Command line LLDB under root permission - Catalina + Xcode 11

[Prokash Sinha via Darwin-dev]

Hello! ,

Can someone explain, why I’m getting a Killed 9, when I launch an app under root account. Is there a way to disable this timeout or whatever causing KILL signal ?

This is just to test some of the Endpoint Security framework in post Catalina, and it requires root permission.

Thanks,
Prokash
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Darwin-dev mailing list (Darwi...@lists.apple.com)
Help/Unsubscribe/Update your Subscription:
https://lists.apple.com/mailman/options/darwin-dev/darwin-dev-garchive-73044%40googlegroups.com

This email sent to darwin-dev-g...@googlegroups.com

[Max Coplan via Darwin-dev]

Prokash,
Which app are you trying to run, and “how” are you trying to run it as root?

Thanks,
Max

Sent from my iPad

> On Oct 16, 2019, at 3:00 PM, darwin-de...@lists.apple.com wrote:
>
> Send Darwin-dev mailing list submissions to
> darwi...@lists.apple.com
>
> To subscribe or unsubscribe via the World Wide Web, visit
> https://lists.apple.com/mailman/listinfo/darwin-dev
> or, via email, send a message with subject or body 'help' to
> darwin-de...@lists.apple.com
>
> You can reach the person managing the list at
> darwin-d...@lists.apple.com
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of Darwin-dev digest..."
>
>
> Today's Topics:
>
> 1. Command line LLDB under root permission - Catalina + Xcode 11
> (Prokash Sinha)
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Wed, 16 Oct 2019 10:20:38 -0700
> From: Prokash Sinha <pro...@garlic.com>
> To: darwi...@lists.apple.com
> Subject: Command line LLDB under root permission - Catalina + Xcode 11
> Message-ID: <AFCF7700-DAB5-4799...@garlic.com>
> Content-Type: text/plain; charset=utf-8
>
> Hello! ,
>
> Can someone explain, why I?m getting a Killed 9, when I launch an app under root account. Is there a way to disable this timeout or whatever causing KILL signal ?

>
> This is just to test some of the Endpoint Security framework in post Catalina, and it requires root permission.
>
> Thanks,
> Prokash
>

> ------------------------------
>
> Subject: Digest Footer
>
> _______________________________________________
> Darwin-dev mailing list
> Darwi...@lists.apple.com
> https://lists.apple.com/mailman/listinfo/darwin-dev
>
>
> ------------------------------
>
> End of Darwin-dev Digest, Vol 16, Issue 18
> ******************************************

[Prokash Sinha via Darwin-dev]

This is not any App distributed by Apple.

It’s a command line app (with right entitlement ) to execute Endpoint security extension related APIs. These are post Catalina features that coming down the pipe… The App requires root permission to run ( but I can try a normal command line App to see if there is any diff …)

$sudo su
password:: <…..>

# lldb <path of the app>/commandlineapp

(lldb) set some bp
(lldb) run

Once some breakpoint is hit, within 20 to 30 sec. it gets sorta kill -9 kinda signal ( exit code is 9 ).

Usually I see this kind of behavior when kernel debugging over KDP, but on this occasion its pure application debugging on the same machine.

Thanks Max!
Prokash

[comex via Darwin-dev]

On Thu, Oct 17, 2019 at 1:22 PM Prokash Sinha via Darwin-dev
<darwi...@lists.apple.com> wrote:
> Once some breakpoint is hit, within 20 to 30 sec. it gets sorta kill -9 kinda signal ( exit code is 9 ).

The EndpointSecurity driver currently kills client processes if they
take too long to respond to a synchronous message
(ES_EVENT_TYPE_AUTH_*). There is no way to turn this off.

[Prokash Sinha via Darwin-dev]

Thanks much for the information Max !

Really appreciate it !

Personally, IMHO there should be a way to debug this by disabling some flag(s) from lldb. Otherwise we will have to depend on trace messages - which is passive debugging :-)

-Prokash