ThreadSanitizer cannot disable ASLR on the Gitea Docker runner #20

New Issue

logikoma · 2026-08-03T09:29:15-04:00

logikoma commented

2026-08-03 09:29:15 -04:00

Problem

The ThreadSanitizer workflow cannot run reliably on the current Gitea Actions Docker runner. ThreadSanitizer aborts before main() with unexpected memory mapping unless ASLR is disabled with setarch -R on this kernel.

The repository workflow already installs util-linux, which provides setarch. The job still fails because the Docker runner's default seccomp profile denies the personality syscall used by setarch -R. This is also reproducible against the current main workflow; normal build, coverage, and mutation jobs remain green.

Functional consequence

The default CI pipeline reports a ThreadSanitizer failure even when the library thread tests pass. A repository workflow cannot grant the required syscall permission, so further package installation will not resolve the failure.

Closing this

Configure a Starfort runner label backed by a host executor or a Docker/seccomp policy that permits the personality syscall, then select that label for the ThreadSanitizer workflow job. Re-enable the default ThreadSanitizer job and verify its 36 CTest programs pass on that runner.

Scope

This involves .gitea/workflows/ci.yaml, scripts/thread_test.sh, and the Starfort Gitea Actions runner configuration.

## Problem The ThreadSanitizer workflow cannot run reliably on the current Gitea Actions Docker runner. ThreadSanitizer aborts before main() with unexpected memory mapping unless ASLR is disabled with setarch -R on this kernel. The repository workflow already installs util-linux, which provides setarch. The job still fails because the Docker runner's default seccomp profile denies the personality syscall used by setarch -R. This is also reproducible against the current main workflow; normal build, coverage, and mutation jobs remain green. ## Functional consequence The default CI pipeline reports a ThreadSanitizer failure even when the library thread tests pass. A repository workflow cannot grant the required syscall permission, so further package installation will not resolve the failure. ## Closing this Configure a Starfort runner label backed by a host executor or a Docker/seccomp policy that permits the personality syscall, then select that label for the ThreadSanitizer workflow job. Re-enable the default ThreadSanitizer job and verify its 36 CTest programs pass on that runner. ## Scope This involves .gitea/workflows/ci.yaml, scripts/thread_test.sh, and the Starfort Gitea Actions runner configuration.

logikoma added the defect blast-radius:high status::grooming labels 2026-08-03 09:29:15 -04:00

logikoma referenced this issue

2026-08-03 09:32:43 -04:00

Annotate intentional handler fallthrough #19

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: andrew/libakerror#20