{"action":"created","issue":{"url":"https://api.github.com/repos/docker/docker/issues/21051","repository_url":"https://api.github.com/repos/docker/docker","labels_url":"https://api.github.com/repos/docker/docker/issues/21051/labels{/name}","comments_url":"https://api.github.com/repos/docker/docker/issues/21051/comments","events_url":"https://api.github.com/repos/docker/docker/issues/21051/events","html_url":"https://github.com/docker/docker/issues/21051","id":139489873,"number":21051,"title":"ptrace(ltrace/strace) does not work on non-privileged mode even apparmor is disabled and SYS_PTRACE is enabled.","user":{"login":"yoshiokatsuneo","id":381300,"avatar_url":"https://avatars.githubusercontent.com/u/381300?v=3","gravatar_id":"","url":"https://api.github.com/users/yoshiokatsuneo","html_url":"https://github.com/yoshiokatsuneo","followers_url":"https://api.github.com/users/yoshiokatsuneo/followers","following_url":"https://api.github.com/users/yoshiokatsuneo/following{/other_user}","gists_url":"https://api.github.com/users/yoshiokatsuneo/gists{/gist_id}","starred_url":"https://api.github.com/users/yoshiokatsuneo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yoshiokatsuneo/subscriptions","organizations_url":"https://api.github.com/users/yoshiokatsuneo/orgs","repos_url":"https://api.github.com/users/yoshiokatsuneo/repos","events_url":"https://api.github.com/users/yoshiokatsuneo/events{/privacy}","received_events_url":"https://api.github.com/users/yoshiokatsuneo/received_events","type":"User","site_admin":false},"labels":[{"id":375241376,"url":"https://api.github.com/repos/docker/docker/labels/version/1.10","name":"version/1.10","color":"ededed","default":false}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/docker/docker/milestones/53","html_url":"https://github.com/docker/docker/milestone/53","labels_url":"https://api.github.com/repos/docker/docker/milestones/53/labels","id":1657301,"number":53,"title":"1.12.0","description":"feature/code freeze: June 14th, 2016","creator":{"login":"thaJeztah","id":1804568,"avatar_url":"https://avatars.githubusercontent.com/u/1804568?v=3","gravatar_id":"","url":"https://api.github.com/users/thaJeztah","html_url":"https://github.com/thaJeztah","followers_url":"https://api.github.com/users/thaJeztah/followers","following_url":"https://api.github.com/users/thaJeztah/following{/other_user}","gists_url":"https://api.github.com/users/thaJeztah/gists{/gist_id}","starred_url":"https://api.github.com/users/thaJeztah/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thaJeztah/subscriptions","organizations_url":"https://api.github.com/users/thaJeztah/orgs","repos_url":"https://api.github.com/users/thaJeztah/repos","events_url":"https://api.github.com/users/thaJeztah/events{/privacy}","received_events_url":"https://api.github.com/users/thaJeztah/received_events","type":"User","site_admin":false},"open_issues":20,"closed_issues":911,"state":"closed","created_at":"2016-03-21T13:47:53Z","updated_at":"2016-12-12T13:28:52Z","due_on":"2016-07-28T07:00:00Z","closed_at":"2016-07-29T00:47:52Z"},"comments":7,"created_at":"2016-03-09T06:34:09Z","updated_at":"2016-12-15T19:56:42Z","closed_at":"2016-10-23T19:56:38Z","body":"Adding both \"--cap-add=SYS_PTRACE\" and \"--security-opt=apparmor:unconfined\" does not allow container to run programs like strace/ltrace using the ptrace (PTRACE_TRACEME).\n\n```\n$ docker run -i -t --cap-add=SYS_PTRACE --security-opt=apparmor:unconfined --rm ubuntu sh -c 'apt-get install -y strace; strace /bin/ls'\nReading package lists... Done\nBuilding dependency tree       \nReading state information... Done\nThe following NEW packages will be installed:\n  strace\n0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.\nNeed to get 113 kB of archives.\nAfter this operation, 504 kB of additional disk space will be used.\nGet:1 http://archive.ubuntu.com/ubuntu/ trusty/main strace amd64 4.8-1ubuntu5 [113 kB]\nFetched 113 kB in 1s (81.3 kB/s) \nSelecting previously unselected package strace.\n(Reading database ... 11542 files and directories currently installed.)\nPreparing to unpack .../strace_4.8-1ubuntu5_amd64.deb ...\nUnpacking strace (4.8-1ubuntu5) ...\nSetting up strace (4.8-1ubuntu5) ...\nstrace: test_ptrace_setoptions_for_all: PTRACE_TRACEME doesn't work: Operation not permitted\nstrace: test_ptrace_setoptions_for_all: unexpected exit status 1\n```\n\nOnly \"--privileded\" option allow the container to use ptrace.\n\nIs there any way to allow ptrace without using \"privileged\" flag ?\n\nOutput of `docker version`:\n\n```\n~$ docker version\nClient:\n Version:      1.10.1\n API version:  1.22\n Go version:   go1.5.3\n Git commit:   9e83765\n Built:        Thu Feb 11 19:14:21 2016\n OS/Arch:      darwin/amd64\n\nServer:\n Version:      1.10.1\n API version:  1.22\n Go version:   go1.5.3\n Git commit:   9e83765\n Built:        Thu Feb 11 19:32:54 2016\n OS/Arch:      linux/amd64\n```\n\nOutput of `docker info`:\n\n```\n~$ docker info\nContainers: 10\n Running: 8\n Paused: 0\n Stopped: 2\nImages: 6\nServer Version: 1.10.1\nStorage Driver: aufs\n Root Dir: /var/lib/docker/aufs\n Backing Filesystem: extfs\n Dirs: 393\n Dirperm1 Supported: true\nExecution Driver: native-0.2\nLogging Driver: json-file\nPlugins: \n Volume: local\n Network: bridge null host\nKernel Version: 4.2.0-18-generic\nOperating System: Ubuntu 15.10\nOSType: linux\nArchitecture: x86_64\nCPUs: 2\nTotal Memory: 3.858 GiB\nName: docker-node4\nID: U35M:LIYV:T5Q3:PMU5:UV4N:3QAS:I4ZA:YXQW:U23B:2RBK:E2GQ:L7BP\nWARNING: No swap limit support\nLabels:\n provider=amazonec2\n~$ \n\n```\n\nProvide additional environment details (AWS, VirtualBox, physical, etc.):\nUbuntu14.04\n\nList the steps to reproduce the issue:\n1. Run: $ docker run -i -t --cap-add=SYS_PTRACE --security-opt=apparmor:unconfined --rm ubuntu sh -c 'apt-get install -y strace; strace /bin/ls'\n\nDescribe the results you received:\nstrace: test_ptrace_setoptions_for_all: PTRACE_TRACEME doesn't work: Operation not permitted\n\nDescribe the results you expected:\nstrike result\n\nProvide additional info you think is important:\n"},"comment":{"url":"https://api.github.com/repos/docker/docker/issues/comments/267427382","html_url":"https://github.com/docker/docker/issues/21051#issuecomment-267427382","issue_url":"https://api.github.com/repos/docker/docker/issues/21051","id":267427382,"user":{"login":"avindra","id":126848,"avatar_url":"https://avatars.githubusercontent.com/u/126848?v=3","gravatar_id":"","url":"https://api.github.com/users/avindra","html_url":"https://github.com/avindra","followers_url":"https://api.github.com/users/avindra/followers","following_url":"https://api.github.com/users/avindra/following{/other_user}","gists_url":"https://api.github.com/users/avindra/gists{/gist_id}","starred_url":"https://api.github.com/users/avindra/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/avindra/subscriptions","organizations_url":"https://api.github.com/users/avindra/orgs","repos_url":"https://api.github.com/users/avindra/repos","events_url":"https://api.github.com/users/avindra/events{/privacy}","received_events_url":"https://api.github.com/users/avindra/received_events","type":"User","site_admin":false},"created_at":"2016-12-15T19:56:42Z","updated_at":"2016-12-15T19:56:42Z","body":"The answer is here:\r\n\r\nhttps://github.com/docker/docker/issues/7276#issuecomment-194139257\r\n\r\nYou should add this as a flag to the container\r\n\r\n```sh\r\n--security-opt seccomp:unconfined\r\n```"}}
{"actor":{"display_login":"avindra"}}