debug: abiltiy to debug with root privileges

[dzvancuks]

Add ability to debug with Delve with sudo flag. Similar as it it done for Python:
https://code.visualstudio.com/docs/python/debugging#_sudo

It is needed to debug modules that require root access, i.e. gopacket/pcap to capture traffic.

[hyangah]

I didn't look into how python is addressing the issue. Based on the description,
#124 can be a prerequisite.

/cc @polinasok @quoctruong

[dacut]

This is a duplicate/continuation of microsoft/vscode-go#2889 -- the fix there was to:

Create a script named (e.g.) $HOME/.local/bin/dlv-sudo.sh:

#!/bin/bash
if ! which dlv ; then
	PATH="${GOPATH}/bin:$PATH"
fi
if [ "$DEBUG_AS_ROOT" = "true" ]; then
	exec sudo dlv "$@"
else
	exec dlv "$@"
fi

Make it executable: chmod a+x $HOME/.local/bin/dlv-sudo.sh

Create a user/workspace/folder setting (> Preferences: Open Workspace Settings (JSON)) that points at this as an alternative to dlv:

{
    "go.alternateTools": {
        "dlv": "${env:HOME}/.local/bin/dlv-sudo.sh"
    }
}

And create a launch.json (> Debug: Open launch.json) that sets the DEBUG_AS_ROOT environment variable:

{
    "version": "0.2.0",
    "configurations": [
        {
            "name": "Run as root",
            "type": "go",
            "request": "launch",
            "mode": "auto",
            "program": "${workspaceFolder}",
            "env": {
                "DEBUG_AS_ROOT": "true"
            }
        }
    ]
}

[dzvancuks]

@dacut yes, I found this tutorial but this part was impossible to implement as in latest/greatest go plugin there was no "dlv" property in "go.alternateTools":

{
    "go.alternateTools": {
        "dlv": "${env:HOME}/.local/bin/dlv-sudo.sh"
    }
}

I even mentioned this in SO, but no replies on it: https://stackoverflow.com/questions/63505746/how-can-i-debug-go-file-in-vs-code-with-root-privileges.

In any case this feature request is about adding 'sudo' flag naively, without extra workaround. Goland IDE has it, why VSC can't do the same? :)

[hyangah]

@dzvancuks you can use the above configuration @dacut mentioned - v0.16.2 fixed the misleading error message.
But, an easier way to enable sudo is still a nice feature to have.

[dacut]

@dzvancuks -- That's strange; I definitely have a "dlv" property, and it was suggested by IntelliCode as well. Check your plugin version? I'm running 0.16.2.

But, yes, having this natively is definitely wanted. (I was just mentioning a workaround.)

[polinasok]

@hyangah Why is "console" a prerequisite for this? Just like in the workaround, isn't it just a matter of adding "sudo" to the dlv command we launch if the configuration has a flag for that?

[hyangah]

@polinasok See the sudoers file modification described here microsoft/vscode-go#2889 (comment). That is not ideal and running sudo dlv from the terminal would allow users to enter the password.

[sethRait]

This method seems to be broken again. Using the script above (adding the -E flag to sudo and the --only-same-user=false flag to dlv as necessary does indeed get dlv to launch as sudo, but using this method, it won't hit any breakpoints for some reason, even though the logs indicate the breakpoints have been added.
This bug has been marked as fixed through several iterations over 2 years. It would be nice to see an actual fix that addresses the problem without workarounds.

[MaurGi]

Any solution for this? the suggestion above does not seem to work on WSL2, even if I change the settings.json on the remote.

[precisionpete]

I have been fighting with this for a week now. Can someone please give the current solution? Feb 2021. Go 1.6...

[hyangah]

#1424 (comment) describes a current, temporary workaround.
I propose we add the temporary hack to dlv-dap integration now, which requires edit to the sudoer file.

Once "console" property or RunInTerminal feature is ready so we can run sudo with terminal, we can remove the hack to fix this issue.

[ip2k]

This does not work for me on Ubuntu 20.10 // VSCode 1.56.2 // Go v0.25.0 extension, and the workaround is a bit ridiculous to expect those less familiar with systems to grok. This has been suggested already, but why is adding a sudo config attribute like how Python ( https://code.visualstudio.com/docs/python/debugging#_sudo ) works off the table? That seems like a much more user-friendly option.

[linlih]

Setting by this method, it couldn't found go executable

[linlih]

Setting dlv-dap， but got a timeout error

[dzvancuks]

Recently re-installed Ubuntu 20.04 and VSC with latest plugins. Tried #558 (comment) one more time.

go.alternateTools is now available and I was able to call script. However DLV won't launch the application. Tried with and without DEBUG_AS_ROOT flag.

I hope there will be a solution for configurations as workaround is not working.

[mayocream]

Related issues (closed):

• debug the golang project use root privilege microsoft/vscode-go#2889
• Enable Easier Debugging of Code Requiring Root microsoft/vscode-go#2610

[gnode1]

The issue here is combination of sudo and --log-dest=3. The latter sends logs to file descriptor 3, but sudo doesn't forward it, so extension never sees the output .

I made it work by making dlv-dap owned by root and SUID bit set:

sudo chown root.root <path>/dlv-dap
sudo chmod +s <path>/dlv-dap

Also undo

        "go.alternateTools": {
                "dlv-dap": "${workspaceFolder}/.vscode/dlv-sudo.sh"

in settings.json.

The drawback is that now dlv-dap runs as root in all cases.

[gopherbot]

Change https://golang.org/cl/361100 mentions this issue: src/goDebugFactory: add support for asRoot property

[marcozaccari]

Updated workaround for dlv-dap fixing the --log-dest=3 issue.

workspaceFolder/.vscode/settings.json

{
    "go.alternateTools": {
        "dlv-dap": "${workspaceFolder}/.vscode/dlv-override.sh"
    }
}

workspaceFolder/.vscode/dlv-override.sh
(remember to chmod +x .vscode/dlv-override.sh)

#!/bin/sh

DLV=$(which dlv-dap)

if [ -x "${DLV}" ] ; then
	PATH="/usr/local/go/bin/:$PATH"
fi

if [ "$DEBUG_AS_ROOT" = "true" ]; then
	echo Run as Root
	# The parameter -C 4 keeps the descriptor 3 opened
	exec sudo -C 4 "$DLV" --only-same-user=false "$@"
else
	echo Run as User
	exec "$DLV" "$@"
fi

workspaceFolder/.vscode/launch.json

{
    "version": "0.2.0",
    "configurations": [
        {
            "name": "Debug as root",
            "type": "go",
            "request": "launch",
            "mode": "auto",
            "program": "${workspaceFolder}",
            "args": [],

            "debugAdapter": "dlv-dap",
            "env": {
                "DEBUG_AS_ROOT": "true"
            }
        },
    ]
}

/etc/sudoers.d/users
(remember to change myuser)

myuser ALL=(ALL) NOPASSWD: /home/myuser/go/bin/dlv-dap
# Permission to use sudo with the -C parameter 
Defaults:myuser closefrom_override

[gopherbot]

Change https://golang.org/cl/374134 mentions this issue: package.json: add description of 'console' and 'asRoot'

[zhylmzr]

I found that dap remote debugging can be used.

Open the command line and use root privileges to open the dap server:

sudo dlv-dap dap -l='127.0.0.1:2345' --only-same-user=false

If it says that go is not in the PATH, it may be because the installation path of go is in /usr/local/go/, use the following command to create a link:

ln -s /usr/local/go/bin/go /usr/bin/go

Configure in launch.json:

{
    "version": "0.2.0",
    "configurations": [
        {
            "name": "Launch Package",
            "type": "go",
            "request": "launch",
            "mode": "debug", // builds and launches, or use `exec` to executes precompiled binary
            "host": "127.0.0.1",
            "port": 2345,
            "program": "${workspaceFolder}/main.go"
        }
    ]
}

Add a breakpoint in main.go, then F5 can start debugging.

[hyangah]

asRoot property is currently available in the nightly version. (golang.go-nightly)
sudo must be present in PATH, and console property must be set to integratedTerminal or externalTerminal because sudo will need users to enter password. Feedback is welcome.

[precisionpete]

I finally got it working. I used the nightly build of the plugin but also some specific configuration of the environment before it worked for me.

I think we have all been suffering not because of the plugin, but by the number of different ways we set up our development environments. Once solved, it makes perfect sense... Computers only do what they're told.

I think we all owe it to each other to write better documentation. A little documentation goes a very long way...

See my solution here: #1834

[thediveo]

Seems that we don't need the dlv wrapper anymore ... as of VSCode version 1.65.0 I noticed a new experimental launch option "asRoot": "true" 🙌 that needs to be combined with "console": "integratedTerminal".

For instance, in your launch.json:

{
    "version": "0.2.0",
    "configurations": [
        {
	    "name": "Test/dbg pkg as root",
	    "type": "go",
	    "request": "launch",
	    "mode": "test",
	    "program": "${fileDirname}",
            "console": "integratedTerminal",
            "asRoot": true,
	},
    ]
}

When launching this configuration by pressing F5, a new debug terminal session opens (or might get reused) and the following command executed:

/usr/bin/env GOPATH=/home/foobar/go /usr/bin/sudo /home/foobar/go/bin/dlv dap --check-go-version=false --client-addr=:41945

This now automatically inserts the sudo command before dlv itself, so this needs to be launched into an internal or external interactive terminal (and thus does not work in the internal console). After authenticating to sudo, VSCode switches back to the debug console view and you are good to go.

This now avoids having to fiddle around with remapping the dlv command in your workspace to a wrapper shell script.

[colecrouter]

@thediveo thanks for finding this!

However, when I try, I get this: exec: "go": executable file not found in $PATH. Did you run into this issue? I've made sure go is accessible from root.

[thediveo]

No, luckily not. And this is even using Go as a snap package on Ubuntu. Is you go binary accessible from the ordinary root?

[colecrouter]

It is. However, I don't think sudo runs .bashrc or anything of the sort. I've been Googling for a solution with no luck so far, open to suggestions 😮‍💨

EDIT: I've added the Go install path to the sudoers file Defaults secure_path="... :/usr/local/go/bin". Kind of dirty, but seems to work for me.

[thediveo]

No, that's in my understanding not dirty at all ... I was about to suggest to check secure_path= as I checked it on my Ubuntu installation, where it contains the bin dir for the binaries provided by installed snaps. As long as you do trust your local go bin and that cannot be modified by arbitrary users, that should be proper procedure.

[hyangah]

The actual work is done. The only remaining part is documentation.

[gopherbot]

Change https://go.dev/cl/406295 mentions this issue: docs/debugging.md: instruction for console and debugging as root

[hyangah]

Please find instructions in https://github.com/golang/vscode-go/wiki/debugging#debugging-a-program-as-root

[thediveo]

Would it be possible to also document "test as root"? In my scenarious I barely ever debug programs, but instead debug code under test. I'm still unsure if this is the same configuration or if there are specific things to watch out for?

[precisionpete]

Is there an equivalent technique to debug with elevated privileges on Windows? I have been running vscode itself as Administrator to do that. But it would be good to run just dlv with elevated privileges.

How are others debugging elevated stuff on Windows?

[precisionpete]

It is. However, I don't think sudo runs .bashrc or anything of the sort. I've been Googling for a solution with no luck so far, open to suggestions face_exhaling

EDIT: I've added the Go install path to the sudoers file Defaults secure_path="... :/usr/local/go/bin". Kind of dirty, but seems to work for me.

You need to modify /etc/sudoers and add a secure path. For me, I add another file /etc/sudoers.d/golang. This should go in the docs too.

sudo cat /etc/sudoers.d/golang 
Defaults	secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin:/root/bin:/usr/local/go/bin:/home/username/go/bin/"
username ALL=(root)NOPASSWD:/home/username/go/bin/dlv
username ALL=(root)NOPASSWD:/home/username/go/bin/dlv-dap

[hyangah]

#558 (comment) @precisionpete I don't know much about windows. runas command from random google search seems promising. How about testing it and if it works, modify this section (https://github.com/golang/vscode-go/blob/master/src/goDebugFactory.ts#L424-L430)?