[Linux] Segmentation fault when subscribing to an unauthorized topic

BorisBoutillier commented 1 year ago

Bug report

Required Info:

Operating System: Linux Ubuntu 22.04
Installation type: Binary Iron
Version or commit hash: Iron
DDS implementation: Fast-RTPS

Steps to reproduce issue

I have followed the SROS_Linux.md with installation from packages with Ros2 Iron for testing.

In the "Access control" section, when running the command to check that the listener cannot subscribe to a topic other than chatter, running the provided command leads to Segmentation Fault, which is a valid but abrupt way to say "Access control forbidden".

Expected behavior

Some kind of error message that it is forbidden to subscribe to the topic.

Actual behavior

Segmentation fault

Additional information

This is perhaps the expected behaviour , in this case just close this. Discovered as part of the Iron testing, see https://github.com/osrf/ros2_test_cases/issues/535

clalancette commented 1 year ago

I finally got some time to look into this, and it is indeed a bug (or rather, a couple of bugs). I fixed one of them in https://github.com/ros2/rmw_fastrtps/pull/697, but more work is likely required.

mikaelarguedas commented 2 months ago

On Fast-RTPS / Ubuntu Noble / Jazzy the outcome seems decent:

mikael@sanji:~/sros2_demo$ ros2 run demo_nodes_py listener --ros-args -r chatter:=not_chatter -e /talker_listener/listener
[INFO] [1715000071.436466975] [rcl]: Found security directory: /home/mikael/sros2_demo/demo_keystore/enclaves/talker_listener/listener
2024-05-06 14:54:31.518 [SECURITY Error] rt/not_chatter topic not found in allow rule. (./src/cpp/security/accesscontrol/Permissions.cpp:1176) -> Function check_create_datareader
2024-05-06 14:54:31.518 [SECURITY Error] Error checking creation of local reader  (rt/not_chatter topic not found in allow rule. (./src/cpp/security/accesscontrol/Permissions.cpp:1176))
 -> Function get_datareader_sec_attributes
2024-05-06 14:54:31.518 [DATA_READER Error] Problem creating associated Reader -> Function enable

>>> [rcutils|error_handling.c:108] rcutils_set_error_state()
This error state is being overwritten:

  'create_datareader() could not create data reader, at ./src/subscription.cpp:673, at ./src/rcl/subscription.c:112'

with this new error message:

  'invalid allocator, at ./src/rcl/subscription.c:261'

rcutils_reset_error() should be called after error handling to avoid this.
<<<
invalid allocator, at ./src/rcl/subscription.c:261
Traceback (most recent call last):
  File "/opt/ros/jazzy/lib/demo_nodes_py/listener", line 33, in <module>
    sys.exit(load_entry_point('demo-nodes-py==0.33.2', 'console_scripts', 'listener')())
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/ros/jazzy/lib/python3.12/site-packages/demo_nodes_py/topics/listener.py", line 35, in main
    node = Listener()
           ^^^^^^^^^^
  File "/opt/ros/jazzy/lib/python3.12/site-packages/demo_nodes_py/topics/listener.py", line 26, in __init__
    self.sub = self.create_subscription(String, 'chatter', self.chatter_callback, 10)
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/ros/jazzy/lib/python3.12/site-packages/rclpy/node.py", line 1628, in create_subscription
    subscription_object = _rclpy.Subscription(
                          ^^^^^^^^^^^^^^^^^^^^
rclpy._rclpy_pybind11.RCLError: Failed to create subscription: invalid allocator, at ./src/rcl/subscription.c:261
[ros2run]: Process exited with failure 1

mikaelarguedas commented 2 months ago

On Iron it still segfaults but with explicit error message:

root@a70c5eb1db51:~/sros2_demo# ros2 run demo_nodes_py listener --ros-args -r chatter:=not_chatter -e /talker_listener/listener
[INFO] [1715000280.507727878] [rcl]: Found security directory: /root/sros2_demo/demo_keystore/enclaves/talker_listener/listener
2024-05-06 12:58:00.592 [SECURITY Error] rt/not_chatter topic not found in allow rule. (./src/cpp/security/accesscontrol/Permissions.cpp:1245) -> Function check_create_datareader
2024-05-06 12:58:00.592 [SECURITY Error] Error checking creation of local reader  (rt/not_chatter topic not found in allow rule. (./src/cpp/security/accesscontrol/Permissions.cpp:1245))
 -> Function get_datareader_sec_attributes
2024-05-06 12:58:00.592 [DATA_READER Error] Problem creating associated Reader -> Function enable
[ros2run]: Segmentation fault

mikaelarguedas commented 2 months ago

So IMO we can close this @clalancette

ros2 / sros2