Using ARCUS inside docker

[gpriamo]

Hi,

I am trying to use ARCUS to perform a root cause analysis of crashes I found via fuzzing, however due to the high demands of RAM angr seems to have (my laptop only has 16GB of RAM), I am forced to use your tool on a shared server, therefore I need to run it inside docker.

I managed to build ARCUS (the analyzer passes the tests) and fetch all of its dependencies flawlessly, however once I try to use it with one of my programs under test I get the following error from the analyzer:

ERROR | 2024-09-09 11:44:02,909 | analysis | Cannot find PIDs for tasks in trace

After doing some digging, the culprit seems to be the tracer: for some reason it seems perf is not capable of correctly tracing intel_pt (which is available and shown, both inside the container and outside, when using perf list | grep intel) events: the perf.data file is smaller (less than 1MB) than the one which I manage to generate while running the tracer on my laptop (2+MB). Moreover, when trying to run the perf script command to check the contents of the of the perf.data file, it returns an empty output on docker, while on my laptop it correctly shows the recorded information from running the program.

My questions are: Do you know if it is possible to run ARCUS inside a docker container? Have you ever tried it? In that case, do you know the reasons behind the issues I am having a now a way to get it to work?

Here are some more info which I hope be useful:
docker run parameters: --privileged --cap-add=ALL --memory="100g" (I tried both with and without --cap-add=ALL - I read on the Internet it could be a possible fix, sadly it's not)

../ARCUS/tools/angr/tracer.py --keep-perf trace-output ./target poc
../ARCUS/tools/angr/analysis.py trace-output

I also tried setting the value of kernel.perf_event_paranoid to 1, 0 and even -1, unfortunately I had no luck.

Thank you in advance for your help.