Nightly Toolchain has broken LLDB support on macOS

Development LLDB
1

It seems that the official toolchains on swift.org don't have the proper entitlements to debug processes.

This breaks the REPL as well:

lldb ls
(lldb) target create "ls"
Current executable set to 'ls' (x86_64).
(lldb) r
error: process exited with status -1 (attach failed (Not allowed to attach to process.  Look in the console messages (Console.app), near the debugserver entries, when the attach failed.  The subsystem that denied the attach permission will likely have logged an informative message about why it was denied.))
(lldb) q

------------

Apple Swift version 5.6-dev (LLVM 7aef0efea99e2c6, Swift e4f71c8e118fc09)
Target: x86_64-apple-macosx11.0

Welcome to Swift!

Subcommands:

  swift build      Build Swift packages
  swift package    Create and work on packages
  swift run        Run a program from a package
  swift test       Run package tests
  swift repl       Experiment with Swift code interactively (default)

  Use `swift --help` for descriptions of available options and flags.

  Use `swift help <subcommand>` for more information about a subcommand.

error: failed to launch REPL process: process exited with status -1 (attach failed (Not allowed to attach to process.  Look in the console messages (Console.app), near the debugserver entries, when the attach failed.  The subsystem that denied the attach permission will likely have logged an informative message about why it was denied.))

EDIT

Console:

macOSTaskPolicy: (com.apple.debugserver) may not get the task control port of (repl_swift) (pid: 86426):
(repl_swift) is hardened, (repl_swift) doesn't have get-task-allow, (com.apple.debugserver) is a declared debugger
(com.apple.debugserver) is not a declared read-only debugger
2 
# codesign --display --entitlements :- /Library/Developer/Toolchains/swift-DEVELOPMENT-SNAPSHOT-2021-10-27-a.xctoolchain/System/Library/PrivateFrameworks/LLDB.framework/Versions/A/Resources/repl_swift
Executable=/Library/Developer/Toolchains/swift-DEVELOPMENT-SNAPSHOT-2021-10-27-a.xctoolchain/System/Library/PrivateFrameworks/LLDB.framework/Versions/A/Resources/repl_swift
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>com.apple.security.cs.allow-jit</key>
	<true/>
        <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
        <true/>
        <key>com.apple.security.cs.disable-library-validation</key>
        <true/>
</dict>
</plist>

# codesign --display --entitlements :- /Library/Developer/CommandLineTools/Library/PrivateFrameworks/LLDB.framework/Versions/A/Resources/repl_swift
Executable=/Library/Developer/CommandLineTools/Library/PrivateFrameworks/LLDB.framework/Versions/A/Resources/repl_swift
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>com.apple.security.get-task-allow</key>
    <true/>
</dict>
</plist>
3

Solution in case anyone is interested:

  1. Install the nightly toolchain
  2. create a entitlements.xml with
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>com.apple.security.cs.allow-jit</key>
	<true/>
        <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
        <true/>
        <key>com.apple.security.cs.disable-library-validation</key>
        <true/>
    <key>com.apple.security.get-task-allow</key>
    <true/>
</dict>
</plist>
  1. cp /Library/Developer/Toolchains/swift-DEVELOPMENT-SNAPSHOT-2021-10-27-a.xctoolchain/System/Library/PrivateFrameworks/LLDB.framework/Versions/A/Resources/repl_swift .
  2. Create a code sign certificate following Install Gdb Mac: Setup gdb on macOS in 2020 - DEV Community 👩‍💻👨‍💻
  3. codesign --entitlements entitlements.xml -fs <cert name> repl_swift
  4. sudo cp repl_swift /Library/Developer/Toolchains/swift-DEVELOPMENT-SNAPSHOT-2021-10-27-a.xctoolchain/System/Library/PrivateFrameworks/LLDB.framework/Versions/A/Resources/repl_swift

Now the REPL should work.

2 Likes
4

Hope someone in Apple could fix this soon.

5

@Joe_Groff @compnerd Could you help me relay this to the packaging team?

6

It's 2022 and this issue still persists...

7

It is frustrating that important issues take so long to get resolved!

8

Agree, I got many problems when building the swift toolchain, and ask questions on this forum, but no one can help me to solve these problems, disappointing.

9

Still happens, but I was able to fix it without creating a new code-signing certificate. If you sign with the identity name "-", it uses ad-hoc signing, which apparently is sufficient:

codesign --entitlements entitlements.xml -fs - repl_swift

It's still weird that you need to sign this part of the nightly toolchains yourself.