SELinuxDenyPtrace: Write, compile, run, but don't debug applications?

[John Reiser]

> I recently tested out f17 and saw I can no longer trace or debug
> applications by default.  ...

> Is there still time to discuss and/or reconsider turning this on by
> default for F17?

According to this bugzilla Comment
   https://bugzilla.redhat.com/show_bug.cgi?id=786878#c27
Fedora 17 Alpha turned on denyPtrace (as default) by mistake.

According to other Comments to that same bug, the fix might involve
allowing by default only PTRACE_ME, which then enables other PTRACE_*
actions for the same (process, parent} pair.  Apparently this will allow
a debugger to ptrace a process that the debugger starts.  I don't see
that such a mechanism necessarily allows attaching a debugger to an
existing non-child process, even if the other process has the same UID
(which is the only requirement in Fedora 16 and previous.)

gdb nicely gives the work-around for denyPtrace, but the work-around
requires privileges to implement.  So far the implementation history
of the denyPtrace feature leads me to fear loss of Functionality and
Usability for software developers.

--