PermissionError when attaching to a remote process despite elevated privileges (file permission)

Documentation

Description

According to the documentation of the permission requirements for remote debugging (via sys.remote_exec), the tracer process must have elevated privileges (or CAP_SYS_PTRACE).

But I get a PermissionError in the "remote" process when it tries to open the "debugger script" after I execute the tracer program with sudo on Linux. It works if I also run the app with elevated privileges.

Reproducible example

1. Create a virtual environment with Python 3.14.2 and activate it
2. Create the following script app.py

# app.py
import os
import time


print("PID:", os.getpid())
print("Waiting for interrupt", end="")
while True:
    print(".", end="", flush=True)
    time.sleep(1)

3. Run the script above via python app.py
4. Create the debugger script debug.py

# debug.py
import sys
import textwrap
from tempfile import NamedTemporaryFile

assert len(sys.argv) >= 2, "Pass PID as first argument"

pid = int(sys.argv[1])
script = 'print("Injected!")'

with NamedTemporaryFile(mode="w", suffix=".py", delete=False) as f:
    script_path = f.name
    f.write(script)

print("Injecting...")
sys.remote_exec(pid, script_path)
print("Done :)")

5. Run the debug script (in a new shell) via sudo .venv/bin/python debug.py <pid-from-other-process>

Output of debug.py

Injecting...
Done :)

Output of app.py

PID: 27796
Waiting for interrupt.........Can't open debugger script /tmp/tmpsjqnnjw6.py:
Traceback (most recent call last):
  File "/home/rafael/repos/rafaelwo/python-remote-exec-sudo/app.py", line 9, in <module>
    time.sleep(1)
PermissionError: [Errno 13] Permission denied: '/tmp/tmpsjqnnjw6.py'

Expected output of app.py

PID: 27796
Waiting for interrupt............Injected!
....

---

What confuses me is that sudo .venv/bin/python -m pdb -p works when running the app as non-root. Doesn't pdb also create a temporary file and use sys.remote_exec to let the app run the debug attachment script?

Or is this a documentation issue, i.e. the app-to-be-traced also needs elevated privileges?

CPython versions tested on:

3.14

Operating systems tested on:

Linux

Linked PRs

• gh-143575

Leia a documentação de depuração remota vinculada na issue e reproduza o comportamento com app.py e debug.py no Linux usando a configuração indicada do Python 3.14. Compare os requisitos de permissão documentados com sys.remote_exec e o comportamento de pdb -p; o trabalho estará concluído quando a documentação ou o comportamento relatado explicar claramente se o aplicativo rastreado também precisa de privilégios elevados.