With Go program, inside a docker container, bind fails with permission denied error, invalid handle error. about graphene HOT 7 CLOSED

@dimakuv did some debugging with GDB, and turns out that this a configuration issue, not a graphene issue.
Given that this Go application was run using Graphene, inside a docker container, bind failed due to this error-> EADDRNOTAVAIL(99) Cannot assign requested address
But Pal's-> unix_to_pal_error_positive, does NOT check for this->EADDRNOTAVAIL, and instead returns a default value of PAL_ERROR_DENIED
And then later in LibOS, in shim_do_bind, it calls-> pal_to_unix_errno(PAL_ERROR_DENIED), gets converted to EACCES(Permission Denied).

If possible, we can try to add a change in Graphene, to ensure that application gets the REAL error for this case-> EADDRNOTAVAIL(99) Cannot assign requested address.

But otherwise, this PR can be closed.

from graphene.

May be fixed by this PR: #2678

from graphene.

@dimakuv , this PR #2678 that you have mentioned, has change only in Graphene-direct, not in Graphene-SGX. I am testing in Graphene-SGX, also I am using a non-zero port-number.
In any case, I tested with a TCP Go server program, and it still fails to bind, when launched inside a docker container using Graphene-SGX. Here is a zip file with the program and how to test-> (gopro_tcp_testing_container.zip)

And here is the log:
[P1:T1:main] debug: loading "file:./main"
[P1:T1:main] debug: append_r_debug: adding file:./main at 0x0
[P1:T1:main] debug: Creating pipe: pipe.srv:1
debug: sock_getopt (fd = 11, sockopt addr = 0x7ffc7c4c4740) is not implemented and always returns 0
[P1:T1:main] debug: Shim process initialized
[P1:shim] debug: IPC worker started
[P1:T1:main] debug: Created sigframe for sig: 23 at 0x90009390 (handler: 0x460b80, restorer: 0x460cc0)
[P1:T1:main] error: bind: invalid handle returned
Error listening: listen tcp 172.17.0.1:8805: bind: permission denied
[P1:T1:main] debug: ---- shim_exit_group (returning 1)

from graphene.

Can you run it with loader.log_level = "all" and attach the resulting log?

from graphene.

@dimakuv attached log-> ( udp_bind_perm_denied_within_container_graphene_log.zip)

from graphene.

The relevant part of this log is:

[P1:T1:main] trace: ---- shim_socket(INET, SOCK_NONBLOCK|SOCK_CLOEXEC|DGRAM, 0) = 0x3
[P1:T1:main] trace: ---- shim_setsockopt(3, 1, 6, 0xa41047e4, 4) = 0x0
[P1:T1:main] error: bind: invalid handle returned
[P1:T1:main] trace: ---- shim_bind(3, 0xa404002c, 16) = -13

To be honest, this doesn't help much. Apparently, there is some issue with the address parameter used by bind() of the UDP server. Could you maybe debug it with GDB?

Given that we didn't debug UDP properly, and the UDP code in PAL is very old, it's no surprise it is so buggy... We need to refactor it completely.

from graphene.

Thanks for debugging this. Looking at https://github.com/gramineproject/gramine/blob/40e942db6b02555cf2414f20bbd313b63f50e400/Pal/src/host/Linux/pal_linux_error.h and https://github.com/gramineproject/gramine/blob/40e942db6b02555cf2414f20bbd313b63f50e400/common/include/pal_error.h, I don't see any suitable PAL error code to correspond to EADDRNOTAVAIL. In other words, we'll have to add a new PAL error code to have the 1:1 conversion, and we try to not increase the number of error codes in Gramine.

But noted. If we'll hit something similar again, we'll strongly consider adding this error code. Closing the issue.

from graphene.