“请检查gdb是协同设计的-见task封闭(8)”-如何让gdb安装与homebrew代码签名?

I'm under osx 10.8.4 and have installed gdb 7.5.1 with homebrew (motivation get a new gdb with new features such as --with-python etc... )

我在osx 10.8.4下安装了带有homebrew的gdb 7.5.1(动机获得了带有新特性的gdb，比如——带有python等等)

Long story short when I run debug within a c++ Eclipse project I get :

长话短说，当我在c++ Eclipse项目中运行调试时，我得到:

Error in final launch sequence
Failed to execute MI command:
-exec-run
Error message from debugger back end:
Unable to find Mach task port for process-id 46234: (os/kern) failure (0x5).
 (please check gdb is codesigned - see taskgated(8))
Unable to find Mach task port for process-id 46234: (os/kern) failure (0x5).
 (please check gdb is codesigned - see taskgated(8))

I have followed various suggestions for code signing

我遵循了各种代码签名的建议

https://sourceware.org/gdb/wiki/BuildingOnDarwin
https://sourceware.org/gdb/wiki/BuildingOnDarwin
partly http://www.noktec.be/archives/1251 with various adjusts
部分http://www.nok.tecbe/archives/1251与各种调整

So I did:

所以我做了:

Set up the certificate
设置证书
Sign the gdb -> codesign -s gdb-cert /usr/local/bin/gdb
签下gdb- > codesign -s gdb-cert /usr/local/bin/gdb。

When I re-run debugging in Eclipse I get same error as above "(please check gdb is codesigned - see taskgated(8))".

当我在Eclipse中重新运行调试时，我得到了与上面相同的错误“(请检查gdb是协同设计的-参见task封闭(8))”。

If I set back the gdb to the older gdb (in the gdb preferences of Eclipse) /usr/libexec/gdb/gdb-i386-apple-darwin the debugging runs as expected.

如果我将gdb设置为旧的gdb(在Eclipse的gdb首选项中)/usr/libexec/gdb/gdb-i386-apple-darwin，调试将按预期运行。

Any solutions / hints out there ?

有什么解决办法/建议吗?

Thx

谢谢

Pelle

佩尔

6 个解决方案

#1

This error occurs because OSX implements a pid access policy which requires a digital signature for binaries to access other processes pids. To enable gdb access to other processes, we must first code sign the binary. This signature depends on a particular certificate, which the user must create and register with the system.

出现此错误是因为OSX实现了pid访问策略，该策略要求二进制文件的数字签名来访问其他进程pid。要使gdb能够访问其他进程，我们必须首先对二进制代码签名。此签名取决于特定的证书，用户必须创建该证书并向系统注册。

To create a code signing certificate, open the Keychain Access application. Choose menu Keychain Access -> Certificate Assistant -> Create a Certificate…

要创建代码签名证书，请打开Keychain访问应用程序。选择菜单Keychain Access ->证书助理->创建证书…

Choose a name for the certificate (e.g., gdb-cert), set Identity Type to Self Signed Root, set Certificate Type to Code Signing and select the Let me override defaults. Click several times on Continue until you get to the Specify a Location For The Certificate screen, then set Keychain to System.

为证书选择一个名称(例如，gdb-cert)，将标识类型设置为自签名根，将证书类型设置为代码签名，并选择“让我覆盖默认值”。在Continue上单击几次，直到指定证书屏幕的位置，然后将Keychain设置为System。

Double click on the certificate, open Trust section, and set Code Signing to Always Trust. Exit Keychain Access application.

双击证书、打开信任部分，并将代码签名设置为“始终信任”。退出密钥链访问应用程序。

Restart the taskgated service, and sign the binary.

重新启动任务门控服务，并对二进制进行签名。

$ sudo killall taskgated
$ codesign -fs gdb-cert "$(which gdb)"

source http://andresabino.com/2015/04/14/codesign-gdb-on-mac-os-x-yosemite-10-10-2/

源http://andresabino.com/2015/04/14/codesign-gdb-on-mac-os-x-yosemite-10-10-2/

On macOS 10.12 (Sierra) and later, you must also

在macOS 10.12 (Sierra)和以后，你也必须这样做

Use gdb 7.12.1 or later Additionally prevent gdb from using a shell to start the program to be debugged. You can use the following command for this inside gdb:

使用gdb 7.12.1或更高版本，可以防止gdb使用shell启动被调试的程序。您可以在gdb内部使用以下命令:

set startup-with-shell off

You can also put this last command in a file called .gdbinit in your home directory, in which case it will be applied automatically every time you start gdb

您还可以将这最后一个命令放在您的主目录中名为.gdbinit的文件中，在这种情况下，每次启动gdb时都将自动应用它。

echo "set startup-with-shell off" >> ~/.gdbinit

SOURCE: https://sourceware.org/gdb/wiki/BuildingOnDarwin

来源:https://sourceware.org/gdb/wiki/BuildingOnDarwin

#2

I made gdb work on OSX 10.9 without codesigning this way (described here):

我在osx10.9上做了gdb的工作，没有这样设计(此处描述):

Install gdb with macports. (may be you can skip it)

使用macports安装gdb。(也许你可以跳过)
sudo nano /System/Library/LaunchDaemons/com.apple.taskgated.plist

sudo纳米/系统/图书馆/ LaunchDaemons / com.apple.taskgated.plist

change option string from -s to -sp at line 22, col 27.

在第22行，第27节，将选项字符串从-s改为-sp。
reboot the computer.

重新启动计算机。
Use gdb. If you installed it with mac ports then you must use 'ggdb' command. Or made an alias in your config file:

使用gdb。如果你安装了mac端口，那么你必须使用“ggdb”命令。或者在配置文件中使用别名:

alias gdb='ggdb'

别名gdb = ' ggdb '

and use 'gdb' command then.

然后使用“gdb”命令。

#3

I experienced the same issue with GDB. I am running under Mac OS X 10.8.5 aka Mountain Lion. I am using GDB version 7.7.1.

GDB也遇到了同样的问题。我在Mac OS X 10.8.5下跑步。我正在使用GDB版本7.7.1。

I compiled my test program with following command:

我用以下命令编译了我的测试程序:

g++ -o gdb-sample.out -g gdb-sample.cpp

If I entered the command gdb sample.out, I get the same cryptic error message:

如果我输入命令gdb示例。我得到了同样的神秘错误信息:

"Unable to find Mach task port for process-id 46234: (os/kern) failure (0x5). (please check gdb is codesigned - see taskgated(8))"

This error message however is a red herring.

然而，这个错误信息是一个转移注意力的问题。

The solution I found that worked for me was to simply invoke GDB using the superuser acct:

我发现对我有效的解决方案是使用超级用户acct调用GDB:

sudo gdb sample.out.

That works fine for me.

对我来说没问题。

And that from that point I could run GDB example.out without using sudo.

这样我就可以运行GDB的例子了。不使用sudo。

Hope this helps and works for others. RSVP if it doesn't.

希望这能对他人有所帮助。回复如果它不。

#4

I wonder if the global change in the highest voted answer here has some unintended consequences.

我想知道，全球最高的投票结果是否会产生一些意想不到的后果。

Rather than enabling the old Tiger convention, taskgated does allow signed code to run. So it might be better to just get a signed cert for gdb, similar to the answer here.

task封闭并没有启用旧的Tiger约定，而是允许运行签名代码。因此，最好是为gdb获得一个签名的证书，类似于这里的答案。

After this I was able to sudo use gdb. If you need to use gdb w/o sudo then perhaps this link will help though, disclaimer, I haven't tried it yet because using sudo is an ok solution for now`.

在这之后，我就可以使用gdb了。如果您需要使用gdb w/o sudo，那么这个链接可能会有所帮助，免责声明，我还没有尝试过，因为使用sudo目前是一个不错的解决方案。

#5

For anyone who using Sierra 10.12.6 (and above) and Homebrew, /usr/local/bin/gdb is a symbolic link to /usr/local/Cellar/gdb/8.0/bin/gdb (or whatever version, e.g. 8.0.1).

对于任何使用Sierra 10.12.6(及以上版本)和Homebrew的用户来说，/usr/local/bin/gdb是/usr/local/Cellar/gdb/8.0/bin/gdb(或其他版本，如8.0.1)的符号链接。

You need to codesign both link and target:

你需要同时设计链接和目标:

codesign -fs gdb-cert /usr/local/bin/gdb
codesign -fs gdb-cert "/usr/local/Cellar/gdb/8.0/bin/gdb"

Or, if you have greadlink (installed via brew install coreutils):

或者，如果您有greadlink(通过brew install coreutils安装):

codesign -fs gdb-cert $(which gdb)
codesign -fs gdb-cert $(greadlink -f $(which gdb))

#6

None of this worked for me and I had to go with a long run. Here is a full list of steps I've done to get it working.

所有这些对我都不起作用，我不得不长期坚持下去。这里有一个完整的步骤清单，我已经做了使它工作。

Create a certificate to sign the gdb.
创建一个证书来签名gdb。

Unfortunately, system certificate gave me Unknown Error = -2,147,414,007 which is very helpful, so I had to go with a workaround. KeyChain Assistant -> Create certificate ->

不幸的是，系统证书给了我未知的错误= -2,147,414,007，这很有帮助，所以我不得不进行一个变通。密钥链助理->创建证书->

Pick login, gdb-cert, Code Signing

选择登录、gdb-cert、代码签名

Copy/move certificate to the System keychain (enter password)

复制/移动证书到系统密钥链(输入密码)

Select certificate (gdb-cert) click Get info -> Trust Always
选择证书(gdb-cert)单击Get info ->信任始终
Disable startup-with-shell
禁用startup-with-shell

Enter in console: set startup-with-shell off

输入控制台:设置启动-带shell

Remember configuration: echo "set startup-with-shell off" >> ~/. gdbinit

记得配置:echo "set start -with-shell off" >> ~/。gdbinit

Enable Root User
使根用户

Go to System Preferences -> Users & Groups -> Unlock it -> Login Options -> Network Account Server -> Join -> Unlock it -> Edit (menu) -> Enable Root User

进入系统首选项->用户和组->解锁它->登录选项->网络帐户服务器->连接->解锁它->编辑(菜单)->启用根用户

sudo killall taskgated
sudo killall taskgated
Finally sign gdb
最后gdb迹象

codesign -fs gdb-cert "$(which gdb)"

协同设计-fs gdb-cert“$(哪个gdb)”

Disable Root User (Step 4)
禁用根用户(步骤4)
Reboot if still does not work. (if nothing else works, most likely it works already)
如果仍然不工作，重新启动。(如果其他方法都不管用，很可能已经奏效了)

PS. I end up using lldb because it just works (tutorial)

我最后使用lldb，因为它只是工作(教程)

#1