7.5.1 Codesigning the Debugger ¶

The Darwin Kernel, used by Apple’s OS X, requires the debugger to have special permissions before it’s allowed to control other processes. These permissions are granted by codesigning the GDB executable. Without these permissions, the debugger will report error messages such as:

Starting program: /x/y/foo
Unable to find Mach task port for process-id 28885: (os/kern) failure (0x5).
(please check gdb is codesigned - see taskgated(8))

Codesigning requires a certificate. The following procedure explains how to create one:

• Start the Keychain Access application (in /Applications/Utilities/Keychain Access.app)
• Select the Keychain Access -> Certificate Assistant -> Create a Certificate… menu
• Then:
  • Choose a name for the new certificate (this procedure will use “gdb-cert” as an example)
  • Set “Identity Type” to “Self Signed Root”
  • Set “Certificate Type” to “Code Signing”
  • Activate the “Let me override defaults” option
• Click several times on “Continue” until the “Specify a Location For The Certificate” screen appears, then set “Keychain” to “System”
• Click on “Continue” until the certificate is created
• Finally, in the view, double-click on the new certificate, and set “When using this certificate” to “Always Trust”
• Exit the Keychain Access application and restart the computer (this is unfortunately required)

Once you’ve created a certificate as above, you can codesign the debugger by running the following command in a Terminal:

$ codesign -f -s  "gdb-cert"  <gnat_install_prefix>/bin/gdb

with gdb-cert replaced by the actual certificate name chosen above, and gnat_install_prefix replaced by the location where you installed GNAT. Also, be sure that users of GDB are in the Unix group _developer.