dtruss在OS X 10.11的ps上失败 [英] dtruss fails on ps on OS X 10.11

问题描述

我试图查看哪个系统调用ps用于获取OS X 10.11(El Capitan)上进程的命令行，并遇到以下错误:

I was trying to see which syscall ps uses to get the command line of a process on OS X 10.11 (El Capitan), and ran into the following error:

# dtruss ps -p 43520 -o args

dtrace: failed to execute ps: dtrace cannot control executables signed with restricted entitlements

使用谷歌搜索的建议是，制作ps的副本将使我可以绕过此操作，但这对我不起作用.为什么我不能再在任意二进制文件上运行dtruss了，我有什么办法可以恢复旧的行为?

Googling resulted in the suggestion that making a copy of ps would allow me to bypass this, but that didn't work for me. Why can't I run dtruss on arbitrary binaries anymore, and is there any way for me to restore the old behavior?

推荐答案

问题与代码签名有关.如果您制作副本，然后使用您自己的身份(或者可能是任何非Apple身份)重新签名，则dtrace会附在上面.

The issue has to do with the code signature. If you make a copy and then re-sign it with your own identity (or, presumably, any non-Apple identity), then dtrace will attach to it just fine.

$ mkdir ~/temp
$ cp /bin/ps ~/temp/
$ codesign -f -s `whoami` ~/temp/ps
$ sudo dtruss ~/temp/ps -p 43520 -o args

这篇关于dtruss在OS X 10.11的ps上失败的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！