[SR-15343] Docker image requires seccomp=unconfined to run repl

[shahmishal]

Previous ID	SR-15343
Radar	None
Original Reporter	@shahmishal
Type	Task

Additional Detail from JIRA

Votes	0
Component/s	Docker, LLDB for Swift
Labels	Task
Assignee	@shahmishal
Priority	Medium

Watchers: @shahmishal

md5: 6d64e10343b074609d94aad16a1eee9c

Issue Description:

Without flag seccomp=unconfined we are not able to run swift-package-tests :: repl/test-repl-glibc.py test.

FAIL: swift-package-tests :: repl/test-repl-glibc.py (28 of 31)
******************** TEST 'swift-package-tests :: repl/test-repl-glibc.py' FAILED ********************
Script:
--
: 'RUN: at line 6';   rm -rf /root/rpmbuild/BUILD/swift-source/build/buildbot_linux/none-swift_package_sandbox_linux-x86_64/tests/repl/Output/test-repl-glibc.py.tmp.dir
: 'RUN: at line 7';   mkdir /root/rpmbuild/BUILD/swift-source/build/buildbot_linux/none-swift_package_sandbox_linux-x86_64/tests/repl/Output/test-repl-glibc.py.tmp.dir
: 'RUN: at line 8';   /usr/bin/python3 /root/rpmbuild/BUILD/swift-source/swift-integration-tests/repl/test-repl-glibc.py /root/rpmbuild/BUILD/swift-source/build/buildbot_linux/none-swift_package_sandbox_linux-x86_64/usr/bin/swift > /root/rpmbuild/BUILD/swift-source/build/buildbot_linux/none-swift_package_sandbox_linux-x86_64/tests/repl/Output/test-repl-glibc.py.tmp.dir/output.txt
: 'RUN: at line 9';   /root/rpmbuild/BUILD/swift-source/build/buildbot_linux/llvm-linux-x86_64/bin/FileCheck --input-file /root/rpmbuild/BUILD/swift-source/build/buildbot_linux/none-swift_package_sandbox_linux-x86_64/tests/repl/Output/test-repl-glibc.py.tmp.dir/output.txt /root/rpmbuild/BUILD/swift-source/swift-integration-tests/repl/test-repl-glibc.py
--
Exit Code: 1

Command Output (stdout):
--
$ ":" "RUN: at line 6"
$ "rm" "-rf" "/root/rpmbuild/BUILD/swift-source/build/buildbot_linux/none-swift_package_sandbox_linux-x86_64/tests/repl/Output/test-repl-glibc.py.tmp.dir"
$ ":" "RUN: at line 7"
$ "mkdir" "/root/rpmbuild/BUILD/swift-source/build/buildbot_linux/none-swift_package_sandbox_linux-x86_64/tests/repl/Output/test-repl-glibc.py.tmp.dir"
$ ":" "RUN: at line 8"
$ "/usr/bin/python3" "/root/rpmbuild/BUILD/swift-source/swift-integration-tests/repl/test-repl-glibc.py" "/root/rpmbuild/BUILD/swift-source/build/buildbot_linux/none-swift_package_sandbox_linux-x86_64/usr/bin/swift"
# command stderr:
Traceback (most recent call last):
  File "/usr/lib/python3.6/site-packages/pexpect/spawnbase.py", line 152, in read_nonblocking
    s = os.read(self.child_fd, size)
OSError: [Errno 5] Input/output error

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/lib/python3.6/site-packages/pexpect/expect.py", line 96, in expect_loop
    incoming = spawn.read_nonblocking(spawn.maxread, timeout)
  File "/usr/lib/python3.6/site-packages/pexpect/pty_spawn.py", line 469, in read_nonblocking
    return super(spawn, self).read_nonblocking(size)
  File "/usr/lib/python3.6/site-packages/pexpect/spawnbase.py", line 157, in read_nonblocking
    raise EOF('End Of File (EOF). Exception style platform.')
pexpect.exceptions.EOF: End Of File (EOF). Exception style platform.

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/root/rpmbuild/BUILD/swift-source/swift-integration-tests/repl/test-repl-glibc.py", line 22, in <module>
    repl.expect('(.*)Welcome to Swift version (.*)\r\n')
  File "/usr/lib/python3.6/site-packages/pexpect/spawnbase.py", line 327, in expect
    timeout, searchwindowsize, async_)
  File "/usr/lib/python3.6/site-packages/pexpect/spawnbase.py", line 355, in expect_list
    return exp.expect_loop(timeout)
  File "/usr/lib/python3.6/site-packages/pexpect/expect.py", line 102, in expect_loop
    return self.eof(e)
  File "/usr/lib/python3.6/site-packages/pexpect/expect.py", line 49, in eof
    raise EOF(msg)
pexpect.exceptions.EOF: End Of File (EOF). Exception style platform.
<pexpect.pty_spawn.spawn object at 0x7fa30d1d8208>
command: /root/rpmbuild/BUILD/swift-source/build/buildbot_linux/none-swift_package_sandbox_linux-x86_64/usr/bin/swift
args: ['/root/rpmbuild/BUILD/swift-source/build/buildbot_linux/none-swift_package_sandbox_linux-x86_64/usr/bin/swift']
buffer (last 100 chars): b''
before (last 100 chars): b"error: failed to launch REPL process: 'A' packet returned an error: 8\r\n"
after: <class 'pexpect.exceptions.EOF'>
match: None
match_index: None
exitstatus: None
flag_eof: True
pid: 26622
child_fd: 5
closed: False
timeout: 30
delimiter: <class 'pexpect.exceptions.EOF'>
logfile: None
logfile_read: None
logfile_send: None
maxread: 2000
ignorecase: False
searchwindowsize: None
delaybeforesend: 0.05
delayafterclose: 0.1
delayafterterminate: 0.1
searcher: searcher_re:
    0: re.compile("b'(.*)Welcome to Swift version (.*)\r\n'")

error: command failed with exit status: 1

--

********************
Testing:  0.. 10.. 20.. 30.. 40.. 50.. 60.. 70.. 80.. 90.. 
********************
Failed Tests (1):
  swift-package-tests :: repl/test-repl-glibc.py


Testing Time: 25.91s
  Unsupported: 10
  Passed     : 20
  Failed     :  1

[tomerd]

afaik this is because the REPL is based on LLDB which requires elevated permissions. you can also run the container in privileged mode.

not sure if there is a way to run LLDB without elevated permissions, probably question for @fredriss