gdb fails with "Unable to find Mach task port for process-id" error

Question

My app runs fine but gdb fails to debug it with the following error

(gdb) run
Starting program: /path/to/app 
Unable to find Mach task port for process-id 83767: (os/kern) failure (0x5).

I am on OS X Lion. GDB version is

$ gdb --version
GNU gdb 6.3.50-20050815 (Apple version gdb-1752) (Sat Jan 28 03:02:46 UTC 2012)
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "x86_64-apple-darwin".

Answer 1

These instructions work for OSX High Sierra and avoid running gdb as root (yuck!). I recently updated from OSX 10.13.2 to 10.3.3. I think this is when gdb 8.0.1 (installed w/ homebrew) started failing for me.

I had difficulty with other people's instructions. After different instructions, everything was a mess. So I started a fresh. I more or less followed these instructions.

Clean the mess :

1. brew uninstall --force gdb # This deletes _all_ versions of gdb on the machine
2. In Applications -> Utilities -> Keychain Access, I deleted all previous gdb certificates and keys (be sure you know what you're doing here!). It's unclear if this is necessary, but since I'd buggered up trying to create those certificates and keys using other instructions I eliminated them anyways. I had keys and certificates in both login and system.

Now reinstall gdb.

3. brew install gdb
4. Within Keychain Access, go to menu Keychain Access-> Certificate Assistant -> Create a Certificate
5. Check "Let me override defaults" and set

Name : gdb-cert
Identity Type: Self Signed Root
Certificate Type : Code Signing

[X] Let me override defaults

6. On 1st Certificate Information page:

Serial Number : 1
Validity Period (days): 3650

7. On 2nd Certificate Information page, I left all fields blank except those already filled in.

8. On Key Pair Information page, I left the defaults

Key Size : 2048
Algorithm : RSA

9. On Key Usage Extension page, I left the defaults checked.

[X] Include Key Usage Extension
[X] This extension is critical
Capabilities:
[X] Signature

10. On Extended Key Usage Extension page, I left the defaults checked.

[X] Include Extended Key Usage Extension
[X] This extension is critical
Capabilities:
[X] Code Signing

11. On Basic Constraints Extension Page, nothing was checked (default).

12. On Subject Alternate Name Extension page, I left the default checked and didn't add anything else.

[X] Include Subject Alternate Name Extension

13. On Specify a Location for the certificate page, I set

Keychain: System

14. I clicked Create and was prompted for my password.

15. Back in the Keychain Access app, I went to System and right clicked on gdb-cert and under dropdown menu Trust, I changed all the fields to Always Trust.

16. Rebooted computer.

17. (EDIT Sept 2023 on OSX 13.4.1). Following these instructions. Create an entitlements.xml file

    local: Downloads $ cat entitlements.xml

    com.apple.security.cs.debugger

18. (EDIT Sept 2023) At the Terminal, I ran codesign --entitlements entitlements.xml -fs gdb-cert $(which gdb). I entered my password when prompted.

19. (EDIT Sept 2023) Check that it is signed

    local: Downloads $ codesign -vv $(which gdb) /usr/local/bin/gdb: valid on disk /usr/local/bin/gdb: satisfies its Designated Requirement local: Downloads $ codesign -d --entitlements - $(which gdb) Executable=/usr/local/Cellar/gdb/13.2/bin/gdb [Dict] [Key] com.apple.security.cs.debugger [Value] [Bool] true

20. At the Terminal, I ran echo "set startup-with-shell off" >> ~/.gdbinit

21. I ran gdb myprogram and then start within the gdb console. Here, I believe, it prompted for me for my password. After that, all subsequent runs, it did not prompt for my password.

Answer 2

The problem is that you are not logged in as a root user (which you don't want). You need to create a certificate for gdb to be allowed access. Follow this tutorial and you should be good to go...

http://sourceware.org/gdb/wiki/BuildingOnDarwin

If all else fails, just use: sudo gdb executableFileName

Answer 3

Here is a really useful guide which solved my problem(OSX 10.13.6).

1. Open Keychain Access
2. In the menu, open Keychain Access > Certificate Assistant > Create a certificate
3. Give it a name (e.g. gdbc)
   • Identity type: Self Signed Root
   • Certificate type: Code Signing
   • Check: let me override defaults
4. Continue until it prompts you for: "specify a location for..."
5. Set Keychain location to System
6. Create a certificate and close assistant.
7. Find the certificate in System keychains, right click it > get info (or just double click it)
8. Expand Trust, set Code signing to always trust
9. Restart taskgated in terminal: killall taskgated
10. Run codesign -fs gdbc /usr/local/bin/gdb in terminal: this asks for the root password

Answer 4

Following the instructions here Codesign gdb on macOS seemed to resolve this issue, for me, on macOS High Sierra (10.13.3).

Answer 5

This is a weird approach but it worked for me(MacOs HighSierra 10.13.3). Install CLion. It comes with gdb. Once run the gdb using Terminal. Copy the gdb program to your usr/local/bin/. No problem of signin, sudo etc.

Answer 6

On MacOSX lldb needs to be code signed. The Debug and Release builds are set to code sign using a code signing certificate named lldb_codesign.

If you don't have one yet you will need to:
- Launch /Applications/Utilities/Keychain Access.app

- In Keychain Access select the "login" keychain in the "Keychains"
  list in the upper left hand corner of the window.

- Select the following menu item:

    Keychain Access->Certificate Assistant->Create a Certificate...

- Set the following settings

    Name = lldb_codesign
    Identity Type = Self Signed Root
    Certificate Type = Code Signing

- Click Continue
- Click Continue
- Click Done
- Click on the "My Certificates"
- Double click on your new lldb_codesign certificate
- Turn down the "Trust" disclosure triangle

    Change:
        When using this certificate: Always Trust

- Enter your login password to confirm and make it trusted

The next steps are necessary on SnowLeopard, but are probably because of a bug
how Keychain Access makes certificates.

- Option-drag the new lldb_codesign certificate from the login keychain to
  the System keychain in the Keychains pane of the main Keychain Access window
  to make a copy of this certificate in the System keychain.  You'll have to
  authorize a few more times, set it to be "Always trusted" when asked.
- Switch to the System keychain, and drag the copy of lldb_codesign you just
  made there onto the desktop.
- Switch to Terminal, and run the following:

sudo security add-trust -d -r trustRoot -p basic -p codeSign -k /Library/Keychains/System.keychain ~/Desktop/lldb_codesign.cer

- Right click on the "lldb_codesign" certificate in the "System" keychain (NOT
  "login", but the one in "System"), and select "Delete" to delete it from
  the "System" keychain.
- Reboot
- Clean and rebuild lldb and you should be able to debug.

That should do it.

[Note: - lldb is used in mac as gdb.]

Answer 7

I needed this command to make it work on El Capitan:

sudo security add-trust -d -r trustRoot -p basic -p codeSign -k /Library/Keychains/System.keychain ~/Desktop/gdb-cert.cer

Answer 8

You need to create a certificate and sign gdb:

• Open application “Keychain Access” (/Applications/Utilities/Keychain Access.app)
• Open menu /Keychain Access/Certificate Assistant/Create a Certificate...
• Choose a name (gdb-cert in the example), set “Identity Type” to “Self Signed Root”, set “Certificate Type” to “Code Signing” and select the “Let me override defaults”. Click “Continue”. You might want to extend the predefined 365 days period to 3650 days.
• Click several times on “Continue” until you get to the “Specify a Location For The Certificate” screen, then set “Keychain to System”.
• If you can't store the certificate in the “System” keychain, create it in the “login” keychain, then export it. You can then import it into the “System” keychain.
• In keychains select “System”, and you should find your new certificate. Use the context menu for the certificate, select “Get Info”, open the “Trust” item, and set “Code Signing” to “Always Trust”.
• You must quit “Keychain Access” application in order to use the certificate and restart “taskgated” service by killing the current running “taskgated” process. Alternatively you can restart your computer.

• Finally you can sign gdb:

  sudo codesign -s gdb-cert /usr/local/bin/ggdb

  sudo ggdb ./myprog

Answer 9

I followed this tutorial, and everything is OK.

Answer 10

This link had the clearest and most detailed step-by-step to make this error disappear for me.

In my case I had to have the key as a "System" key otherwise it did not work (which not every url mentions).

Also killing taskgated is a viable (and quicker) alternative to having to restart.

I also uninstalled MacPorts before I started this process and uninstalled the current gdb using brew uninstall gdb.

Answer 11

It works when I change to sudo gdb executableFileName! :)

Answer 12

In Snow Leopard and later Mac OS versions, it isn't enough to codesign the gdb executable.

You have to follow this guide to make it work: http://www.opensource.apple.com/source/lldb/lldb-69/docs/code-signing.txt

The guide explains how to do it for lldb, but the process is exactly the same for gdb.