dtruss fails on ps on OS X 10.11

Question

I was trying to see which syscall ps uses to get the command line of a process on OS X 10.11 (El Capitan), and ran into the following error:

# dtruss ps -p 43520 -o args

dtrace: failed to execute ps: dtrace cannot control executables signed with restricted entitlements

Googling resulted in the suggestion that making a copy of ps would allow me to bypass this, but that didn't work for me. Why can't I run dtruss on arbitrary binaries anymore, and is there any way for me to restore the old behavior?

Absolutely

Answer 1

The issue has to do with the code signature. If you make a copy and then re-sign it with your own identity (or, presumably, any non-Apple identity), then dtrace will attach to it just fine.

$ mkdir ~/temp
$ cp /bin/ps ~/temp/
$ codesign -f -s `whoami` ~/temp/ps
$ sudo dtruss ~/temp/ps -p 43520 -o args

Scurf

Yes, that makes sense, as the comment in the source code refers to the process being signed with restricted entitlements, so removing the signature would change how that logic is handled. – Contribution

Answer 2

cannot control executables signed with restricted entitlements

Security Integrity Protection ('rootless') is now preventing dtruss from operating here.

You can disable it by booting into Recovery mode, but it looks like dtrace has specifically been blocked regardless of the state of rootless, as can be seen in the source code if you search for "dtrace cannot control".

You can also see from the comments in Pcreate:

    /*
     * <rdar://problem/13969762>:
     * If the process is signed with restricted entitlements, the libdtrace_dyld
     * library will not be injected in the process. In this case we kill the
     * process and report an error.
     */

Contribution

@Glyph, no dtrace has specifically been made to not work on System processes. I've updated the answer. – Contribution