dtruss fails on ps on OS X 10.11

Question

I was trying to see which syscall ps uses to get the command line of a process on OS X 10.11 (El Capitan), and ran into the following error:

# dtruss ps -p 43520 -o args

dtrace: failed to execute ps: dtrace cannot control executables signed with restricted entitlements

Googling resulted in the suggestion that making a copy of ps would allow me to bypass this, but that didn't work for me. Why can't I run dtruss on arbitrary binaries anymore, and is there any way for me to restore the old behavior?

Answer 1

cannot control executables signed with restricted entitlements

Security Integrity Protection ('rootless') is now preventing dtruss from operating here.

You can disable it by booting into Recovery mode, but it looks like dtrace has specifically been blocked regardless of the state of rootless, as can be seen in the source code if you search for "dtrace cannot control".

You can also see from the comments in Pcreate:

    /*
     * <rdar://problem/13969762>:
     * If the process is signed with restricted entitlements, the libdtrace_dyld
     * library will not be injected in the process. In this case we kill the
     * process and report an error.
     */

Answer 2

The issue has to do with the code signature. If you make a copy and then re-sign it with your own identity (or, presumably, any non-Apple identity), then dtrace will attach to it just fine.

$ mkdir ~/temp
$ cp /bin/ps ~/temp/
$ codesign -f -s `whoami` ~/temp/ps
$ sudo dtruss ~/temp/ps -p 43520 -o args