PTRACE_ATTACH not permitted for

Question

For some reason i am not able to attach to my very own processes?! Works fine if i try strace as root.

$ ./list8 &
[1] 3141
$ child4 starts...

$ strace -p 3141
attach: ptrace(PTRACE_ATTACH, ...): Operation not permitted
Could not attach to process.  If your uid matches the uid of the target
process, check the setting of /proc/sys/kernel/yama/ptrace_scope, or try
again as the root user.  For more details, see /etc/sysctl.d/10-ptrace.conf
$ cat /proc/sys/kernel/yama/ptrace_scope
1

Running on lubuntu 13.10

Linux goal 3.8.0-19-generic #29-Ubuntu SMP Wed Apr 17 18:19:42 UTC 2013 i686 i686 i686 GNU/Linux

So then how does gdb attach to user's own processes without having to muck around with kernel settings (ptrace_scope)??

http://askubuntu.com/questions/41629/after-upgrade-gdb-wont-attach-to-process — Ciro Santilli OurBigBook.com, Jul 23 '15 at 08:47

score 6 · Accepted Answer · answered Aug 21 '13 at 23:02

6

Looks like you answered your own question -- you have ptrace_scope set to 1, so you can only trace direct children. To allow tracing any process belonging to the same user, set it to 0. This is also required to use the gdb attach command.

READ the /etc/sysctl.d/10-ptrace.conf file as your error message suggested...

answered Aug 21 '13 at 23:02

Chris Dodd

119,907
13
134
226

you're right, gdb doesn't work by default either in this new lubuntu! how does one create a direct child from C? execl() doesn't seem to work - getting error on PTRACE_ATTACH – user2705045 Aug 21 '13 at 23:24
@user2705045: `fork` creates a child. With ptrace_scope set to 1, you can only attach to children you forked directly (not grandchildren or siblings) – Chris Dodd Aug 22 '13 at 18:04

score 6 · Answer 2 · answered Mar 17 '16 at 05:41

6

If strace fails as root, try checking whether... gdb or strace is not running in the background (that was my case).

Command: ps aux | grep "gdb\|strace"

answered Mar 17 '16 at 05:41

Lukasz Czerwinski

13,499
10
55
65

score 2 · Answer 3 · answered Nov 06 '13 at 14:29

2

If this fails as root, I had a problem stracing enlightenment (e17) and the reason was that you can't strace a process already being straced or run under gdb, which some programs will do so that they can get their own debugging info.

answered Nov 06 '13 at 14:29

Marc Merlin

566
4
6

PTRACE_ATTACH not permitted for

3 Answers3