "a.out"
Current executable set to '/tmp/a.out' (aarch64).
(lldb) run
error: Cannot launch '/tmp/a.out': personality set failed: Function not implemented

I can workaround it by running

$ docker run --security-opt seccomp=unconfined lldb

(lldb) target create "a.out"
Current executable set to '/tmp/a.out' (aarch64).
(lldb) run
Process 6 exited with status = 0 (0x00000000)
Process 6 launched: '/tmp/a.out' (aarch64)

But was wondering if there is another way, as in the CI environment I am not in control of the docker security policy.

You are hitting unfriendly error message when debugee does not start correctly Ā· Issue #48067 Ā· llvm/llvm-project Ā· GitHub and more specifically I think LLDB to skip disabling ASLR in constrained environments Ā· Issue #61899 Ā· llvm/llvm-project Ā· GitHub.

If it is ASLR, settings set target.disable-aslr false should get you around it. Depending on your CI setup, one way to do it is to create a lldbinit file or if you have a test generator maybe itā€™s a one line change there if youā€™re lucky.

If itā€™s not ASLR then stracing lldb-server is one way to find out what itā€™s asking for (though of course we should fix the error reporting eventually).

Perfect, it was ineed the ASLR issue.

Thanks for the rapid solution.

Iā€™m trying to test the LLDB libc++ dataformatters in the libc++ precommit CI. This runs inside a Docker image here I run into the same personality set failed: Function not implemented issue.

When manually running LLDB either of these solutions solves the issue:

  • echo 'settings set target.disable-aslr false' >~/.lldbinit
  • Using lldb -O 'settings set target.disable-aslr false' a.out.

When I build the check-lldb-api-functionalities-data-formatter-data-formatter-stl-libcxx target it does not use the ~/.lldbinit.
Configuring CMake using -DLLDB_TEST_USER_ARGS="-O 'settings set target.disable-aslr false'" also does not solve the issue.

Any suggestions how to fix this when running the LLDB tests in a Docker image?

If you git grep where we do settings set target.inherit-tcc youā€™ll find four places where we set this setting when running tests (altho Iā€™m not sure why the one in test/API/types/AbstractBase.py isnā€™t inherited from the normal setup methods tbh).

Disabling ASLR is useful for a user who is debugging a binary repeatedly, to increase the chance that addresses may be the same across debug sessions. It is not adding anything when running the testsuite (beyond testing that binaries can be launched with ASLR disabled, obvi), my first impression is that we should probably disable this setting by default for the testsuite in those same setup files. @DavidSpickett what do you think?

Thanks a lot @jasonmolenda! Adding "settings set target.disable-aslr false", to lldb/packages/Python/lldbsuite/test/lldbtest.py fixes testing the libc++ data formatters.

Most tests should be fine with ALSR being on. If they were I think weā€™d view that as something to fix as itā€™s relying on the equivalent of C undefined behaviour.

Maybe there is a test that genuinely needs an exact layout but weā€™d be better off marking those tests individually. In a few runs on AArch64 Linux I didnā€™t see any failures with ASLR on.

Let me see if my GDB colleagues have experience that contradicts this and if not, Iā€™ll make a patch for the change.

@DavidSpickett maybe add a dotest command line option to turn disabling back on, just in case. I could see where this might cause issues on some RTOSes.

fwiw this change was merged via [libc++][CI] Tests LLDB libc++ data formatters. by mordante Ā· Pull Request #88312 Ā· llvm/llvm-project Ā· GitHub .

When we run the testsuite against an iOS/etc device, the ā€œlaunch with ASLR disabledā€ flag to posix_spawn is ignored, weā€™ve never seen a test failure that came down to that behavior.

I canā€™t think of any time logic that depended on the assumption that some library always loads at the same address run to run would be anything other than a bug. As Jason said, this is a convenience to our users that we canā€™t guarantee we can provide, so we shouldnā€™t rely on it.

I canā€™t think of an algorithm where itā€™s likely we would do the right thing with ASLR off, but the wrong thing with it on, however. So itā€™s probably not worth trying to test that modally.

Great, so we already know the tests are fine :slight_smile:

My GDB colleague told me that their test suite is in theory agnostic to the setting apart from the test for the setting itself, and one specific test that must disable it. So pretty much what we also found.

Yeah Iā€™m surprised that @mordante 's cmake change didnā€™t do the same thing so Iā€™ll see what the canonical way to do this and at least get it documented.

We already have the ability to override settings, itā€™s just poorly documented, who would have guessed :slight_smile:

You can add --setting "target.disable-aslr=true" to a dotest command, or if you want to use LLDB_TEST_USER_ARGS you have to set it to --setting;target.disable-aslr=true. That ; is the magic separator that we donā€™t document.

Iā€™ll improve the cmake docstrings and update the docs. Testing - šŸ› LLDB talks about it but Iā€™m not sure the examples work anymore.

1 Like

Thanks for the information! Do you want me to make a PR to do this in the libc++ CI or do you want to make a patch?

Well we changed the ASLR default for the entire lldb test suite (we now donā€™t disable it), I assumed that would carry over to libc++'s CI too. If not, yes please make the changes yourself, youā€™re the expert there.

Iā€™ll handle the rest of it.

Fix the docs: [lldb] Correct documentation of LLDB_TEST_USER_ARGS by DavidSpickett Ā· Pull Request #89042 Ā· llvm/llvm-project Ā· GitHub

1 Like

I indeed did. If youā€™re happy to keep that as is, we donā€™t need to make changes.

Yes letā€™s keep it as is, I havenā€™t seen any problems with it.

1 Like