"please check gdb is codesigned - see taskgated(8)" - How to get gdb installed with homebrew code signed?

Question

I'm under osx 10.8.4 and have installed gdb 7.5.1 with homebrew (motivation get a new gdb with new features such as --with-python etc... )

Long story short when I run debug within a c++ Eclipse project I get :

Error in final launch sequence
Failed to execute MI command:
-exec-run
Error message from debugger back end:
Unable to find Mach task port for process-id 46234: (os/kern) failure (0x5).
 (please check gdb is codesigned - see taskgated(8))
Unable to find Mach task port for process-id 46234: (os/kern) failure (0x5).
 (please check gdb is codesigned - see taskgated(8))

I have followed various suggestions for code signing

• https://sourceware.org/gdb/wiki/BuildingOnDarwin
• partly http://www.noktec.be/archives/1251 with various adjusts

So I did:

1. Set up the certificate
2. Sign the gdb -> codesign -s gdb-cert /usr/local/bin/gdb

When I re-run debugging in Eclipse I get same error as above "(please check gdb is codesigned - see taskgated(8))".

If I set back the gdb to the older gdb (in the gdb preferences of Eclipse) /usr/libexec/gdb/gdb-i386-apple-darwin the debugging runs as expected.

Any solutions / hints out there ?

Thx

Pelle

Solution 1

This error occurs because OSX implements a pid access policy which requires a digital signature for binaries to access other processes pids. To enable gdb access to other processes, we must first code sign the binary. This signature depends on a particular certificate, which the user must create and register with the system.

To create a code signing certificate, open the Keychain Access application. Choose menu Keychain Access -> Certificate Assistant -> Create a Certificate…

Choose a name for the certificate (e.g., gdb-cert), set Identity Type to Self Signed Root, set Certificate Type to Code Signing and select the Let me override defaults. Click several times on Continue until you get to the Specify a Location For The Certificate screen, then set Keychain to System.

Double click on the certificate, open Trust section, and set Code Signing to Always Trust. Exit Keychain Access application.

Restart the taskgated service, and sign the binary.

$ sudo killall taskgated
$ codesign -fs gdb-cert "$(which gdb)"

source http://andresabino.com/2015/04/14/codesign-gdb-on-mac-os-x-yosemite-10-10-2/

On macOS 10.12 (Sierra) and later, you must also

Use gdb 7.12.1 or later Additionally prevent gdb from using a shell to start the program to be debugged. You can use the following command for this inside gdb:

set startup-with-shell off

You can also put this last command in a file called .gdbinit in your home directory, in which case it will be applied automatically every time you start gdb

echo "set startup-with-shell off" >> ~/.gdbinit

SOURCE: https://sourceware.org/gdb/wiki/BuildingOnDarwin

Solution 2

I upgraded to gdb 8.3 and was not able to make things working. This helped me:

codesign --entitlements gdb.xml -fs gdb-cert /usr/local/bin/gdb

Where content of gdb.xml is:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
"http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>com.apple.security.cs.allow-jit</key>
    <true/>
    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
    <true/>
    <key>com.apple.security.cs.allow-dyld-environment-variables</key>
    <true/>
    <key>com.apple.security.cs.disable-library-validation</key>
    <true/>
    <key>com.apple.security.cs.disable-executable-page-protection</key>
    <true/>
    <key>com.apple.security.cs.debugger</key>
    <true/>
    <key>com.apple.security.get-task-allow</key>
    <true/>
</dict>
</plist>

I found this solution here: https://timnash.co.uk/getting-gdb-to-semi-reliably-work-on-mojave-macos/

Note: Without the entitlement I was able to run gdb only with sudo.

Solution 3

I made gdb work on OSX 10.9 without codesigning this way (described here):

1. Install gdb with macports. (may be you can skip it)

2. sudo nano /System/Library/LaunchDaemons/com.apple.taskgated.plist

   change option string from -s to -sp at line 22, col 27.

3. Reboot the computer.

4. Use gdb. If you installed it with mac ports then you must use ggdb command. Or made an alias in your config file:

alias gdb='ggdb'

and use 'gdb' command then.

Solution 4

I experienced the same issue with GDB. I am running under Mac OS X 10.8.5 aka Mountain Lion. I am using GDB version 7.7.1.

I compiled my test program with following command:

g++ -o gdb-sample.out -g gdb-sample.cpp    

If I entered the command gdb sample.out, I get the same cryptic error message:

"Unable to find Mach task port for process-id 46234: (os/kern) failure (0x5). (please check gdb is codesigned - see taskgated(8))"

This error message however is a red herring.

The solution I found that worked for me was to simply invoke GDB using the superuser acct:

sudo gdb sample.out. 

That works fine for me.

And that from that point I could run GDB example.out without using sudo.

Hope this helps and works for others. RSVP if it doesn't.

Solution 5

None of this worked for me and I had to go with a long run. Here is a full list of steps I've done to get it working.

1. Create a certificate to sign the gdb.

Unfortunately, system certificate gave me Unknown Error = -2,147,414,007 which is very helpful, so I had to go with a workaround. Keychain Access -> Create certificate ->

Pick login, gdb-cert, Code Signing

Copy/move certificate to the System keychain (enter password)

2. Select certificate (gdb-cert) click Get info -> Trust Always
3. Disable startup-with-shell

Enter in console: set startup-with-shell off

Remember configuration: echo "set startup-with-shell off" >>~/.gdbinit

4. Enable Root User

Go to System Preferences -> Users & Groups -> Unlock it -> Login Options -> Network Account Server -> Join -> Unlock it -> Edit (menu) -> Enable Root User

5. sudo killall taskgated
6. Finally sign gdb

codesign -fs gdb-cert "$(which gdb)"

7. Disable Root User (Step 4)
8. Reboot if still does not work. (if nothing else works, most likely it works already)

PS. I ended up using lldb because it just works (tutorial)

View more solutions

Comments

[Bill DeRose]

I'd been running into this issue for a while and had found other how-tos unhelpful. This worked like a charm.

[klm123]

@BillDeRose, the same for me.

[klm123]

@nimrodm, you mean "sudo gdb"? it should be "ggdb" with macports

[nimrodm]

@klm123, I have installed using Homebrew (brew install raw.github.com/Homebrew/homebrew-dupes/master/gdb.rb). And yes, I meant "sudo gdb", of course.

[Arthur Neves]

Any why to not run this as sudo ?

[Translunar]

Ugh. I don't want to have to run gdb as sudo. That seems like an unneeded security risk.

[Michael]

Not going to restart the computer. There must be a command to restart something!

[user124384]

Sorry for the noob question, but how does one do anything in #4? How does one "use gdb" or the ggdb command? Is this a command-line thing? What if you're using an IDE?

[klm123]

@user124384, it is command line thing. sourceware.org/gdb/current/onlinedocs/gdb/Running.html#Runni‌​ng

[user124384]

So does anyone know if this is possible with an IDE, like NetBeans?

[iProgram]

Not sure why this was down voted. I runed the command as root (with sudo) and it worked.

[pceccon]

Works like a charm. Thank you.

[PVitt]

As the OP pointed out, this didn't do the trick for him (and for me neither).

[Andrew Mackenzie]

If the restart is just to restart taskgated then you can do so by just killing it line in the answer above

[loretoparisi]

It seems it does not work on macOS Sierra with self signed certificates.

[Karthikeyan]

sudo killall taskgated is the key to solve my problem

[jdg]

I followed the steps precisely, and this worked beautifully for me on macOS Sierra.

[RandomEli]

@zplizzi Check out these: gist.github.com/hlissner/898b7dfc0a3b63824a70e15cd0180154 and these: gist.github.com/gravitylow/fb595186ce6068537a6e9da6d8b5b96d for setting users and groups

[RandomEli]

@vaughan Check out these: gist.github.com/hlissner/898b7dfc0a3b63824a70e15cd0180154 and these: gist.github.com/gravitylow/fb595186ce6068537a6e9da6d8b5b96d for setting users and groups

[Dejan Jovanović]

Instead of set startup-with-shell off you can also install the brew version of bash (brew install bash) and set the shell to the new bash. This can be done system wide, but simple export SHELL=$(which bash) suffices before calling gdb. Then gdb will safely debug through brew bash, which can be useful for passing complex arguments to the program being debugged. Turning the shell off, for example, breaks the Eclipse integration with gdb. I also had to downgrade gdb to 8.0.1 since 8.1 seems to be broken.

[rustyMagnet]

did you try this on High Sierra? It did not work for me on O/S: 10.13.6

[Sridhar Sarnobat]

What do you do if you get error: The specified item could not be found in the keychain.

[honey_badger]

Performing all the steps in section 1 of sourceware.org/gdb/wiki/PermissionsDarwin resolved the issue for me on macOS Catalina (Version 10.15.4).

[Panayotis]

@SridharSarnobat Use the pipeline first of this answer stackoverflow.com/a/32727069/339146

[weaming]

Failed after trying @maximser 's answer. Then this works for me. macOS 10.15.4, gdb 9.2 installed via brew.

[Akansha]

@SridharSarnobat: You have to create the certificate first stackoverflow.com/questions/35020236/…

[Kerrick Staley]

This answer is now out-of-date for newer versions of macOS; you have to also create gdb-entitlement.xml and run codesign with --entitlements gdb-entitlement.xml. Could you please update this answer with the message "Additional steps are required on macOS 10.14 and later, see sourceware.org/gdb/wiki/PermissionsDarwin" or copy the additional information about gdb-entitlement.xml from that page into this answer?

[user5735224]

Looks like we need to repeat this command after every new build

[James Robert Albert]

Using this answer in conjunction with Johnny's got it going again

[irritable_phd_syndrome]

+1, this works on 10.15.7. I think you should reference the the link that is provided when you install it via homebrew, sourceware.org/gdb/wiki/PermissionsDarwin. Also maybe at the top mention that this works with 10.15.X and that this is really an addendum to @maximser's answer?

[borgomeister]

If you are using bigSur, do sourceware.org/gdb/wiki/PermissionsDarwin as @KerrickStaley says

[kdy]

I missed the hidden comments and wasted lots of time. @KerrickStaley 's comment should get more upvotes.

[anishtain4]

On Monterey this throws an error codesign: option requires an argument -- s