Error disabling address space randomization: Operation not permitted

DockerContainer下gdb無法正常工作的解決辦法

昨天想在Mac上使用gdb調試一個Linux下編譯的動態鏈接庫, 以正常選項啟動一個docker container, 運行gdb卻發現如下錯誤提示.

warning: Error disabling address space randomization: Operation not permitted
Cannot create process: Operation not permitted
During startup program exited with code 127.
(gdb)

在google搜索結果里第6個才找到正確答案, https://www.google.com/search?safe=off&q=docker+gdb+warning%3A+Error+disabling+address+space+randomization%3A+Operation+not+permitted+Cannot+create+process%3A+Operation+not+permitted+During+startup+program+exited+with+code+127&oq=docker+gdb+warning%3A+Error+disabling+address+space+randomization%3A+Operation+not+permitted+Cannot+create+process%3A+Operation+not+permitted+During+startup+program+exited+with+code+127, 原來是docker run中的一個不太常用的選項, docker run --privileged, 加上即可.

 

我的運行命令是：docker run --privileged -it  docker-kali-shared /bin/bash

 

原因：warning: Error disabling address space randomization: Operation not permitted

linux 內核為了安全起見，采用了Seccomp(secure computing)的沙箱機制來保證系統不被破壞。它能使一個進程進入到一種“安全”運行模式，該模式下的進程只能調用4種系統調用（system calls），即read(), write(), exit()和sigreturn()，否則進程便會被終止。

docker只有以--security-opt seccomp=unconfined的模式運行container才能利用GDB調試