gdb cannot attach to process

Question

Here is the OS I am using:

Linux securecluster 4.9.8-moby #1 SMP Wed Feb 8 09:56:43 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux

When trying to attach gdb to hanging process as root user, I got the following:

Attaching to process 9636
Could not attach to process.  If your uid matches the uid of the target
process, check the setting of /proc/sys/kernel/yama/ptrace_scope, or try
again as the root user.  For more details, see /etc/sysctl.d/10-ptrace.conf
ptrace: Operation not permitted.

I modified /etc/sysctl.d/10-ptrace.conf ,resulting in:

kernel.yama.ptrace_scope = 0

However, I got the same error. I tried changing /proc/sys/kernel/yama/ptrace_scope :

echo 0 | tee /proc/sys/kernel/yama/ptrace_scope
tee: /proc/sys/kernel/yama/ptrace_scope: Read-only file system

Hint is appreciated.

In case you are in a docker container, try to re-enter it with docker exec --privileged -ti <container> bash and gdb should just work! See unix.stackexchange.com/a/328861/480898 — it-alien
– it-alien, Commented Aug 21, 2023 at 5:07

Employed Russian · Accepted Answer · 2017-07-18 15:49:36Z

22

I modified /etc/sysctl.d/10-ptrace.conf

This will only take effect on next reboot.

Until then, just do sudo sysctl -w kernel.yama.ptrace_scope=0

answered Jul 18, 2017 at 15:49

Employed Russian

217k36 gold badges324 silver badges396 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Ted Over a year ago

I tried that command: sysctl -w kernel.yama.ptrace_scope=0 sysctl: setting key "kernel.yama.ptrace_scope": Read-only file system

escapecharacter Over a year ago

@Ted did you find a solution to the Read-only file system issue?

Florian Weimer · Accepted Answer · 2021-12-17 09:51:22Z

15

Are you using a container engine? Try attaching to the process from the outside of the container (on the host); it may have a different PID there.

Alternatively, launch the container with the CAP_SYS_PTRACE capability (using --cap-add=SYS_PTRACE, for example). Of course, if you cannot reproduce the hang, then you cannot use this approach.

edited Dec 17, 2021 at 9:51

answered Jul 18, 2017 at 15:51

Florian Weimer

34.1k4 gold badges59 silver badges103 bronze badges

5 Comments

Ted Over a year ago

The environment is in docker. I couldn't find the process outside docker.

Florian Weimer Over a year ago

The process might have a different PID on the outside. Come to think of it, it may also help yo lift the YAMA ptrace restriction on the host (if it is enabled at all).

Ted Over a year ago

I use Docker on MacBook. Should the --cap-add flag be added in Dockerfile ?

Florian Weimer Over a year ago

No, it's an argument to docker run.

yyFred Over a year ago

It's actually --cap-add=SYS_PTRACE.

naftulee · Accepted Answer · 2021-06-09 08:09:18Z

0

@Ted @escapecharacter The kernel parameters you are referring to are taken from the host system that is why it is read-only, you cannot edit the actual config file from inside the container. you can override it in the container, just drop the -w flag to #sudo sysctl kernel.yama.ptrace_scope=0 . A permanent solution is to do this on the host node and all containers would inherit this by default.

answered Jun 9, 2021 at 8:09

naftulee

11 bronze badge

Collectives™ on Stack Overflow

gdb cannot attach to process

3 Answers 3

2 Comments

5 Comments

Comments

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

2 Comments

5 Comments

Comments

Linked

Related