Search code examples
linuxconfigureptraceaddress-sanitizer

How to fix error "cannot run C compiled programs" when using ASAN


Issue: running configure scripts work fine, the C compiler can be used and the generated programs run. As soon as ASAN is added the configure script complains that the generated programs cannot run.

./configure
checking for a BSD-compatible install... /usr/bin/install -c
checking whether build environment is sane... yes
checking for a thread-safe mkdir -p... /bin/mkdir -p
checking whether make sets $(MAKE)... yes
checking whether make supports nested variables... yes
checking for gcc... gcc
checking whether the C compiler works... yes
checking for C compiler default output file name... a.out
checking for suffix of executables...
checking whether we are cross compiling... no
checking for suffix of object files... o
checking whether we are using the GNU C compiler... yes
...

vs.

./configure CFLAGS="-fsanitize=address -fsanitize=undefined -fno-omit-frame-pointer -fstack-protector" LDFLAGS="-fsanitize=undefined -fsanitize=address" --enable-debug
checking for a BSD-compatible install... /usr/bin/install -c
checking whether build environment is sane... yes
checking for a thread-safe mkdir -p... /bin/mkdir -p
checking whether make sets $(MAKE)... yes
checking whether make supports nested variables... yes
checking whether CFLAGS can be modified... yes
checking for gcc... gcc
checking whether the C compiler works... yes
checking for C compiler default output file name... a.out
checking for suffix of executables...
checking whether we are cross compiling... configure: error: in `/tmp/test-asan':
configure: error: cannot run C compiled programs.
If you meant to cross compile, use `--host'.
See `config.log' for more details

config.log shows:

configure:3653: checking whether we are cross compiling
configure:3661: gcc -o conftest -fsanitize=address -fsanitize=undefined -fno-omit-frame-pointer -fstack-protector  -fsanitize=undefined -fsanitize=address conftest.c  >&5
configure:3665: $? = 0
configure:3672: ./conftest
==9941==LeakSanitizer has encountered a fatal error.
==9941==HINT: For debugging, try setting environment variable LSAN_OPTIONS=verbosity=1:log_threads=1
==9941==HINT: LeakSanitizer does not work under ptrace (strace, gdb, etc)
configure:3676: $? = 1
configure:3683: error: in `/tmp/test-asan':
configure:3685: error: cannot run C compiled programs.

Solution

  • The error message from the configure script is very confusing (there's no cross-compiling involved), the hint of LeakSanitizer is not much better (we don't do any debugging) but contains an important hint: ptrace.

    As hinted in a GDB + ptrace question the issue is that the Yama kernel security module was configured to prevent the use of ptrace by ASAN.

    Similar, slightly more helpful messages can be seen when running in valgrind:

    error calling PR_SET_PTRACER, vgdb might block

    To work-around this issue:

    • option 1: run the configure script (and later tests) in an elevated shell (sudo bash)
    • option 2 (on a local/secured machine [possibly a VM/sandbox]): allow ptrace for everyone
      echo 0 | sudo tee /proc/sys/kernel/yama/ptrace_scope

    When doing so the configure script runs as expected and the generated programs abort on exit if there's any error found by the sanitizers.