docker容器ldd无读权限,文件无法执行问题记录

问题描述

我在ubuntu22打包的镜像在ubuntu22上正常运行,但在CentOS 7上运行时,执行ldd命令时提示无读权限,文件无法执行。

gdb

CentOS 7 上调试时提示文件格式不被识别,无法执行。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
root@989437facd87:/app/Salesight/bin# gdb Salesight
GNU gdb (Ubuntu 12.1-0ubuntu1~22.04.2) 12.1
Copyright (C) 2022 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
"/app/Salesight/bin/Salesight": not in executable format: file format not recogized
(gdb) r
Starting program:
warning: Error disabling address space randomization: Operation not permitted
No executable file specified.
Use the "file" or "exec-file" command.
(gdb) exit

在ubuntu22使用gdb查看core文件

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
(base) fanzengxu@deroml20:bin$ gdb ./Salesight ./core.3007 
GNU gdb (Ubuntu 12.1-0ubuntu1~22.04.2) 12.1
Copyright (C) 2022 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.

--Type <RET> for more, q to quit, c to continue without paging--
For help, type "help".
Type "apropos word" to search for commands related to "word"...
"/data/fanzengxu/project/Salesight-docker/Salesight/bin/./Salesight": not in executable format: file format not recognized

warning: Can't open file /app/Salesight/bin/Salesight during file-backed mapping note processing

warning: Can't open file /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.33 during file-backed mapping note processing
[New LWP 15]
Core was generated by `./Salesight'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 0x0000560ea0058d78 in ?? ()
(gdb) bt
#0 0x0000560ea0058d78 in ?? ()
#1 0x00007ffd2eb50950 in ?? ()
#2 0x0000560ea0072f3a in ?? ()
#3 0x00007fca8b17a1c0 in ?? ()
#4 0x0000000000000000 in ?? ()

ldd

1
2
ldd ./Salesight
ldd: error: you do not have read permission for `./Salesight'

权限查看

1
2
ls -la ./Salesight
-rwxr-xr-x. 1 root root 114556928 May 22 07:31 ./Salesight

解决方案

加上–privileged参数后,问题解决了。非常奇怪

猜测

发现 caddy 可以正常执行,只有自己使用brpc编译的Salesight无法执行,猜测可能是brpc在协程切换时是直接使用汇编指令触发了CentOS 7 docker的安全机制,导致文件无法执行。