From 980b6fb8689e202198adef3c44e07eafe26fefca Mon Sep 17 00:00:00 2001 From: dusoleil Date: Mon, 20 Dec 2021 02:54:37 -0500 Subject: Add doc about fixing a ptrace error in debugger. Signed-off-by: dusoleil --- docs/re/ptrace_not_permitted.txt | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) create mode 100644 docs/re/ptrace_not_permitted.txt diff --git a/docs/re/ptrace_not_permitted.txt b/docs/re/ptrace_not_permitted.txt new file mode 100644 index 0000000..07ca568 --- /dev/null +++ b/docs/re/ptrace_not_permitted.txt @@ -0,0 +1,22 @@ +If you are seeing errors from your debugger such as +strace: (PTRACE_ATTACH): operation not permitted +ptrace: operation not permitted +ptrace_attach: operation not permitted +etc. + +This is likely because of a linux kernel hardening setting. +/proc/sys/kernel/yama/ptrace_scope +This setting prevents a process from running ptrace on a non-child process. +Even with this on, a can still ptrace another process if it is a child. +Debuggers like gdb and radare2 use ptrace when you attach via PID. + +You can turn this off +$ sudo su +$ echo 0 > /proc/sys/kernel/yama/ptrace_scope + +Turning this off is global, though. +Instead, set the capabilities of just your debugger to override this setting. + +$ sudo setcap CAP_SYS_PTRACE=+eip /usr/bin/gdb +$ sudo setcap CAP_SYS_PTRACE=+eip /usr/bin/radare2 + -- cgit v1.2.3