macOS core files: how can I enable them and can I enable them for specific applications?

Question

I have found discussions on these sites about macOS core files but the ones I found are old and do not address a core file created by an application that is launched from Finder.

I would like to help in the debugging of Emacs. I have built it myself and I have it so it launches from Finder. If / when it core dumps, a Report dialog comes up but that isn't really going to help me or the Emacs developers but a core file would. The problem is, /cores is currently empty. I see reports in ~/Library/Logs/DiagnosticReports/Retired/Emacs-* but they are text files probably what is sent in the "Report" dialog.

I get that core files are big and ugly and raise customer's questions so I get why they are turned off by default. What I'd like to do is turn it back on. And, if possible, turn it on only for specific applications like Emacs to prevent /cores from filling up with useless grot.

TL; DR --

1. How can I turn on core files for applications launched from Finder on 12.3 Monterey?
2. Can I turn on core file creation for specific applications?

Answer 1

On Monterey, you can add entitlements to generate a core per-application according to this detailed post from Apple Developer:

I have edited it to hopefully suit your case - apologies if I mess up anything in translation

From the command-line

Configure the core limit:
% ulimit -c unlimited
Make a copy of your emacs that’s failing to generate core.
% cp /path/to/emacs .
Create a dummy .entitlements with the com.apple.security.get-task-allow entitlement set:
% /usr/libexec/PlistBuddy -c "Add :com.apple.security.get-task-allow bool true" tmp.entitlements
File Doesn't Exist, Will Create: tmp.entitlements
Re-sign emacs with those entitlements:
% codesign -s - -f --entitlements tmp.entitlements ./emacs 
CrashSelf: replacing existing signature
Run that copy:
% ./emacs

Answer 2

@bmike gave me most of what I needed. A few additional clues and limitations.

Emacs is an app that lives in /Applications/Emacs.app and it has lots of stuff within that directory. I finally took it one step at a time. I created a dumpme app:

#include <unistd.h>
#include <signal.h>

int main(int argc, char *argv[])
{
  pid_t pid = getpid();

  kill(pid, SIGBUS);
}

and I did the codesign as suggested and I got a core file. Note that before the code side, I would get

zsh: bus error  ./dumpme

and after the codesign I would get:

zsh: bus error (core dumped)  ./dumpme

A preliminary step in building the Emacs app is temacs which is an executable without an initial state. I codesigned it and it produced a core too when started from the Terminal prompt. Then I did the codesign for /Applications/Emacs.app/Contents/MacOS/Emacs and I got this nastygram:

codesign -s - -f --entitlements tmp.entitlements /Applications/Emacs.app/Contents/MacOS/Emacs
/Applications/Emacs.app/Contents/MacOS/Emacs: replacing existing signature
/Applications/Emacs.app/Contents/MacOS/Emacs: code object is not signed at all
In subcomponent: /Applications/Emacs.app/Contents/MacOS/Emacs.pdmp

A search found this answer so I backed up and I did sudo codesign -s - -f --deep --entitlements tmp.entitlements /Applications/Emacs.app -- (Note the addition of --deep). Also, without the sudo I got permission problems.

If I start Emacs from the Finder or via open /Applications/Emacs.app and kill it, I do not get a core file. But if I start it from my Terminal prompt I do. e.g.

% /Applications/Emacs.app/Contents/MacOS/Emacs

I suspect there is a fix when starting from Finder as well. I'm assuming it has something to do with the ulimit -c unlimited that is suggested / required.

Update:

Take Finder out of the equation. Get the app to set the limit itself. i.e.

#include <unistd.h>
#include <signal.h>
#include <sys/resource.h>
#include <stdio.h>

int main(int argc, char *argv[])
{
  pid_t pid = getpid();
  struct rlimit l;
  int ret = getrlimit(RLIMIT_CORE, &l);

  printf("getrlimit returned %d\n", ret);
  printf("rlim_cur = %llu\n", l.rlim_cur);
  printf("rlim_max = %llu\n", l.rlim_max);
  l.rlim_cur = l.rlim_max;
  printf("setrlimit returned %d\n", setrlimit(RLIMIT_CORE, &l));
  printf("Time to kill myself\n");

  kill(pid, SIGBUS);
}

A modified Emacs.app even when started from Finder now produces a core dump.