1

Issue: running configure scripts work fine, the C compiler can be used and the generated programs run. As soon as ASAN is added the configure script complains that the generated programs cannot run.

./configure
checking for a BSD-compatible install... /usr/bin/install -c
checking whether build environment is sane... yes
checking for a thread-safe mkdir -p... /bin/mkdir -p
checking whether make sets $(MAKE)... yes
checking whether make supports nested variables... yes
checking for gcc... gcc
checking whether the C compiler works... yes
checking for C compiler default output file name... a.out
checking for suffix of executables...
checking whether we are cross compiling... no
checking for suffix of object files... o
checking whether we are using the GNU C compiler... yes
...

vs.

./configure CFLAGS="-fsanitize=address -fsanitize=undefined -fno-omit-frame-pointer -fstack-protector" LDFLAGS="-fsanitize=undefined -fsanitize=address" --enable-debug
checking for a BSD-compatible install... /usr/bin/install -c
checking whether build environment is sane... yes
checking for a thread-safe mkdir -p... /bin/mkdir -p
checking whether make sets $(MAKE)... yes
checking whether make supports nested variables... yes
checking whether CFLAGS can be modified... yes
checking for gcc... gcc
checking whether the C compiler works... yes
checking for C compiler default output file name... a.out
checking for suffix of executables...
checking whether we are cross compiling... configure: error: in `/tmp/test-asan':
configure: error: cannot run C compiled programs.
If you meant to cross compile, use `--host'.
See `config.log' for more details

config.log shows:

configure:3653: checking whether we are cross compiling
configure:3661: gcc -o conftest -fsanitize=address -fsanitize=undefined -fno-omit-frame-pointer -fstack-protector  -fsanitize=undefined -fsanitize=address conftest.c  >&5
configure:3665: $? = 0
configure:3672: ./conftest
==9941==LeakSanitizer has encountered a fatal error.
==9941==HINT: For debugging, try setting environment variable LSAN_OPTIONS=verbosity=1:log_threads=1
==9941==HINT: LeakSanitizer does not work under ptrace (strace, gdb, etc)
configure:3676: $? = 1
configure:3683: error: in `/tmp/test-asan':
configure:3685: error: cannot run C compiled programs.
Simon Sobisch
  • 6,263
  • 1
  • 18
  • 38
  • 1
    You should *not* add `-lasan` or `-lubsan` to `LDFLAGS`. They are libs, and should be added to `LIBS` if needed. However, they are not needed. Instead, add `-fsanitize=address -fsanitize=undefined` to `LDFLAGS`. The compiler driver will add the proper libs. – jww Aug 12 '19 at 18:11

2 Answers2

1

The error message from the configure script is very confusing (there's no cross-compiling involved), the hint of LeakSanitizer is not much better (we don't do any debugging) but contains an important hint: ptrace.

As hinted in a GDB + ptrace question the issue is that the Yama kernel security module was configured to prevent the use of ptrace by ASAN.

Similar, slightly more helpful messages can be seen when running in valgrind:

error calling PR_SET_PTRACER, vgdb might block

To work-around this issue:

  • option 1: run the configure script (and later tests) in an elevated shell (sudo bash)
  • option 2 (on a local/secured machine [possibly a VM/sandbox]): allow ptrace for everyone
    echo 0 | sudo tee /proc/sys/kernel/yama/ptrace_scope

When doing so the configure script runs as expected and the generated programs abort on exit if there's any error found by the sanitizers.

Robin Kanters
  • 5,018
  • 2
  • 20
  • 36
Simon Sobisch
  • 6,263
  • 1
  • 18
  • 38
1

I ran into the same issue when using "podman build" ("docker build" works). Adding ptrace as a capability is probably doable. But another workaround is to set ASAN_OPTIONS=detect_leaks=0 (during ./configure and make test in my case).

Bjoern Dahlgren
  • 931
  • 8
  • 18