> To allow it to process the rm command, I had to make a copy of the executable into a temporary directory and execute that.
To be clear this is due to SIP.
To be clear this is due to SIP.
It's probably System Integrity Protection, right?
It can however be used to leak information or read info out of other processes.
I was going to say that for this reason even on linux you can't ptrace processes that are not children of the current process (e.g. you can run something under strace, but not attach to an existing process unless you twiddle a flag or do it as root). Having said that, you CAN modify data with ptrace, unlike dtrace. So that's kindof an aside. In any case the idea is that one process can't hijack another even from the same user for ptrace.
There are a few “destructive actions” that can be enabled with a DTrace flag and also require appropriate system permissions.
Never the less.