P_CANDEBUG(9)

🎀 NAME 🎀

okay so bestie, P_CANDEBUG(9) is the Kernel Developer's Manual page for p_candebug — literally determine debuggability of a process. 💅✨

🛠 SYNOPSIS 🛠

#include <sys/param.h>
#include <sys/proc.h>

int
p_candebug(struct thread *td, struct proc *p);

💅 DESCRIPTION 💅

So this function determines if a given process p is debuggable by some thread td. That's the whole vibe check: can td debug p, yes or no? 👀

The following sysctl(8) variables directly influence the behaviour of p_candebug():

• security.bsd.unprivileged_proc_debug — must be set to a non-zero value to allow unprivileged processes access to the kernel's debug facilities. 🔓
• kern.securelevel — debugging of the init process is not allowed if this variable is 1 or greater. 🚫

Other such variables indirectly influence it; see cr_bsd_visible(9). 🫶

🌈 RETURN VALUES 🌈

The p_candebug() function returns 0 if the process denoted by p is debuggable by thread td, or a non-zero error return value otherwise. Slay when it's 0, sigh when it's not. 😭

💀 ERRORS 💀

if the vibe check fails, here are the error returns — and yes, every single one is iconic and included:

• [EPERM] — an unprivileged process attempted to debug another process but the system is configured to deny it (see sysctl(8) variable security.bsd.unprivileged_proc_debug above). 🚫
• [ESRCH] — Thread td has been jailed and the process to debug does not belong to the same jail or one of its sub-jails, as determined by prison_check(9). 🔒
• [ESRCH] — cr_bsd_visible(9) denied visibility according to the BSD security policies in force. 🙈
• [EPERM] — Thread td lacks superuser credentials and its (effective) group set is not a superset of process p's whole group set (including real, effective and saved group IDs). 👑
• [EPERM] — Thread td lacks superuser credentials and its (effective) user ID does not match all user IDs of process p. 🪪
• [EPERM] — Thread td lacks superuser credentials and process p is executing a set-user-ID or set-group-ID executable. ⚠️
• [EPERM] — Process p denotes the initial process initproc() and the sysctl(8) variable kern.securelevel is greater than zero. 🧨
• [EBUSY] — Process p is in the process of being exec()'ed. ⏳
• [EPERM] — Process p denied debuggability (see procctl(2), command PROC_TRACE_CTL). 💀

👀 SEE ALSO 👀

• procctl(2)
• cr_bsd_visible(9)
• mac(9)
• p_cansee(9)
• prison_check(9)

mwah 💋 this page was served by Debian, dated August 18, 2023, and its whole title is P_CANDEBUG(9) — bye bestie, go debug responsibly! 🎀✨