3

First I should note that I'm using macOS Sierra (version 10.12 beta 16A238m), but I don't think it's that different than El Capitan in this certain situation (but I guess you know more than I do about that, or I wouldn't be here right now asking this question).

So I installed GDB (The GNU Debugger) for following among a book I am currently reading ("Hacking: The Art of Exploitation"), which only explains how to use GDB, so I can't use LLDB. I installed it using Homebrew (brew install gdb), and everything worked fine. Until I used it. I compiled my C source code using clang -g hello_word.c -o hello_world (it's just a simple C "Hello, World!" program), and then I run gdb -q hello_world, and here's the session:

Chens-MacBook-Pro:C chenjian$ gdb -q hello_world
Reading symbols from hello_world...Reading symbols from /Users/chenjian/Documents/Coding/Projects/RandomDev/C/hello_world.dSYM/Contents/Resources/DWARF/hello_world...done.
done.
(gdb) list
1   #include <stdio.h>
2   
3   int main() {
4       printf("Hello, World!\n");
5   }
(gdb) break main
Breakpoint 1 at 0x100000f6f: file hello_world.c, line 4.
(gdb) run
Starting program: /Users/chenjian/Documents/Coding/Projects/RandomDev/C/hello_world 
Unable to find Mach task port for process-id 42492: (os/kern) failure (0x5).
 (please check gdb is codesigned - see taskgated(8))

So I googled a bit about codesigning, and found this. So I went through the instructions (except for the ones for Snow Leopard), and it still doesn't work! Anyone knows how I can make it work?

  • Would you like an answer that walks you through disabling SIP which kills dtrace, debugging and some other things developers need? – bmike Jul 18 '16 at 1:55
  • Is there a different, less destructive way? – Hexa Jul 18 '16 at 9:26
  • @bmike um the above comment is for you – Hexa Jul 23 '16 at 21:48
  • No - (or AFAIK) you need to turn off some or all of SIP to accomplish what you ask. – bmike Jul 23 '16 at 21:50
  • 1
    Also - Look into veertu on the Mac App Store. You might be up and running in a ubuntu VM much faster. Chances are a free VM would be closer to the setup the book assumes. – bmike Jul 23 '16 at 22:41
1

Yes, code signing should work is a substantially better alternative to disabling SIP. I can't really believe how often disabling SIP is suggested as a solution to this problem - if you get desperate I'd sooner advise running sudo gdb (have backups!) than disabling SIP.

For me, the problem was that I repeatedly messed up one or more steps in the procedure. I ended up doing brew reinstall gdb, deleting all the certificates I had created, rebooting and then very carefully following the procedure again. Note that when you install gdb with Homebrew, the following is shown:

==> Caveats
gdb requires special privileges to access Mach ports.
You will need to codesign the binary. For instructions, see:

  https://sourceware.org/gdb/wiki/BuildingOnDarwin

On 10.12 (Sierra) or later with SIP, you need to run this:

  echo "set startup-with-shell off" >> ~/.gdbinit

Those instructions were what worked for me on Sierra. Disabling startup-with-shell so far has not been necessary, but it's worth keeping in mind if you're sure that you did it all correctly and the troubleshooting section of the link is of no use.

0
  1. Boot to recovery
  2. Open Terminal
  3. type csrutil disable

Then restart. dtrace and gdb should work.

https://developer.apple.com/library/mac/documentation/Security/Conceptual/System_Integrity_Protection_Guide/ConfiguringSystemIntegrityProtection/ConfiguringSystemIntegrityProtection.html

You could also run a script to determine which parts of SIP are enabled if you enable it with exclusions:

One nice thing is you don't need to relax SIP if you choose to use lldb and can compile your code with Xcode. Since gdb is not signed by Apple - it's intentionally prevented from attaching to anything on the system by design.

  • Thanks! But what exactly IS system integrity protection? – Hexa Jul 23 '16 at 22:22
  • @Hexa You might need to read the introduction to the first link in my answer. It explains SIP at a general level. I figured you'd see SystemIntegrityProtection and know that's SIP - sorry for not spelling that out. – bmike Jul 23 '16 at 22:25
  • No I understood System Integrity Protection is SIP, they just don't really explain it that good in the link... though you might be able to give some deeper insight into what it is – Hexa Jul 23 '16 at 22:27
  • It took me several hours to digest the section of the guide and I've been using UNIX for decades. You might have to study it a bit before you get it. – bmike Jul 23 '16 at 22:30
  • So I guess it's time to read my "Linux Kernel Development" book... – Hexa Jul 23 '16 at 22:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .