I have a CentOS 7 system. I need to attach my GDB to an already running application, but get the (apparently usual) "ptrace: Operation not permitted." error. Running GDB as root prevents the error, but I would rather not resort to this.
I have researched the issue and did find multiple answers stating that you simply needed to either modify
/proc/sys/kernel/yama/ptrace_scope with the value
0 or go for a permanent fix regarding the file
Well, apparently everyone assumes you are using YAMA, which seems not to be the case over here. Yet, I have not been able to find what to do in my situation yet.
I have checked, and it seems my system is configured with SELinux, but it is not enabled. My Kernel boot settings include the flag
selinux=0, and the command
grep CONFIG_SECURITY /boot/config-`uname -r`
# CONFIG_SECURITY_DMESG_RESTRICT is not set CONFIG_SECURITY=y CONFIG_SECURITYFS=y CONFIG_SECURITY_NETWORK=y CONFIG_SECURITY_NETWORK_XFRM=y # CONFIG_SECURITY_PATH is not set CONFIG_SECURITY_SECURELEVEL=y CONFIG_SECURITY_SELINUX=y CONFIG_SECURITY_SELINUX_BOOTPARAM=y CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE=1 CONFIG_SECURITY_SELINUX_DISABLE=y CONFIG_SECURITY_SELINUX_DEVELOP=y CONFIG_SECURITY_SELINUX_AVC_STATS=y CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE=1 # CONFIG_SECURITY_SELINUX_POLICYDB_VERSION_MAX is not set # CONFIG_SECURITY_SMACK is not set # CONFIG_SECURITY_TOMOYO is not set # CONFIG_SECURITY_APPARMOR is not set # CONFIG_SECURITY_YAMA is not set
getsebool deny_ptrace returns
getsebool: SELinux is disabled.
From my understanding, no LSM is currently enabled on my system, yet I still get the ptrace limitations. I am here clueless about where to look next, or what even causes the ptrace limitation at this point.
Is the fact that the setuid bit is set on my executable file potentially causing this issue? Both gdb and the application are themselves launched using the same user, without any super-user privileges specifically added to either.
ps -eouid,comm also shows both as having the same uid. Only the application is run using the setuid bit, and the file belongs to root:root.
ps -eouid,commalso shows both as having the same uid. Only the application is run using the setuid bit, and the file belongs to root:root.