(I hope the post is not OT here.)

I have to debug my C program and I'm using gdb on Linux. Since my
program is writing output to the screen (and I want separate control
of the debugger I/O) I started the program from one terminal window
and the debugger from another one.

'man gdb' says:
You can, instead, specify a process ID as a second argument,
if you want to debug a running process: gdb program 1234

Starting the program and calling the debugger reports this failure:

Attaching to process 29631
Could not attach to process.
If your uid matches the uid of the target process, check the setting
of /proc/sys/kernel/yama/ptrace_scope, or try again as the root user.
For more details, see /etc/sysctl.d/10-ptrace.conf
ptrace: Operation not permitted.

The mentioned information sources show:

$ cat /proc/sys/kernel/yama/ptrace_scope
1

$ cat /etc/sysctl.d/10-ptrace.conf
# The PTRACE system is used for debugging. With it, a single user process
# can attach to any other dumpable process owned by the same user. [...]
kernel.yama.ptrace_scope = 1

Given the comment in 10-ptrace.conf I wonder what's going wrong here.
I am running my program and gdb both under my UID. I am reluctant to
"try again as the root user" (as suggested by the gdb output); to me,
at least, that seems not to be the "right way". - Any suggestions how
to fix that?

Thanks.

Janis

Janis Papanagnou <janis_papanagnou+ng@hotmail.com> writes:
>(I hope the post is not OT here.)
>
>I have to debug my C program and I'm using gdb on Linux. Since my
>program is writing output to the screen (and I want separate control
>of the debugger I/O) I started the program from one terminal window
>and the debugger from another one.
>
>'man gdb' says:
> You can, instead, specify a process ID as a second argument,
> if you want to debug a running process: gdb program 1234
>
>Starting the program and calling the debugger reports this failure:
>
>Attaching to process 29631
>Could not attach to process.
>If your uid matches the uid of the target process, check the setting
>of /proc/sys/kernel/yama/ptrace_scope, or try again as the root user.
>For more details, see /etc/sysctl.d/10-ptrace.conf
>ptrace: Operation not permitted.
>
>The mentioned information sources show:
>
>$ cat /proc/sys/kernel/yama/ptrace_scope
>1

Set it to zero and reboot.

The sysctl settings (writable only with CAP_SYS_PTRACE) are:

0 - classic ptrace permissions: a process can PTRACE_ATTACH to any other
process running under the same uid, as long as it is dumpable (i.e.
did not transition uids, start privileged, or have called
prctl(PR_SET_DUMPABLE...) already). Similarly, PTRACE_TRACEME is
unchanged.

1 - restricted ptrace: a process must have a predefined relationship
with the inferior it wants to call PTRACE_ATTACH on. By default,
this relationship is that of only its descendants when the above
classic criteria is also met. To change the relationship, an
inferior can call prctl(PR_SET_PTRACER, debugger, ...) to declare
an allowed debugger PID to call PTRACE_ATTACH on the inferior.
Using PTRACE_TRACEME is unchanged.

2 - admin-only attach: only processes with CAP_SYS_PTRACE may use ptrace
with PTRACE_ATTACH, or through children calling PTRACE_TRACEME.

3 - no attach: no processes may use ptrace with PTRACE_ATTACH nor via
PTRACE_TRACEME. Once set, this sysctl value cannot be changed.

In article <FuhiN.6171$SyNd.490@fx33.iad>,
Scott Lurndal <slp53@pacbell.net> wrote:
....
>>$ cat /proc/sys/kernel/yama/ptrace_scope
>>1
>
>Set it to zero and reboot.

Easiest is to just do

# echo 0 > /proc/sys/kernel/yama/ptrace_scope

No reboot needed.

--
Just like Donald Trump today, Jesus Christ had a Messiah complex.

And, in fact, the similarities between the two figures are quite striking.
For example, both have a ragtag band of followers, whose faith cannot be shaken.

On 25.12.2023 19:23, Kenny McCormack wrote:
> In article <FuhiN.6171$SyNd.490@fx33.iad>,
> Scott Lurndal <slp53@pacbell.net> wrote:
> ...
>>> $ cat /proc/sys/kernel/yama/ptrace_scope
>>> 1
>>
>> Set it to zero and reboot.
>
> Easiest is to just do
>
> # echo 0 > /proc/sys/kernel/yama/ptrace_scope
>
> No reboot needed.
>

Thanks, Scott and Kenny.

It had been very convenient that no reboot was necessary.

Janis

On 2023-12-26, Janis Papanagnou <janis_papanagnou+ng@hotmail.com> wrote:
> On 25.12.2023 19:23, Kenny McCormack wrote:
>> In article <FuhiN.6171$SyNd.490@fx33.iad>,
>> Scott Lurndal <slp53@pacbell.net> wrote:
>> ...
>>>> $ cat /proc/sys/kernel/yama/ptrace_scope
>>>> 1
>>>
>>> Set it to zero and reboot.
>>
>> Easiest is to just do
>>
>> # echo 0 > /proc/sys/kernel/yama/ptrace_scope
>>
>> No reboot needed.
>>
>
> Thanks, Scott and Kenny.
>
> It had been very convenient that no reboot was necessary.

However, a reboot will wipe out that setting, unless
you record the configuration in /etc/sysctl.conf,
or else stick that echo command into some "rc.local"
boot script.

--
TXR Programming Language: http://nongnu.org/txr
Cygnal: Cygwin Native Application Library: http://kylheku.com/cygnal
Mastodon: @Kazinator@mstdn.ca
NOTE: If you use Google Groups, I don't see you, unless you're whitelisted.

In article <umdqhd$3d2fh$1@dont-email.me>,
Janis Papanagnou <janis_papanagnou+ng@hotmail.com> wrote:
>On 25.12.2023 19:23, Kenny McCormack wrote:
>> In article <FuhiN.6171$SyNd.490@fx33.iad>,
>> Scott Lurndal <slp53@pacbell.net> wrote:
>> ...
>>>> $ cat /proc/sys/kernel/yama/ptrace_scope
>>>> 1
>>>
>>> Set it to zero and reboot.
>>
>> Easiest is to just do
>>
>> # echo 0 > /proc/sys/kernel/yama/ptrace_scope
>>
>> No reboot needed.
>>
>
>Thanks, Scott and Kenny.
>
>It had been very convenient that no reboot was necessary.

Another way to solve this problem - applicable here because the target
program was written and compiled by you - is to use prctl(2) to make the
target traceable (even if tracing is turned off at the system level).

Do "man prctl" and search for PR_SET_PTRACER for the details. You can
either specify that one specific program (pid) can trace (i.e., debug) the
calling process - or you can specify PR_SET_PTRACER_ANY.

I've never actually tested this, but I could see it being useful if you are
working on a system where you don't have root.

Changing the subject a bit, and just out of curiosity, which distros do this?
It seems to me to be a Ubuntu thing. I have one Ubuntu system - and that
system is the only one that does this "YAMA" thing. Is it unique to Ubuntu
or do others do it too?

--
Many North Koreans believe Kim-il-Sung is an "almighty god" who "created
the world" in seven days as a divine spirit millions of years ago, and
came to Earth as a human in 1912 as a messianic figure.