"please check gdb is codesigned - see taskgated(8)" - How to get gdb installed with homebrew code signed?

Question

I'm under osx 10.8.4 and have installed gdb 7.5.1 with homebrew (motivation get a new gdb with new features such as --with-python etc... )

Long story short when I run debug within a c++ Eclipse project I get :

Error in final launch sequence
Failed to execute MI command:
-exec-run
Error message from debugger back end:
Unable to find Mach task port for process-id 46234: (os/kern) failure (0x5).
 (please check gdb is codesigned - see taskgated(8))
Unable to find Mach task port for process-id 46234: (os/kern) failure (0x5).
 (please check gdb is codesigned - see taskgated(8))

I have followed various suggestions for code signing

https://sourceware.org/gdb/wiki/BuildingOnDarwin
partly http://www.noktec.be/archives/1251 with various adjusts

So I did:

Set up the certificate
Sign the gdb -> codesign -s gdb-cert /usr/local/bin/gdb

When I re-run debugging in Eclipse I get same error as above "(please check gdb is codesigned - see taskgated(8))".

If I set back the gdb to the older gdb (in the gdb preferences of Eclipse) /usr/libexec/gdb/gdb-i386-apple-darwin the debugging runs as expected.

Any solutions / hints out there ?

Thx

Pelle

Is this not a "security feature" - in other words, your system is configured to only accept software that has been officially signed? If so, hopefully there is a way to turn that feature off... — Mats Petersson, Aug 24 '13 at 21:30
ok thanks for your feedback - i understand your security feature point but my problem is then how to do the signing... there is a similar post http://stackoverflow.com/questions/12050257/gdb-fails-on-mountain-lion which didn't solve it for me yet — pellekrogholt, Sep 21 '13 at 09:13
Sorry to revive such an old thread, but I have followed dozens of tutorials with near identical instructions and I am still not getting anywhere with V12.4 (Monterey). Is there any new required steps? — mreff555, Aug 03 '22 at 01:00

score 159 · Answer 1 · edited Nov 07 '17 at 20:21

159

This error occurs because OSX implements a pid access policy which requires a digital signature for binaries to access other processes pids. To enable gdb access to other processes, we must first code sign the binary. This signature depends on a particular certificate, which the user must create and register with the system.

To create a code signing certificate, open the Keychain Access application. Choose menu Keychain Access -> Certificate Assistant -> Create a Certificate…

Choose a name for the certificate (e.g., gdb-cert), set Identity Type to Self Signed Root, set Certificate Type to Code Signing and select the Let me override defaults. Click several times on Continue until you get to the Specify a Location For The Certificate screen, then set Keychain to System.

Double click on the certificate, open Trust section, and set Code Signing to Always Trust. Exit Keychain Access application.

Restart the taskgated service, and sign the binary.

$ sudo killall taskgated
$ codesign -fs gdb-cert "$(which gdb)"

source http://andresabino.com/2015/04/14/codesign-gdb-on-mac-os-x-yosemite-10-10-2/

On macOS 10.12 (Sierra) and later, you must also

Use gdb 7.12.1 or later Additionally prevent gdb from using a shell to start the program to be debugged. You can use the following command for this inside gdb:

set startup-with-shell off

You can also put this last command in a file called .gdbinit in your home directory, in which case it will be applied automatically every time you start gdb

echo "set startup-with-shell off" >> ~/.gdbinit

SOURCE: https://sourceware.org/gdb/wiki/BuildingOnDarwin

edited Nov 07 '17 at 20:21

xfze

765
1
9
24

answered Sep 22 '15 at 21:14

maximser

1,746
1
9
6

6

Works like a charm. Thank you. – pceccon Oct 22 '15 at 15:14
17

As the OP pointed out, this didn't do the trick for him (and for me neither). – PVitt Dec 08 '15 at 11:15
8

It seems it does not work on `macOS Sierra` with self signed certificates. – loretoparisi Jul 30 '17 at 12:34
`sudo killall taskgated` is the key to solve my problem – seenukarthi Aug 07 '17 at 10:05
I followed the steps precisely, and this worked beautifully for me on macOS Sierra. – jdg Aug 31 '17 at 16:45
@zplizzi Check out these: https://gist.github.com/hlissner/898b7dfc0a3b63824a70e15cd0180154 and these: https://gist.github.com/gravitylow/fb595186ce6068537a6e9da6d8b5b96d for setting users and groups – RandomEli Oct 05 '17 at 23:15
@vaughan Check out these: gist.github.com/hlissner/898b7dfc0a3b63824a70e15cd0180154 and these: gist.github.com/gravitylow/fb595186ce6068537a6e9da6d8b5b96d for setting users and groups – RandomEli Oct 05 '17 at 23:15
Instead of `set startup-with-shell off` you can also install the brew version of bash (`brew install bash`) and set the shell to the new bash. This can be done system wide, but simple `export SHELL=$(which bash)` suffices before calling gdb. Then gdb will safely debug through brew bash, which can be useful for passing complex arguments to the program being debugged. Turning the shell off, for example, breaks the Eclipse integration with gdb. I also had to downgrade gdb to 8.0.1 since 8.1 seems to be broken. – Dejan Jovanović Apr 11 '18 at 20:51
5

Performing all the steps in section 1 of https://sourceware.org/gdb/wiki/PermissionsDarwin resolved the issue for me on macOS Catalina (Version 10.15.4). – honey_badger Apr 13 '20 at 11:53
9

This answer is now out-of-date for newer versions of macOS; you have to also create gdb-entitlement.xml and run codesign with --entitlements gdb-entitlement.xml. Could you please update this answer with the message "Additional steps are required on macOS 10.14 and later, see https://sourceware.org/gdb/wiki/PermissionsDarwin" or copy the additional information about gdb-entitlement.xml from that page into this answer? – Kerrick Staley Jul 01 '20 at 17:27
Using this answer in conjunction with Johnny's got it going again – James Robert Albert Jan 29 '21 at 03:03
If you are using bigSur, do https://sourceware.org/gdb/wiki/PermissionsDarwin as @KerrickStaley says – borgomeister Apr 23 '21 at 15:02
I missed the hidden comments and wasted lots of time. @KerrickStaley 's comment should get more upvotes. – kdy Jun 25 '21 at 14:20

score 72 · Answer 2 · answered Aug 07 '19 at 15:42

72

I upgraded to gdb 8.3 and was not able to make things working. This helped me:

codesign --entitlements gdb.xml -fs gdb-cert /usr/local/bin/gdb

Where content of gdb.xml is:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
"http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>com.apple.security.cs.allow-jit</key>
    <true/>
    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
    <true/>
    <key>com.apple.security.cs.allow-dyld-environment-variables</key>
    <true/>
    <key>com.apple.security.cs.disable-library-validation</key>
    <true/>
    <key>com.apple.security.cs.disable-executable-page-protection</key>
    <true/>
    <key>com.apple.security.cs.debugger</key>
    <true/>
    <key>com.apple.security.get-task-allow</key>
    <true/>
</dict>
</plist>

I found this solution here: https://timnash.co.uk/getting-gdb-to-semi-reliably-work-on-mojave-macos/

Note: Without the entitlement I was able to run gdb only with sudo.

answered Aug 07 '19 at 15:42

Johnny Thunderman

906
8
7

7

What do you do if you get `error: The specified item could not be found in the keychain.` – Sridhar Sarnobat Jan 11 '20 at 14:58
1

@SridharSarnobat Use the pipeline first of this answer https://stackoverflow.com/a/32727069/339146 – Panayotis May 03 '20 at 10:30
1

Failed after trying @maximser 's answer. Then this works for me. macOS 10.15.4, gdb 9.2 installed via brew. – weaming Jun 06 '20 at 09:45
@SridharSarnobat: You have to create the certificate first https://stackoverflow.com/questions/35020236/creating-certificate-to-sign-gdb-on-mac-os-x-from-bash – Akansha Jun 20 '20 at 18:27
Looks like we need to repeat this command after every new build – user5735224 Aug 29 '20 at 06:20
+1, this works on 10.15.7. I think you should reference the the link that is provided when you install it via homebrew, https://sourceware.org/gdb/wiki/PermissionsDarwin. Also maybe at the top mention that this works with 10.15.X and that this is really an addendum to @maximser's answer? – irritable_phd_syndrome Mar 30 '21 at 14:58

score 31 · Answer 3 · edited May 20 '16 at 23:08

31

I experienced the same issue with GDB. I am running under Mac OS X 10.8.5 aka Mountain Lion. I am using GDB version 7.7.1.

I compiled my test program with following command:

g++ -o gdb-sample.out -g gdb-sample.cpp

If I entered the command gdb sample.out, I get the same cryptic error message:

"Unable to find Mach task port for process-id 46234: (os/kern) failure (0x5). (please check gdb is codesigned - see taskgated(8))"

This error message however is a red herring.

The solution I found that worked for me was to simply invoke GDB using the superuser acct:

sudo gdb sample.out.

That works fine for me.

And that from that point I could run GDB example.out without using sudo.

Hope this helps and works for others. RSVP if it doesn't.

edited May 20 '16 at 23:08

brokenfoot

11,083
10
59
80

answered Jan 18 '15 at 00:05

mickster99

329
3
2

3

Not sure why this was down voted. I runed the command as root (with sudo) and it worked. – iProgram Sep 03 '15 at 10:41
Same here. I followed all the steps mentioned earlier though. – Albi93 Jul 15 '23 at 21:03

score 29 · Answer 4 · edited Apr 16 '20 at 08:14

29

I made gdb work on OSX 10.9 without codesigning this way (described here):

Install gdb with macports. (may be you can skip it)
sudo nano /System/Library/LaunchDaemons/com.apple.taskgated.plist

change option string from -s to -sp at line 22, col 27.
Reboot the computer.
Use gdb. If you installed it with mac ports then you must use ggdb command. Or made an alias in your config file:

alias gdb='ggdb'

and use 'gdb' command then.

edited Apr 16 '20 at 08:14

Gonzalo Garcia

6,192
2
29
32

answered Nov 18 '13 at 12:55

klm123

12,105
14
57
95

I'd been running into this issue for a while and had found other how-tos unhelpful. This worked like a charm. – Bill DeRose Dec 07 '13 at 23:46
@BillDeRose, the same for me. – klm123 Dec 08 '13 at 04:47
@nimrodm, you mean "sudo gdb"? it should be "ggdb" with macports – klm123 Jan 21 '14 at 21:06
@klm123, I have installed using Homebrew (brew install https://raw.github.com/Homebrew/homebrew-dupes/master/gdb.rb). And yes, I meant "sudo gdb", of course. – nimrodm Jan 21 '14 at 21:14
Any why to not run this as `sudo` ? – Arthur Neves Jan 26 '14 at 16:27
1

Ugh. I don't want to have to run `gdb` as `sudo`. That seems like an unneeded security risk. – Translunar Mar 12 '14 at 17:32
3

Not going to restart the computer. There must be a command to restart something! – Michael Sep 28 '14 at 18:16
Sorry for the noob question, but how does one do anything in #4? How does one "use gdb" or the ggdb command? Is this a command-line thing? What if you're using an IDE? – user124384 Jul 06 '15 at 18:13
@user124384, it is command line thing. http://sourceware.org/gdb/current/onlinedocs/gdb/Running.html#Running – klm123 Jul 06 '15 at 18:53
So does anyone know if this is possible with an IDE, like NetBeans? – user124384 Jul 06 '15 at 18:59
1

If the restart is just to restart taskgated then you can do so by just killing it line in the answer above – Andrew Mackenzie Oct 16 '16 at 14:05
1

@Michael try to restart taskgated service – Et7f3XIV Sep 03 '22 at 14:52
Procmod and procview support (-p) was removed in 10.11. – Et7f3XIV Sep 03 '22 at 16:19

score 9 · Answer 5 · edited May 22 '22 at 11:53

None of this worked for me and I had to go with a long run. Here is a full list of steps I've done to get it working.

Create a certificate to sign the gdb.

Unfortunately, system certificate gave me Unknown Error = -2,147,414,007 which is very helpful, so I had to go with a workaround. Keychain Access -> Create certificate ->

Pick login, gdb-cert, Code Signing

Copy/move certificate to the System keychain (enter password)

Select certificate (gdb-cert) click Get info -> Trust Always
Disable startup-with-shell

Enter in console: set startup-with-shell off

Remember configuration: echo "set startup-with-shell off" >>~/.gdbinit

Enable Root User

Go to System Preferences -> Users & Groups -> Unlock it -> Login Options -> Network Account Server -> Join -> Unlock it -> Edit (menu) -> Enable Root User

sudo killall taskgated
Finally sign gdb

codesign -fs gdb-cert "$(which gdb)"

Disable Root User (Step 4)
Reboot if still does not work. (if nothing else works, most likely it works already)

PS. I ended up using lldb because it just works (tutorial)

Larry Song · Answer 6 · 2017-10-07T02:05:05.247

7

For anyone who using Sierra 10.12.6 (and above) and Homebrew, /usr/local/bin/gdb is a symbolic link to /usr/local/Cellar/gdb/8.0/bin/gdb (or whatever version, e.g. 8.0.1).

You need to codesign both link and target:

codesign -fs gdb-cert /usr/local/bin/gdb
codesign -fs gdb-cert "/usr/local/Cellar/gdb/8.0/bin/gdb"

Or, if you have greadlink (installed via brew install coreutils):

codesign -fs gdb-cert $(which gdb)
codesign -fs gdb-cert $(greadlink -f $(which gdb))

edited Oct 07 '17 at 02:05

answered Aug 31 '17 at 05:12

Larry Song

1,086
9
13

1

did you try this on High Sierra? It did not work for me on O/S: 10.13.6 – rustyMagnet Oct 01 '18 at 16:13

score 5 · Answer 7 · answered Jul 08 '18 at 06:08

5

This may not be related. You can use lldb on macos instead of gdb. You don't need this hassle to install gdb.

lldb(http://lldb.llvm.org) is already installed by default in High Sierra

answered Jul 08 '18 at 06:08

Kaituo Li

347
3
7

score 4 · Answer 8 · edited May 22 '22 at 11:57

This is what worked for me on Big Sur: https://dev.to/jasonelwood/setup-gdb-on-macos-in-2020-489k. The crucial missing step from other guides was the --entitlements gdb-entitlement.xml option for codesigning:

I am copying here the file gdb-entitlement.xml for reference in case the linked site disappears: codesign --entitlements gdb-entitlement.xml -fs

where <gdb-cert> is the name of the certificate and is the path to the gdb executable

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><plist version="1.0"><dict><key>com.apple.security.cs.allow-jit</key><true/><key>com.apple.security.cs.allow-unsigned-executable-memory</key><true/><key>com.apple.security.cs.allow-dyld-environment-variables</key><true/><key>com.apple.security.cs.disable-library-validation</key><true/><key>com.apple.security.cs.disable-executable-page-protection</key><true/><key>com.apple.security.cs.debugger</key><true/><key>com.apple.security.get-task-allow</key><true/></dict></plist>

On Monterey this throws an error `codesign: option requires an argument -- s` — anishtain4, May 19 '22 at 22:57

score 3 · Answer 9 · edited May 23 '17 at 11:54

I wonder if the global change in the highest voted answer here has some unintended consequences.

Rather than enabling the old Tiger convention, taskgated does allow signed code to run. So it might be better to just get a signed cert for gdb, similar to the answer here.

After this I was able to sudo use gdb. If you need to use gdb w/o sudo then perhaps this link will help though, disclaimer, I haven't tried it yet because using sudo is an ok solution for now`.

score 0 · Answer 10 · answered Jul 21 '20 at 21:20

I can recommend to follow this gist: https://gist.github.com/gravitylow/fb595186ce6068537a6e9da6d8b5b96d#file-codesign_gdb-md

With trick to overcome: unknown error = -2,147,414,007 during Certificate Creation described here: https://apple.stackexchange.com/a/309123

Notes:

Path for gdb installed as homebrew package should be something like: /usr/local/Cellar/gdb/9.2/bin/gdb

And csrutil enable --without debug will cause a message about requesting unsupported configuration, like here: https://totalfinder.binaryage.com/system-integrity-protection

Test:

○ → sw_vers -productVersion
10.13.6

○ → gdb ./a.out
GNU gdb (GDB) 9.2
...
Thread 3 hit Breakpoint 1, main () at main.c:14
14          data_t d = {0};

score -1 · Answer 11 · answered Aug 22 '19 at 07:49

-1

gdb 8.3;

My problem is the same as the guy above, solved by

codesign --entitlements gdb.xml -fs gdb-cert /usr/local/bin/gdb

answered Aug 22 '19 at 07:49

C.J

1
1

"please check gdb is codesigned - see taskgated(8)" - How to get gdb installed with homebrew code signed?

11 Answers11

Linked