syscall_4294967295

[Pas]

Hello!

I would like to ask for a bit of help and maybe report a bug (but it's
probably just a known, however, a rather confusing behavior of strace).

While running serf (a Raft consensus agent) in Docker (which uses cgroups
and kernel namespaces) I got a strange error. ("==> Failed to start the
Serf agent: Error creating Serf: Failed to create memberlist: Failed to
start TCP listener. Err: listen tcp 0.0.0.0:7946: socket: operation not
permitted") But the process inside the container should be behaving as a
process running as root, with all the necessary capabilities.

So, strace-ing from the host (cannot strace/ptrace from the container
without using --privileged), I get the following trace:

...
[pid 17148] read(3,  <unfinished ...>
[pid 17144] clock_gettime(CLOCK_MONOTONIC,  <unfinished ...>
[pid 17148] <... read resumed> "", 4096) = 0
[pid 17144] <... clock_gettime resumed> {939382190280542405,
579195224836800512}) = 0
[pid 17148] close(3 <unfinished ...>
[pid 17144] clock_gettime(CLOCK_REALTIME,  <unfinished ...>
[pid 17148] <... close resumed> )       = 0
[pid 17144] <... clock_gettime resumed> {4155469542819979293, 17314723865})
= 0
[pid 17148] clock_gettime(CLOCK_REALTIME,  <unfinished ...>
[pid 17144] _newselect(0, NULL, NULL, NULL, {85899345920, 86034069969}
<unfinished ...>
[pid 17148] <... clock_gettime resumed> {4155579120320602141,
598189438530486336}) = 0
[pid 17148] futex(0x18928620, FUTEX_WAKE, 1) = 1
[pid 17146] <... futex resumed> )       = 0
[pid 17146] _newselect(0, NULL, NULL, NULL, {429496729600, 429631460482}
<unfinished ...>
[pid 17144] <... _newselect resumed> )  = 0 (Timeout)
[pid 17144] clock_gettime(CLOCK_MONOTONIC, {940046419857770693,
579195224836800512}) = 0
[pid 17144] clock_gettime(CLOCK_REALTIME,  <unfinished ...>
[pid 17148] syscall_4294967295(0x1, 0x18935730, 0, 0, 0, 0xff <unfinished
...>
[pid 17144] <... clock_gettime resumed> {4156106598139125789, 17314723865})
= 0
[pid 17148] <... syscall_4294967295 resumed> ) = -1 (errno 1)
[pid 17144] _newselect(0, NULL, NULL, NULL, {85899345920, 86034069969}
<unfinished ...>
[pid 17148] write(1, "==> Failed to start the Serf agent: Error creating
Serf: Failed to create memberlist: Failed to start TCP listener. Err:
listen tcp 0.0.0.0:7946: socket: operation not permitted", 177) = 177
...


I'm wondering what syscall_4294967295 could be, and shouldn't strace know
that it's a socket (or similar) call?


Here's a strace from inside the container:

...
[pid   151] read(3,
"TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0"..., 4096) =
118
[pid   151] read(3, "", 4096)           = 0
[pid   151] close(3)                    = 0
[pid   151] clock_gettime(CLOCK_REALTIME, {1455331897, 882136632}) = 0
[pid   151] futex(0x189d88e0, FUTEX_WAKE, 1 <unfinished ...>
[pid   155] <... futex resumed> )       = 0
[pid   151] <... futex resumed> )       = 1
[pid   155] select(0, NULL, NULL, NULL, {0, 100} <unfinished ...>
[pid   151] socket(PF_INET6, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK,
IPPROTO_IP) = 3
[pid   151] setsockopt(3, SOL_IPV6, IPV6_V6ONLY, [0], 4) = 0
[pid   151] setsockopt(3, SOL_SOCKET, SO_BROADCAST, [1], 4 <unfinished ...>
[pid   155] <... select resumed> )      = 0 (Timeout)
[pid   151] <... setsockopt resumed> )  = 0
[pid   155] futex(0x18928620, FUTEX_WAKE, 1 <unfinished ...>
[pid   151] setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4 <unfinished ...>
[pid   155] <... futex resumed> )       = 1
[pid   152] <... futex resumed> )       = 0
[pid   151] <... setsockopt resumed> )  = 0
[pid   155] select(0, NULL, NULL, NULL, {0, 100} <unfinished ...>
[pid   152] select(0, NULL, NULL, NULL, {0, 100} <unfinished ...>
[pid   151] bind(3, {sa_family=AF_INET6, sin6_port=htons(7946),
inet_pton(AF_INET6, "::", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0},
28) = 0
[pid   151] listen(3, 128)              = 0
[pid   151] epoll_create1(EPOLL_CLOEXEC) = 4
...



I've tried it on Linux 4.4.0-4-generic #19-Ubuntu SMP Fri Feb 5 17:39:10
UTC 2016 x86_64 x86_64 x86_64 GNU/Linux, with strace 4.11, and with
4.11.0.233-0aae build from sources. (Oh, and docker 1.10.1 and systemd 229,
maybe they matter for namespaces.)


Thanks for your time!

Pas
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.strace.io/pipermail/strace-devel/attachments/20160213/d89eebbc/attachment.html>