---
name: "p_candebug"
section: "9"
platform: "freebsd"
package: "base"
version: "16.0-CURRENT-20261027-61c70dc16a79"
release: "FreeBSD 16.0-CURRENT (2026-10-27)"
platforms: ["linux", "freebsd"]
url: "https://new.carta.tech/p_candebug"
---

# p\_candebug(9)

determine debuggability of a process

## NAME

**p\_candebug** – determine debuggability of a process

## SYNOPSIS

**#include \<sys/param.h\>**

**#include \<sys/proc.h\>**

*int*\

**p\_candebug**(*struct thread \*td*, *struct proc \*p*);

## DESCRIPTION

This function determines if a given process *p* is debuggable by some thread *td*.

The following [sysctl(8)](/sysctl/8.md) variables directly influence the behaviour of **p\_candebug**():

- *security.bsd.unprivileged\_proc\_debug*

  Must be set to a non-zero value to allow unprivileged processes access to the kernel's debug facilities.

- *kern.securelevel*

  Debugging of the init process is not allowed if this variable is 1 or greater.

Other such variables indirectly influence it; see [cr\_bsd\_visible(9)](/cr_bsd_visible/9.md).

## RETURN VALUES

The **p\_candebug**() function returns 0 if the process denoted by *p* is debuggable by thread *td*, or a non-zero error return value otherwise.

## ERRORS

- \[EPERM\]

  An unprivileged process attempted to debug another process but the system is configured to deny it( see [sysctl(8)](/sysctl/8.md) variable *security.bsd.unprivileged\_proc\_debug* above).

- \[ESRCH\]

  Thread *td* has been jailed and the process to debug does not belong to the same jail or one of its sub-jails, as determined by [prison\_check(9)](/prison_check/9.md).

- \[ESRCH\]

  [cr\_bsd\_visible(9)](/cr_bsd_visible/9.md) denied visibility according to the BSD security policies in force.

- \[EPERM\]

  Thread *td* lacks superuser credentials and its (effective) group set is not a superset of process *p*'s whole group set (including real, effective and saved group IDs).

- \[EPERM\]

  Thread *td* lacks superuser credentials and its (effective) user ID does not match all user IDs of process *p*.

- \[EPERM\]

  Thread *td* lacks superuser credentials and process *p* is executing a set-user-ID or set-group-ID executable.

- \[EPERM\]

  Process *p* denotes the initial process **initproc**() and the [sysctl(8)](/sysctl/8.md) variable *kern.securelevel* is greater than zero.

- \[EBUSY\]

  Process *p* is in the process of being **exec**(*Ns*, *'ed.*)

- \[EPERM\]

  Process *p* denied debuggability( see [procctl(2)](/procctl/2.md), command PROC\_TRACE\_CTL).

## SEE ALSO

[procctl(2)](/procctl/2.md), [cr\_bsd\_visible(9)](/cr_bsd_visible/9.md), [mac(9)](/mac/9.md), [p\_cansee(9)](/p_cansee/9.md), [prison\_check(9)](/prison_check/9.md)