Only root can attach to a process with elevated privileges. In a bit more detail, attaching to a running process with the ptrace system call (which is what debuggers use under the hood) requires several conditions. A necessary condition, the classical Unix condition, is that if the target process is running without elevated privileges (no setuid, no setgid, and no other privilege elevation mechanism such as setcap), then the process calling ptrace
must be running as the same user ID. A process running as root (effective user ID equal to 0) can always attach, so root can debug any process.
(Linux has additional restrictions depending on its hardening state; most distributions set the kernel.yama.ptrace_scope
to 1, which prevents any non-root process from running ptrace
except to trace its child processes. This means you can run a program in a debugger but not attach a debugger to an already-running process.)
Furthermore, if a process is being traced (i.e. being debugged), then it cannot elevate its privileges. Privilege elevation is performed by the execve
system call, based on the permission flags in the executed file. If a process calls execve
while it is being traced, the privilege elevation flags are ignored, and the new process image has the same privileges as it had before the execve
call.
This way, privilege elevation is incompatible with anything that could change the security implications. There's no way to arrange to run a debugger on a process with extra privileges, unless you run the debugger as root (if you can do that then you won't be getting any privileges that you didn't already have).
If you want to debug a program that runs with elevated privileges, there are two ways, both requiring that the debugger runs as root. You can start the debugger and make it run the whole preparation code that sets up the privileges with which the process will run. Or else you can let the program start under its normal conditions, and attach the debugger to it at any point.
Of course, if a program starts as setuid and then drops privileges (i.e. ends up with equal effective, real and saved user IDs, and likewise for group IDs and any other privileges), then you can attach a debugger running under the same user after the process has dropped its privileges.