[lldb] Improve error message when trying to debug a non-debuggable process

[JDevlieghere]

Summary

On the Swift forums [1][2], people are disabling SIP in order to debug process that are missing the get-task-allow entitlement. Improve the error to give developers a hint at the potential issues.

[1] https://forums.swift.org/t/yo-apple-xcode-debugging-swift-is-still-horribly-broken/62702/26
[2] https://forums.swift.org/t/finding-cycles-with-the-memory-graph-debugger-with-swift-pm-projects/62769/7

rdar://113704200

[jasonmolenda]

I'm fine with this but on macOS I believe it's com.apple.security.get-task-allow v. "Entitlements on macOS"
https://developer.apple.com/documentation/technotes/tn3125-inside-code-signing-provisioning-profiles

[jasonmolenda]

Maybe get-task-allow is allowed (lol) on macOS too.

[jasonmolenda]

Maybe

const char *ent_name = 
#if TARGET_OS_OSX
"com.apple.security.get-task-allow";
#else
"get-task-allow";
#endif

debugserver is running on the target device so compile time checks are fine.

[jingham]

In this function we have the path to the binary. We could spawn codesign -d -entitlements - and then we would know whether it had that entitlement.

Maybe that's more work than you wanted to do here, however.

[jingham]

Not sure if codesign exists on iOS devices, but at least we could do this on macOS.

I thought we'd be able to tell from the Team Identifier whether it was a platform binary, but for /bin/ls & Co I get "not set" for the Team Identifier.

[JDevlieghere]

In D157640#4578198, @jingham wrote:

In this function we have the path to the binary. We could spawn codesign -d -entitlements - and then we would know whether it had that entitlement.

Maybe that's more work than you wanted to do here, however.

Yeah I'm not sure that being able to be more precise is a huge improvement over the current error message. If we still see a lot of people struggling with this we can easily reconsider.

lldb/tools/debugserver/source/DNB.cpp

if (pid != INVALID_NUB_PROCESS) {
         // point and get reparented to someone else and never go away.
         DNBLog("Could not get task port for process, sending SIGKILL and "
                "exiting.");
         kill(SIGKILL, pid);
 
         if (err_str && err_len > 0) {
           if (launch_err.AsString()) {
             ::snprintf(err_str, err_len,
-                       "failed to get the task for process %i (%s)", pid,
+                       "failed to get the task for process %i: %s", pid,
                        launch_err.AsString());
           } else {
             ::snprintf(err_str, err_len,
-                       "failed to get the task for process %i", pid);
+                       "failed to get the task for process %i: this likely "
+                       "means the process cannot be debugged, either because "
+                       "it's a system process or because the process is "
+                       "missing the get-task-allow entitlement.",
+                       pid);
           }
         }
       } else {
         bool res = AddProcessToMap(pid, processSP);
         UNUSED_IF_ASSERT_DISABLED(res);
         assert(res && "Couldn't add process to map!");
         return pid;
       }