Skip to content

fix: Grant gdb ptrace capabilities so the end-to-end CI job passes #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Saggre merged 1 commit into from
Aug 7, 2026
Merged

fix: Grant gdb ptrace capabilities so the end-to-end CI job passes #3

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,6 +78,8 @@ make run-test-dump-generator

# Extract and unshield a key from a dump
docker run --rm \
--cap-add=SYS_PTRACE \
--security-opt seccomp=unconfined \
-e KEY_COMMENT=test@key \
-e DUMP_PATH=/data/<dump-file>.mem \
-v "$(pwd)/dumps:/data:ro" \
Expand All @@ -88,6 +90,11 @@ docker run --rm \
`KEY_COMMENT` is the comment string of the target key, used to locate it in the
dump. The recovered plaintext key is written to the mounted `/out` directory.

The `--cap-add=SYS_PTRACE` and `--security-opt seccomp=unconfined` flags are
required because the unshield step drives gdb, which makes calls into a live
`ssh-keygen` process. gdb needs ptrace to do that; without these flags it fails
on restricted sandboxes with `Couldn't write extended state status: Bad address`.

## Testing

The parser has structural unit tests (Go's `testing` package) covering the ELF
Expand Down
2 changes: 1 addition & 1 deletion entrypoint.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
#!/bin/bash

# docker run -e KEY_COMMENT=test@key -e DUMP_PATH=/data/cf87158b-7e71-4552-a0a4-2d941010e12f.mem -v $(pwd)/dumps:/data:ro -v $(pwd)/dumps:/out:ro shieldbreak
# docker run --cap-add=SYS_PTRACE --security-opt seccomp=unconfined -e KEY_COMMENT=test@key -e DUMP_PATH=/data/cf87158b-7e71-4552-a0a4-2d941010e12f.mem -v $(pwd)/dumps:/data:ro -v $(pwd)/dumps:/out:ro shieldbreak

set -eu

Expand Down
7 changes: 7 additions & 0 deletions test/run-test.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,14 @@ docker run --rm --privileged \
ssh-agent-test-dump-generator

echo "[*] Extracting and unshielding the key"
# The unshield step drives gdb, which makes inferior calls into a live
# ssh-keygen process. That needs ptrace (to save/restore the inferior's register
# state and to disable ASLR), so grant SYS_PTRACE and relax seccomp. Without
# these the run is flaky: it works where the host allows the ptrace calls and
# fails on restricted sandboxes such as GitHub Actions runners.
docker run --rm \
--cap-add=SYS_PTRACE \
--security-opt seccomp=unconfined \
-e KEY_COMMENT="$KEY_COMMENT" \
-e DUMP_PATH="/data/${DUMP_FILE}" \
-v "$DUMPS_DIR:/data:ro" \
Expand Down
Loading