For solving ptrace_scope issue on Linux, I thought about making DF ptraceable by anyone instead of adding a capability to DT. It allows for making DT works when ptrace_scope is set to 1 without needing root access. The required syscall is available since Linux 3.4. I see two way of implementing that.
1) A DFHack plugin:
#include "PluginManager.h"
extern "C" {
#include <sys/prctl.h>
}
using namespace DFHack;
DFHACK_PLUGIN("set_ptracer")
DFhackCExport command_result plugin_init(color_ostream &out, std::vector<PluginCommand> &)
{
if (-1 == prctl(PR_SET_PTRACER, PR_SET_PTRACER_ANY, 0, 0, 0))
out.printerr("Failed to set ptracer: %s.\n", strerror(errno));
}
DFhackCExport command_result plugin_shutdown(color_ostream &out)
{
if (-1 == prctl(PR_SET_PTRACER, 0, 0, 0, 0))
out.printerr("Failed to reset ptracer: %s.\n", strerror(errno));
}
Loading the plugin will allow any one to ptrace DF. Unloading restore to default.
2) A library preloaded when running DF:
#include <stdlib.h>
#include <stdio.h>
#include <unistd.h>
#include <sys/prctl.h>
void set_ptracer_any() __attribute__((constructor));
void set_ptracer_any()
{
if (-1 == prctl(PR_SET_PTRACER, PR_SET_PTRACER_ANY, 0, 0, 0))
perror("prctl");
}
Compile with "gcc set_ptracer_any.c -fPIC -shared -o set_ptracer_any.so", then run DF with "LD_PRELOAD=set_ptracer_any.so ./df" (or add "export LD_PRELOAD=set_ptracer_any.so" in the df script). It does not require dfhack, but it does require to modify the way DF is started. Maybe it can be used in LinuxLNP.
Now, I wonder if something similar is possible for macOS.