PermissionError when attaching to a remote process despite elevated privileges (file permission)

Documentation

Description

According to the documentation of the permission requirements for remote debugging (via sys.remote_exec), the tracer process must have elevated privileges (or CAP_SYS_PTRACE).

But I get a PermissionError in the "remote" process when it tries to open the "debugger script" after I execute the tracer program with sudo on Linux. It works if I also run the app with elevated privileges.

Reproducible example

1. Create a virtual environment with Python 3.14.2 and activate it
2. Create the following script app.py

# app.py
import os
import time


print("PID:", os.getpid())
print("Waiting for interrupt", end="")
while True:
    print(".", end="", flush=True)
    time.sleep(1)

3. Run the script above via python app.py
4. Create the debugger script debug.py

# debug.py
import sys
import textwrap
from tempfile import NamedTemporaryFile

assert len(sys.argv) >= 2, "Pass PID as first argument"

pid = int(sys.argv[1])
script = 'print("Injected!")'

with NamedTemporaryFile(mode="w", suffix=".py", delete=False) as f:
    script_path = f.name
    f.write(script)

print("Injecting...")
sys.remote_exec(pid, script_path)
print("Done :)")

5. Run the debug script (in a new shell) via sudo .venv/bin/python debug.py <pid-from-other-process>

Output of debug.py

Injecting...
Done :)

Output of app.py

PID: 27796
Waiting for interrupt.........Can't open debugger script /tmp/tmpsjqnnjw6.py:
Traceback (most recent call last):
  File "/home/rafael/repos/rafaelwo/python-remote-exec-sudo/app.py", line 9, in <module>
    time.sleep(1)
PermissionError: [Errno 13] Permission denied: '/tmp/tmpsjqnnjw6.py'

Expected output of app.py

PID: 27796
Waiting for interrupt............Injected!
....

---

What confuses me is that sudo .venv/bin/python -m pdb -p works when running the app as non-root. Doesn't pdb also create a temporary file and use sys.remote_exec to let the app run the debug attachment script?

Or is this a documentation issue, i.e. the app-to-be-traced also needs elevated privileges?

CPython versions tested on:

3.14

Operating systems tested on:

Linux

Linked PRs

• gh-143575

Read the remote debugging documentation linked in the issue, then reproduce the behavior with app.py and debug.py on Linux using the stated Python 3.14 setup. Compare the documented permission requirements with sys.remote_exec and the pdb -p behavior; done means the documentation or reported behavior clearly explains whether the traced app also needs elevated privileges.