[macOS] task_for_pid failing with 0x5

[adamsitnik]

I've ported BenchmarkDotNet from ClrMd v1 to v2 hoping that it's going to give us macOS support (dotnet/BenchmarkDotNet#1499).

When I try to attach to the process using DataTarget.AttachToProcess I am getting following error:

task_for_pid failed with status code 0x5

I googled a bit and it seems that I need to sign the app to be able to use this API and also run as root?

Is that true (the first article is from 2010)? Is there no easier way to get it working?

cc @leculver @nxtn @mfilippov

[mfilippov]

@adamsitnik You also need to have entitlement: com.apple.security.get-task-allow

[mfilippov]

Usually dotnet had this entitlements:

codesign -d --entitlements - /usr/local/share/dotnet/dotnet 
Executable=/usr/local/share/dotnet/dotnet
[Dict]
	[Key] com.apple.security.cs.allow-dyld-environment-variables
	[Value]
		[Bool] true
	[Key] com.apple.security.cs.allow-jit
	[Value]
		[Bool] true
	[Key] com.apple.security.cs.debugger
	[Value]
		[Bool] true
	[Key] com.apple.security.cs.disable-library-validation
	[Value]
		[Bool] true
	[Key] com.apple.security.get-task-allow
	[Value]
		[Bool] true

[leculver]

@mikem8361 Knows more about this than I do. Mike, do you know what permissions/entitlements/etc are needed to attach to a process with task_for_pid?

We are at the mercy of whatever Apple requires here. I should probably update the documentation with what we find here. I'm not an OS X expert though.

[mikem8361]

As far as I know, as long as the host (/usr/local/share/dotnet/dotnet) that is running clrmd has the com.apple.security.cs.debugger entitlement and the target app's host (assuming dotnet) has the com.apple.security.get-task-allow then it should work without being supervisor. Try running the clrmd "side" (the code calling task_for_pid) under sudo.

[NinoFloris]

It would be really helpful if we can get macOS supported. @adamsitnik with some pointers I could work on it. It looks like at the moment it's even gated behind ShouldUseClrMdDisassembler not passing for macOS?

[adamsitnik]

It looks like at the moment it's even gated behind ShouldUseClrMdDisassembler not passing for macOS?

That is correct, I wanted to display a nice error to the users.

[nsky99]

I have also encountered the same problem. May I ask if your issue has been resolved? I tried to disable Apple's SIP protection and sudo could be called normally, but it cannot be called normally in SIP enabled mode. task_for_pid returned 5