Repository navigation
[macOS] does not work with some stripped binaries (e.g., limactl) #95
Description
#78 introduced the support for stripped binaries, but this does not seem to work with limactl from https://github.com/lima-vm/lima .
It still works with simpler programs, such as alclessctl from https://github.com/AkihiroSuda/alcless
Reproduction
- Checkout https://github.com/lima-vm/lima v2.0.2 with the following modification to verify that gomodjail blocks syscalls from confined modules:
diff --git a/go.mod b/go.mod
index 094d60e5..59b66213 100644
--- a/go.mod
+++ b/go.mod
@@ -42,7 +42,7 @@ require (
github.com/santhosh-tekuri/jsonschema/v6 v6.0.2
github.com/sethvargo/go-password v0.3.1
github.com/sirupsen/logrus v1.9.4-0.20230606125235-dd1b4c2e81af
- github.com/spf13/cobra v1.10.2 // gomodjail:unconfined
+ github.com/spf13/cobra v1.10.2
github.com/spf13/pflag v1.0.10
github.com/wk8/go-ordered-map/v2 v2.1.8
golang.org/x/net v0.48.0- Install Lima with
KEEP_SYMBOLS=1:
make PREFIX="$HOME/.local" KEEP_SYMBOLS=1 native install- Make sure that gomodjail blocks syscalls:
$ gomodjail run --go-mod=go.mod -- limactl ls
time=2025-12-23T17:19:17.731+09:00 level=WARN msg=***Blocked*** pid=99669 exe=/Users/suda/.local/bin/limactl syscall=open entry="{Address:0 File:/Users/suda/.local/bin/limactl Symbol:github.com/spf13/cobra.(*Command).execute}" module=github.com/spf13/cobra sym=github.com/spf13/cobra.(*Command).execute
WARN[0000] The directory "/Users/suda/.lima" does not look like a valid Lima directory: open /Users/suda/.lima: operation not permitted
time=2025-12-23T17:19:17.732+09:00 level=WARN msg=***Blocked*** pid=99669 exe=/Users/suda/.local/bin/limactl syscall=open entry="{Address:0 File:/Users/suda/.local/bin/limactl Symbol:github.com/spf13/cobra.(*Command).execute}" module=github.com/spf13/cobra sym=github.com/spf13/cobra.(*Command).execute
FATA[0000] open /Users/suda/.lima: operation not permitted-
Install Lima with
KEEP_SYMBOLS=0and runlimactlwithgomodjailagain -
The confinement rule is not applied (
limactl lssucceeds)
Environment
- gomodjail: master 2e51017
- Go: 1.25.5
- macOS: 26.2
- CPU: Apple M4 Max
Potentially relevant:
Activity