Docker Run ‘echo core ＞ /proc/sys/kernel/core_pattern‘ Error

1、 Background

In the previous article, the research group needs to encapsulate AFL as a web API with docker in order to make a visual display of AFL on the web side. When the script is redeployed, the AFL boot fails when calling AFL for fuzzing. Because before executing AFL fuzzy , if the system is configured to send core dump file (core) notification to external programs, the delay between sending crash information to fuzzer will increase, and the crash may be falsely reported as timeout. So you have to modify the core temporarily_ Pattern file, as follows:

echo core > /proc/sys/kernel/core_pattern

However, an error occurs when executing the above command in the docker container:

bash: /proc/sys/kernel/core_pattern: Read-only file system

Core_ Pattern is a system read-only file and cannot be modified

2、 Doubt

When docker is executed, the root user executes various commands internally. Why can’t you change the files with read-only permission?With this question, baidu found it again and again, but it didn’t find one. Therefore, it checked a machine turned post, which is also ambiguous.

Since Baidu can’t, then Google. After checking for two minutes, I found a blog of compatriots across the Strait and found a solution.

3、 Solution

Direct code:

# Add the --privileged parameter when building the container
docker run -idt -p xx:xx --privileged afl-api:0.0.3

As with the above command, the problem can be solved by adding an additional -- privileged parameter when building the container.

4、 Cause

About version 0.6, privileged was introduced into docker
with this parameter, the root in the container has real root permissions
otherwise, the root in the container is only an external ordinary user permission
with the container started by privileged, you can see many devices on the host and execute mount
it even allows you to start the docker container in the docker container

That is, the container with the -- privileged parameter can really execute root permission.

Read More: