C++ “请检查 gdb 是否已进行代码签名 - 请参阅 taskgated(8)” - 如何使用签名的自制代码安装 gdb？

"please check gdb is codesigned - see taskgated(8)" - How to get gdb installed with homebrew code signed?

提问by pellekrogholt

I'm under osx 10.8.4 and have installed gdb 7.5.1 with homebrew (motivation get a new gdb with new features such as --with-python etc... )

我在 osx 10.8.4 下安装了带有自制软件的 gdb 7.5.1（动机是获得一个具有新功能的新 gdb，例如 --with-python 等...）

Long story short when I run debug within a c++ Eclipse project I get :

长话短说，当我在 c++ Eclipse 项目中运行调试时，我得到：

Error in final launch sequence
Failed to execute MI command:
-exec-run
Error message from debugger back end:
Unable to find Mach task port for process-id 46234: (os/kern) failure (0x5).
 (please check gdb is codesigned - see taskgated(8))
Unable to find Mach task port for process-id 46234: (os/kern) failure (0x5).
 (please check gdb is codesigned - see taskgated(8))

I have followed various suggestions for code signing

我遵循了代码签名的各种建议

• https://sourceware.org/gdb/wiki/BuildingOnDarwin
• partly http://www.noktec.be/archives/1251with various adjusts

• https://sourceware.org/gdb/wiki/BuildingOnDarwin
• 部分http://www.noktec.be/archives/1251有各种调整

So I did:

所以我做了：

1. Set up the certificate
2. Sign the gdb -> codesign -s gdb-cert /usr/local/bin/gdb

1. 设置证书
2. 签署 gdb -> codesign -s gdb-cert /usr/local/bin/gdb

When I re-run debugging in Eclipse I get same error as above "(please check gdb is codesigned - see taskgated(8))".

当我在 Eclipse 中重新运行调试时，我得到与上面相同的错误“（请检查 gdb 是否是协同设计的 - 请参阅 taskgated(8)）”。

If I set back the gdb to the older gdb (in the gdb preferences of Eclipse) /usr/libexec/gdb/gdb-i386-apple-darwin the debugging runs as expected.

如果我将 gdb 设置回旧的 gdb（在 Eclipse 的 gdb 首选项中）/usr/libexec/gdb/gdb-i386-apple-darwin，调试会按预期运行。

Any solutions / hints out there ?

有什么解决方案/提示吗？

Thx

谢谢

Pelle

佩莱

回答by maximser

This error occurs because OSX implements a pid access policy which requires a digital signature for binaries to access other processes pids. To enable gdb access to other processes, we must first code sign the binary. This signature depends on a particular certificate, which the user must create and register with the system.

发生此错误是因为 OSX 实现了 pid 访问策略，该策略需要二进制文件的数字签名才能访问其他进程的 pid。要使 gdb 能够访问其他进程，我们必须首先对二进制文件进行代码签名。此签名取决于用户必须创建并在系统中注册的特定证书。

To create a code signing certificate, open the Keychain Access application. Choose menu Keychain Access -> Certificate Assistant -> Create a Certificate…

要创建代码签名证书，请打开 Keychain Access 应用程序。选择菜单 Keychain Access -> Certificate Assistant -> Create a Certificate...

Choose a name for the certificate (e.g., gdb-cert), set Identity Type to Self Signed Root, set Certificate Type to Code Signing and select the Let me override defaults. Click several times on Continue until you get to the Specify a Location For The Certificate screen, then set Keychain to System.

为证书选择一个名称（例如，gdb-cert），将身份类型设置为自签名根，将证书类型设置为代码签名并选择让我覆盖默认值。单击“继续”多次，直到进入“为证书指定位置”屏幕，然后将“钥匙串”设置为“系统”。

Double click on the certificate, open Trust section, and set Code Signing to Always Trust. Exit Keychain Access application.

双击证书，打开信任部分，并将代码签名设置为始终信任。退出钥匙串访问应用程序。

Restart the taskgated service, and sign the binary.

重新启动 taskgated 服务，并对二进制文件进行签名。

$ sudo killall taskgated
$ codesign -fs gdb-cert "$(which gdb)"

source http://andresabino.com/2015/04/14/codesign-gdb-on-mac-os-x-yosemite-10-10-2/

来源http://andresabino.com/2015/04/14/codesign-gdb-on-mac-os-x-yosemite-10-10-2/

On macOS 10.12 (Sierra) and later, you must also

在 macOS 10.12 (Sierra) 及更高版本上，您还必须

Use gdb 7.12.1 or later Additionally prevent gdb from using a shell to start the program to be debugged. You can use the following command for this inside gdb:

使用 gdb 7.12.1 或更高版本另外防止 gdb 使用 shell 来启动要调试的程序。您可以在 gdb 中使用以下命令：

set startup-with-shell off

You can also put this last command in a file called .gdbinit in your home directory, in which case it will be applied automatically every time you start gdb

您还可以将最后一条命令放在主目录中名为 .gdbinit 的文件中，这样每次启动 gdb 时它都会自动应用

echo "set startup-with-shell off" >> ~/.gdbinit

SOURCE: https://sourceware.org/gdb/wiki/BuildingOnDarwin

来源：https: //sourceware.org/gdb/wiki/BuildingOnDarwin

回答by klm123

I made gdb work on OSX 10.9 without codesigning this way (described here):

我让 gdb 在 OSX 10.9 上工作，而没有以这种方式进行协同设计（此处描述）：

1. Install gdb with macports. (may be you can skip it)

2. sudo nano /System/Library/LaunchDaemons/com.apple.taskgated.plist

   change option string from -sto -spat line 22, col 27.

3. Reboot the computer.

4. Use gdb. If you installed it with mac ports then you must use ggdbcommand. Or made an alias in your config file:

1. 使用 macports 安装 gdb。（也许你可以跳过它）

2. sudo nano /System/Library/LaunchDaemons/com.apple.taskgated.plist

   将选项字符串从第 22 行第 27 列更改-s为-sp。

3. 重新启动计算机。

4. 使用 gdb。如果您使用 mac 端口安装它，那么您必须使用ggdb命令。或者在你的配置文件中创建一个别名：

alias gdb='ggdb'

alias gdb='ggdb'

and use 'gdb' command then.

然后使用'gdb'命令。

回答by mickster99

I experienced the same issue with GDB. I am running under Mac OS X 10.8.5aka Mountain Lion. I am using GDB version 7.7.1.

我在 GDB 上遇到了同样的问题。我在Mac OS X 10.8.5又名山狮下奔跑。我正在使用 GDB 版本7.7.1。

I compiled my test program with following command:

我使用以下命令编译了我的测试程序：

g++ -o gdb-sample.out -g gdb-sample.cpp    

If I entered the command gdb sample.out, I get the same cryptic error message:

如果我输入命令gdb sample.out，我会收到相同的神秘错误消息：

"Unable to find Mach task port for process-id 46234: (os/kern) failure (0x5). (please check gdb is codesigned - see taskgated(8))"

This error message however is a red herring.

然而，此错误消息是一个红鲱鱼。

The solution I found that worked for me was to simply invoke GDB using the superuser acct:

我发现对我有用的解决方案是使用超级用户 acct 简单地调用 GDB：

sudo gdb sample.out. 

That works fine for me.

这对我来说很好用。

And that from that point I could run GDB example.out without using sudo.

从那时起，我可以在不使用 sudo 的情况下运行 GDB example.out。

Hope this helps and works for others. RSVP if it doesn't.

希望这对其他人有帮助并适用。如果没有，请回复。

回答by Johnny Thunderman

I upgraded to gdb 8.3and was not able to make things working. This helped me:

我升级到gdb 8.3并且无法使事情正常工作。这帮助了我：

codesign --entitlements gdb.xml -fs gdb-cert /usr/local/bin/gdb

Where content of gdb.xmlis:

其中的内容gdb.xml是：

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
"http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>com.apple.security.cs.allow-jit</key>
    <true/>
    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
    <true/>
    <key>com.apple.security.cs.allow-dyld-environment-variables</key>
    <true/>
    <key>com.apple.security.cs.disable-library-validation</key>
    <true/>
    <key>com.apple.security.cs.disable-executable-page-protection</key>
    <true/>
    <key>com.apple.security.cs.debugger</key>
    <true/>
    <key>com.apple.security.get-task-allow</key>
    <true/>
</dict>
</plist>

I found this solution here: https://timnash.co.uk/getting-gdb-to-semi-reliably-work-on-mojave-macos/

我在这里找到了这个解决方案：https: //timnash.co.uk/getting-gdb-to-semi-reliably-work-on-mojave-macos/

Note: Without the entitlement I was able to run gdbonly with sudo.

注意：如果没有权利，我gdb只能使用sudo.

回答by Taras Matsyk

None of this worked for me and I had to go with a long run. Here is a full list of steps I've done to get it working.

这些都不适合我，我不得不长期坚持下去。这是我为使其正常工作所做的步骤的完整列表。

1. Create a certificate to sign the gdb.

1. 创建一个证书来签署 gdb。

Unfortunately, system certificate gave me Unknown Error = -2,147,414,007which is very helpful, so I had to go with a workaround. KeyChain Assistant -> Create certificate ->

不幸的是，系统证书给了我Unknown Error = -2,147,414,007很大帮助，所以我不得不采取一种解决方法。 KeyChain Assistant -> Create certificate ->

Pick login, gdb-cert, Code Signing

选取login, gdb-cert,Code Signing

Copy/move certificate to the System keychain (enter password)

将证书复制/移动到系统钥匙串（输入密码）

1. Select certificate (gdb-cert) click Get info-> Trust Always
2. Disable startup-with-shell

2. 选择证书 ( gdb-cert) 单击Get info->Trust Always
3. 禁用 startup-with-shell

Enter in console: set startup-with-shell off

在控制台输入： set startup-with-shell off

Remember configuration: echo "set startup-with-shell off" >> ~/. gdbinit

记住配置： echo "set startup-with-shell off" >> ~/. gdbinit

1. Enable Root User

4. 启用根用户

Go to System Preferences-> Users & Groups-> Unlock it-> Login Options-> Network Account Server-> Join-> Unlock it-> Edit(menu) -> Enable Root User

去System Preferences-> Users & Groups-> Unlock it-> Login Options-> Network Account Server-> Join-> Unlock it-> Edit(菜单) ->Enable Root User

1. sudo killall taskgated
2. Finally sign gdb

5. sudo killall taskgated
6. 最后签署gdb

codesign -fs gdb-cert "$(which gdb)"

codesign -fs gdb-cert "$(which gdb)"

1. Disable Root User (Step 4)
2. Reboot if still does not work. (if nothing else works, most likely it works already)

7. 禁用根用户（步骤 4）
8. 如果仍然不起作用，请重新启动。（如果没有其他工作，很可能它已经工作了）

PS. I end up using lldbbecause it just works (tutorial)

附注。我最终使用，lldb因为它只是有效（教程）

回答by Larry Song

For anyone who using Sierra 10.12.6 (and above) and Homebrew, /usr/local/bin/gdbis a symbolic link to /usr/local/Cellar/gdb/8.0/bin/gdb(or whatever version, e.g. 8.0.1).

对于使用 Sierra 10.12.6（及更高版本）和 Homebrew 的任何人来说，/usr/local/bin/gdb是一个符号链接/usr/local/Cellar/gdb/8.0/bin/gdb（或任何版本，例如8.0.1）。

You need to codesign both link and target:

您需要对链接和目标进行协同设计：

codesign -fs gdb-cert /usr/local/bin/gdb
codesign -fs gdb-cert "/usr/local/Cellar/gdb/8.0/bin/gdb"

Or, if you have greadlink(installed via brew install coreutils):

或者，如果您有greadlink（通过 安装brew install coreutils）：

codesign -fs gdb-cert $(which gdb)
codesign -fs gdb-cert $(greadlink -f $(which gdb))

回答by JnBrymn

I wonder if the global change in the highest voted answer herehas some unintended consequences.

我想知道这里最高投票答案的全球变化是否会产生一些意想不到的后果。

Rather than enabling the old Tiger convention, taskgated does allow signed code to run. So it might be better to just get a signed cert for gdb, similar to the answer here.

与启用旧的 Tiger 约定不同，taskgated 确实允许运行签名代码。因此，最好为 gdb 获取签名证书，类似于此处的答案。

After this I was able to sudouse gdb. If you need to use gdb w/o sudo then perhaps this link will helpthough, disclaimer, I haven't tried it yet because using sudois an ok solution for now`.

在此之后，我能够sudo使用gdb。如果您需要使用 gdb w/o sudo 那么也许这个链接会有所帮助，免责声明，我还没有尝试过，因为现在使用sudo是一个不错的解决方案。

回答by Kaituo Li

This may not be related. You can use lldb on macos instead of gdb. You don't need this hassle to install gdb.

这可能没有关系。您可以在 macos 上使用 lldb 而不是 gdb。你不需要这个麻烦来安装 gdb。

lldb(http://lldb.llvm.org) is already installed by default in High Sierra

lldb( http://lldb.llvm.org) 已经默认安装在 High Sierra 中

回答by C.J

gdb 8.3;

gdb 8.3;

My problem is the same as the guy above, solved by

我的问题和上面那个人一样，解决了

codesign --entitlements gdb.xml -fs gdb-cert /usr/local/bin/gdb