How do I debug a program run by a different user?

Question

Say I am writing and compiling a program with user alice. The program is then run by user bob on the same machine, but from a location that alice cannot access.

alice@localhost:/home/alice$ g++ helloworld.cpp -o helloworld -g

bob@localhost:/home/bob$ cp ../alice/helloworld .
bob@localhost:/home/bob$ ./helloworld

Now, alice wants to debug what bob is doing. Out of the box, this is not possible:

alice@localhost:/home/alice$ pidof helloworld
1234
alice@localhost:/home/alice$ gdb
[...]
(gdb) attach <pidof helloworld>
Attaching to process 1234
ptrace: Operation not permitted.

What should Alice do?

Answer 1

Remote debugging

Alice and Bob should use remote debugging. Bob starts gdbserver with specifying the port (in this example port 2345) ...

a) to run the program

bob@localhost:/home/bob$ gdbserver :2345 ./helloworld

or

b) to connect to the running process (in this case with the example PID 133245)

bob@localhost:/home/bob$ gdbserver --attach :2345 133245

And Alice connects to it:

alice@localhost:/home/alice$ gdb
[...]
(gdb) file helloworld
Reading symbols from /home/alice/helloworld...done.
(gdb) target remote :2345
Remote debugging using :2345
[...]
0x00007fbdc6329af0 in _start () from /lib64/ld-linux-x86-64.so.2

Remote debugging with absolute paths

This works in this simple case. However, some more sophistication is required when Bob uses absolute paths for his shared libraries:

bob@localhost:/home/bob$ ls
helloworld  libmylib.so
bob@localhost:/home/bob$ LD_LIBRARY_PATH=/home/bob gdbserver :2345 ./helloworld

Now, alice can't find the shared library:

alice@localhost:/home/alice$ gdb
[...]
(gdb) file helloworld
Reading symbols from /home/alice/helloworld...done.
(gdb) target remote :2345
Remote debugging using :2345
[...]
(gdb) break helloWorld() 
Breakpoint 1 at 0x400480
(gdb) c
Continuing.
Error while mapping shared library sections:
/home/bob/libmylib.so: No such file or directory.

To solve this, Alice creates a virtual root folder with links to its on binaries:

alice@localhost:/home/alice$ mkdir -p gdb-symbols/home/
alice@localhost:/home/alice$ ln -s /home/alice gdb-symbols/home/bob
alice@localhost:/home/alice$ ln -s /lib gdb-symbols/lib
alice@localhost:/home/alice$ ln -s /lib64 gdb-symbols/lib64
[and so forth for every shared library that cannot be found...]

And is now able to debug with all symbols loaded:

alice@localhost:/home/alice$ gdb
[...]
(gdb) file helloworld
Reading symbols from /home/alice/helloworld...done.
(gdb) target remote :2345
Remote debugging using :2345
[...]
Reading symbols from /home/alice/gdb-symbols/home/bob/libmylib.so...done.
Loaded symbols from /home/alice/gdb-symbols/home/bob/libmylib.so
(gdb)

As an alternative with reasonable new GDB versions Alice connects with

(gdb) target extended-remote :2345
Remote debugging using :2345

and by default GDB will load all the necessary symbols from the server.

Answer 2

Alice should obtain permissions to debug the process launched by bob. Alice can do this by becoming a SuperUser (sudo gdb) or by running gdb as Bob (sudo -u bob gdb).

Maybe there is a permission flag you can use to allow debugging from other users, but I would not count on it.