glibc build fails with ISE:_do_ptrace: ptrace operation not permitted

[edannenberg]

glibc build fails with ISE:_do_ptrace: ptrace operation not permitted

[edannenberg]

Removed BUILD_PRIVILEGED in favor of BUILDER_CAPS_SYS_PTRACE. Let me know if you run into any issues.

[berney]

It might be nice to add more fine-grained privileges. On a Ubuntu 16.04 host building net-analyzers/nmap fails due to the sandbox trying to use PTRACE. Several work-arounds I've found are to: -

• disable the sandbox (e.g. FEATURES=-usersandbox emerge net-analyzers/nmap) in build.sh
• set BUILD_PRIVILEGED=true in build.conf
• add --cap-add=SYS_PTRACE to the docker run command in function run_image

It might be possible to reduce the privileges a lot of BUILD_PRIVILEGED=true builders and images have to a --cap-add=SYS_SOMETHING.

[edannenberg]

I was thinking about just setting --cap-add=SYS_PTRACE back then, but as it is just for some select build containers the current solution looked simpler (from a user's perspective) as it also takes care of any other missing cap problems.

Looking back so far though it always was missing SYS_PTRACE cap that required BUILD_PRIVILEGED=true, so thanks for bringing this up again. Should be a fairly simple change.