DTrace Guide: invalid user access on OSX #97
Description
On OSX, processes that request PT_DENY_ATTACH with the ptrace system call will cause dtrace to log a message about invalid user access when attempting to access that process' memory.
[user@host.com] (master) $ sudo dtruss -n ssh-agent
dtrace: error on enabled probe ID 2708 (ID 224: syscall::accept:return): invalid user access in action #5 at DIF offset 0
The OSX dtrace manual page makes no reference to this, and this behavior and message may lead dtrace beginners, like me, to think that they're incorrectly accessing memory they haven't copied into the dtrace address space yet.
There's also no way that I see to force dtrace on OSX to ignore PT_DENY_ATTACH processes, but that's a separate issue from the documentation itself.
@rmustacc thought that this behavior might be worth documenting in the dtrace guide.