Only if one is writing to a process running under a different user ID. Non-privileged users can write to the memory of their own processes.

Linux used to be similar (and I think some distributions still are), but is now slightly more restrictive, in that processes running as non-root user accounts can only debug child processes they've launched, as opposed to other processes running under the same user account. It can still be used for hiding extra code, of course.

Mac OS is the only mainstream OS I know of that disallows debugging by non-root user accounts entirely.

Think of it this way - on a shared system (e.g. a Linux server) how would developers debug their code in e.g. gdb if they couldn't attach to a process that they'd launched, and interact with it at a low level? Apple can avoid supporting that scenario because they no longer sell systems intended for use my multiple people at the same time, and a developer on a Mac will have sudo permissions as root.

> Mac OS is the only mainstream OS I know of that disallows debugging by non-root user accounts entirely.

This isn't true; Xcode works just fine on non-root accounts. You will need to get permission to debug anything from an admin user, or add yourself to the developers group. And if you want to debug a system binary you'll need to disable SIP.

> Xcode works just fine on non-root accounts

Are you sure that attaching to a process (for debugging/memory-modification) in general does on modern versions of Mac OS?

"In order to guarantee support for debugging on the Mac, you need to log in on the Developer Tools Access dialog box using the administrator or root user password" [1]

"DTrace requires admin privileges" [2]

[1] http://docwiki.embarcadero.com/RADStudio/Tokyo/en/Acquiring_...

[2] http://dtrace.org/blogs/brendan/2011/10/10/top-10-dtrace-scr...

That's consistent with I'm saying. You do not need to be root to attach to a process on macOS; you merely need to be part of the _developer group. I believe admins are added to this group by default, but you can do it manually if you wish. If you don't, you'll need to type the password of an admin user before you can debug anything.

Unfortunately, I don't have access to a machine to test with - my statement was based on a lengthy discussion from a few months ago at a previous job - but I'll assume you're correct, and amend my original statement to "Mac OS is the only mainstream OS I know of that disallows debugging by non-privileged user accounts entirely." Thanks :).

This is mentioned as one of the mitigation techniques. >don’t give admin permissions to random applications