6

I am looking to disable ASLR (address space layout randomization) inside a Docker container. Not sure if it is possible. The container is running on Alpine, but from what I understand, ASLR is a Kernel feature and Docker uses the host kernel to run, thus not making it easily possible to disable ASLR only for Docker.

How can I disable ASLR only inside the Docker container ?

  • Is your question answered with this post or the linked question? – mhr Aug 8 '19 at 9:25
3

You can use the personality(2) syscall to set the ADDR_NO_RANDOMIZE flag for a process. That process, and any of its children, will not be using ASLR. Do this in whatever process starts Docker.

ADDR_NO_RANDOMIZE (since Linux 2.6.12)
       With this flag set, disable address-space-layout
       randomization.
| improve this answer | |
1

So essentially you're right, disabling ASLR is a kernel setting, you'd need to make the change at a kernel level.

There's a couple of options here.

  1. Make the change to the host before starting the container.
  2. Mount /proc inside the container and make the change from inside the container
  3. Use something like KataContainers to run the container with it's own kernel, and then make the change in there.

In theory, all of those should work, but which is good for you will depend on your precise use-case.

| improve this answer | |
1

I was trying to make this work for a CTF environment.

what didn't work:

  • using personality with ADDR_NO_RANDOMIZE will make any SUID app ignore the flag.
  • giving the docker extra privileges with --privileged

solution

the only way to achieve this is to change ASLR configuration on host kernel! using : echo 0 | sudo tee /proc/sys/kernel/randomize_va_space

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.