21

I'm trying to dtruss a process in Mac OSX Catalina, however dtrace is reporting an error.

$ sudo dtruss whoami                 
dtrace: system integrity protection is on, some features will not be available

dtrace: failed to execute whoami: (os/kern) failure

I'm basically trying to get a stack trace. Can anyone provide guidance on accomplishing this?

Thanks

4

2 Answers 2

21

This article explains how to accomplish this: Enabling D-Trace on system with SIP

You can disable SIP entirely by doing the following:

  1. Reboot your mac
  2. Hold ⌘R during reboot
  3. From the Utilities menu, run Terminal
  4. Enter the following command
csrutil disable

Alternatively you can re-enable SIP while still allowing dtrace to work by also running the following:

csrutil enable --without dtrace
7
  • 1
    Yep, this should work. Note that the dtruss that ships with macOS is fairly basic/buggy so you might want to use a patched version, e.g. github.com/microsoft/scalar/tree/… (disclosure: those are my patches)
    – pmdj
    Mar 29, 2020 at 10:21
  • 4
    It's important to prefer the csrutil enable --without dtrace command over a blanket disable. This does the job just as well and doesn't turn off all the security features that may make your system more vulnerable. Jun 30, 2020 at 21:55
  • 2
    Update: I've made a more permanent home for the updated/improved dtruss here: gitlab.com/pmdj/macos-dtrace-scripts - I don't have write access to the original repo anymore, where it was just one small script in an otherwise unrelated project.
    – pmdj
    Jun 1, 2021 at 13:19
  • Not sure if this is specific to Apple silicon or macOS Monterey, but I had to run csrutil enable --without dtrace --without debug in order to get dtrace to work on my M1 Max. According to csrutil status this also disabled kernel integrity protection. Still better than disabling SIP entirely. Nov 10, 2021 at 15:02
  • curious, is there something wrong with using the strace provided by brew? e.g. formulae.brew.sh/formula/strace Jun 13, 2022 at 17:37
4

If you are in apple silicon(like m1 now), you should not press ⌘R to enter recovery mode. The alternative is keep pressing the power button until the screen tells you "loading setting...".

And if you want to trace build-in command like ls, csrutil enable --without dtrace cannot work for me, but csrutil disable works.

5
  • 1
    As mentioned in my comment on the other answer, you can run csrutil enable --without dtrace --without debug to get dtrace working without completely disabling SIP. Nov 10, 2021 at 15:04
  • curious, is there something wrong with using the strace provided by brew? e.g. formulae.brew.sh/formula/strace Jun 13, 2022 at 17:37
  • 3
    @CharlieParker yes, strace works for Linux only, not for macOS
    – Ralph
    Jun 19, 2022 at 11:18
  • is it possible to run dtruss without doing the complicated things suggested in this question/post/answers? Feb 23 at 19:41
  • @CharlieParker I don't think it's possible since security policy of macOS
    – MrZ
    Feb 24 at 4:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.