security: disable setrlimit with asan

Various parts of ASAN will require creation of threads. At least
LSAN reporting and ASAN stack traces require this. Detect if we
run with ASAN and bypass the noproc setting with a warning.

Bug: #5661.

diff --git a/src/suricata-common.h b/src/suricata-common.h
index 1e7e316af13e81f0701a7a2d7fa9b84ce1ed13c7..49e82b8a418a81b30ce5db32142e70226fe74c70 100644 (file)
--- a/src/suricata-common.h
+++ b/src/suricata-common.h
@@ -36,6 +36,14 @@
 #define _GNU_SOURCE
 #define __USE_GNU
 
+#if defined(__has_feature)
+#if __has_feature(address_sanitizer)
+#define SC_ADDRESS_SANITIZER 1
+#endif
+#elif defined(__SANITIZE_ADDRESS__)
+#define SC_ADDRESS_SANITIZER 1
+#endif
+
 #if HAVE_CONFIG_H
 #include <autoconf.h>
 #endif

diff --git a/src/suricata.c b/src/suricata.c
index 8ac0552097770b71386bc832f8a910eecabad122..31ba223ed04a93dae6ecd774c25f4c3eecc947d3 100644 (file)
--- a/src/suricata.c
+++ b/src/suricata.c
@@ -691,7 +691,6 @@ static void PrintBuildInfo(void)
     const char *tls;
 
     printf("This is %s version %s\n", PROG_NAME, GetProgramVersion());
-
 #ifdef DEBUG
     strlcat(features, "DEBUG ", sizeof(features));
 #endif
@@ -766,6 +765,9 @@ static void PrintBuildInfo(void)
     strlcat(features, "MAGIC ", sizeof(features));
 #endif
     strlcat(features, "RUST ", sizeof(features));
+#if defined(SC_ADDRESS_SANITIZER)
+    strlcat(features, "ASAN ", sizeof(features));
+#endif
     if (strlen(features) == 0) {
         strlcat(features, "none", sizeof(features));
     }
@@ -2913,8 +2915,17 @@ int SuricataMain(int argc, char **argv)
     if (ConfGetBool("security.limit-noproc", &limit_nproc) == 0) {
         limit_nproc = 0;
     }
+
+#if defined(SC_ADDRESS_SANITIZER)
     if (limit_nproc) {
-#ifdef HAVE_SYS_RESOURCE_H
+        SCLogWarning(SC_ERR_SYSCONF,
+                "\"security.limit-noproc\" (setrlimit()) not set when using address sanitizer");
+        limit_nproc = 0;
+    }
+#endif
+
+    if (limit_nproc) {
+#if defined(HAVE_SYS_RESOURCE_H)
 #ifdef linux
         if (geteuid() == 0) {
             SCLogWarning(SC_ERR_SYSCONF, "setrlimit has no effet when running as root.");