PermissionError when attaching to a remote process despite elevated privileges (file permission)

Documentation

Description

According to the documentation of the permission requirements for remote debugging (via sys.remote_exec), the tracer process must have elevated privileges (or CAP_SYS_PTRACE).

But I get a PermissionError in the "remote" process when it tries to open the "debugger script" after I execute the tracer program with sudo on Linux. It works if I also run the app with elevated privileges.

Reproducible example

1. Create a virtual environment with Python 3.14.2 and activate it
2. Create the following script app.py

# app.py
import os
import time


print("PID:", os.getpid())
print("Waiting for interrupt", end="")
while True:
    print(".", end="", flush=True)
    time.sleep(1)

3. Run the script above via python app.py
4. Create the debugger script debug.py

# debug.py
import sys
import textwrap
from tempfile import NamedTemporaryFile

assert len(sys.argv) >= 2, "Pass PID as first argument"

pid = int(sys.argv[1])
script = 'print("Injected!")'

with NamedTemporaryFile(mode="w", suffix=".py", delete=False) as f:
    script_path = f.name
    f.write(script)

print("Injecting...")
sys.remote_exec(pid, script_path)
print("Done :)")

5. Run the debug script (in a new shell) via sudo .venv/bin/python debug.py <pid-from-other-process>

Output of debug.py

Injecting...
Done :)

Output of app.py

PID: 27796
Waiting for interrupt.........Can't open debugger script /tmp/tmpsjqnnjw6.py:
Traceback (most recent call last):
  File "/home/rafael/repos/rafaelwo/python-remote-exec-sudo/app.py", line 9, in <module>
    time.sleep(1)
PermissionError: [Errno 13] Permission denied: '/tmp/tmpsjqnnjw6.py'

Expected output of app.py

PID: 27796
Waiting for interrupt............Injected!
....

---

What confuses me is that sudo .venv/bin/python -m pdb -p works when running the app as non-root. Doesn't pdb also create a temporary file and use sys.remote_exec to let the app run the debug attachment script?

Or is this a documentation issue, i.e. the app-to-be-traced also needs elevated privileges?

CPython versions tested on:

3.14

Operating systems tested on:

Linux

Linked PRs

• gh-143575

閱讀 issue 中連結的遠端偵錯文件，然後在 Linux 上使用所述的 Python 3.14 設定，透過 app.py 和 debug.py 重現該行為。將文件中說明的權限需求與 sys.remote_exec 和 pdb -p 的行為進行比較；完成的標準是文件或回報的行為能清楚說明被追蹤的應用程式是否也需要提升的權限。