I recently tested out f17 and saw I can no longer trace or debug
applications by default. ...
Is there still time to discuss and/or reconsider turning this on by
default for F17?
According to this bugzilla Comment
https://bugzilla.redhat.com/show_bug.cgi?id=786878#c27
Fedora 17 Alpha turned on denyPtrace (as default) by mistake.
According to other Comments to that same bug, the fix might involve
allowing by default only PTRACE_ME, which then enables other PTRACE_*
actions for the same (process, parent} pair. Apparently this will allow
a debugger to ptrace a process that the debugger starts. I don't see
that such a mechanism necessarily allows attaching a debugger to an
existing non-child process, even if the other process has the same UID
(which is the only requirement in Fedora 16 and previous.)
gdb nicely gives the work-around for denyPtrace, but the work-around
requires privileges to implement. So far the implementation history
of the denyPtrace feature leads me to fear loss of Functionality and
Usability for software developers.
--