echo "Usage: $(basename "$0") [-p port] [deployment]"

echo " [deployment] Pod or deployment that is to be debugged, e.g. deploy/sensor, central-d5bffdf6-wlx5c."

echo " Default deployment: $DEFAULT_DEPLOYMENT"

echo " -p, --port number Local and remote port number to open for debugger connection."

echo " Default port: $DEFAULT_PORT."

echo " -h, --help This message."

echo ""

echo "This command attaches dlv debugger to StackRox pod. The pod image must be a debug build."

echo "See https://github.com/stackrox/rox#debugging for complete instructions."

if [[ -n "${1:-}" ]]; then

echo ""

echo >&2 "Error: $1"

exit 2

fi

exit 0

local read_only_root_fs

if [[ "${target_is_pod}" == "true" ]]; then

read_only_root_fs="$(kubectl -n stackrox get "${deployment}" \

if [[ $read_only_root_fs == "true" ]]; then

echo >&2 "Cannot debug ${deployment}: the pod uses a read-only root filesystem"

exit 1

fi

else

read_only_root_fs="$(kubectl -n stackrox get "${deployment}" -o=jsonpath="{.spec.template.spec.containers[?(@.name=='${container_name}')].securityContext.readOnlyRootFilesystem}")"

if [[ "${read_only_root_fs}" == "true" ]]; then

local patch_root_fs_ro="{\"spec\":{\"template\":{\"spec\":{\"containers\":[{\"name\":\"${deployment_name}\",\"securityContext\":{\"readOnlyRootFilesystem\":true}}]}}}}"

local patch_root_fs_rw="{\"spec\":{\"template\":{\"spec\":{\"containers\":[{\"name\":\"${deployment_name}\",\"securityContext\":{\"readOnlyRootFilesystem\":false}}]}}}}"

echo "Configuring root filesystem of container ${container_name} within ${deployment} to be read-write."

echo "Remember to undo this change after debugging. For example, by executing:"

echo " $ kubectl -n stackrox patch '${deployment}' -p '${patch_root_fs_ro}'"

echo

kubectl -n stackrox patch "${deployment}" -p "${patch_root_fs_rw}"

# Unfortunately kubectl wait cannot wait yet for creation of new resources (pods, in this case).

# Hence, as a workaround to prevent a race here we need to wait a couple of seconds.

sleep 5

kubectl -n stackrox wait --for=condition=Ready pod -l app="${deployment_name}" --timeout=60s

fi

fi

ptrace_scope_file="/proc/sys/kernel/yama/ptrace_scope"

# If /proc/sys/kernel/yama/ptrace_scope is present and it contains anything non-zero, the following error will appear

# during `dlv attach` attempt:

# Could not attach to pid 1: this could be caused by a kernel security setting, try writing "0" to /proc/sys/kernel/yama/ptrace_scope

# This is likely on MacOS Docker and in some cloud environments.

# First, we check if anything needs adjustment. We read the current value by exec-ing into the existing deployment

# because a) that's much faster than spinning up a new image, and b) we read the value from the same node where

# the deployment is running.

ptrace_scope_state=$(kubectl --namespace stackrox exec "${deployment}" -- /bin/sh -c "[ -e ${ptrace_scope_file} ] && cat ${ptrace_scope_file} || echo 0")

if [[ "${ptrace_scope_state}" != "0" ]]; then

echo "${ptrace_scope_file} is currently set to ${ptrace_scope_state}, trying to change it to 0"

# Find out node where the pod is deployed.

if [[ "${deployment}" =~ ^deploy/ ]]; then # $deployment is like "deploy/central"

# We rely on `app` label (e.g. app=central).

# In case this turns unreliable, something like this should be done https://github.com/kubernetes/kubernetes/issues/72794#issuecomment-483502617

selector="--selector=app=${deployment/deploy\//}"

jsonpath="{.items[0].spec.nodeName}"

else # $deployment it is just a pod name e.g. "central-d5bffdf6-wlx5c"

selector="${deployment}"

jsonpath="{.spec.nodeName}"

fi

node_name=$(kubectl -n stackrox get pods "${selector}" --output jsonpath="${jsonpath}")

# Run one-off privileged container on the target node. The container will write 0 to the file.

# The file is mounted from the node and so the privileged container should be able to change it for all pods on the node.

kubectl -n stackrox run -it --rm --restart=Never \

--privileged \

--overrides "{ \"spec\": { \"nodeName\": \"${node_name}\" } }" \

--image=alpine debug-enabler -- /bin/sh -c "echo 0 > ${ptrace_scope_file}"

fi